# Woo and Lam Pi 1
#
# Modelled after the description in the SPORE library
# http://www.lsv.ens-cachan.fr/spore/wooLamPi1.html
#
# Note:
# This protocol uses a ticket so scyther will only be able to verify
# the protocol using the ARACHNE engine (-a) and type 2 matching (-m2)
#

usertype Ticket;

secret k: Function;

protocol woolamPi1(I,R,S)
{
    role I
    {
        var Nr: Nonce;

        send_1(I,R, I); 
        read_2(R,I, Nr);
        send_3(I,R, {I,R,Nr}k(I,S));

    }    
    
    role R
    {
        const Nr: Nonce;
        var T: Ticket;

        read_1(I,R, I);
        send_2(R,I, Nr);
        read_3(I,R, T);
        send_4(R,S, {I,R, T}k(R,S)); 
        read_5(S,R, {I,R, Nr}k(R,S));
        
        claim_R1(R,Nisynch);
    }

    role S
    {
        var Nr: Nonce;
        
        read_4(R,S, {I,R, {I,R,Nr}k(I,S)}k(R,S));
        send_5(S,R, {I,R,Nr}k(R,S));
    }
}

const Alice,Bob,Eve,Simon: Agent;
const Te: Ticket;
const Ne: Nonce;


untrusted Eve;
compromised k(Eve,Simon);

run woolamPi1.I (Agent,Agent,Simon);
run woolamPi1.R (Agent,Agent,Simon);
run woolamPi1.S (Agent,Agent,Simon);