//-*-mode:outline;outline-regexp:"[0-9a-z.]+"-*-
. %false(intruder_knows_session_key_as_seen_by_B)  [intruder_knows_session_key_as_seen_by_B].
  using assumption %false(intruder_knows_session_key_as_seen_by_B) :- knows crypt(s(nonceb(X1,X2,X3)),X1), knows X1.
     {X3=bob,X1=key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),X2=alice}
1. knows crypt(s(nonceb(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),alice,bob)),key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))))  [intruder_can_encrypt].
    using assumption knows crypt(X1,X2) :- knows X2, knows X1.
       {X1=s(nonceb(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),alice,bob)),X2=key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil)))))}
1.1. knows key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil)))))  [intruder_knows_all_previous_session_keys].
      using assumption knows key(X1,X2) :- __aux_58 X2, __aux_57 X1.
         {X1=sym,X2=old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))}
      and definition __aux_58 old_session(X1,X2,X3).
         {X3=noncea(cons(alice,cons(bob,nil))),X1=nil,X2=nil}
      and definition __aux_57 sym.
1.2. knows s(nonceb(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),alice,bob))  [intruder_can_compute_successors].
      using assumption knows s(X1) :- knows X1.
         {X1=nonceb(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),alice,bob)}
1.2.1. knows nonceb(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),alice,bob)  [intruder_can_decrypt_if_has_symmetric_key].
        using assumption knows X1 :- __aux_6(X1,X2), __aux_5 X2.
           {X1=nonceb(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),alice,bob),X2=old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))}
        and definition __aux_6(X1,X2) :- knows crypt(X1,key(sym,X2)).
           {X1=nonceb(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),alice,bob),X2=old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))}
        and definition __aux_5 X1 :- knows key(sym,X1).
           {X1=old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))}
1.2.1.1. knows crypt(nonceb(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),alice,bob),key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))))  [agent_B_gets_forwarded_submessage_and_sends_confirmation_challenge].
          using assumption knows crypt(X1,X2) :- __aux_50 X2, __aux_49 X1.
             {X1=nonceb(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),alice,bob),X2=key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil)))))}
          and definition __aux_50 X1 :- __aux_48(X2,X3,X1).
             {X3=bob,X1=key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),X2=alice}
          and definition __aux_48(X1,X2,X3) :- knows crypt(cons(X3,cons(X1,nil)),key(sym,cons(X2,cons(server,nil)))).
             {X3=key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),X1=alice,X2=bob}
          and definition __aux_49 nonceb(X1,X2,X3) :- __aux_48(X2,X3,X1).
             {X3=bob,X1=key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),X2=alice}
          and definition __aux_48(X1,X2,X3) :- knows crypt(cons(X3,cons(X1,nil)),key(sym,cons(X2,cons(server,nil)))).
             {X3=key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),X1=alice,X2=bob}
1.2.1.1.1. knows crypt(cons(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),cons(alice,nil)),key(sym,cons(bob,cons(server,nil))))  [alice_gets_server_message_and_forwards_submessage_to_bob].
            using assumption knows X1 :- __aux_44(X1,X2).
               {X1=crypt(cons(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),cons(alice,nil)),key(sym,cons(bob,cons(server,nil)))),X2=key(sym,old_session(alice,bob,noncea(cons(alice,cons(bob,nil)))))}
            and definition __aux_44(X1,X2) :- knows crypt(cons(noncea(cons(alice,cons(bob,nil))),cons(bob,cons(X2,cons(X1,nil)))),key(sym,cons(alice,cons(server,nil)))).
               {X1=crypt(cons(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),cons(alice,nil)),key(sym,cons(bob,cons(server,nil)))),X2=key(sym,old_session(alice,bob,noncea(cons(alice,cons(bob,nil)))))}
1.2.1.1.1.1. knows crypt(cons(noncea(cons(alice,cons(bob,nil))),cons(bob,cons(key(sym,old_session(alice,bob,noncea(cons(alice,cons(bob,nil))))),cons(crypt(cons(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),cons(alice,nil)),key(sym,cons(bob,cons(server,nil)))),nil)))),key(sym,cons(alice,cons(server,nil))))  [intruder_knows_previous_server_messages].
              using assumption knows crypt(X1,X2) :- __aux_17 X2, __aux_36 X1.
                 {X1=cons(noncea(cons(alice,cons(bob,nil))),cons(bob,cons(key(sym,old_session(alice,bob,noncea(cons(alice,cons(bob,nil))))),cons(crypt(cons(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),cons(alice,nil)),key(sym,cons(bob,cons(server,nil)))),nil)))),X2=key(sym,cons(alice,cons(server,nil)))}
              and definition __aux_17 key(X1,X2) :- __aux_35 X2, __aux_24 X1.
                 {X1=sym,X2=cons(alice,cons(server,nil))}
              and definition __aux_35 cons(X1,X2) :- __aux_33 X2, __aux_31 X1.
                 {X1=alice,X2=cons(server,nil)}
              and definition __aux_33 cons(X1,X2) :- __aux_12 X2, __aux_34 X1.
                 {X1=server,X2=nil}
              and definition __aux_12 nil.
              and definition __aux_34 server.
              and definition __aux_31 X1 :- __aux_15(X1,X2,X3).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=alice,X2=bob}
              and definition __aux_15(X1,X2,X3) :- knows cons(X1,cons(X2,cons(X3,nil))).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=alice,X2=bob}
              and definition __aux_24 sym.
              and definition __aux_36 cons(X1,X2) :- __aux_37 X2, __aux_18 X1.
                 {X1=noncea(cons(alice,cons(bob,nil))),X2=cons(bob,cons(key(sym,old_session(alice,bob,noncea(cons(alice,cons(bob,nil))))),cons(crypt(cons(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),cons(alice,nil)),key(sym,cons(bob,cons(server,nil)))),nil)))}
              and definition __aux_37 cons(X1,X2) :- __aux_38 X2, __aux_20 X1.
                 {X1=bob,X2=cons(key(sym,old_session(alice,bob,noncea(cons(alice,cons(bob,nil))))),cons(crypt(cons(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),cons(alice,nil)),key(sym,cons(bob,cons(server,nil)))),nil))}
              and definition __aux_38 cons(X1,X2) :- __aux_40 X2, __aux_39 X1.
                 {X1=key(sym,old_session(alice,bob,noncea(cons(alice,cons(bob,nil))))),X2=cons(crypt(cons(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),cons(alice,nil)),key(sym,cons(bob,cons(server,nil)))),nil)}
              and definition __aux_40 cons(X1,X2) :- __aux_27 X2, __aux_42 X1.
                 {X1=crypt(cons(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),cons(alice,nil)),key(sym,cons(bob,cons(server,nil)))),X2=nil}
              and definition __aux_27 nil.
              and definition __aux_42 crypt(X1,X2) :- __aux_29 X2, __aux_43 X1.
                 {X1=cons(key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),cons(alice,nil)),X2=key(sym,cons(bob,cons(server,nil)))}
              and definition __aux_29 key(X1,X2) :- __aux_32 X2, __aux_24 X1.
                 {X1=sym,X2=cons(bob,cons(server,nil))}
              and definition __aux_32 cons(X1,X2) :- __aux_33 X2, __aux_20 X1.
                 {X1=bob,X2=cons(server,nil)}
              and definition __aux_33 cons(X1,X2) :- __aux_12 X2, __aux_34 X1.
                 {X1=server,X2=nil}
              and definition __aux_12 nil.
              and definition __aux_34 server.
              and definition __aux_20 X1 :- __aux_15(X2,X1,X3).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=bob,X2=alice}
              and definition __aux_15(X1,X2,X3) :- knows cons(X1,cons(X2,cons(X3,nil))).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=alice,X2=bob}
              and definition __aux_24 sym.
              and definition __aux_43 cons(X1,X2) :- __aux_30 X2, __aux_39 X1.
                 {X1=key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))),X2=cons(alice,nil)}
              and definition __aux_30 cons(X1,X2) :- __aux_27 X2, __aux_31 X1.
                 {X1=alice,X2=nil}
              and definition __aux_27 nil.
              and definition __aux_31 X1 :- __aux_15(X1,X2,X3).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=alice,X2=bob}
              and definition __aux_15(X1,X2,X3) :- knows cons(X1,cons(X2,cons(X3,nil))).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=alice,X2=bob}
              and definition __aux_39 key(X1,X2) :- __aux_41 X2, __aux_24 X1.
                 {X1=sym,X2=old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))}
              and definition __aux_41 old_session(X1,X2,X3) :- __aux_15(X1,X2,X3).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=nil,X2=nil}
              and definition __aux_15(X1,X2,X3) :- knows cons(X1,cons(X2,cons(X3,nil))).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=nil,X2=nil}
              and definition __aux_24 sym.
              and definition __aux_39 key(X1,X2) :- __aux_41 X2, __aux_24 X1.
                 {X1=sym,X2=old_session(alice,bob,noncea(cons(alice,cons(bob,nil))))}
              and definition __aux_41 old_session(X1,X2,X3) :- __aux_15(X1,X2,X3).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=alice,X2=bob}
              and definition __aux_15(X1,X2,X3) :- knows cons(X1,cons(X2,cons(X3,nil))).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=alice,X2=bob}
              and definition __aux_24 sym.
              and definition __aux_20 X1 :- __aux_15(X2,X1,X3).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=bob,X2=alice}
              and definition __aux_15(X1,X2,X3) :- knows cons(X1,cons(X2,cons(X3,nil))).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=alice,X2=bob}
              and definition __aux_18 X1 :- __aux_15(X2,X3,X1).
                 {X3=bob,X1=noncea(cons(alice,cons(bob,nil))),X2=alice}
              and definition __aux_15(X1,X2,X3) :- knows cons(X1,cons(X2,cons(X3,nil))).
                 {X3=noncea(cons(alice,cons(bob,nil))),X1=alice,X2=bob}
1.2.1.1.1.1.1. knows cons(alice,cons(bob,cons(noncea(cons(alice,cons(bob,nil))),nil)))  [alice_sends_message_1_to_server].
                using assumption knows cons(X1,X2) :- __aux_8 X2, __aux_7 X1.
                   {X1=alice,X2=cons(bob,cons(noncea(cons(alice,cons(bob,nil))),nil))}
                and definition __aux_8 cons(X1,X2) :- __aux_10 X2, __aux_9 X1.
                   {X1=bob,X2=cons(noncea(cons(alice,cons(bob,nil))),nil)}
                and definition __aux_10 cons(X1,X2) :- __aux_12 X2, __aux_11 X1.
                   {X1=noncea(cons(alice,cons(bob,nil))),X2=nil}
                and definition __aux_12 nil.
                and definition __aux_11 noncea(X1) :- __aux_13 X1.
                   {X1=cons(alice,cons(bob,nil))}
                and definition __aux_13 cons(X1,X2) :- __aux_14 X2, __aux_7 X1.
                   {X1=alice,X2=cons(bob,nil)}
                and definition __aux_14 cons(X1,X2) :- __aux_12 X2, __aux_9 X1.
                   {X1=bob,X2=nil}
                and definition __aux_12 nil.
                and definition __aux_9 bob.
                and definition __aux_7 alice.
                and definition __aux_9 bob.
                and definition __aux_7 alice.
1.2.1.1.1.1.2. knows cons(nil,cons(nil,cons(noncea(cons(alice,cons(bob,nil))),nil)))  [intruder_can_build_pairs].
                using assumption knows cons(X1,X2) :- knows X2, knows X1.
                   {X1=nil,X2=cons(nil,cons(noncea(cons(alice,cons(bob,nil))),nil))}
1.2.1.1.1.1.2.1. knows cons(nil,cons(noncea(cons(alice,cons(bob,nil))),nil))  [intruder_can_build_pairs].
                  using assumption knows cons(X1,X2) :- knows X2, knows X1.
                     {X1=nil,X2=cons(noncea(cons(alice,cons(bob,nil))),nil)}
1.2.1.1.1.1.2.1.1. knows cons(noncea(cons(alice,cons(bob,nil))),nil)  [intruder_can_take_second_components].
                    using assumption knows X1 :- knows cons(X2,X1).
                       {X1=cons(noncea(cons(alice,cons(bob,nil))),nil),X2=bob}
1.2.1.1.1.1.2.1.1.1. knows cons(bob,cons(noncea(cons(alice,cons(bob,nil))),nil))  [intruder_can_take_second_components].
                      using assumption knows X1 :- knows cons(X2,X1).
                         {X1=cons(bob,cons(noncea(cons(alice,cons(bob,nil))),nil)),X2=alice}
1.2.1.1.1.1.2.1.1.1.1. knows cons(alice,cons(bob,cons(noncea(cons(alice,cons(bob,nil))),nil)))  [alice_sends_message_1_to_server].
                        using assumption knows cons(X1,X2) :- __aux_8 X2, __aux_7 X1.
                           {X1=alice,X2=cons(bob,cons(noncea(cons(alice,cons(bob,nil))),nil))}
                        and definition __aux_8 cons(X1,X2) :- __aux_10 X2, __aux_9 X1.
                           {X1=bob,X2=cons(noncea(cons(alice,cons(bob,nil))),nil)}
                        and definition __aux_10 cons(X1,X2) :- __aux_12 X2, __aux_11 X1.
                           {X1=noncea(cons(alice,cons(bob,nil))),X2=nil}
                        and definition __aux_12 nil.
                        and definition __aux_11 noncea(X1) :- __aux_13 X1.
                           {X1=cons(alice,cons(bob,nil))}
                        and definition __aux_13 cons(X1,X2) :- __aux_14 X2, __aux_7 X1.
                           {X1=alice,X2=cons(bob,nil)}
                        and definition __aux_14 cons(X1,X2) :- __aux_12 X2, __aux_9 X1.
                           {X1=bob,X2=nil}
                        and definition __aux_12 nil.
                        and definition __aux_9 bob.
                        and definition __aux_7 alice.
                        and definition __aux_9 bob.
                        and definition __aux_7 alice.
1.2.1.1.1.1.2.1.2. knows nil  [intruder_knows_nil] by assumption.
1.2.1.1.1.1.2.2. knows nil  [intruder_knows_nil] by assumption.
1.2.1.2. knows key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil)))))  [intruder_knows_all_previous_session_keys].
          using assumption knows key(X1,X2) :- __aux_58 X2, __aux_57 X1.
             {X1=sym,X2=old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))}
          and definition __aux_58 old_session(X1,X2,X3).
             {X3=noncea(cons(alice,cons(bob,nil))),X1=nil,X2=nil}
          and definition __aux_57 sym.
2. knows key(sym,old_session(nil,nil,noncea(cons(alice,cons(bob,nil)))))  [intruder_knows_all_previous_session_keys].
    using assumption knows key(X1,X2) :- __aux_58 X2, __aux_57 X1.
       {X1=sym,X2=old_session(nil,nil,noncea(cons(alice,cons(bob,nil))))}
    and definition __aux_58 old_session(X1,X2,X3).
       {X3=noncea(cons(alice,cons(bob,nil))),X1=nil,X2=nil}
    and definition __aux_57 sym.
