/*
 * Modeled from ISO/IEC 9798
 * Modeler: Cas Cremers, Dec. 2010, Feb. 2011.
 *
 * History:
 * 
 * - v2.0, Feb. 2011:
 *   Added key symmetry emulation protocol.
 *
 * ccf
 * mutual
 * three-pass
 * 
 * The identifier B is optional and may be omitted if the key is unidirectional.
 * 
 * Modeling notes:
 *
 * - The keyed CCF (f_kab(x)) is modeled as f(x,kab)
 */
hashfunction f;

protocol @keysymm-44(A,B)
{
	role A
	{
		var X,Y,Z: Ticket;

		recv_!1(B,A, f(X,Y,Z, k(A,B) ) );
		send_!2(A,B, f(X,Y,Z, k(B,A) ) );
	}
	role B
	{
		var X,Y,Z,ZZ: Ticket;

		recv_!3(A,B, f(X,Y,Z,ZZ, k(A,B) ) );
		send_!4(B,A, f(X,Y,Z,ZZ, k(B,A) ) );
	}
}

protocol isoiec-9798-4-4(A,B)
{
	role A
	{
		fresh Ra: Nonce;
		var Rb: Nonce;
		var Text1,Text4,Text5: Ticket;
		fresh Text2,Text3: Ticket;

		recv_1(B,A, Rb, Text1 );
		claim(A,Running,B,Ra,Rb,Text2);
		send_2(A,B, Ra, Text3, f(Ra,Rb,B,Text2, k(A,B) ) );
		recv_3(B,A, Text5, f(Rb,Ra,Text4, k(A,B) ) );

		claim(A,Commit,B,Ra,Rb,Text2,Text4);
		claim(A,Alive);
		claim(A,Weakagree);
	}
	role B
	{
		var Ra: Nonce;
		fresh Rb: Nonce;
		fresh Text1,Text4,Text5: Ticket;
		var Text2,Text3: Ticket;

		send_1(B,A, Rb, Text1 );
		recv_2(A,B, Ra, Text3, f(Ra,Rb,B,Text2, k(A,B) ) );
		claim(B,Running,A,Ra,Rb,Text2,Text4);
		send_3(B,A, Text5, f(Rb,Ra,Text4, k(A,B) ) );

		claim(B,Commit,A,Ra,Rb,Text2);
		claim(B,Alive);
		claim(B,Weakagree);
	}
}