(herald
  "Fourth approx to TLS:  Both parties get cert, then c sends pms encrypted and hash.  CA guarantees privk uncompromised."
  (bound 14))

(comment "CPSA 2.2.11")
(comment "All input read from tls3.scm")
(comment "Strand count bounded at 14")

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

(defskeleton tls3
  (vars (ca s client_name name) (pms skey) (k client_key akey))
  (defstrand client 4 (ca ca) (server_name s) (client_name client_name)
    (pre_master_secret pms) (server_key k) (client_key client_key))
  (deflistener pms)
  (non-orig (invk k) (privk ca))
  (uniq-orig pms)
  (comment "Confidentiality should be OK.")
  (traces
    ((recv
       (cat s k (enc (enc "hash_zero" (cat "cert" s k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (send (enc "client_version" pms k))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s k
                (enc (enc "hash_zero" (cat "cert" s k)) (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key)))) ((recv pms) (send pms)))
  (label 0)
  (unrealized (0 0) (0 1) (1 0))
  (preskeleton)
  (comment "Not a skeleton"))

(defskeleton tls3
  (vars (ca s client_name name) (pms skey) (k client_key akey))
  (defstrand client 4 (ca ca) (server_name s) (client_name client_name)
    (pre_master_secret pms) (server_key k) (client_key client_key))
  (deflistener pms)
  (precedes ((0 2) (1 0)))
  (non-orig (invk k) (privk ca))
  (uniq-orig pms)
  (traces
    ((recv
       (cat s k (enc (enc "hash_zero" (cat "cert" s k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (send (enc "client_version" pms k))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s k
                (enc (enc "hash_zero" (cat "cert" s k)) (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key)))) ((recv pms) (send pms)))
  (label 1)
  (parent 0)
  (unrealized (0 0) (0 1) (1 0))
  (origs (pms (0 2)))
  (comment "empty cohort"))

(comment "Nothing left to do")

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

(defskeleton tls3
  (vars (ca s client_name name) (pms skey) (k client_key akey))
  (defstrand client 4 (ca ca) (server_name s) (client_name client_name)
    (pre_master_secret pms) (server_key k) (client_key client_key))
  (non-orig (invk k) (privk ca))
  (uniq-orig pms)
  (comment "Authenticates CA.")
  (traces
    ((recv
       (cat s k (enc (enc "hash_zero" (cat "cert" s k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (send (enc "client_version" pms k))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s k
                (enc (enc "hash_zero" (cat "cert" s k)) (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key)))))
  (label 2)
  (unrealized (0 0) (0 1))
  (origs (pms (0 2)))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca s client_name name) (pms skey) (client_key akey))
  (defstrand client 4 (ca ca) (server_name s) (client_name client_name)
    (pre_master_secret pms) (server_key (pubk s))
    (client_key client_key))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (precedes ((1 0) (0 0)))
  (non-orig (privk ca) (privk s))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)) (0 0))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (invk client_key))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))))
  (label 3)
  (parent 2)
  (unrealized (0 1))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca s name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name s)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk s)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (precedes ((1 0) (0 0)))
  (non-orig (privk ca) (privk s))
  (uniq-orig pms)
  (operation encryption-test (displaced 2 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat s (pubk s)
          (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk s))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))))
  (label 4)
  (parent 3)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk s)) (ca ca) (s s) (client_key (pubk s))
        (client_name s))))
  (origs (pms (0 2))))

(defskeleton tls3
  (vars (ca s client_name name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name client_name)
    (pre_master_secret pms) (server_key (pubk s))
    (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)))
  (non-orig (privk ca) (privk s) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk client_name))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 5)
  (parent 3)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk s)) (ca ca) (s s)
        (client_key (pubk client_name)) (client_name client_name))))
  (origs (pms (0 2))))

(comment "Nothing left to do")

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

(defskeleton tls3
  (vars (ca s c ca-0 server_name client_name name) (pms skey)
    (k client_key server_key client_key-0 akey))
  (defstrand client 4 (ca ca-0) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key k) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key server_key) (client_key client_key-0))
  (non-orig (invk k) (privk ca) (privk c) (privk ca-0))
  (uniq-orig pms)
  (comment "Authenticates CA and implicit auth for server.")
  (traces
    ((recv
       (cat s k (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0))))
      (recv
        (cat c client_key
          (enc (enc "hash_zero" (cat "cert" c client_key))
            (privk ca-0)))) (send (enc "client_version" pms k))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s k
                (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0)))
              (cat c client_key
                (enc (enc "hash_zero" (cat "cert" c client_key))
                  (privk ca-0))) (enc "client_version" pms k)))
          (invk client_key))))
    ((recv
       (cat server_name server_key
         (enc (enc "hash_zero" (cat "cert" server_name server_key))
           (privk ca))))
      (recv
        (cat client_name client_key-0
          (enc (enc "hash_zero" (cat "cert" client_name client_key-0))
            (privk ca)))) (recv (enc "client_version" pms server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key-0
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name client_key-0)) (privk ca)))
              (enc "client_version" pms server_key)))
          (invk client_key-0)))))
  (label 6)
  (unrealized (0 0) (0 1) (1 0) (1 1) (1 2) (1 3))
  (preskeleton)
  (comment "Not a skeleton"))

(defskeleton tls3
  (vars (ca s c ca-0 server_name client_name name) (pms skey)
    (k client_key server_key client_key-0 akey))
  (defstrand client 4 (ca ca-0) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key k) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key server_key) (client_key client_key-0))
  (precedes ((0 2) (1 2)))
  (non-orig (invk k) (privk ca) (privk c) (privk ca-0))
  (uniq-orig pms)
  (traces
    ((recv
       (cat s k (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0))))
      (recv
        (cat c client_key
          (enc (enc "hash_zero" (cat "cert" c client_key))
            (privk ca-0)))) (send (enc "client_version" pms k))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s k
                (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0)))
              (cat c client_key
                (enc (enc "hash_zero" (cat "cert" c client_key))
                  (privk ca-0))) (enc "client_version" pms k)))
          (invk client_key))))
    ((recv
       (cat server_name server_key
         (enc (enc "hash_zero" (cat "cert" server_name server_key))
           (privk ca))))
      (recv
        (cat client_name client_key-0
          (enc (enc "hash_zero" (cat "cert" client_name client_key-0))
            (privk ca)))) (recv (enc "client_version" pms server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key-0
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name client_key-0)) (privk ca)))
              (enc "client_version" pms server_key)))
          (invk client_key-0)))))
  (label 7)
  (parent 6)
  (unrealized (0 0) (0 1) (1 0) (1 1) (1 2) (1 3))
  (origs (pms (0 2)))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca s c ca-0 server_name client_name name) (pms skey)
    (k client_key client_key-0 akey))
  (defstrand client 4 (ca ca-0) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key k) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((0 2) (1 2)) ((2 0) (1 0)))
  (non-orig (invk k) (privk ca) (privk c) (privk ca-0)
    (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (1 0))
  (traces
    ((recv
       (cat s k (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0))))
      (recv
        (cat c client_key
          (enc (enc "hash_zero" (cat "cert" c client_key))
            (privk ca-0)))) (send (enc "client_version" pms k))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s k
                (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0)))
              (cat c client_key
                (enc (enc "hash_zero" (cat "cert" c client_key))
                  (privk ca-0))) (enc "client_version" pms k)))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key-0
          (enc (enc "hash_zero" (cat "cert" client_name client_key-0))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key-0
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name client_key-0)) (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 8)
  (parent 7)
  (unrealized (0 0) (0 1) (1 1) (1 2) (1 3))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca s c ca-0 server_name name) (pms skey) (k client_key akey))
  (defstrand client 4 (ca ca-0) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key k) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((0 2) (1 2)) ((2 0) (1 0)))
  (non-orig (invk k) (privk ca) (privk c) (privk ca-0)
    (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 3 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (1 1))
  (traces
    ((recv
       (cat s k (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0))))
      (recv
        (cat c client_key
          (enc (enc "hash_zero" (cat "cert" c client_key))
            (privk ca-0)))) (send (enc "client_version" pms k))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s k
                (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0)))
              (cat c client_key
                (enc (enc "hash_zero" (cat "cert" c client_key))
                  (privk ca-0))) (enc "client_version" pms k)))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 9)
  (parent 8)
  (unrealized (0 0) (0 1) (1 2) (1 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca s c ca-0 server_name client_name name) (pms skey)
    (k client_key akey))
  (defstrand client 4 (ca ca-0) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key k) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((0 2) (1 2)) ((2 0) (1 0)) ((3 0) (1 1)))
  (non-orig (invk k) (privk ca) (privk c) (privk ca-0)
    (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (1 1))
  (traces
    ((recv
       (cat s k (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0))))
      (recv
        (cat c client_key
          (enc (enc "hash_zero" (cat "cert" c client_key))
            (privk ca-0)))) (send (enc "client_version" pms k))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s k
                (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0)))
              (cat c client_key
                (enc (enc "hash_zero" (cat "cert" c client_key))
                  (privk ca-0))) (enc "client_version" pms k)))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 10)
  (parent 8)
  (unrealized (0 0) (0 1) (1 2) (1 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca s c ca-0 server_name name) (pms skey) (client_key akey))
  (defstrand client 4 (ca ca-0) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk server_name))
    (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((0 2) (1 2)) ((2 0) (1 0)))
  (non-orig (privk ca) (privk c) (privk ca-0) (privk server_name))
  (uniq-orig pms)
  (operation nonce-test (contracted (k (pubk server_name))) pms (1 2)
    (enc "client_version" pms (pubk server_name)))
  (traces
    ((recv
       (cat s (pubk server_name)
         (enc (enc "hash_zero" (cat "cert" s (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat c client_key
          (enc (enc "hash_zero" (cat "cert" c client_key))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk server_name)
                (enc (enc "hash_zero" (cat "cert" s (pubk server_name)))
                  (privk ca-0)))
              (cat c client_key
                (enc (enc "hash_zero" (cat "cert" c client_key))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 11)
  (parent 9)
  (unrealized (0 0) (0 1) (1 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca s c ca-0 server_name client_name name) (pms skey)
    (client_key akey))
  (defstrand client 4 (ca ca-0) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk server_name))
    (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((0 2) (1 2)) ((2 0) (1 0)) ((3 0) (1 1)))
  (non-orig (privk ca) (privk c) (privk ca-0) (privk server_name)
    (privk client_name))
  (uniq-orig pms)
  (operation nonce-test (contracted (k (pubk server_name))) pms (1 2)
    (enc "client_version" pms (pubk server_name)))
  (traces
    ((recv
       (cat s (pubk server_name)
         (enc (enc "hash_zero" (cat "cert" s (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat c client_key
          (enc (enc "hash_zero" (cat "cert" c client_key))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk server_name)
                (enc (enc "hash_zero" (cat "cert" s (pubk server_name)))
                  (privk ca-0)))
              (cat c client_key
                (enc (enc "hash_zero" (cat "cert" c client_key))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 12)
  (parent 10)
  (unrealized (0 0) (0 1) (1 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (1 0)))
  (non-orig (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (displaced 3 0 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (1 3))
  (traces
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk c)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk c)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 13)
  (parent 11)
  (unrealized (0 0) (0 1))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (s c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (1 0)) ((3 0) (1 1)))
  (non-orig (privk s) (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 0 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (1 3))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 14)
  (parent 12)
  (unrealized (0 0) (0 1))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (0 0)) ((2 0) (1 0)))
  (non-orig (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (displaced 3 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 0))
  (traces
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk c)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk c)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 15)
  (parent 13)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk c)) (ca ca) (s c) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk c)) (client_key-0 (pubk c))
        (server_name c) (client_name c))))
  (origs (pms (0 2))))

(defskeleton tls3
  (vars (c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (1 0)) ((3 0) (0 0)))
  (non-orig (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 0))
  (traces
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk c)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk c)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 16)
  (parent 13)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk c)) (ca ca) (s c) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk c)) (client_key-0 (pubk c))
        (server_name c) (client_name c))))
  (origs (pms (0 2))))

(defskeleton tls3
  (vars (s c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (0 0)) ((2 0) (1 0))
    ((3 0) (1 1)))
  (non-orig (privk s) (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)) (0 0))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 17)
  (parent 14)
  (seen 15)
  (unrealized (0 1))
  (comment "3 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (1 0)) ((3 0) (0 0))
    ((3 0) (1 1)))
  (non-orig (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)) (0 0))
  (traces
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk c)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk c)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 18)
  (parent 14)
  (seen 16)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (s c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (1 0)) ((3 0) (1 1))
    ((4 0) (0 0)))
  (non-orig (privk s) (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)) (0 0))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))))
  (label 19)
  (parent 14)
  (seen 16)
  (unrealized (0 1))
  (comment "4 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (s c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (0 0)) ((2 0) (1 0))
    ((3 0) (0 1)) ((3 0) (1 1)))
  (non-orig (privk s) (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 20)
  (parent 17)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk s)) (ca ca) (s s) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk s)) (client_key-0 (pubk c))
        (server_name s) (client_name c))))
  (origs (pms (0 2))))

(defskeleton tls3
  (vars (s c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (0 0)) ((2 0) (1 0))
    ((3 0) (1 1)) ((4 0) (0 1)))
  (non-orig (privk s) (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 21)
  (parent 17)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk s)) (ca ca) (s s) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk s)) (client_key-0 (pubk c))
        (server_name s) (client_name c))))
  (origs (pms (0 2))))

(defskeleton tls3
  (vars (s ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name s)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk s)))
  (defstrand server 4 (ca ca) (server_name s) (client_name s)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk s)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (0 1)) ((2 0) (1 0))
    ((3 0) (0 0)))
  (non-orig (privk s) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat s (pubk s)
          (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk s))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat s (pubk s)
          (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk s))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))))
  (label 22)
  (parent 19)
  (seen 16)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (s c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (1 0)) ((3 0) (0 1))
    ((3 0) (1 1)) ((4 0) (0 0)))
  (non-orig (privk s) (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))))
  (label 23)
  (parent 19)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk s)) (ca ca) (s s) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk s)) (client_key-0 (pubk c))
        (server_name s) (client_name c))))
  (origs (pms (0 2))))

(defskeleton tls3
  (vars (s c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (1 0)) ((3 0) (1 1))
    ((4 0) (0 0)) ((5 0) (0 1)))
  (non-orig (privk s) (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 24)
  (parent 19)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk s)) (ca ca) (s s) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk s)) (client_key-0 (pubk c))
        (server_name s) (client_name c))))
  (origs (pms (0 2))))

(comment "Nothing left to do")

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey)
    (k client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms) (server_key k)
    (client_key client_key))
  (deflistener pms)
  (non-orig (invk k) (privk ca))
  (uniq-orig pms)
  (comment "Confidentiality guarantees to server")
  (traces
    ((recv
       (cat server_name k
         (enc (enc "hash_zero" (cat "cert" server_name k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (recv (enc "client_version" pms k))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name k
                (enc (enc "hash_zero" (cat "cert" server_name k))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key)))) ((recv pms) (send pms)))
  (label 25)
  (unrealized (0 0) (0 1) (0 3))
  (origs)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 26)
  (parent 25)
  (unrealized (0 1) (0 3))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 3 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 27)
  (parent 26)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((3 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 28)
  (parent 26)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((2 0) (0 0)) ((3 2) (0 2)) ((3 2) (1 0)) ((3 3) (0 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 29)
  (parent 27)
  (unrealized (1 0) (3 0) (3 1))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 0)) ((3 0) (0 1)) ((4 2) (0 2)) ((4 2) (1 0))
    ((4 3) (0 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 30)
  (parent 28)
  (unrealized (1 0) (4 0) (4 1))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((2 0) (0 0)) ((2 0) (3 0)) ((3 2) (0 2)) ((3 2) (1 0))
    ((3 3) (0 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (3 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 31)
  (parent 29)
  (unrealized (1 0))
  (comment "empty cohort"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((3 2) (0 2)) ((3 2) (1 0)) ((3 3) (0 3))
    ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (3 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 32)
  (parent 29)
  (unrealized (1 0))
  (comment "empty cohort"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 0)) ((2 0) (4 0)) ((3 0) (0 1)) ((4 2) (0 2))
    ((4 2) (1 0)) ((4 3) (0 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (4 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 33)
  (parent 30)
  (seen 31)
  (unrealized (1 0) (4 1))
  (comment "3 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 0)) ((3 0) (0 1)) ((3 0) (4 0)) ((4 2) (0 2))
    ((4 2) (1 0)) ((4 3) (0 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (4 0))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))) ((recv pms) (send pms))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 34)
  (parent 30)
  (unrealized (1 0))
  (comment "empty cohort"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((3 0) (0 1)) ((4 2) (0 2)) ((4 2) (1 0))
    ((4 3) (0 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (4 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 35)
  (parent 30)
  (seen 32)
  (unrealized (1 0) (4 1))
  (comment "4 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 0)) ((2 0) (4 0)) ((3 0) (0 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 0)) ((4 3) (0 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (4 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 36)
  (parent 33)
  (unrealized (1 0))
  (comment "empty cohort"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (4 0)) ((3 0) (0 1)) ((4 2) (0 2))
    ((4 2) (1 0)) ((4 3) (0 3)) ((5 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (4 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 37)
  (parent 33)
  (unrealized (1 0))
  (comment "empty cohort"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (3 1)) ((3 2) (0 2)) ((3 2) (1 0))
    ((3 3) (0 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (4 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 38)
  (parent 35)
  (unrealized (1 0))
  (comment "empty cohort"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((3 0) (0 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 0)) ((4 3) (0 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (4 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 39)
  (parent 35)
  (unrealized (1 0))
  (comment "empty cohort"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (deflistener pms)
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((3 0) (0 1)) ((4 2) (0 2)) ((4 2) (1 0))
    ((4 3) (0 3)) ((5 0) (4 0)) ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (4 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))) ((recv pms) (send pms))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 40)
  (parent 35)
  (unrealized (1 0))
  (comment "empty cohort"))

(comment "Nothing left to do")

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey)
    (k client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms) (server_key k)
    (client_key client_key))
  (non-orig (invk k) (privk ca))
  (uniq-orig pms)
  (comment "Auth guarantees to server")
  (traces
    ((recv
       (cat server_name k
         (enc (enc "hash_zero" (cat "cert" server_name k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (recv (enc "client_version" pms k))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name k
                (enc (enc "hash_zero" (cat "cert" server_name k))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key)))))
  (label 41)
  (unrealized (0 0) (0 1) (0 3))
  (origs)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 42)
  (parent 41)
  (unrealized (0 1) (0 3))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 2 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 43)
  (parent 42)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 44)
  (parent 42)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((1 0) (0 0)) ((2 2) (0 2)) ((2 3) (0 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 45)
  (parent 43)
  (unrealized (2 0) (2 1))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((3 2) (0 2)) ((3 3) (0 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 46)
  (parent 44)
  (unrealized (3 0) (3 1))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((1 0) (0 0)) ((1 0) (2 0)) ((2 2) (0 2)) ((2 3) (0 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 3 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (2 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 47)
  (parent 45)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name))))
  (origs (pms (2 2))))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 2) (0 2)) ((2 3) (0 3)) ((3 0) (2 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (2 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 48)
  (parent 45)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name))))
  (origs (pms (2 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((1 0) (0 0)) ((1 0) (3 0)) ((2 0) (0 1)) ((3 2) (0 2))
    ((3 3) (0 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (3 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 49)
  (parent 46)
  (seen 47)
  (unrealized (3 1))
  (comment "3 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((2 0) (3 0)) ((3 2) (0 2))
    ((3 3) (0 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (3 0))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 50)
  (parent 46)
  (seen 48)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((3 2) (0 2)) ((3 3) (0 3))
    ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (3 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 51)
  (parent 46)
  (seen 48)
  (unrealized (3 1))
  (comment "4 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((1 0) (0 0)) ((1 0) (3 0)) ((2 0) (0 1)) ((2 0) (3 1))
    ((3 2) (0 2)) ((3 3) (0 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 52)
  (parent 49)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name))))
  (origs (pms (3 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((1 0) (3 0)) ((2 0) (0 1)) ((3 2) (0 2))
    ((3 3) (0 3)) ((4 0) (3 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 53)
  (parent 49)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name))))
  (origs (pms (3 2))))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((1 0) (2 1)) ((2 2) (0 2)) ((2 3) (0 3))
    ((3 0) (2 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 54)
  (parent 51)
  (seen 48)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 3) (0 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 55)
  (parent 51)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name))))
  (origs (pms (3 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((3 2) (0 2)) ((3 3) (0 3))
    ((4 0) (3 0)) ((5 0) (3 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 56)
  (parent 51)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name))))
  (origs (pms (3 2))))

(comment "Nothing left to do")

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

(defskeleton tls3
  (vars
    (ca server_name client_name ca-0 server_name-0 client_name-0 name)
    (pms skey) (k client_key client_key-0 akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms) (server_key k)
    (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms) (server_key k)
    (client_key client_key-0))
  (non-orig (invk k) (privk ca) (privk ca-0))
  (uniq-orig pms)
  (comment "Session property?")
  (traces
    ((recv
       (cat server_name k
         (enc (enc "hash_zero" (cat "cert" server_name k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (recv (enc "client_version" pms k))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name k
                (enc (enc "hash_zero" (cat "cert" server_name k))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key))))
    ((recv
       (cat server_name-0 k
         (enc (enc "hash_zero" (cat "cert" server_name-0 k))
           (privk ca-0))))
      (recv
        (cat client_name-0 client_key-0
          (enc (enc "hash_zero" (cat "cert" client_name-0 client_key-0))
            (privk ca-0)))) (recv (enc "client_version" pms k))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 k
                (enc (enc "hash_zero" (cat "cert" server_name-0 k))
                  (privk ca-0)))
              (cat client_name-0 client_key-0
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 client_key-0))
                  (privk ca-0))) (enc "client_version" pms k)))
          (invk client_key-0)))))
  (label 57)
  (unrealized (0 0) (0 1) (0 3) (1 0) (1 1) (1 3))
  (origs)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey)
    (k client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms) (server_key k)
    (client_key client_key))
  (non-orig (invk k) (privk ca))
  (uniq-orig pms)
  (operation collapsed 1 0)
  (traces
    ((recv
       (cat server_name k
         (enc (enc "hash_zero" (cat "cert" server_name k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (recv (enc "client_version" pms k))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name k
                (enc (enc "hash_zero" (cat "cert" server_name k))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key)))))
  (label 58)
  (parent 57)
  (unrealized (0 0) (0 1) (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars
    (ca server_name client_name ca-0 server_name-0 client_name-0 name)
    (pms skey) (client_key client_key-0 akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key-0))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (precedes ((2 0) (1 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" server_name-0 (pubk server_name-0)))
      (privk ca-0)) (1 0))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 client_key-0
          (enc (enc "hash_zero" (cat "cert" client_name-0 client_key-0))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 client_key-0
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 client_key-0))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))))
  (label 59)
  (parent 57)
  (unrealized (0 0) (0 1) (0 3) (1 1) (1 3))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 60)
  (parent 58)
  (unrealized (0 1) (0 3))
  (origs)
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name ca-0 server_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name server_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk server_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (precedes ((2 0) (1 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 3 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (1 1))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat server_name-0 (pubk server_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name-0 (pubk server_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk server_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))))
  (label 61)
  (parent 59)
  (unrealized (0 0) (0 1) (0 3) (1 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars
    (ca server_name client_name ca-0 server_name-0 client_name-0 name)
    (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (1 1))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0))))))
  (label 62)
  (parent 59)
  (unrealized (0 0) (0 1) (0 3) (1 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 2 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 63)
  (parent 60)
  (unrealized (0 3))
  (origs)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 64)
  (parent 60)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name ca-0 server_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name server_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk server_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name-0)
    (client_name server_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk server_name-0)))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name-0 (pubk server_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name-0 (pubk server_name-0)))
              (privk ca-0)))
          (cat server_name-0 (pubk server_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name-0 (pubk server_name-0)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name-0))))
      (privk server_name-0)) (1 3))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat server_name-0 (pubk server_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name-0 (pubk server_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk server_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat server_name-0 (pubk server_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name-0 (pubk server_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk server_name-0)))))
  (label 65)
  (parent 61)
  (unrealized (0 0) (0 1) (0 3) (3 0) (3 1))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars
    (ca server_name client_name ca-0 server_name-0 client_name-0 name)
    (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name-0 (pubk server_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name-0 (pubk server_name-0)))
              (privk ca-0)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name-0))))
      (privk client_name-0)) (1 3))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0)))))
  (label 66)
  (parent 62)
  (unrealized (0 0) (0 1) (0 3) (4 0) (4 1))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((1 0) (0 0)) ((2 2) (0 2)) ((2 3) (0 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 67)
  (parent 63)
  (unrealized (2 0) (2 1))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((3 2) (0 2)) ((3 3) (0 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 68)
  (parent 64)
  (unrealized (3 0) (3 1))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name ca-0 server_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name server_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk server_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name-0)
    (client_name server_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk server_name-0)))
  (precedes ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" server_name-0 (pubk server_name-0)))
      (privk ca-0)) (3 0))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat server_name-0 (pubk server_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name-0 (pubk server_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk server_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat server_name-0 (pubk server_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name-0 (pubk server_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk server_name-0)))))
  (label 69)
  (parent 65)
  (unrealized (0 0) (0 1) (0 3))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name ca-0 server_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name server_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk server_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name-0)
    (client_name server_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk server_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (3 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" server_name-0 (pubk server_name-0)))
      (privk ca-0)) (3 0))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat server_name-0 (pubk server_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name-0 (pubk server_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk server_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat server_name-0 (pubk server_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name-0 (pubk server_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk server_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))))
  (label 70)
  (parent 65)
  (unrealized (0 0) (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars
    (ca server_name client_name ca-0 server_name-0 client_name-0 name)
    (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" server_name-0 (pubk server_name-0)))
      (privk ca-0)) (4 0))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0)))))
  (label 71)
  (parent 66)
  (seen 69)
  (unrealized (0 0) (0 1) (0 3) (4 1))
  (comment "3 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name ca-0 client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 0)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk ca-0) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" server_name-0 (pubk server_name-0)))
      (privk ca-0)) (4 0))
  (traces
    ((recv
       (cat server_name (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk client_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (invk client_key))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0)))))
  (label 72)
  (parent 66)
  (unrealized (0 0) (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars
    (ca server_name client_name ca-0 server_name-0 client_name-0 name)
    (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" server_name-0 (pubk server_name-0)))
      (privk ca-0)) (4 0))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))))
  (label 73)
  (parent 66)
  (seen 70)
  (unrealized (0 0) (0 1) (0 3) (4 1))
  (comment "4 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((1 0) (0 0)) ((1 0) (2 0)) ((2 2) (0 2)) ((2 3) (0 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 3 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (2 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 74)
  (parent 67)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (2 2))))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 2) (0 2)) ((2 3) (0 3)) ((3 0) (2 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (2 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 75)
  (parent 67)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (2 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((1 0) (0 0)) ((1 0) (3 0)) ((2 0) (0 1)) ((3 2) (0 2))
    ((3 3) (0 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (3 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 76)
  (parent 68)
  (seen 74)
  (unrealized (3 1))
  (comment "3 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((2 0) (3 0)) ((3 2) (0 2))
    ((3 3) (0 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (3 0))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 77)
  (parent 68)
  (seen 75)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((3 2) (0 2)) ((3 3) (0 3))
    ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (3 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 78)
  (parent 68)
  (seen 75)
  (unrealized (3 1))
  (comment "4 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name name) (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (1 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 79)
  (parent 69)
  (unrealized (0 1) (0 3))
  (comment "2 in cohort - 2 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 80)
  (parent 69)
  (unrealized (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name name) (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 81)
  (parent 70)
  (unrealized (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name name) (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (0 0)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 82)
  (parent 70)
  (unrealized (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 83)
  (parent 70)
  (unrealized (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars
    (ca server_name client_name ca-0 server_name-0 client_name-0 name)
    (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (4 1))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0)))))
  (label 84)
  (parent 71)
  (unrealized (0 0) (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars
    (ca server_name client_name ca-0 server_name-0 client_name-0 name)
    (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 1)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (4 1))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0))))))
  (label 85)
  (parent 71)
  (unrealized (0 0) (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (invk client_key))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0)))))
  (label 86)
  (parent 72)
  (unrealized (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (invk client_key))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0)))))
  (label 87)
  (parent 72)
  (unrealized (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 0)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 0))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (invk client_key))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))))
  (label 88)
  (parent 72)
  (unrealized (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name ca-0 server_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name server_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk server_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name-0)
    (client_name server_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk server_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (precedes ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (4 1))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat server_name-0 (pubk server_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name-0 (pubk server_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk server_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat server_name-0 (pubk server_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name-0 (pubk server_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk server_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))))
  (label 89)
  (parent 73)
  (unrealized (0 0) (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars
    (ca server_name client_name ca-0 server_name-0 client_name-0 name)
    (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (4 1))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))))
  (label 90)
  (parent 73)
  (unrealized (0 0) (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars
    (ca server_name client_name ca-0 server_name-0 client_name-0 name)
    (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (4 1)))
  (non-orig (privk ca) (privk ca-0) (privk server_name-0)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (4 1))
  (traces
    ((recv
       (cat server_name (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name (pubk server_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name-0))))
          (invk client_key))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 (pubk server_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name-0 (pubk server_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name-0))))
          (privk client_name-0))))
    ((send
       (cat server_name-0 (pubk server_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" server_name-0 (pubk server_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0))))))
  (label 91)
  (parent 73)
  (unrealized (0 0) (0 1) (0 3))
  (comment "5 in cohort - 5 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((1 0) (0 0)) ((1 0) (3 0)) ((2 0) (0 1)) ((2 0) (3 1))
    ((3 2) (0 2)) ((3 3) (0 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 92)
  (parent 76)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (3 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((1 0) (3 0)) ((2 0) (0 1)) ((3 2) (0 2))
    ((3 3) (0 3)) ((4 0) (3 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 93)
  (parent 76)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (3 2))))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((1 0) (2 1)) ((2 2) (0 2)) ((2 3) (0 3))
    ((3 0) (2 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 94)
  (parent 78)
  (seen 75)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 3) (0 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 95)
  (parent 78)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (3 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((3 2) (0 2)) ((3 3) (0 3))
    ((4 0) (3 0)) ((5 0) (3 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 96)
  (parent 78)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (3 2))))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (1 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 97)
  (parent 79)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (1 3)) ((4 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 98)
  (parent 79)
  (seen 141)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (1 3)) ((4 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 99)
  (parent 80)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca ca-0 server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 100)
  (parent 80)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 0)) ((5 0) (0 1)))
  (non-orig (privk ca) (privk client_name) (privk ca-0)
    (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 101)
  (parent 80)
  (seen 143)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 102)
  (parent 81)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 1)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 103)
  (parent 81)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 104)
  (parent 81)
  (seen 144)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 105)
  (parent 82)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (0 0)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 106)
  (parent 82)
  (seen 143)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (0 0)) ((4 0) (3 0)) ((5 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 107)
  (parent 82)
  (seen 143)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 108)
  (parent 83)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (0 1)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 109)
  (parent 83)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca ca-0 server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 110)
  (parent 83)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (3 0)) ((5 0) (0 0)) ((6 0) (0 1)))
  (non-orig (privk ca) (privk client_name) (privk ca-0)
    (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 111)
  (parent 83)
  (seen 149)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0)))))
  (label 112)
  (parent 84)
  (unrealized (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (invk client_key))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0)))))
  (label 113)
  (parent 84)
  (unrealized (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 114)
  (parent 84)
  (unrealized (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))))
  (label 115)
  (parent 85)
  (unrealized (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (invk client_key))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0)))))
  (label 116)
  (parent 85)
  (unrealized (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 1)))
  (non-orig (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (invk client_key))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))))
  (label 117)
  (parent 85)
  (unrealized (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 1)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 118)
  (parent 85)
  (unrealized (0 1) (0 3))
  (comment "5 in cohort - 5 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 119)
  (parent 86)
  (seen 145)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((3 0) (4 0)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 120)
  (parent 86)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 121)
  (parent 86)
  (seen 145)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 0)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 122)
  (parent 87)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 123)
  (parent 87)
  (seen 142)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 124)
  (parent 87)
  (seen 142)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 125)
  (parent 88)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 126)
  (parent 88)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca ca-0 client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca-0) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 0)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca-0))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca-0)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca-0)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca-0))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 127)
  (parent 88)
  (seen 148)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca-0) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 0)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)) ((6 0) (0 1)))
  (non-orig (privk ca) (privk client_name) (privk ca-0)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 128)
  (parent 88)
  (seen 148)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name name) (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (1 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 129)
  (parent 89)
  (unrealized (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name name) (pms skey) (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 130)
  (parent 89)
  (unrealized (0 1) (0 3))
  (comment "3 in cohort - 3 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 131)
  (parent 89)
  (unrealized (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 132)
  (parent 90)
  (unrealized (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (invk client_key))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))))
  (label 133)
  (parent 90)
  (unrealized (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 134)
  (parent 90)
  (unrealized (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 135)
  (parent 90)
  (unrealized (0 1) (0 3))
  (comment "5 in cohort - 5 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))))
  (label 136)
  (parent 91)
  (unrealized (0 1) (0 3))
  (comment "5 in cohort - 5 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (invk client_key))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))))
  (label 137)
  (parent 91)
  (unrealized (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)) ((5 0) (0 0)) ((5 0) (4 0)) ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 5 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))))
  (label 138)
  (parent 91)
  (unrealized (0 1) (0 3))
  (comment "5 in cohort - 5 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (3 0)) ((5 0) (0 0)) ((5 0) (3 1)))
  (non-orig (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 6 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca-0)) (0 0))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (invk client_key))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))))
  (label 139)
  (parent 91)
  (unrealized (0 1) (0 3))
  (comment "4 in cohort - 4 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name client_name-0 name) (pms skey)
    (client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (4 1)) ((7 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (0 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (invk client_key))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 140)
  (parent 91)
  (unrealized (0 1) (0 3))
  (comment "6 in cohort - 6 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (0 3)) ((3 3) (1 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 141)
  (parent 97)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (3 2))))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 142)
  (parent 99)
  (seen 143)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 143)
  (parent 100)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (3 2))))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 144)
  (parent 102)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (3 2))))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (0 1)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 145)
  (parent 103)
  (seen 144)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 146)
  (parent 105)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 147)
  (parent 108)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (0 3))
    ((3 3) (1 3)) ((4 0) (0 1)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 148)
  (parent 109)
  (seen 149)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (0 3))
    ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 149)
  (parent 110)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (3 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 150)
  (parent 112)
  (seen 141)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1))
    ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 151)
  (parent 112)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3))
    ((5 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk server_name)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 152)
  (parent 112)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 0))
    ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 153)
  (parent 113)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 154)
  (parent 113)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3))
    ((5 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 155)
  (parent 113)
  (seen 235)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3))
    ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 156)
  (parent 114)
  (seen 142)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3))
    ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 157)
  (parent 114)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca ca-0 server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name)
    (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 158)
  (parent 114)
  (seen 143)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0))
    ((6 0) (0 1)))
  (non-orig (privk ca) (privk client_name) (privk ca-0)
    (privk server_name) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 159)
  (parent 114)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 160)
  (parent 115)
  (seen 141)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1))
    ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3))
    ((5 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 161)
  (parent 115)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 1))
    ((5 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 162)
  (parent 115)
  (seen 233)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 1))
    ((6 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk server_name)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 163)
  (parent 115)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 0))
    ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 164)
  (parent 116)
  (seen 176)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 165)
  (parent 116)
  (seen 146)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 166)
  (parent 116)
  (seen 146)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 1)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 167)
  (parent 117)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 1)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 168)
  (parent 117)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 1)) ((5 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 169)
  (parent 117)
  (seen 241)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 1))
    ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 170)
  (parent 118)
  (seen 142)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 1))
    ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 171)
  (parent 118)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 1)) ((5 0) (4 1))
    ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 172)
  (parent 118)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca ca-0 server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 1)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name)
    (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 6 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 173)
  (parent 118)
  (seen 143)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 1)) ((6 0) (0 0))
    ((7 0) (0 1)))
  (non-orig (privk ca) (privk client_name) (privk ca-0)
    (privk server_name) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 174)
  (parent 118)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((3 0) (4 0)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 175)
  (parent 120)
  (seen 145)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 0)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 176)
  (parent 122)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (0 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 177)
  (parent 125)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (0 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 178)
  (parent 126)
  (seen 148)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (1 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 179)
  (parent 129)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (1 3)) ((4 0) (0 1)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 180)
  (parent 129)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 181)
  (parent 129)
  (seen 247)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 182)
  (parent 130)
  (seen 235)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 183)
  (parent 130)
  (seen 241)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 0)) ((5 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 184)
  (parent 130)
  (seen 241)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 185)
  (parent 131)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (0 1)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 186)
  (parent 131)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca ca-0 server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 187)
  (parent 131)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)) ((6 0) (0 1)))
  (non-orig (privk ca) (privk client_name) (privk ca-0)
    (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 188)
  (parent 131)
  (seen 251)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 189)
  (parent 132)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3))
    ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 190)
  (parent 132)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 1))
    ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 191)
  (parent 132)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk server_name)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 192)
  (parent 132)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3))
    ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 193)
  (parent 133)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 194)
  (parent 133)
  (seen 249)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 1))
    ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 195)
  (parent 133)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 196)
  (parent 133)
  (seen 249)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0))
    ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 197)
  (parent 134)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0))
    ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 198)
  (parent 134)
  (seen 236)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 199)
  (parent 134)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)) ((5 0) (4 0))
    ((6 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk server_name)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 200)
  (parent 134)
  (seen 243)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 201)
  (parent 135)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 202)
  (parent 135)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 1)) ((5 0) (4 0))
    ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 203)
  (parent 135)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca ca-0 server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name)
    (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 6 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 204)
  (parent 135)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (0 0))
    ((7 0) (0 1)))
  (non-orig (privk ca) (privk client_name) (privk ca-0)
    (privk server_name) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 205)
  (parent 135)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 206)
  (parent 136)
  (seen 144)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 207)
  (parent 136)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 1)) ((5 0) (4 0))
    ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 208)
  (parent 136)
  (seen 145)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (0 1))
    ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 6 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 209)
  (parent 136)
  (seen 255)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (4 1))
    ((7 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk server_name)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 210)
  (parent 136)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 211)
  (parent 137)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 212)
  (parent 137)
  (seen 147)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 1)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 213)
  (parent 137)
  (seen 177)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 214)
  (parent 137)
  (seen 147)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)) ((5 0) (4 0))
    ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 215)
  (parent 138)
  (seen 146)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (0 0)) ((5 0) (4 0))
    ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 216)
  (parent 138)
  (seen 242)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)) ((5 0) (0 0)) ((5 0) (4 0)) ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 217)
  (parent 138)
  (seen 143)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)) ((5 0) (0 0)) ((5 0) (4 0)) ((6 0) (0 1))
    ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 6 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 218)
  (parent 138)
  (seen 237)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (client_name ca server_name client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)) ((5 0) (0 0)) ((5 0) (4 0)) ((6 0) (4 1))
    ((7 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk server_name)
    (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 219)
  (parent 138)
  (seen 244)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)) ((5 0) (3 1)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 220)
  (parent 139)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (0 1)) ((4 0) (3 0)) ((5 0) (0 0)) ((5 0) (3 1)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 221)
  (parent 139)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (3 0)) ((5 0) (0 0)) ((5 0) (3 1)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 222)
  (parent 139)
  (seen 251)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (client_name ca client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name-0)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk client_name-0)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (1 3))
    ((4 0) (3 0)) ((5 0) (0 0)) ((5 0) (3 1)) ((6 0) (0 1)))
  (non-orig (privk client_name) (privk ca) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (recv (enc "client_version" pms (pubk client_name-0)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((recv
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca))))
      (send (enc "client_version" pms (pubk client_name-0)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name-0))))
          (privk client_name-0))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 223)
  (parent 139)
  (seen 251)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (4 1))
    ((7 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 2 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 224)
  (parent 140)
  (seen 147)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (4 1))
    ((7 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 3 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 225)
  (parent 140)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)) ((5 0) (0 1)) ((5 0) (4 0)) ((6 0) (4 1))
    ((7 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 5 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 226)
  (parent 140)
  (seen 148)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (0 1)) ((6 0) (4 1))
    ((7 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 6 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca-0)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 227)
  (parent 140)
  (seen 264)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca ca-0 server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (4 1)) ((7 0) (0 0)))
  (non-orig (privk ca) (privk ca-0) (privk server_name)
    (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 7 certificate_auth 1)
    (enc
      (enc "hash_zero" (cat "cert" client_name-0 (pubk client_name-0)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 228)
  (parent 140)
  (seen 149)
  (unrealized (0 3))
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name ca-0 server_name client_name-0 name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand client 4 (ca ca-0) (server_name server_name)
    (client_name client_name-0) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name-0)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name client_name-0) (ca ca-0))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (4 1)) ((7 0) (0 0))
    ((8 0) (0 1)))
  (non-orig (privk ca) (privk client_name) (privk ca-0)
    (privk server_name) (privk client_name-0))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0))))
      (recv
        (cat client_name-0 (pubk client_name-0)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name-0 (pubk client_name-0)))
            (privk ca-0))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca-0)))
              (cat client_name-0 (pubk client_name-0)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 (pubk client_name-0)))
                  (privk ca-0)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name-0))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca-0)))))
    ((send
       (cat client_name-0 (pubk client_name-0)
         (enc
           (enc "hash_zero"
             (cat "cert" client_name-0 (pubk client_name-0)))
           (privk ca-0)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 229)
  (parent 140)
  (unrealized (0 3))
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 2)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 1)))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 230)
  (parent 146)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 2)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 1)))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 231)
  (parent 147)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1))
    ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (0 3)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 232)
  (parent 151)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)) ((5 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 233)
  (parent 152)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 0))
    ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (0 3)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 234)
  (parent 153)
  (seen 235)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 235)
  (parent 154)
  (seen 146)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 236)
  (parent 157)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (0 0)) ((6 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 237)
  (parent 159)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1))
    ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)) ((5 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 238)
  (parent 161)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 1)) ((6 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 239)
  (parent 163)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (0 0))
    ((4 0) (3 1)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 240)
  (parent 167)
  (seen 241)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 1)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 241)
  (parent 168)
  (seen 230)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 1)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 242)
  (parent 171)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (0 1))
    ((5 0) (4 1)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 243)
  (parent 172)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (4 1))
    ((6 0) (0 0)) ((7 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 244)
  (parent 174)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 2)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 0)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 1)))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 245)
  (parent 176)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 2)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (0 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 1)))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 246)
  (parent 177)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 247)
  (parent 179)
  (seen 144)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (0 1))
    ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 248)
  (parent 180)
  (seen 247)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (3 0))
    ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 249)
  (parent 185)
  (seen 251)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (0 1)) ((4 0) (3 0))
    ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 250)
  (parent 186)
  (seen 251)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 1)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 251)
  (parent 187)
  (seen 231)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 252)
  (parent 189)
  (seen 144)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 253)
  (parent 190)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (0 1)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 254)
  (parent 191)
  (seen 145)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 0)) ((6 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 255)
  (parent 192)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 256)
  (parent 193)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (0 1)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 257)
  (parent 195)
  (seen 249)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (0 0)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 258)
  (parent 197)
  (seen 146)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (0 0))
    ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 259)
  (parent 199)
  (seen 143)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 0)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 260)
  (parent 201)
  (seen 147)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 0)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 261)
  (parent 202)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (0 1))
    ((5 0) (4 0)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 262)
  (parent 203)
  (seen 148)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (0 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 263)
  (parent 204)
  (seen 149)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (0 0)) ((7 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 264)
  (parent 205)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 0)) ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 265)
  (parent 207)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (4 1)) ((7 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 266)
  (parent 210)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 267)
  (parent 211)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 1)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0))
    ((5 0) (3 1)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 268)
  (parent 220)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (0 3))
    ((3 3) (1 3)) ((4 0) (0 1)) ((4 0) (3 0)) ((5 0) (0 0))
    ((5 0) (3 1)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk client_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 269)
  (parent 221)
  (seen 251)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (4 1)) ((7 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 270)
  (parent 225)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (4 1))
    ((7 0) (0 0)) ((8 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 9 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 271)
  (parent 229)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 3)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (0 0)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 2)))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 272)
  (parent 230)
  (seen 143)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 3)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 2)))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 273)
  (parent 231)
  (seen 149)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 3)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 0)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 2)))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name)))))
  (label 274)
  (parent 245)
  (seen 142)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 3)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 0))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (0 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 2)))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 275)
  (parent 246)
  (seen 148)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 2)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 1)))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 276)
  (parent 256)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 2)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 1)))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 277)
  (parent 267)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 2)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0))
    ((5 0) (3 1)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 1)))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 278)
  (parent 268)
  (unrealized)
  (comment "1 in cohort - 1 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 3)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 2)))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 279)
  (parent 276)
  (seen 249)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 3)) ((2 0) (1 0)) ((3 0) (0 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 0)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 2)))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 280)
  (parent 277)
  (seen 147)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(defskeleton tls3
  (vars (ca client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name client_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk client_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 3)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0))
    ((5 0) (3 1)))
  (non-orig (privk ca) (privk client_name))
  (uniq-orig pms)
  (operation generalization weakened ((2 0) (0 2)))
  (traces
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk client_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk client_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk client_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 281)
  (parent 278)
  (seen 251)
  (unrealized)
  (comment "1 in cohort - 0 not yet seen"))

(comment "Nothing left to do")