Fourth approx to TLS: Both parties get cert, then c sends pms encrypted and hash. CA guarantees privk uncompromised.

(comment "CPSA 2.2.11")
(comment "Extracted shapes")
(herald
  "Fourth approx to TLS:  Both parties get cert, then c sends pms encrypted and hash.  CA guarantees privk uncompromised."
  (bound 14))
(comment "CPSA 2.2.11")
(comment "All input read from tls3.scm")
(comment "Strand count bounded at 14")

Trees: 0 2 6 25 41 57.

Tree 0.

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

Item 0.

(defskeleton tls3
  (vars (ca s client_name name) (pms skey) (k client_key akey))
  (defstrand client 4 (ca ca) (server_name s) (client_name client_name)
    (pre_master_secret pms) (server_key k) (client_key client_key))
  (deflistener pms)
  (non-orig (invk k) (privk ca))
  (uniq-orig pms)
  (comment "Confidentiality should be OK.")
  (traces
    ((recv
       (cat s k (enc (enc "hash_zero" (cat "cert" s k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (send (enc "client_version" pms k))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s k
                (enc (enc "hash_zero" (cat "cert" s k)) (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key)))) ((recv pms) (send pms)))
  (label 0)
  (unrealized (0 0) (0 1) (1 0))
  (preskeleton)
  (comment "Not a skeleton"))

Tree 2.

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

Item 2, Children: 4 5.

(defskeleton tls3
  (vars (ca s client_name name) (pms skey) (k client_key akey))
  (defstrand client 4 (ca ca) (server_name s) (client_name client_name)
    (pre_master_secret pms) (server_key k) (client_key client_key))
  (non-orig (invk k) (privk ca))
  (uniq-orig pms)
  (comment "Authenticates CA.")
  (traces
    ((recv
       (cat s k (enc (enc "hash_zero" (cat "cert" s k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (send (enc "client_version" pms k))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s k
                (enc (enc "hash_zero" (cat "cert" s k)) (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key)))))
  (label 2)
  (unrealized (0 0) (0 1))
  (origs (pms (0 2)))
  (comment "1 in cohort - 1 not yet seen"))

Item 4, Parent: 2.

(defskeleton tls3
  (vars (ca s name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name s)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk s)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (precedes ((1 0) (0 0)))
  (non-orig (privk ca) (privk s))
  (uniq-orig pms)
  (operation encryption-test (displaced 2 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat s (pubk s)
          (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk s))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))))
  (label 4)
  (parent 2)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk s)) (ca ca) (s s) (client_key (pubk s))
        (client_name s))))
  (origs (pms (0 2))))

Item 5, Parent: 2.

(defskeleton tls3
  (vars (ca s client_name name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name client_name)
    (pre_master_secret pms) (server_key (pubk s))
    (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)))
  (non-orig (privk ca) (privk s) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk client_name))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 5)
  (parent 2)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk s)) (ca ca) (s s)
        (client_key (pubk client_name)) (client_name client_name))))
  (origs (pms (0 2))))

Tree 6.

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

Item 6, Children: 15 16 20 21 23 24.

(defskeleton tls3
  (vars (ca s c ca-0 server_name client_name name) (pms skey)
    (k client_key server_key client_key-0 akey))
  (defstrand client 4 (ca ca-0) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key k) (client_key client_key))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key server_key) (client_key client_key-0))
  (non-orig (invk k) (privk ca) (privk c) (privk ca-0))
  (uniq-orig pms)
  (comment "Authenticates CA and implicit auth for server.")
  (traces
    ((recv
       (cat s k (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0))))
      (recv
        (cat c client_key
          (enc (enc "hash_zero" (cat "cert" c client_key))
            (privk ca-0)))) (send (enc "client_version" pms k))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s k
                (enc (enc "hash_zero" (cat "cert" s k)) (privk ca-0)))
              (cat c client_key
                (enc (enc "hash_zero" (cat "cert" c client_key))
                  (privk ca-0))) (enc "client_version" pms k)))
          (invk client_key))))
    ((recv
       (cat server_name server_key
         (enc (enc "hash_zero" (cat "cert" server_name server_key))
           (privk ca))))
      (recv
        (cat client_name client_key-0
          (enc (enc "hash_zero" (cat "cert" client_name client_key-0))
            (privk ca)))) (recv (enc "client_version" pms server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key-0
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name client_key-0)) (privk ca)))
              (enc "client_version" pms server_key)))
          (invk client_key-0)))))
  (label 6)
  (unrealized (0 0) (0 1) (1 0) (1 1) (1 2) (1 3))
  (preskeleton)
  (comment "Not a skeleton"))

Item 15, Parent: 6.

(defskeleton tls3
  (vars (c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (0 0)) ((2 0) (1 0)))
  (non-orig (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (displaced 3 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 0))
  (traces
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk c)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk c)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 15)
  (parent 6)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk c)) (ca ca) (s c) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk c)) (client_key-0 (pubk c))
        (server_name c) (client_name c))))
  (origs (pms (0 2))))

Item 16, Parent: 6.

(defskeleton tls3
  (vars (c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name c) (client_name c)
    (pre_master_secret pms) (server_key (pubk c)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (1 0)) ((3 0) (0 0)))
  (non-orig (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 0))
  (traces
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk c)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((recv
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk c)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk c))))
          (privk c))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 16)
  (parent 6)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk c)) (ca ca) (s c) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk c)) (client_key-0 (pubk c))
        (server_name c) (client_name c))))
  (origs (pms (0 2))))

Item 20, Parent: 6.

(defskeleton tls3
  (vars (s c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (0 0)) ((2 0) (1 0))
    ((3 0) (0 1)) ((3 0) (1 1)))
  (non-orig (privk s) (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 20)
  (parent 6)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk s)) (ca ca) (s s) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk s)) (client_key-0 (pubk c))
        (server_name s) (client_name c))))
  (origs (pms (0 2))))

Item 21, Parent: 6.

(defskeleton tls3
  (vars (s c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (0 0)) ((2 0) (1 0))
    ((3 0) (1 1)) ((4 0) (0 1)))
  (non-orig (privk s) (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 21)
  (parent 6)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk s)) (ca ca) (s s) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk s)) (client_key-0 (pubk c))
        (server_name s) (client_name c))))
  (origs (pms (0 2))))

Item 23, Parent: 6.

(defskeleton tls3
  (vars (s c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (1 0)) ((3 0) (0 1))
    ((3 0) (1 1)) ((4 0) (0 0)))
  (non-orig (privk s) (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))))
  (label 23)
  (parent 6)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk s)) (ca ca) (s s) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk s)) (client_key-0 (pubk c))
        (server_name s) (client_name c))))
  (origs (pms (0 2))))

Item 24, Parent: 6.

(defskeleton tls3
  (vars (s c ca name) (pms skey))
  (defstrand client 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand server 4 (ca ca) (server_name s) (client_name c)
    (pre_master_secret pms) (server_key (pubk s)) (client_key (pubk c)))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (defstrand certificate_auth 1 (subject_name s) (ca ca))
  (defstrand certificate_auth 1 (subject_name c) (ca ca))
  (precedes ((0 2) (1 2)) ((0 3) (1 3)) ((2 0) (1 0)) ((3 0) (1 1))
    ((4 0) (0 0)) ((5 0) (0 1)))
  (non-orig (privk s) (privk c) (privk ca))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)) (0 1))
  (traces
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (send (enc "client_version" pms (pubk s)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((recv
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca))))
      (recv
        (cat c (pubk c)
          (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))
      (recv (enc "client_version" pms (pubk s)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat s (pubk s)
                (enc (enc "hash_zero" (cat "cert" s (pubk s)))
                  (privk ca)))
              (cat c (pubk c)
                (enc (enc "hash_zero" (cat "cert" c (pubk c)))
                  (privk ca))) (enc "client_version" pms (pubk s))))
          (privk c))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca)))))
    ((send
       (cat s (pubk s)
         (enc (enc "hash_zero" (cat "cert" s (pubk s))) (privk ca)))))
    ((send
       (cat c (pubk c)
         (enc (enc "hash_zero" (cat "cert" c (pubk c))) (privk ca))))))
  (label 24)
  (parent 6)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk s)) (ca ca) (s s) (c c) (client_key (pubk c))
        (ca-0 ca) (server_key (pubk s)) (client_key-0 (pubk c))
        (server_name s) (client_name c))))
  (origs (pms (0 2))))

Tree 25.

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

Item 25.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey)
    (k client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms) (server_key k)
    (client_key client_key))
  (deflistener pms)
  (non-orig (invk k) (privk ca))
  (uniq-orig pms)
  (comment "Confidentiality guarantees to server")
  (traces
    ((recv
       (cat server_name k
         (enc (enc "hash_zero" (cat "cert" server_name k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (recv (enc "client_version" pms k))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name k
                (enc (enc "hash_zero" (cat "cert" server_name k))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key)))) ((recv pms) (send pms)))
  (label 25)
  (unrealized (0 0) (0 1) (0 3))
  (origs)
  (comment "1 in cohort - 1 not yet seen"))

Tree 41.

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

Item 41, Children: 47 48 52 53 55 56.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey)
    (k client_key akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms) (server_key k)
    (client_key client_key))
  (non-orig (invk k) (privk ca))
  (uniq-orig pms)
  (comment "Auth guarantees to server")
  (traces
    ((recv
       (cat server_name k
         (enc (enc "hash_zero" (cat "cert" server_name k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (recv (enc "client_version" pms k))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name k
                (enc (enc "hash_zero" (cat "cert" server_name k))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key)))))
  (label 41)
  (unrealized (0 0) (0 1) (0 3))
  (origs)
  (comment "1 in cohort - 1 not yet seen"))

Item 47, Parent: 41.

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((1 0) (0 0)) ((1 0) (2 0)) ((2 2) (0 2)) ((2 3) (0 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 3 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (2 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 47)
  (parent 41)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name))))
  (origs (pms (2 2))))

Item 48, Parent: 41.

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 2) (0 2)) ((2 3) (0 3)) ((3 0) (2 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (2 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 48)
  (parent 41)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name))))
  (origs (pms (2 2))))

Item 52, Parent: 41.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((1 0) (0 0)) ((1 0) (3 0)) ((2 0) (0 1)) ((2 0) (3 1))
    ((3 2) (0 2)) ((3 3) (0 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 52)
  (parent 41)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name))))
  (origs (pms (3 2))))

Item 53, Parent: 41.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((1 0) (3 0)) ((2 0) (0 1)) ((3 2) (0 2))
    ((3 3) (0 3)) ((4 0) (3 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 53)
  (parent 41)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name))))
  (origs (pms (3 2))))

Item 55, Parent: 41.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 3) (0 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 55)
  (parent 41)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name))))
  (origs (pms (3 2))))

Item 56, Parent: 41.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((3 2) (0 2)) ((3 3) (0 3))
    ((4 0) (3 0)) ((5 0) (3 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 56)
  (parent 41)
  (unrealized)
  (shape)
  (maps
    ((0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name))))
  (origs (pms (3 2))))

Tree 57.

(defprotocol tls3 basic
  (defrole client
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (send (enc "client_version" pre_master_secret server_key))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole server
    (vars (pre_master_secret skey) (server_key client_key akey)
      (ca server_name client_name name))
    (trace
      (recv
        (cat server_name server_key
          (enc (enc "hash_zero" (cat "cert" server_name server_key))
            (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca))))
      (recv (enc "client_version" pre_master_secret server_key))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name server_key
                (enc
                  (enc "hash_zero" (cat "cert" server_name server_key))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca)))
              (enc "client_version" pre_master_secret server_key)))
          (invk client_key))))
    (non-orig (privk ca)))
  (defrole certificate_auth
    (vars (subject_name ca name))
    (trace
      (send
        (cat subject_name (pubk subject_name)
          (enc
            (enc "hash_zero"
              (cat "cert" subject_name (pubk subject_name)))
            (privk ca)))))
    (non-orig (privk subject_name))))

Item 57, Children: 74 75 92 93 95 96 141 143 144 149 232 233 236 237 238 239 242 243 244 253 255 261 264 265 266 270 271.

(defskeleton tls3
  (vars
    (ca server_name client_name ca-0 server_name-0 client_name-0 name)
    (pms skey) (k client_key client_key-0 akey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms) (server_key k)
    (client_key client_key))
  (defstrand server 4 (ca ca-0) (server_name server_name-0)
    (client_name client_name-0) (pre_master_secret pms) (server_key k)
    (client_key client_key-0))
  (non-orig (invk k) (privk ca) (privk ca-0))
  (uniq-orig pms)
  (comment "Session property?")
  (traces
    ((recv
       (cat server_name k
         (enc (enc "hash_zero" (cat "cert" server_name k)) (privk ca))))
      (recv
        (cat client_name client_key
          (enc (enc "hash_zero" (cat "cert" client_name client_key))
            (privk ca)))) (recv (enc "client_version" pms k))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name k
                (enc (enc "hash_zero" (cat "cert" server_name k))
                  (privk ca)))
              (cat client_name client_key
                (enc
                  (enc "hash_zero" (cat "cert" client_name client_key))
                  (privk ca))) (enc "client_version" pms k)))
          (invk client_key))))
    ((recv
       (cat server_name-0 k
         (enc (enc "hash_zero" (cat "cert" server_name-0 k))
           (privk ca-0))))
      (recv
        (cat client_name-0 client_key-0
          (enc (enc "hash_zero" (cat "cert" client_name-0 client_key-0))
            (privk ca-0)))) (recv (enc "client_version" pms k))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name-0 k
                (enc (enc "hash_zero" (cat "cert" server_name-0 k))
                  (privk ca-0)))
              (cat client_name-0 client_key-0
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name-0 client_key-0))
                  (privk ca-0))) (enc "client_version" pms k)))
          (invk client_key-0)))))
  (label 57)
  (unrealized (0 0) (0 1) (0 3) (1 0) (1 1) (1 3))
  (origs)
  (comment "1 in cohort - 1 not yet seen"))

Item 74, Parent: 57.

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((1 0) (0 0)) ((1 0) (2 0)) ((2 2) (0 2)) ((2 3) (0 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 3 1 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (2 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 74)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (2 2))))

Item 75, Parent: 57.

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 2) (0 2)) ((2 3) (0 3)) ((3 0) (2 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
      (privk ca)) (2 0))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 75)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (2 2))))

Item 92, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((1 0) (0 0)) ((1 0) (3 0)) ((2 0) (0 1)) ((2 0) (3 1))
    ((3 2) (0 2)) ((3 3) (0 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 92)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (3 2))))

Item 93, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((1 0) (3 0)) ((2 0) (0 1)) ((3 2) (0 2))
    ((3 3) (0 3)) ((4 0) (3 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 93)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (3 2))))

Item 95, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((2 0) (3 1)) ((3 2) (0 2))
    ((3 3) (0 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 2 certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 95)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (3 2))))

Item 96, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((1 0) (0 0)) ((2 0) (0 1)) ((3 2) (0 2)) ((3 3) (0 3))
    ((4 0) (3 0)) ((5 0) (3 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (added-strand certificate_auth 1)
    (enc (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
      (privk ca)) (3 1))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 96)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 0)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (3 2))))

Item 141, Parent: 57.

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2))
    ((3 2) (1 2)) ((3 3) (0 3)) ((3 3) (1 3)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 4 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name)))))
  (label 141)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (3 2))))

Item 143, Parent: 57.

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (3 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 143)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (3 2))))

Item 144, Parent: 57.

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2))
    ((3 3) (0 3)) ((3 3) (1 3)) ((4 0) (3 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 144)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (3 2))))

Item 149, Parent: 57.

(defskeleton tls3
  (vars (ca server_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name server_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk server_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 2) (0 2)) ((3 2) (1 2)) ((3 3) (0 3))
    ((3 3) (1 3)) ((4 0) (3 0)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 3 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk server_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat server_name (pubk server_name)
          (enc
            (enc "hash_zero"
              (cat "cert" server_name (pubk server_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk server_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 149)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk server_name))
        (ca ca) (server_name server_name) (client_name server_name)
        (client_key-0 (pubk server_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 server_name))))
  (origs (pms (3 2))))

Item 232, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1))
    ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (0 3)) ((4 3) (1 3)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 5 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name)))))
  (label 232)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 233, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)) ((5 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 233)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 236, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)) ((5 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 236)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 237, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (0 0)) ((6 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 237)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 238, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1))
    ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)) ((5 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 238)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 239, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 1)) ((6 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 239)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 242, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 1)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 242)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 243, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (0 1))
    ((5 0) (4 1)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 243)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 244, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((2 0) (4 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (4 1))
    ((6 0) (0 0)) ((7 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 244)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 253, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((3 0) (4 1)) ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3))
    ((4 3) (1 3)) ((5 0) (4 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 6 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 253)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 255, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 0)) ((6 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 255)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 261, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1)) ((3 0) (4 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 0)) ((6 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 261)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 264, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((3 0) (4 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (0 0)) ((7 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 264)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 265, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1))
    ((4 2) (0 2)) ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3))
    ((5 0) (4 0)) ((6 0) (4 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 7 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 265)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 266, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (0 0)) ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (4 1)) ((7 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 266)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 270, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (0 1)) ((3 0) (1 1)) ((4 2) (0 2))
    ((4 2) (1 2)) ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (4 0))
    ((6 0) (4 1)) ((7 0) (0 0)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 8 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca)))
          (cat client_name (pubk client_name)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name (pubk client_name)))
              (privk ca)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))))
  (label 270)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))

Item 271, Parent: 57.

(defskeleton tls3
  (vars (ca server_name client_name name) (pms skey))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand server 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand client 4 (ca ca) (server_name server_name)
    (client_name client_name) (pre_master_secret pms)
    (server_key (pubk server_name)) (client_key (pubk client_name)))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name server_name) (ca ca))
  (defstrand certificate_auth 1 (subject_name client_name) (ca ca))
  (precedes ((2 0) (1 0)) ((3 0) (1 1)) ((4 2) (0 2)) ((4 2) (1 2))
    ((4 3) (0 3)) ((4 3) (1 3)) ((5 0) (4 0)) ((6 0) (4 1))
    ((7 0) (0 0)) ((8 0) (0 1)))
  (non-orig (privk ca) (privk server_name) (privk client_name))
  (uniq-orig pms)
  (operation encryption-test (displaced 9 4 client 4)
    (enc
      (enc "hash_zero"
        (cat
          (cat server_name (pubk server_name)
            (enc
              (enc "hash_zero"
                (cat "cert" server_name (pubk server_name)))
              (privk ca-0)))
          (cat client_name-0 (pubk client_name-0)
            (enc
              (enc "hash_zero"
                (cat "cert" client_name-0 (pubk client_name-0)))
              (privk ca-0)))
          (enc "client_version" pms (pubk server_name))))
      (privk client_name-0)) (0 3))
  (traces
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (recv (enc "client_version" pms (pubk server_name)))
      (recv
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((recv
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca))))
      (recv
        (cat client_name (pubk client_name)
          (enc
            (enc "hash_zero"
              (cat "cert" client_name (pubk client_name))) (privk ca))))
      (send (enc "client_version" pms (pubk server_name)))
      (send
        (enc
          (enc "hash_zero"
            (cat
              (cat server_name (pubk server_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" server_name (pubk server_name)))
                  (privk ca)))
              (cat client_name (pubk client_name)
                (enc
                  (enc "hash_zero"
                    (cat "cert" client_name (pubk client_name)))
                  (privk ca)))
              (enc "client_version" pms (pubk server_name))))
          (privk client_name))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca)))))
    ((send
       (cat server_name (pubk server_name)
         (enc
           (enc "hash_zero" (cat "cert" server_name (pubk server_name)))
           (privk ca)))))
    ((send
       (cat client_name (pubk client_name)
         (enc
           (enc "hash_zero" (cat "cert" client_name (pubk client_name)))
           (privk ca))))))
  (label 271)
  (parent 57)
  (unrealized)
  (shape)
  (maps
    ((0 1)
      ((pms pms) (k (pubk server_name)) (client_key (pubk client_name))
        (ca ca) (server_name server_name) (client_name client_name)
        (client_key-0 (pubk client_name)) (ca-0 ca)
        (server_name-0 server_name) (client_name-0 client_name))))
  (origs (pms (4 2))))