shs_proof.spthy

theory SHS_ng begin

// Function signature and definition of the equational theory E

builtins: diffie-hellman
functions: fst/1, h/1, mac/2, pair/2, pk/1, sdec/2, senc/2, sign/2,
           snd/1, true/0, verify/3
equations:
    fst(<x.1, x.2>) = x.1,
    sdec(senc(x.1, x.2), x.2) = x.1,
    snd(<x.1, x.2>) = x.2,
    verify(sign(x.1, x.2), x.1, pk(x.2)) = true

rule (modulo E) Random:
   [ Fr( ~eph ), !Agent( pkA, ltkA ) ]
  --[ MkRand( pkA, ~eph ) ]->
   [ Rand( pkA, ~eph ) ]

  /* has exactly the trivial AC variant */

rule (modulo E) NewProto:
   [ Fr( ~protoKey ) ]
  --[ NewProto( ~protoKey ) ]->
   [ !Proto( ~protoKey ), Out( ~protoKey ) ]

  /* has exactly the trivial AC variant */

rule (modulo E) NewAgent:
   [ Fr( ~ltk ) ]
  --[
  IsAgent( <'g'^~ltk, pk(~ltk)> ),
  AgentPubkey( <'g'^~ltk, pk(~ltk)>, 'g'^~ltk, pk(~ltk) ),
  WithLtk( ~ltk ),
  HasCapability( <'g'^~ltk, pk(~ltk)>, <'g'^~ltk, pk(~ltk)> )
  ]->
   [
   !Agent( <'g'^~ltk, pk(~ltk)>, ~ltk ),
   !Capability( <'g'^~ltk, pk(~ltk)>, <'g'^~ltk, pk(~ltk)> )
   ]

  /* has exactly the trivial AC variant */

rule (modulo E) Delegate:
   [ !Capability( pkDelegator, pkR ), !Agent( pkDelegatee, ~ltk ) ]
  --[ HasCapability( pkDelegatee, pkR ), Delegator( pkDelegator ) ]->
   [ !Capability( pkDelegatee, pkR ) ]

  // loop breaker: [0]
  /* has exactly the trivial AC variant */

rule (modulo E) RevealPubkey:
   [ !Agent( pk, ~ltk ) ] --[ RevealPublicKey( pk ) ]-> [ Out( pk ) ]

  /* has exactly the trivial AC variant */

rule (modulo E) RevealSessionKey:
   [ SessionKey( ~sid, sk ) ]
  --[ RevealSessionKey( sk ) ]->
   [ Out( sk ) ]

  /* has exactly the trivial AC variant */

rule (modulo E) Corrupt_ltk:
   [ !Agent( pkA, ltkA ) ] --[ LtkCorrupt( pkA ) ]-> [ Out( ltkA ) ]

  /* has exactly the trivial AC variant */

rule (modulo E) Dial:
   [
   !Agent( pkI, ~ltkI ), !Capability( pkI, pkR ), !Proto( ~protoKey ),
   Rand( pkI, ~ephI ), Fr( ~sid )
   ]
  --[
  SessionRole( ~sid, 'I' ), SessionInitiator( ~sid, pkI ),
  SessionResponder( ~sid, pkR ),
  SessionEphInitiator( ~sid, 'g'^~ephI ),
  SessionProtoKey( ~sid, ~protoKey ), SessionLocal( ~sid, pkI ),
  SessionPeer( ~sid, pkR )
  ]->
   [ Initiator( pkI, pkR, ~ltkI, ~ephI, ~protoKey, ~sid ) ]

  /* has exactly the trivial AC variant */

rule (modulo E) Listen:
   [
   !Agent( pkR, ~ltkR ), !Proto( ~protoKey ), Rand( pkR, ~ephR ),
   Fr( ~sid )
   ]
  --[
  SessionRole( ~sid, 'R' ), SessionResponder( ~sid, pkR ),
  SessionEphResponder( ~sid, 'g'^~ephR ),
  SessionProtoKey( ~sid, ~protoKey ), SessionLocal( ~sid, pkR )
  ]->
   [ ResponderListen( pkR, ~ltkR, ~ephR, ~protoKey, ~sid ) ]

  /* has exactly the trivial AC variant */

rule (modulo E) Initiator_sendChal:
   [ Initiator( pkI, pkR, ~ltkI, ~ephI, ~protoKey, ~sid ) ]
  --[
  SessionID( ~sid ), DHPubkey( fst(pkI) ), DHPubkey( fst(pkR) ),
  DHPubkey( 'g'^~ephI )
  ]->
   [
   Initiator_chalSent( pkI, pkR, ~ltkI, ~ephI, ~protoKey, ~sid ),
   Out( <'g'^~ephI, mac('g'^~ephI, h(~protoKey))> )
   ]

  /*
  rule (modulo AC) Initiator_sendChal:
     [ Initiator( pkI, pkR, ~ltkI, ~ephI, ~protoKey, ~sid ) ]
    --[
    SessionID( ~sid ), DHPubkey( z ), DHPubkey( z.1 ),
    DHPubkey( 'g'^~ephI )
    ]->
     [
     Initiator_chalSent( pkI, pkR, ~ltkI, ~ephI, ~protoKey, ~sid ),
     Out( <'g'^~ephI, mac('g'^~ephI, h(~protoKey))> )
     ]
    variants (modulo AC)
    1. pkI   = pkI.23
       pkR   = pkR.24
       z     = fst(pkI.23)
       z.1   = fst(pkR.24)
    
    2. pkI   = pkI.53
       pkR   = <z.57, x.96>
       z     = fst(pkI.53)
       z.1   = z.57
    
    3. pkI   = <z.56, x.96>
       pkR   = pkR.54
       z     = z.56
       z.1   = fst(pkR.54)
    
    4. pkI   = <z.58, x.99>
       pkR   = <z.59, x.100>
       z     = z.58
       z.1   = z.59
  */

rule (modulo E) Responder_recvChal:
   [
   ResponderListen( <'g'^~ltkR, pk(~ltkR)>, ~ltkR, ~ephR, ~protoKey,
                    ~sid
   ),
   In( <'g'^ephI, mac('g'^ephI, h(~protoKey))> )
   ]
  --[
  SessionID( ~sid ), SessionEphInitiator( ~sid, 'g'^ephI ),
  DHPubkey( fst(<'g'^~ltkR, pk(~ltkR)>) ), DHPubkey( 'g'^ephI ),
  DHPubkey( 'g'^~ephR )
  ]->
   [
   Responder_chalSent( ~ltkR, ~ephR, 'g'^ephI, ~protoKey, ~sid ),
   Out( <'g'^~ephR, mac('g'^~ephR, h(<'g'^ephI^~ephR, ~protoKey>))> )
   ]

  /*
  rule (modulo AC) Responder_recvChal:
     [
     ResponderListen( <'g'^~ltkR, pk(~ltkR)>, ~ltkR, ~ephR, ~protoKey,
                      ~sid
     ),
     In( <z, mac(z, h(~protoKey))> )
     ]
    --[
    SessionID( ~sid ), SessionEphInitiator( ~sid, z ),
    DHPubkey( 'g'^~ltkR ), DHPubkey( z ), DHPubkey( 'g'^~ephR )
    ]->
     [
     Responder_chalSent( ~ltkR, ~ephR, z, ~protoKey, ~sid ),
     Out( <'g'^~ephR, mac('g'^~ephR, h(<z.1, ~protoKey>))> )
     ]
    variants (modulo AC)
    1. ~ephR = ~ephR.18
       z     = 'g'
       z.1   = 'g'^~ephR.18
    
    2. ~ephR = ~ephR.18
       z     = 'g'^inv(~ephR.18)
       z.1   = 'g'
    
    3. ~ephR = ~ephR.124
       z     = 'g'^ephI.246
       z.1   = 'g'^(~ephR.124*ephI.246)
    
    4. ~ephR = ~ephR.125
       z     = 'g'^inv((~ephR.125*x.248))
       z.1   = 'g'^inv(x.248)
    
    5. ~ephR = ~ephR.125
       z     = 'g'^(x.248*inv(~ephR.125))
       z.1   = 'g'^x.248
    
    6. ~ephR = ~ephR.126
       z     = 'g'^(x.250*inv((~ephR.126*x.249)))
       z.1   = 'g'^(x.250*inv(x.249))
  */

rule (modulo E) Initiator_recvChal:
   [
   Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkR, pkRed>, ~ltkI,
                       ~ephI, ~protoKey, ~sid
   ),
   In( <'g'^ephR, mac('g'^ephR, h(<'g'^ephR^~ephI, ~protoKey>))> )
   ]
  --[
  SessionID( ~sid ), SessionEphResponder( ~sid, 'g'^ephR ),
  SessionKey( ~sid,
              h(<~protoKey, 'g'^ephR^~ephI, 'g'^ephR^~ltkI, 'g'^~ltkR^~ephI>)
  ),
  SessionAll( ~sid, 'I', <pkIdh, pkIed>, <'g'^~ltkR, pkRed>,
              'g'^~ephI, 'g'^ephR,
              h(<~protoKey, 'g'^ephR^~ephI, 'g'^ephR^~ltkI, 'g'^~ltkR^~ephI>),
              ~protoKey
  ),
  SessionAgreementSet( ~sid, 'I', <pkIdh, pkIed>, <'g'^~ltkR, pkRed>,
                       h(<~protoKey, 'g'^ephR^~ephI, 'g'^ephR^~ltkI, 'g'^~ltkR^~ephI>),
                       ~protoKey
  ),
  DHPubkey( fst(<pkIdh, pkIed>) ),
  DHPubkey( fst(<'g'^~ltkR, pkRed>) ), DHPubkey( 'g'^~ephI ),
  DHPubkey( 'g'^ephR )
  ]->
   [
   Initiator_authSent( <pkIdh, pkIed>, <'g'^~ltkR, pkRed>, ~ltkI,
                       ~ephI, 'g'^ephR, ~protoKey, ~sid
   ),
   SessionKey( ~sid,
               h(<~protoKey, 'g'^ephR^~ephI, 'g'^ephR^~ltkI, 'g'^~ltkR^~ephI>)
   ),
   Out( senc(<<pkIdh, pkIed>, 
              sign(<~protoKey, <'g'^~ltkR, pkRed>, h('g'^ephR^~ephI)>, ~ltkI)>,
             h(<~protoKey, 'g'^ephR^~ephI, 'g'^~ltkR^~ephI>))
   )
   ]

  /*
  rule (modulo AC) Initiator_recvChal:
     [
     Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>, ~ltkI, ~ephI,
                         ~protoKey, ~sid
     ),
     In( <z, mac(z, h(<z.1, ~protoKey>))> )
     ]
    --[
    SessionID( ~sid ), SessionEphResponder( ~sid, z ),
    SessionKey( ~sid, h(<~protoKey, z.1, z.2, 'g'^(~ephI*~x)>) ),
    SessionAll( ~sid, 'I', <pkIdh, pkIed>, <'g'^~x, pkRed>, 'g'^~ephI,
                z, h(<~protoKey, z.1, z.2, 'g'^(~ephI*~x)>), ~protoKey
    ),
    SessionAgreementSet( ~sid, 'I', <pkIdh, pkIed>, <'g'^~x, pkRed>,
                         h(<~protoKey, z.1, z.2, 'g'^(~ephI*~x)>), ~protoKey
    ),
    DHPubkey( pkIdh ), DHPubkey( 'g'^~x ), DHPubkey( 'g'^~ephI ),
    DHPubkey( z )
    ]->
     [
     Initiator_authSent( <pkIdh, pkIed>, <'g'^~x, pkRed>, ~ltkI, ~ephI,
                         z, ~protoKey, ~sid
     ),
     SessionKey( ~sid, h(<~protoKey, z.1, z.2, 'g'^(~ephI*~x)>) ),
     Out( senc(<<pkIdh, pkIed>, 
                sign(<~protoKey, <'g'^~x, pkRed>, h(z.1)>, ~ltkI)>,
               h(<~protoKey, z.1, 'g'^(~ephI*~x)>))
     )
     ]
    variants (modulo AC)
     1. ~ephI = ~ephI.55
        ~ltkI = ~ephI.55
        z     = 'g'^inv(~ephI.55)
        z.1   = 'g'
        z.2   = 'g'
    
     2. ~ephI = ~ephI.55
        ~ltkI = ~ltkI.56
        z     = 'g'
        z.1   = 'g'^~ephI.55
        z.2   = 'g'^~ltkI.56
    
     3. ~ephI = ~ephI.55
        ~ltkI = ~ltkI.56
        z     = 'g'^inv(~ephI.55)
        z.1   = 'g'
        z.2   = 'g'^(~ltkI.56*inv(~ephI.55))
    
     4. ~ephI = ~ephI.55
        ~ltkI = ~ltkI.56
        z     = 'g'^inv(~ltkI.56)
        z.1   = 'g'^(~ephI.55*inv(~ltkI.56))
        z.2   = 'g'
    
     5. ~ephI = ~ephI.55
        ~ltkI = ~ltkI.56
        z     = 'g'^inv((~ephI.55*~ltkI.56))
        z.1   = 'g'^inv(~ltkI.56)
        z.2   = 'g'^inv(~ephI.55)
    
     6. ~ephI = ~ephI.535
        ~ltkI = ~ltkI.536
        z     = 'g'^ephR.1068
        z.1   = 'g'^(~ephI.535*ephR.1068)
        z.2   = 'g'^(~ltkI.536*ephR.1068)
    
     7. ~ephI = ~ephI.536
        ~ltkI = ~ephI.536
        z     = 'g'^inv((~ephI.536*x.1070))
        z.1   = 'g'^inv(x.1070)
        z.2   = 'g'^inv(x.1070)
    
     8. ~ephI = ~ephI.536
        ~ltkI = ~ephI.536
        z     = 'g'^(x.1070*inv(~ephI.536))
        z.1   = 'g'^x.1070
        z.2   = 'g'^x.1070
    
     9. ~ephI = ~ephI.536
        ~ltkI = ~ltkI.537
        z     = 'g'^inv((~ephI.536*x.1070))
        z.1   = 'g'^inv(x.1070)
        z.2   = 'g'^(~ltkI.537*inv((~ephI.536*x.1070)))
    
    10. ~ephI = ~ephI.536
        ~ltkI = ~ltkI.537
        z     = 'g'^inv((~ltkI.537*x.1070))
        z.1   = 'g'^(~ephI.536*inv((~ltkI.537*x.1070)))
        z.2   = 'g'^inv(x.1070)
    
    11. ~ephI = ~ephI.536
        ~ltkI = ~ltkI.537
        z     = 'g'^(x.1070*inv(~ephI.536))
        z.1   = 'g'^x.1070
        z.2   = 'g'^(~ltkI.537*x.1070*inv(~ephI.536))
    
    12. ~ephI = ~ephI.536
        ~ltkI = ~ltkI.537
        z     = 'g'^(x.1070*inv(~ltkI.537))
        z.1   = 'g'^(~ephI.536*x.1070*inv(~ltkI.537))
        z.2   = 'g'^x.1070
    
    13. ~ephI = ~ephI.537
        ~ltkI = ~ephI.537
        z     = 'g'^(x.1072*inv((~ephI.537*x.1071)))
        z.1   = 'g'^(x.1072*inv(x.1071))
        z.2   = 'g'^(x.1072*inv(x.1071))
    
    14. ~ephI = ~ephI.537
        ~ltkI = ~ltkI.538
        z     = 'g'^inv((~ephI.537*~ltkI.538*x.1072))
        z.1   = 'g'^inv((~ltkI.538*x.1072))
        z.2   = 'g'^inv((~ephI.537*x.1072))
    
    15. ~ephI = ~ephI.537
        ~ltkI = ~ltkI.538
        z     = 'g'^(x.1072*inv((~ephI.537*~ltkI.538)))
        z.1   = 'g'^(x.1072*inv(~ltkI.538))
        z.2   = 'g'^(x.1072*inv(~ephI.537))
    
    16. ~ephI = ~ephI.537
        ~ltkI = ~ltkI.538
        z     = 'g'^(x.1072*inv((~ephI.537*x.1071)))
        z.1   = 'g'^(x.1072*inv(x.1071))
        z.2   = 'g'^(~ltkI.538*x.1072*inv((~ephI.537*x.1071)))
    
    17. ~ephI = ~ephI.537
        ~ltkI = ~ltkI.538
        z     = 'g'^(x.1072*inv((~ltkI.538*x.1071)))
        z.1   = 'g'^(~ephI.537*x.1072*inv((~ltkI.538*x.1071)))
        z.2   = 'g'^(x.1072*inv(x.1071))
    
    18. ~ephI = ~ephI.538
        ~ltkI = ~ltkI.539
        z     = 'g'^(x.1074*inv((~ephI.538*~ltkI.539*x.1073)))
        z.1   = 'g'^(x.1074*inv((~ltkI.539*x.1073)))
        z.2   = 'g'^(x.1074*inv((~ephI.538*x.1073)))
  */

rule (modulo E) Responder_recvAuth:
   [
   Responder_chalSent( ~ltkR, ~ephR, 'g'^ephI, ~protoKey, ~sid ),
   In( senc(<<'g'^ltkI, pk(ltkI)>, 
             sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, h('g'^ephI^~ephR)>, ltkI)
            >,
            h(<~protoKey, 'g'^ephI^~ephR, 'g'^ephI^~ltkR>))
   )
   ]
  --[
  SessionID( ~sid ), SessionInitiator( ~sid, <'g'^ltkI, pk(ltkI)> ),
  SessionKey( ~sid,
              h(<~protoKey, 'g'^ephI^~ephR, 'g'^ltkI^~ephR, 'g'^ephI^~ltkR>)
  ),
  SessionAll( ~sid, 'R', <'g'^ltkI, pk(ltkI)>,
              <'g'^~ltkR, pk(~ltkR)>, 'g'^ephI, 'g'^~ephR,
              h(<~protoKey, 'g'^ephI^~ephR, 'g'^ltkI^~ephR, 'g'^ephI^~ltkR>),
              ~protoKey
  ),
  SessionAccept( ~sid ),
  SessionAgreementSet( ~sid, 'R', <'g'^ltkI, pk(ltkI)>,
                       <'g'^~ltkR, pk(~ltkR)>,
                       h(<~protoKey, 'g'^ephI^~ephR, 'g'^ltkI^~ephR, 'g'^ephI^~ltkR>),
                       ~protoKey
  ),
  SessionPeer( ~sid, <'g'^ltkI, pk(ltkI)> ),
  DHPubkey( fst(<'g'^ltkI, pk(ltkI)>) ),
  DHPubkey( fst(<'g'^~ltkR, pk(~ltkR)>) ), DHPubkey( 'g'^ephI ),
  DHPubkey( 'g'^~ephR )
  ]->
   [
   Out( senc(sign(<~protoKey, 
                   <<'g'^ltkI, pk(ltkI)>, 
                    sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, h('g'^ephI^~ephR)>, ltkI)
                   >, 
                   h('g'^ephI^~ephR)>,
                  ~ltkR),
             h(<~protoKey, 'g'^ephI^~ephR, 'g'^ltkI^~ephR, 'g'^ephI^~ltkR>))
   ),
   SessionKey( ~sid,
               h(<~protoKey, 'g'^ephI^~ephR, 'g'^ltkI^~ephR, 'g'^ephI^~ltkR>)
   )
   ]

  /*
  rule (modulo AC) Responder_recvAuth:
     [
     Responder_chalSent( ~ltkR, ~ephR, z, ~protoKey, ~sid ),
     In( senc(<<z.1, pk(ltkI)>, 
               sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, h(z.2)>, ltkI)>,
              h(<~protoKey, z.2, z.3>))
     )
     ]
    --[
    SessionID( ~sid ), SessionInitiator( ~sid, <z.1, pk(ltkI)> ),
    SessionKey( ~sid, h(<~protoKey, z.2, z.4, z.3>) ),
    SessionAll( ~sid, 'R', <z.1, pk(ltkI)>, <'g'^~ltkR, pk(~ltkR)>, z,
                'g'^~ephR, h(<~protoKey, z.2, z.4, z.3>), ~protoKey
    ),
    SessionAccept( ~sid ),
    SessionAgreementSet( ~sid, 'R', <z.1, pk(ltkI)>,
                         <'g'^~ltkR, pk(~ltkR)>, h(<~protoKey, z.2, z.4, z.3>), ~protoKey
    ),
    SessionPeer( ~sid, <z.1, pk(ltkI)> ), DHPubkey( z.1 ),
    DHPubkey( 'g'^~ltkR ), DHPubkey( z ), DHPubkey( 'g'^~ephR )
    ]->
     [
     Out( senc(sign(<~protoKey, 
                     <<z.1, pk(ltkI)>, 
                      sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, h(z.2)>, ltkI)>, 
                     h(z.2)>,
                    ~ltkR),
               h(<~protoKey, z.2, z.4, z.3>))
     ),
     SessionKey( ~sid, h(<~protoKey, z.2, z.4, z.3>) )
     ]
    variants (modulo AC)
      1. ~ephR = ~ephR.14
         ~ltkR = ~ephR.14
         ltkI  = inv(~ephR.14)
         z     = 'g'^inv(~ephR.14)
         z.1   = 'g'^inv(~ephR.14)
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'
    
      2. ~ephR = ~ephR.14
         ~ltkR = ~ephR.14
         ltkI  = one
         z     = 'g'^inv(~ephR.14)
         z.1   = 'g'
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'^~ephR.14
    
      3. ~ephR = ~ephR.15
         ~ltkR = ~ltkR.16
         ltkI  = inv(~ephR.15)
         z     = 'g'
         z.1   = 'g'^inv(~ephR.15)
         z.2   = 'g'^~ephR.15
         z.3   = 'g'^~ltkR.16
         z.4   = 'g'
    
      4. ~ephR = ~ephR.15
         ~ltkR = ~ltkR.16
         ltkI  = inv(~ephR.15)
         z     = 'g'^inv(~ephR.15)
         z.1   = 'g'^inv(~ephR.15)
         z.2   = 'g'
         z.3   = 'g'^(~ltkR.16*inv(~ephR.15))
         z.4   = 'g'
    
      5. ~ephR = ~ephR.15
         ~ltkR = ~ltkR.16
         ltkI  = inv(~ephR.15)
         z     = 'g'^inv(~ltkR.16)
         z.1   = 'g'^inv(~ephR.15)
         z.2   = 'g'^(~ephR.15*inv(~ltkR.16))
         z.3   = 'g'
         z.4   = 'g'
    
      6. ~ephR = ~ephR.15
         ~ltkR = ~ltkR.16
         ltkI  = inv(~ephR.15)
         z     = 'g'^inv((~ephR.15*~ltkR.16))
         z.1   = 'g'^inv(~ephR.15)
         z.2   = 'g'^inv(~ltkR.16)
         z.3   = 'g'^inv(~ephR.15)
         z.4   = 'g'
    
      7. ~ephR = ~ephR.15
         ~ltkR = ~ltkR.16
         ltkI  = one
         z     = 'g'
         z.1   = 'g'
         z.2   = 'g'^~ephR.15
         z.3   = 'g'^~ltkR.16
         z.4   = 'g'^~ephR.15
    
      8. ~ephR = ~ephR.15
         ~ltkR = ~ltkR.16
         ltkI  = one
         z     = 'g'^inv(~ephR.15)
         z.1   = 'g'
         z.2   = 'g'
         z.3   = 'g'^(~ltkR.16*inv(~ephR.15))
         z.4   = 'g'^~ephR.15
    
      9. ~ephR = ~ephR.15
         ~ltkR = ~ltkR.16
         ltkI  = one
         z     = 'g'^inv(~ltkR.16)
         z.1   = 'g'
         z.2   = 'g'^(~ephR.15*inv(~ltkR.16))
         z.3   = 'g'
         z.4   = 'g'^~ephR.15
    
     10. ~ephR = ~ephR.15
         ~ltkR = ~ltkR.16
         ltkI  = one
         z     = 'g'^inv((~ephR.15*~ltkR.16))
         z.1   = 'g'
         z.2   = 'g'^inv(~ltkR.16)
         z.3   = 'g'^inv(~ephR.15)
         z.4   = 'g'^~ephR.15
    
     11. ~ephR = ~ephR.19
         ~ltkR = ~ephR.19
         ltkI  = ltkI.24
         z     = 'g'^inv(~ephR.19)
         z.1   = 'g'^ltkI.24
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'^(~ephR.19*ltkI.24)
    
     12. ~ephR = ~ephR.19
         ~ltkR = ~ltkR.20
         ltkI  = ltkI.24
         z     = 'g'
         z.1   = 'g'^ltkI.24
         z.2   = 'g'^~ephR.19
         z.3   = 'g'^~ltkR.20
         z.4   = 'g'^(~ephR.19*ltkI.24)
    
     13. ~ephR = ~ephR.19
         ~ltkR = ~ltkR.20
         ltkI  = ltkI.24
         z     = 'g'^inv(~ephR.19)
         z.1   = 'g'^ltkI.24
         z.2   = 'g'
         z.3   = 'g'^(~ltkR.20*inv(~ephR.19))
         z.4   = 'g'^(~ephR.19*ltkI.24)
    
     14. ~ephR = ~ephR.19
         ~ltkR = ~ltkR.20
         ltkI  = ltkI.24
         z     = 'g'^inv(~ltkR.20)
         z.1   = 'g'^ltkI.24
         z.2   = 'g'^(~ephR.19*inv(~ltkR.20))
         z.3   = 'g'
         z.4   = 'g'^(~ephR.19*ltkI.24)
    
     15. ~ephR = ~ephR.19
         ~ltkR = ~ltkR.20
         ltkI  = ltkI.24
         z     = 'g'^inv((~ephR.19*~ltkR.20))
         z.1   = 'g'^ltkI.24
         z.2   = 'g'^inv(~ltkR.20)
         z.3   = 'g'^inv(~ephR.19)
         z.4   = 'g'^(~ephR.19*ltkI.24)
    
     16. ~ephR = ~ephR.288
         ~ltkR = ~ltkR.289
         ltkI  = ltkI.293
         z     = 'g'^ephI.574
         z.1   = 'g'^ltkI.293
         z.2   = 'g'^(~ephR.288*ephI.574)
         z.3   = 'g'^(~ltkR.289*ephI.574)
         z.4   = 'g'^(~ephR.288*ltkI.293)
    
     17. ~ephR = ~ephR.288
         ~ltkR = ~ltkR.289
         ltkI  = one
         z     = 'g'^ephI.574
         z.1   = 'g'
         z.2   = 'g'^(~ephR.288*ephI.574)
         z.3   = 'g'^(~ltkR.289*ephI.574)
         z.4   = 'g'^~ephR.288
    
     18. ~ephR = ~ephR.289
         ~ltkR = ~ephR.289
         ltkI  = ltkI.294
         z     = 'g'^inv((~ephR.289*x.576))
         z.1   = 'g'^ltkI.294
         z.2   = 'g'^inv(x.576)
         z.3   = 'g'^inv(x.576)
         z.4   = 'g'^(~ephR.289*ltkI.294)
    
     19. ~ephR = ~ephR.289
         ~ltkR = ~ephR.289
         ltkI  = ltkI.294
         z     = 'g'^(x.576*inv(~ephR.289))
         z.1   = 'g'^ltkI.294
         z.2   = 'g'^x.576
         z.3   = 'g'^x.576
         z.4   = 'g'^(~ephR.289*ltkI.294)
    
     20. ~ephR = ~ephR.289
         ~ltkR = ~ephR.289
         ltkI  = inv(~ephR.289)
         z     = 'g'^inv((~ephR.289*x.576))
         z.1   = 'g'^inv(~ephR.289)
         z.2   = 'g'^inv(x.576)
         z.3   = 'g'^inv(x.576)
         z.4   = 'g'
    
     21. ~ephR = ~ephR.289
         ~ltkR = ~ephR.289
         ltkI  = inv(~ephR.289)
         z     = 'g'^(x.576*inv(~ephR.289))
         z.1   = 'g'^inv(~ephR.289)
         z.2   = 'g'^x.576
         z.3   = 'g'^x.576
         z.4   = 'g'
    
     22. ~ephR = ~ephR.289
         ~ltkR = ~ephR.289
         ltkI  = inv((~ephR.289*x.576))
         z     = 'g'^inv(~ephR.289)
         z.1   = 'g'^inv((~ephR.289*x.576))
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'^inv(x.576)
    
     23. ~ephR = ~ephR.289
         ~ltkR = ~ephR.289
         ltkI  = one
         z     = 'g'^inv((~ephR.289*x.576))
         z.1   = 'g'
         z.2   = 'g'^inv(x.576)
         z.3   = 'g'^inv(x.576)
         z.4   = 'g'^~ephR.289
    
     24. ~ephR = ~ephR.289
         ~ltkR = ~ephR.289
         ltkI  = one
         z     = 'g'^(x.576*inv(~ephR.289))
         z.1   = 'g'
         z.2   = 'g'^x.576
         z.3   = 'g'^x.576
         z.4   = 'g'^~ephR.289
    
     25. ~ephR = ~ephR.289
         ~ltkR = ~ephR.289
         ltkI  = (x.576*inv(~ephR.289))
         z     = 'g'^inv(~ephR.289)
         z.1   = 'g'^(x.576*inv(~ephR.289))
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'^x.576
    
     26. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = ltkI.294
         z     = 'g'^inv((~ephR.289*x.576))
         z.1   = 'g'^ltkI.294
         z.2   = 'g'^inv(x.576)
         z.3   = 'g'^(~ltkR.290*inv((~ephR.289*x.576)))
         z.4   = 'g'^(~ephR.289*ltkI.294)
    
     27. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = ltkI.294
         z     = 'g'^inv((~ltkR.290*x.576))
         z.1   = 'g'^ltkI.294
         z.2   = 'g'^(~ephR.289*inv((~ltkR.290*x.576)))
         z.3   = 'g'^inv(x.576)
         z.4   = 'g'^(~ephR.289*ltkI.294)
    
     28. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = ltkI.294
         z     = 'g'^(x.576*inv(~ephR.289))
         z.1   = 'g'^ltkI.294
         z.2   = 'g'^x.576
         z.3   = 'g'^(~ltkR.290*x.576*inv(~ephR.289))
         z.4   = 'g'^(~ephR.289*ltkI.294)
    
     29. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = ltkI.294
         z     = 'g'^(x.576*inv(~ltkR.290))
         z.1   = 'g'^ltkI.294
         z.2   = 'g'^(~ephR.289*x.576*inv(~ltkR.290))
         z.3   = 'g'^x.576
         z.4   = 'g'^(~ephR.289*ltkI.294)
    
     30. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = inv(~ephR.289)
         z     = 'g'^ephI.576
         z.1   = 'g'^inv(~ephR.289)
         z.2   = 'g'^(~ephR.289*ephI.576)
         z.3   = 'g'^(~ltkR.290*ephI.576)
         z.4   = 'g'
    
     31. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = inv(~ephR.289)
         z     = 'g'^inv((~ephR.289*x.576))
         z.1   = 'g'^inv(~ephR.289)
         z.2   = 'g'^inv(x.576)
         z.3   = 'g'^(~ltkR.290*inv((~ephR.289*x.576)))
         z.4   = 'g'
    
     32. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = inv(~ephR.289)
         z     = 'g'^(x.576*inv(~ephR.289))
         z.1   = 'g'^inv(~ephR.289)
         z.2   = 'g'^x.576
         z.3   = 'g'^(~ltkR.290*x.576*inv(~ephR.289))
         z.4   = 'g'
    
     33. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = inv((~ephR.289*x.576))
         z     = 'g'
         z.1   = 'g'^inv((~ephR.289*x.576))
         z.2   = 'g'^~ephR.289
         z.3   = 'g'^~ltkR.290
         z.4   = 'g'^inv(x.576)
    
     34. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = inv((~ephR.289*x.576))
         z     = 'g'^inv(~ephR.289)
         z.1   = 'g'^inv((~ephR.289*x.576))
         z.2   = 'g'
         z.3   = 'g'^(~ltkR.290*inv(~ephR.289))
         z.4   = 'g'^inv(x.576)
    
     35. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = one
         z     = 'g'^inv((~ephR.289*x.576))
         z.1   = 'g'
         z.2   = 'g'^inv(x.576)
         z.3   = 'g'^(~ltkR.290*inv((~ephR.289*x.576)))
         z.4   = 'g'^~ephR.289
    
     36. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = one
         z     = 'g'^inv((~ltkR.290*x.576))
         z.1   = 'g'
         z.2   = 'g'^(~ephR.289*inv((~ltkR.290*x.576)))
         z.3   = 'g'^inv(x.576)
         z.4   = 'g'^~ephR.289
    
     37. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = one
         z     = 'g'^(x.576*inv(~ephR.289))
         z.1   = 'g'
         z.2   = 'g'^x.576
         z.3   = 'g'^(~ltkR.290*x.576*inv(~ephR.289))
         z.4   = 'g'^~ephR.289
    
     38. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = one
         z     = 'g'^(x.576*inv(~ltkR.290))
         z.1   = 'g'
         z.2   = 'g'^(~ephR.289*x.576*inv(~ltkR.290))
         z.3   = 'g'^x.576
         z.4   = 'g'^~ephR.289
    
     39. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = (x.576*inv(~ephR.289))
         z     = 'g'
         z.1   = 'g'^(x.576*inv(~ephR.289))
         z.2   = 'g'^~ephR.289
         z.3   = 'g'^~ltkR.290
         z.4   = 'g'^x.576
    
     40. ~ephR = ~ephR.289
         ~ltkR = ~ltkR.290
         ltkI  = (x.576*inv(~ephR.289))
         z     = 'g'^inv(~ephR.289)
         z.1   = 'g'^(x.576*inv(~ephR.289))
         z.2   = 'g'
         z.3   = 'g'^(~ltkR.290*inv(~ephR.289))
         z.4   = 'g'^x.576
    
     41. ~ephR = ~ephR.290
         ~ltkR = ~ephR.290
         ltkI  = ltkI.295
         z     = 'g'^(x.578*inv((~ephR.290*x.577)))
         z.1   = 'g'^ltkI.295
         z.2   = 'g'^(x.578*inv(x.577))
         z.3   = 'g'^(x.578*inv(x.577))
         z.4   = 'g'^(~ephR.290*ltkI.295)
    
     42. ~ephR = ~ephR.290
         ~ltkR = ~ephR.290
         ltkI  = inv(~ephR.290)
         z     = 'g'^(x.578*inv((~ephR.290*x.577)))
         z.1   = 'g'^inv(~ephR.290)
         z.2   = 'g'^(x.578*inv(x.577))
         z.3   = 'g'^(x.578*inv(x.577))
         z.4   = 'g'
    
     43. ~ephR = ~ephR.290
         ~ltkR = ~ephR.290
         ltkI  = inv((~ephR.290*x.577))
         z     = 'g'^(x.578*inv(~ephR.290))
         z.1   = 'g'^inv((~ephR.290*x.577))
         z.2   = 'g'^x.578
         z.3   = 'g'^x.578
         z.4   = 'g'^inv(x.577)
    
     44. ~ephR = ~ephR.290
         ~ltkR = ~ephR.290
         ltkI  = inv((~ephR.290*x.578))
         z     = 'g'^inv((~ephR.290*x.577))
         z.1   = 'g'^inv((~ephR.290*x.578))
         z.2   = 'g'^inv(x.577)
         z.3   = 'g'^inv(x.577)
         z.4   = 'g'^inv(x.578)
    
     45. ~ephR = ~ephR.290
         ~ltkR = ~ephR.290
         ltkI  = one
         z     = 'g'^(x.578*inv((~ephR.290*x.577)))
         z.1   = 'g'
         z.2   = 'g'^(x.578*inv(x.577))
         z.3   = 'g'^(x.578*inv(x.577))
         z.4   = 'g'^~ephR.290
    
     46. ~ephR = ~ephR.290
         ~ltkR = ~ephR.290
         ltkI  = (x.578*inv(~ephR.290))
         z     = 'g'^inv((~ephR.290*x.577))
         z.1   = 'g'^(x.578*inv(~ephR.290))
         z.2   = 'g'^inv(x.577)
         z.3   = 'g'^inv(x.577)
         z.4   = 'g'^x.578
    
     47. ~ephR = ~ephR.290
         ~ltkR = ~ephR.290
         ltkI  = (x.578*inv(~ephR.290))
         z     = 'g'^(x.577*inv(~ephR.290))
         z.1   = 'g'^(x.578*inv(~ephR.290))
         z.2   = 'g'^x.577
         z.3   = 'g'^x.577
         z.4   = 'g'^x.578
    
     48. ~ephR = ~ephR.290
         ~ltkR = ~ephR.290
         ltkI  = (x.578*inv((~ephR.290*x.577)))
         z     = 'g'^inv(~ephR.290)
         z.1   = 'g'^(x.578*inv((~ephR.290*x.577)))
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'^(x.578*inv(x.577))
    
     49. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = ltkI.295
         z     = 'g'^inv((~ephR.290*~ltkR.291*x.578))
         z.1   = 'g'^ltkI.295
         z.2   = 'g'^inv((~ltkR.291*x.578))
         z.3   = 'g'^inv((~ephR.290*x.578))
         z.4   = 'g'^(~ephR.290*ltkI.295)
    
     50. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = ltkI.295
         z     = 'g'^(x.578*inv((~ephR.290*~ltkR.291)))
         z.1   = 'g'^ltkI.295
         z.2   = 'g'^(x.578*inv(~ltkR.291))
         z.3   = 'g'^(x.578*inv(~ephR.290))
         z.4   = 'g'^(~ephR.290*ltkI.295)
    
     51. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = ltkI.295
         z     = 'g'^(x.578*inv((~ephR.290*x.577)))
         z.1   = 'g'^ltkI.295
         z.2   = 'g'^(x.578*inv(x.577))
         z.3   = 'g'^(~ltkR.291*x.578*inv((~ephR.290*x.577)))
         z.4   = 'g'^(~ephR.290*ltkI.295)
    
     52. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = ltkI.295
         z     = 'g'^(x.578*inv((~ltkR.291*x.577)))
         z.1   = 'g'^ltkI.295
         z.2   = 'g'^(~ephR.290*x.578*inv((~ltkR.291*x.577)))
         z.3   = 'g'^(x.578*inv(x.577))
         z.4   = 'g'^(~ephR.290*ltkI.295)
    
     53. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = inv(~ephR.290)
         z     = 'g'^inv((~ephR.290*~ltkR.291*x.578))
         z.1   = 'g'^inv(~ephR.290)
         z.2   = 'g'^inv((~ltkR.291*x.578))
         z.3   = 'g'^inv((~ephR.290*x.578))
         z.4   = 'g'
    
     54. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = inv(~ephR.290)
         z     = 'g'^inv((~ltkR.291*x.578))
         z.1   = 'g'^inv(~ephR.290)
         z.2   = 'g'^(~ephR.290*inv((~ltkR.291*x.578)))
         z.3   = 'g'^inv(x.578)
         z.4   = 'g'
    
     55. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = inv(~ephR.290)
         z     = 'g'^(x.578*inv(~ltkR.291))
         z.1   = 'g'^inv(~ephR.290)
         z.2   = 'g'^(~ephR.290*x.578*inv(~ltkR.291))
         z.3   = 'g'^x.578
         z.4   = 'g'
    
     56. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = inv(~ephR.290)
         z     = 'g'^(x.578*inv((~ephR.290*~ltkR.291)))
         z.1   = 'g'^inv(~ephR.290)
         z.2   = 'g'^(x.578*inv(~ltkR.291))
         z.3   = 'g'^(x.578*inv(~ephR.290))
         z.4   = 'g'
    
     57. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = inv(~ephR.290)
         z     = 'g'^(x.578*inv((~ephR.290*x.577)))
         z.1   = 'g'^inv(~ephR.290)
         z.2   = 'g'^(x.578*inv(x.577))
         z.3   = 'g'^(~ltkR.291*x.578*inv((~ephR.290*x.577)))
         z.4   = 'g'
    
     58. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = inv((~ephR.290*x.577))
         z     = 'g'^ephI.578
         z.1   = 'g'^inv((~ephR.290*x.577))
         z.2   = 'g'^(~ephR.290*ephI.578)
         z.3   = 'g'^(~ltkR.291*ephI.578)
         z.4   = 'g'^inv(x.577)
    
     59. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = inv((~ephR.290*x.577))
         z     = 'g'^(x.578*inv(~ephR.290))
         z.1   = 'g'^inv((~ephR.290*x.577))
         z.2   = 'g'^x.578
         z.3   = 'g'^(~ltkR.291*x.578*inv(~ephR.290))
         z.4   = 'g'^inv(x.577)
    
     60. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = inv((~ephR.290*x.578))
         z     = 'g'^inv(~ltkR.291)
         z.1   = 'g'^inv((~ephR.290*x.578))
         z.2   = 'g'^(~ephR.290*inv(~ltkR.291))
         z.3   = 'g'
         z.4   = 'g'^inv(x.578)
    
     61. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = inv((~ephR.290*x.578))
         z     = 'g'^inv((~ephR.290*~ltkR.291))
         z.1   = 'g'^inv((~ephR.290*x.578))
         z.2   = 'g'^inv(~ltkR.291)
         z.3   = 'g'^inv(~ephR.290)
         z.4   = 'g'^inv(x.578)
    
     62. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = inv((~ephR.290*x.578))
         z     = 'g'^inv((~ephR.290*x.577))
         z.1   = 'g'^inv((~ephR.290*x.578))
         z.2   = 'g'^inv(x.577)
         z.3   = 'g'^(~ltkR.291*inv((~ephR.290*x.577)))
         z.4   = 'g'^inv(x.578)
    
     63. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = one
         z     = 'g'^inv((~ephR.290*~ltkR.291*x.578))
         z.1   = 'g'
         z.2   = 'g'^inv((~ltkR.291*x.578))
         z.3   = 'g'^inv((~ephR.290*x.578))
         z.4   = 'g'^~ephR.290
    
     64. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = one
         z     = 'g'^(x.578*inv((~ephR.290*~ltkR.291)))
         z.1   = 'g'
         z.2   = 'g'^(x.578*inv(~ltkR.291))
         z.3   = 'g'^(x.578*inv(~ephR.290))
         z.4   = 'g'^~ephR.290
    
     65. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = one
         z     = 'g'^(x.578*inv((~ephR.290*x.577)))
         z.1   = 'g'
         z.2   = 'g'^(x.578*inv(x.577))
         z.3   = 'g'^(~ltkR.291*x.578*inv((~ephR.290*x.577)))
         z.4   = 'g'^~ephR.290
    
     66. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = one
         z     = 'g'^(x.578*inv((~ltkR.291*x.577)))
         z.1   = 'g'
         z.2   = 'g'^(~ephR.290*x.578*inv((~ltkR.291*x.577)))
         z.3   = 'g'^(x.578*inv(x.577))
         z.4   = 'g'^~ephR.290
    
     67. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = (x.577*inv(~ephR.290))
         z     = 'g'^ephI.578
         z.1   = 'g'^(x.577*inv(~ephR.290))
         z.2   = 'g'^(~ephR.290*ephI.578)
         z.3   = 'g'^(~ltkR.291*ephI.578)
         z.4   = 'g'^x.577
    
     68. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = (x.578*inv(~ephR.290))
         z     = 'g'^inv(~ltkR.291)
         z.1   = 'g'^(x.578*inv(~ephR.290))
         z.2   = 'g'^(~ephR.290*inv(~ltkR.291))
         z.3   = 'g'
         z.4   = 'g'^x.578
    
     69. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = (x.578*inv(~ephR.290))
         z     = 'g'^inv((~ephR.290*~ltkR.291))
         z.1   = 'g'^(x.578*inv(~ephR.290))
         z.2   = 'g'^inv(~ltkR.291)
         z.3   = 'g'^inv(~ephR.290)
         z.4   = 'g'^x.578
    
     70. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = (x.578*inv(~ephR.290))
         z     = 'g'^inv((~ephR.290*x.577))
         z.1   = 'g'^(x.578*inv(~ephR.290))
         z.2   = 'g'^inv(x.577)
         z.3   = 'g'^(~ltkR.291*inv((~ephR.290*x.577)))
         z.4   = 'g'^x.578
    
     71. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = (x.578*inv(~ephR.290))
         z     = 'g'^(x.577*inv(~ephR.290))
         z.1   = 'g'^(x.578*inv(~ephR.290))
         z.2   = 'g'^x.577
         z.3   = 'g'^(~ltkR.291*x.577*inv(~ephR.290))
         z.4   = 'g'^x.578
    
     72. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = (x.578*inv((~ephR.290*x.577)))
         z     = 'g'
         z.1   = 'g'^(x.578*inv((~ephR.290*x.577)))
         z.2   = 'g'^~ephR.290
         z.3   = 'g'^~ltkR.291
         z.4   = 'g'^(x.578*inv(x.577))
    
     73. ~ephR = ~ephR.290
         ~ltkR = ~ltkR.291
         ltkI  = (x.578*inv((~ephR.290*x.577)))
         z     = 'g'^inv(~ephR.290)
         z.1   = 'g'^(x.578*inv((~ephR.290*x.577)))
         z.2   = 'g'
         z.3   = 'g'^(~ltkR.291*inv(~ephR.290))
         z.4   = 'g'^(x.578*inv(x.577))
    
     74. ~ephR = ~ephR.291
         ~ltkR = ~ephR.291
         ltkI  = inv((~ephR.291*x.578))
         z     = 'g'^(x.580*inv((~ephR.291*x.579)))
         z.1   = 'g'^inv((~ephR.291*x.578))
         z.2   = 'g'^(x.580*inv(x.579))
         z.3   = 'g'^(x.580*inv(x.579))
         z.4   = 'g'^inv(x.578)
    
     75. ~ephR = ~ephR.291
         ~ltkR = ~ephR.291
         ltkI  = (x.580*inv(~ephR.291))
         z     = 'g'^(x.579*inv((~ephR.291*x.578)))
         z.1   = 'g'^(x.580*inv(~ephR.291))
         z.2   = 'g'^(x.579*inv(x.578))
         z.3   = 'g'^(x.579*inv(x.578))
         z.4   = 'g'^x.580
    
     76. ~ephR = ~ephR.291
         ~ltkR = ~ephR.291
         ltkI  = (x.580*inv((~ephR.291*x.578)))
         z     = 'g'^(x.579*inv(~ephR.291))
         z.1   = 'g'^(x.580*inv((~ephR.291*x.578)))
         z.2   = 'g'^x.579
         z.3   = 'g'^x.579
         z.4   = 'g'^(x.580*inv(x.578))
    
     77. ~ephR = ~ephR.291
         ~ltkR = ~ephR.291
         ltkI  = (x.580*inv((~ephR.291*x.579)))
         z     = 'g'^inv((~ephR.291*x.578))
         z.1   = 'g'^(x.580*inv((~ephR.291*x.579)))
         z.2   = 'g'^inv(x.578)
         z.3   = 'g'^inv(x.578)
         z.4   = 'g'^(x.580*inv(x.579))
    
     78. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = ltkI.296
         z     = 'g'^(x.580*inv((~ephR.291*~ltkR.292*x.579)))
         z.1   = 'g'^ltkI.296
         z.2   = 'g'^(x.580*inv((~ltkR.292*x.579)))
         z.3   = 'g'^(x.580*inv((~ephR.291*x.579)))
         z.4   = 'g'^(~ephR.291*ltkI.296)
    
     79. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = inv(~ephR.291)
         z     = 'g'^(x.580*inv((~ephR.291*~ltkR.292*x.579)))
         z.1   = 'g'^inv(~ephR.291)
         z.2   = 'g'^(x.580*inv((~ltkR.292*x.579)))
         z.3   = 'g'^(x.580*inv((~ephR.291*x.579)))
         z.4   = 'g'
    
     80. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = inv(~ephR.291)
         z     = 'g'^(x.580*inv((~ltkR.292*x.579)))
         z.1   = 'g'^inv(~ephR.291)
         z.2   = 'g'^(~ephR.291*x.580*inv((~ltkR.292*x.579)))
         z.3   = 'g'^(x.580*inv(x.579))
         z.4   = 'g'
    
     81. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = inv((~ephR.291*x.578))
         z     = 'g'^(x.580*inv((~ephR.291*x.579)))
         z.1   = 'g'^inv((~ephR.291*x.578))
         z.2   = 'g'^(x.580*inv(x.579))
         z.3   = 'g'^(~ltkR.292*x.580*inv((~ephR.291*x.579)))
         z.4   = 'g'^inv(x.578)
    
     82. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = inv((~ephR.291*x.579))
         z     = 'g'^(x.580*inv(~ltkR.292))
         z.1   = 'g'^inv((~ephR.291*x.579))
         z.2   = 'g'^(~ephR.291*x.580*inv(~ltkR.292))
         z.3   = 'g'^x.580
         z.4   = 'g'^inv(x.579)
    
     83. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = inv((~ephR.291*x.579))
         z     = 'g'^(x.580*inv((~ephR.291*~ltkR.292)))
         z.1   = 'g'^inv((~ephR.291*x.579))
         z.2   = 'g'^(x.580*inv(~ltkR.292))
         z.3   = 'g'^(x.580*inv(~ephR.291))
         z.4   = 'g'^inv(x.579)
    
     84. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = inv((~ephR.291*x.580))
         z     = 'g'^inv((~ephR.291*~ltkR.292*x.579))
         z.1   = 'g'^inv((~ephR.291*x.580))
         z.2   = 'g'^inv((~ltkR.292*x.579))
         z.3   = 'g'^inv((~ephR.291*x.579))
         z.4   = 'g'^inv(x.580)
    
     85. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = inv((~ephR.291*x.580))
         z     = 'g'^inv((~ltkR.292*x.579))
         z.1   = 'g'^inv((~ephR.291*x.580))
         z.2   = 'g'^(~ephR.291*inv((~ltkR.292*x.579)))
         z.3   = 'g'^inv(x.579)
         z.4   = 'g'^inv(x.580)
    
     86. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = one
         z     = 'g'^(x.580*inv((~ephR.291*~ltkR.292*x.579)))
         z.1   = 'g'
         z.2   = 'g'^(x.580*inv((~ltkR.292*x.579)))
         z.3   = 'g'^(x.580*inv((~ephR.291*x.579)))
         z.4   = 'g'^~ephR.291
    
     87. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = (x.579*inv((~ephR.291*x.578)))
         z     = 'g'^ephI.580
         z.1   = 'g'^(x.579*inv((~ephR.291*x.578)))
         z.2   = 'g'^(~ephR.291*ephI.580)
         z.3   = 'g'^(~ltkR.292*ephI.580)
         z.4   = 'g'^(x.579*inv(x.578))
    
     88. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = (x.580*inv(~ephR.291))
         z     = 'g'^inv((~ephR.291*~ltkR.292*x.579))
         z.1   = 'g'^(x.580*inv(~ephR.291))
         z.2   = 'g'^inv((~ltkR.292*x.579))
         z.3   = 'g'^inv((~ephR.291*x.579))
         z.4   = 'g'^x.580
    
     89. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = (x.580*inv(~ephR.291))
         z     = 'g'^inv((~ltkR.292*x.579))
         z.1   = 'g'^(x.580*inv(~ephR.291))
         z.2   = 'g'^(~ephR.291*inv((~ltkR.292*x.579)))
         z.3   = 'g'^inv(x.579)
         z.4   = 'g'^x.580
    
     90. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = (x.580*inv(~ephR.291))
         z     = 'g'^(x.579*inv(~ltkR.292))
         z.1   = 'g'^(x.580*inv(~ephR.291))
         z.2   = 'g'^(~ephR.291*x.579*inv(~ltkR.292))
         z.3   = 'g'^x.579
         z.4   = 'g'^x.580
    
     91. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = (x.580*inv(~ephR.291))
         z     = 'g'^(x.579*inv((~ephR.291*~ltkR.292)))
         z.1   = 'g'^(x.580*inv(~ephR.291))
         z.2   = 'g'^(x.579*inv(~ltkR.292))
         z.3   = 'g'^(x.579*inv(~ephR.291))
         z.4   = 'g'^x.580
    
     92. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = (x.580*inv(~ephR.291))
         z     = 'g'^(x.579*inv((~ephR.291*x.578)))
         z.1   = 'g'^(x.580*inv(~ephR.291))
         z.2   = 'g'^(x.579*inv(x.578))
         z.3   = 'g'^(~ltkR.292*x.579*inv((~ephR.291*x.578)))
         z.4   = 'g'^x.580
    
     93. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = (x.580*inv((~ephR.291*x.578)))
         z     = 'g'^(x.579*inv(~ephR.291))
         z.1   = 'g'^(x.580*inv((~ephR.291*x.578)))
         z.2   = 'g'^x.579
         z.3   = 'g'^(~ltkR.292*x.579*inv(~ephR.291))
         z.4   = 'g'^(x.580*inv(x.578))
    
     94. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = (x.580*inv((~ephR.291*x.579)))
         z     = 'g'^inv(~ltkR.292)
         z.1   = 'g'^(x.580*inv((~ephR.291*x.579)))
         z.2   = 'g'^(~ephR.291*inv(~ltkR.292))
         z.3   = 'g'
         z.4   = 'g'^(x.580*inv(x.579))
    
     95. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = (x.580*inv((~ephR.291*x.579)))
         z     = 'g'^inv((~ephR.291*~ltkR.292))
         z.1   = 'g'^(x.580*inv((~ephR.291*x.579)))
         z.2   = 'g'^inv(~ltkR.292)
         z.3   = 'g'^inv(~ephR.291)
         z.4   = 'g'^(x.580*inv(x.579))
    
     96. ~ephR = ~ephR.291
         ~ltkR = ~ltkR.292
         ltkI  = (x.580*inv((~ephR.291*x.579)))
         z     = 'g'^inv((~ephR.291*x.578))
         z.1   = 'g'^(x.580*inv((~ephR.291*x.579)))
         z.2   = 'g'^inv(x.578)
         z.3   = 'g'^(~ltkR.292*inv((~ephR.291*x.578)))
         z.4   = 'g'^(x.580*inv(x.579))
    
     97. ~ephR = ~ephR.292
         ~ltkR = ~ephR.292
         ltkI  = (x.582*inv((~ephR.292*x.580)))
         z     = 'g'^(x.581*inv((~ephR.292*x.579)))
         z.1   = 'g'^(x.582*inv((~ephR.292*x.580)))
         z.2   = 'g'^(x.581*inv(x.579))
         z.3   = 'g'^(x.581*inv(x.579))
         z.4   = 'g'^(x.582*inv(x.580))
    
     98. ~ephR = ~ephR.292
         ~ltkR = ~ltkR.293
         ltkI  = inv((~ephR.292*x.580))
         z     = 'g'^(x.582*inv((~ephR.292*~ltkR.293*x.581)))
         z.1   = 'g'^inv((~ephR.292*x.580))
         z.2   = 'g'^(x.582*inv((~ltkR.293*x.581)))
         z.3   = 'g'^(x.582*inv((~ephR.292*x.581)))
         z.4   = 'g'^inv(x.580)
    
     99. ~ephR = ~ephR.292
         ~ltkR = ~ltkR.293
         ltkI  = inv((~ephR.292*x.580))
         z     = 'g'^(x.582*inv((~ltkR.293*x.581)))
         z.1   = 'g'^inv((~ephR.292*x.580))
         z.2   = 'g'^(~ephR.292*x.582*inv((~ltkR.293*x.581)))
         z.3   = 'g'^(x.582*inv(x.581))
         z.4   = 'g'^inv(x.580)
    
    100. ~ephR = ~ephR.292
         ~ltkR = ~ltkR.293
         ltkI  = (x.582*inv(~ephR.292))
         z     = 'g'^(x.581*inv((~ephR.292*~ltkR.293*x.580)))
         z.1   = 'g'^(x.582*inv(~ephR.292))
         z.2   = 'g'^(x.581*inv((~ltkR.293*x.580)))
         z.3   = 'g'^(x.581*inv((~ephR.292*x.580)))
         z.4   = 'g'^x.582
    
    101. ~ephR = ~ephR.292
         ~ltkR = ~ltkR.293
         ltkI  = (x.582*inv(~ephR.292))
         z     = 'g'^(x.581*inv((~ltkR.293*x.580)))
         z.1   = 'g'^(x.582*inv(~ephR.292))
         z.2   = 'g'^(~ephR.292*x.581*inv((~ltkR.293*x.580)))
         z.3   = 'g'^(x.581*inv(x.580))
         z.4   = 'g'^x.582
    
    102. ~ephR = ~ephR.292
         ~ltkR = ~ltkR.293
         ltkI  = (x.582*inv((~ephR.292*x.580)))
         z     = 'g'^(x.581*inv(~ltkR.293))
         z.1   = 'g'^(x.582*inv((~ephR.292*x.580)))
         z.2   = 'g'^(~ephR.292*x.581*inv(~ltkR.293))
         z.3   = 'g'^x.581
         z.4   = 'g'^(x.582*inv(x.580))
    
    103. ~ephR = ~ephR.292
         ~ltkR = ~ltkR.293
         ltkI  = (x.582*inv((~ephR.292*x.580)))
         z     = 'g'^(x.581*inv((~ephR.292*~ltkR.293)))
         z.1   = 'g'^(x.582*inv((~ephR.292*x.580)))
         z.2   = 'g'^(x.581*inv(~ltkR.293))
         z.3   = 'g'^(x.581*inv(~ephR.292))
         z.4   = 'g'^(x.582*inv(x.580))
    
    104. ~ephR = ~ephR.292
         ~ltkR = ~ltkR.293
         ltkI  = (x.582*inv((~ephR.292*x.580)))
         z     = 'g'^(x.581*inv((~ephR.292*x.579)))
         z.1   = 'g'^(x.582*inv((~ephR.292*x.580)))
         z.2   = 'g'^(x.581*inv(x.579))
         z.3   = 'g'^(~ltkR.293*x.581*inv((~ephR.292*x.579)))
         z.4   = 'g'^(x.582*inv(x.580))
    
    105. ~ephR = ~ephR.292
         ~ltkR = ~ltkR.293
         ltkI  = (x.582*inv((~ephR.292*x.581)))
         z     = 'g'^inv((~ephR.292*~ltkR.293*x.580))
         z.1   = 'g'^(x.582*inv((~ephR.292*x.581)))
         z.2   = 'g'^inv((~ltkR.293*x.580))
         z.3   = 'g'^inv((~ephR.292*x.580))
         z.4   = 'g'^(x.582*inv(x.581))
    
    106. ~ephR = ~ephR.292
         ~ltkR = ~ltkR.293
         ltkI  = (x.582*inv((~ephR.292*x.581)))
         z     = 'g'^inv((~ltkR.293*x.580))
         z.1   = 'g'^(x.582*inv((~ephR.292*x.581)))
         z.2   = 'g'^(~ephR.292*inv((~ltkR.293*x.580)))
         z.3   = 'g'^inv(x.580)
         z.4   = 'g'^(x.582*inv(x.581))
    
    107. ~ephR = ~ephR.293
         ~ltkR = ~ltkR.294
         ltkI  = (x.584*inv((~ephR.293*x.582)))
         z     = 'g'^(x.583*inv((~ephR.293*~ltkR.294*x.581)))
         z.1   = 'g'^(x.584*inv((~ephR.293*x.582)))
         z.2   = 'g'^(x.583*inv((~ltkR.294*x.581)))
         z.3   = 'g'^(x.583*inv((~ephR.293*x.581)))
         z.4   = 'g'^(x.584*inv(x.582))
    
    108. ~ephR = ~ephR.293
         ~ltkR = ~ltkR.294
         ltkI  = (x.584*inv((~ephR.293*x.582)))
         z     = 'g'^(x.583*inv((~ltkR.294*x.581)))
         z.1   = 'g'^(x.584*inv((~ephR.293*x.582)))
         z.2   = 'g'^(~ephR.293*x.583*inv((~ltkR.294*x.581)))
         z.3   = 'g'^(x.583*inv(x.581))
         z.4   = 'g'^(x.584*inv(x.582))
  */

rule (modulo E) Initiator_recvAuth:
   [
   Initiator_authSent( <'g'^~ltkI, pk(~ltkI)>, <'g'^ltkR, pk(ltkR)>,
                       ~ltkI, ~ephI, 'g'^ephR, ~protoKey, ~sid
   ),
   In( senc(sign(<~protoKey, 
                  <<'g'^~ltkI, pk(~ltkI)>, 
                   sign(<~protoKey, <'g'^ltkR, pk(ltkR)>, h('g'^ephR^~ephI)>, ~ltkI)
                  >, 
                  h('g'^ephR^~ephI)>,
                 ltkR),
            h(<~protoKey, 'g'^ephR^~ephI, 'g'^ephR^~ltkI, 'g'^ltkR^~ephI>))
   )
   ]
  --[
  SessionID( ~sid ), SessionAccept( ~sid ),
  DHPubkey( fst(<'g'^~ltkI, pk(~ltkI)>) ),
  DHPubkey( fst(<'g'^ltkR, pk(ltkR)>) ), DHPubkey( 'g'^~ephI ),
  DHPubkey( 'g'^ephR )
  ]->
   [ ]

  /*
  rule (modulo AC) Initiator_recvAuth:
     [
     Initiator_authSent( <'g'^~ltkI, pk(~ltkI)>, <z, pk(ltkR)>, ~ltkI,
                         ~ephI, z.1, ~protoKey, ~sid
     ),
     In( senc(sign(<~protoKey, 
                    <<'g'^~ltkI, pk(~ltkI)>, 
                     sign(<~protoKey, <z, pk(ltkR)>, h(z.2)>, ~ltkI)>, 
                    h(z.2)>,
                   ltkR),
              h(<~protoKey, z.2, z.3, z.4>))
     )
     ]
    --[
    SessionID( ~sid ), SessionAccept( ~sid ), DHPubkey( 'g'^~ltkI ),
    DHPubkey( z ), DHPubkey( 'g'^~ephI ), DHPubkey( z.1 )
    ]->
     [ ]
    variants (modulo AC)
      1. ~ephI = ~ephI.16
         ~ltkI = ~ephI.16
         ltkR  = inv(~ephI.16)
         z     = 'g'^inv(~ephI.16)
         z.1   = 'g'^inv(~ephI.16)
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'
    
      2. ~ephI = ~ephI.16
         ~ltkI = ~ephI.16
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^inv(~ephI.16)
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'^~ephI.16
    
      3. ~ephI = ~ephI.17
         ~ltkI = ~ltkI.18
         ltkR  = inv(~ephI.17)
         z     = 'g'^inv(~ephI.17)
         z.1   = 'g'
         z.2   = 'g'^~ephI.17
         z.3   = 'g'^~ltkI.18
         z.4   = 'g'
    
      4. ~ephI = ~ephI.17
         ~ltkI = ~ltkI.18
         ltkR  = inv(~ephI.17)
         z     = 'g'^inv(~ephI.17)
         z.1   = 'g'^inv(~ephI.17)
         z.2   = 'g'
         z.3   = 'g'^(~ltkI.18*inv(~ephI.17))
         z.4   = 'g'
    
      5. ~ephI = ~ephI.17
         ~ltkI = ~ltkI.18
         ltkR  = inv(~ephI.17)
         z     = 'g'^inv(~ephI.17)
         z.1   = 'g'^inv(~ltkI.18)
         z.2   = 'g'^(~ephI.17*inv(~ltkI.18))
         z.3   = 'g'
         z.4   = 'g'
    
      6. ~ephI = ~ephI.17
         ~ltkI = ~ltkI.18
         ltkR  = inv(~ephI.17)
         z     = 'g'^inv(~ephI.17)
         z.1   = 'g'^inv((~ephI.17*~ltkI.18))
         z.2   = 'g'^inv(~ltkI.18)
         z.3   = 'g'^inv(~ephI.17)
         z.4   = 'g'
    
      7. ~ephI = ~ephI.17
         ~ltkI = ~ltkI.18
         ltkR  = one
         z     = 'g'
         z.1   = 'g'
         z.2   = 'g'^~ephI.17
         z.3   = 'g'^~ltkI.18
         z.4   = 'g'^~ephI.17
    
      8. ~ephI = ~ephI.17
         ~ltkI = ~ltkI.18
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^inv(~ephI.17)
         z.2   = 'g'
         z.3   = 'g'^(~ltkI.18*inv(~ephI.17))
         z.4   = 'g'^~ephI.17
    
      9. ~ephI = ~ephI.17
         ~ltkI = ~ltkI.18
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^inv(~ltkI.18)
         z.2   = 'g'^(~ephI.17*inv(~ltkI.18))
         z.3   = 'g'
         z.4   = 'g'^~ephI.17
    
     10. ~ephI = ~ephI.17
         ~ltkI = ~ltkI.18
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^inv((~ephI.17*~ltkI.18))
         z.2   = 'g'^inv(~ltkI.18)
         z.3   = 'g'^inv(~ephI.17)
         z.4   = 'g'^~ephI.17
    
     11. ~ephI = ~ephI.21
         ~ltkI = ~ephI.21
         ltkR  = ltkR.26
         z     = 'g'^ltkR.26
         z.1   = 'g'^inv(~ephI.21)
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'^(~ephI.21*ltkR.26)
    
     12. ~ephI = ~ephI.21
         ~ltkI = ~ltkI.22
         ltkR  = ltkR.26
         z     = 'g'^ltkR.26
         z.1   = 'g'
         z.2   = 'g'^~ephI.21
         z.3   = 'g'^~ltkI.22
         z.4   = 'g'^(~ephI.21*ltkR.26)
    
     13. ~ephI = ~ephI.21
         ~ltkI = ~ltkI.22
         ltkR  = ltkR.26
         z     = 'g'^ltkR.26
         z.1   = 'g'^inv(~ephI.21)
         z.2   = 'g'
         z.3   = 'g'^(~ltkI.22*inv(~ephI.21))
         z.4   = 'g'^(~ephI.21*ltkR.26)
    
     14. ~ephI = ~ephI.21
         ~ltkI = ~ltkI.22
         ltkR  = ltkR.26
         z     = 'g'^ltkR.26
         z.1   = 'g'^inv(~ltkI.22)
         z.2   = 'g'^(~ephI.21*inv(~ltkI.22))
         z.3   = 'g'
         z.4   = 'g'^(~ephI.21*ltkR.26)
    
     15. ~ephI = ~ephI.21
         ~ltkI = ~ltkI.22
         ltkR  = ltkR.26
         z     = 'g'^ltkR.26
         z.1   = 'g'^inv((~ephI.21*~ltkI.22))
         z.2   = 'g'^inv(~ltkI.22)
         z.3   = 'g'^inv(~ephI.21)
         z.4   = 'g'^(~ephI.21*ltkR.26)
    
     16. ~ephI = ~ephI.183
         ~ltkI = ~ltkI.184
         ltkR  = ltkR.188
         z     = 'g'^ltkR.188
         z.1   = 'g'^ephR.364
         z.2   = 'g'^(~ephI.183*ephR.364)
         z.3   = 'g'^(~ltkI.184*ephR.364)
         z.4   = 'g'^(~ephI.183*ltkR.188)
    
     17. ~ephI = ~ephI.183
         ~ltkI = ~ltkI.184
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^ephR.364
         z.2   = 'g'^(~ephI.183*ephR.364)
         z.3   = 'g'^(~ltkI.184*ephR.364)
         z.4   = 'g'^~ephI.183
    
     18. ~ephI = ~ephI.184
         ~ltkI = ~ephI.184
         ltkR  = ltkR.189
         z     = 'g'^ltkR.189
         z.1   = 'g'^inv((~ephI.184*x.366))
         z.2   = 'g'^inv(x.366)
         z.3   = 'g'^inv(x.366)
         z.4   = 'g'^(~ephI.184*ltkR.189)
    
     19. ~ephI = ~ephI.184
         ~ltkI = ~ephI.184
         ltkR  = ltkR.189
         z     = 'g'^ltkR.189
         z.1   = 'g'^(x.366*inv(~ephI.184))
         z.2   = 'g'^x.366
         z.3   = 'g'^x.366
         z.4   = 'g'^(~ephI.184*ltkR.189)
    
     20. ~ephI = ~ephI.184
         ~ltkI = ~ephI.184
         ltkR  = inv(~ephI.184)
         z     = 'g'^inv(~ephI.184)
         z.1   = 'g'^inv((~ephI.184*x.366))
         z.2   = 'g'^inv(x.366)
         z.3   = 'g'^inv(x.366)
         z.4   = 'g'
    
     21. ~ephI = ~ephI.184
         ~ltkI = ~ephI.184
         ltkR  = inv(~ephI.184)
         z     = 'g'^inv(~ephI.184)
         z.1   = 'g'^(x.366*inv(~ephI.184))
         z.2   = 'g'^x.366
         z.3   = 'g'^x.366
         z.4   = 'g'
    
     22. ~ephI = ~ephI.184
         ~ltkI = ~ephI.184
         ltkR  = inv((~ephI.184*x.366))
         z     = 'g'^inv((~ephI.184*x.366))
         z.1   = 'g'^inv(~ephI.184)
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'^inv(x.366)
    
     23. ~ephI = ~ephI.184
         ~ltkI = ~ephI.184
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^inv((~ephI.184*x.366))
         z.2   = 'g'^inv(x.366)
         z.3   = 'g'^inv(x.366)
         z.4   = 'g'^~ephI.184
    
     24. ~ephI = ~ephI.184
         ~ltkI = ~ephI.184
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^(x.366*inv(~ephI.184))
         z.2   = 'g'^x.366
         z.3   = 'g'^x.366
         z.4   = 'g'^~ephI.184
    
     25. ~ephI = ~ephI.184
         ~ltkI = ~ephI.184
         ltkR  = (x.366*inv(~ephI.184))
         z     = 'g'^(x.366*inv(~ephI.184))
         z.1   = 'g'^inv(~ephI.184)
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'^x.366
    
     26. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = ltkR.189
         z     = 'g'^ltkR.189
         z.1   = 'g'^inv((~ephI.184*x.366))
         z.2   = 'g'^inv(x.366)
         z.3   = 'g'^(~ltkI.185*inv((~ephI.184*x.366)))
         z.4   = 'g'^(~ephI.184*ltkR.189)
    
     27. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = ltkR.189
         z     = 'g'^ltkR.189
         z.1   = 'g'^inv((~ltkI.185*x.366))
         z.2   = 'g'^(~ephI.184*inv((~ltkI.185*x.366)))
         z.3   = 'g'^inv(x.366)
         z.4   = 'g'^(~ephI.184*ltkR.189)
    
     28. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = ltkR.189
         z     = 'g'^ltkR.189
         z.1   = 'g'^(x.366*inv(~ephI.184))
         z.2   = 'g'^x.366
         z.3   = 'g'^(~ltkI.185*x.366*inv(~ephI.184))
         z.4   = 'g'^(~ephI.184*ltkR.189)
    
     29. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = ltkR.189
         z     = 'g'^ltkR.189
         z.1   = 'g'^(x.366*inv(~ltkI.185))
         z.2   = 'g'^(~ephI.184*x.366*inv(~ltkI.185))
         z.3   = 'g'^x.366
         z.4   = 'g'^(~ephI.184*ltkR.189)
    
     30. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = inv(~ephI.184)
         z     = 'g'^inv(~ephI.184)
         z.1   = 'g'^ephR.366
         z.2   = 'g'^(~ephI.184*ephR.366)
         z.3   = 'g'^(~ltkI.185*ephR.366)
         z.4   = 'g'
    
     31. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = inv(~ephI.184)
         z     = 'g'^inv(~ephI.184)
         z.1   = 'g'^inv((~ephI.184*x.366))
         z.2   = 'g'^inv(x.366)
         z.3   = 'g'^(~ltkI.185*inv((~ephI.184*x.366)))
         z.4   = 'g'
    
     32. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = inv(~ephI.184)
         z     = 'g'^inv(~ephI.184)
         z.1   = 'g'^(x.366*inv(~ephI.184))
         z.2   = 'g'^x.366
         z.3   = 'g'^(~ltkI.185*x.366*inv(~ephI.184))
         z.4   = 'g'
    
     33. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = inv((~ephI.184*x.366))
         z     = 'g'^inv((~ephI.184*x.366))
         z.1   = 'g'
         z.2   = 'g'^~ephI.184
         z.3   = 'g'^~ltkI.185
         z.4   = 'g'^inv(x.366)
    
     34. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = inv((~ephI.184*x.366))
         z     = 'g'^inv((~ephI.184*x.366))
         z.1   = 'g'^inv(~ephI.184)
         z.2   = 'g'
         z.3   = 'g'^(~ltkI.185*inv(~ephI.184))
         z.4   = 'g'^inv(x.366)
    
     35. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^inv((~ephI.184*x.366))
         z.2   = 'g'^inv(x.366)
         z.3   = 'g'^(~ltkI.185*inv((~ephI.184*x.366)))
         z.4   = 'g'^~ephI.184
    
     36. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^inv((~ltkI.185*x.366))
         z.2   = 'g'^(~ephI.184*inv((~ltkI.185*x.366)))
         z.3   = 'g'^inv(x.366)
         z.4   = 'g'^~ephI.184
    
     37. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^(x.366*inv(~ephI.184))
         z.2   = 'g'^x.366
         z.3   = 'g'^(~ltkI.185*x.366*inv(~ephI.184))
         z.4   = 'g'^~ephI.184
    
     38. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^(x.366*inv(~ltkI.185))
         z.2   = 'g'^(~ephI.184*x.366*inv(~ltkI.185))
         z.3   = 'g'^x.366
         z.4   = 'g'^~ephI.184
    
     39. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = (x.366*inv(~ephI.184))
         z     = 'g'^(x.366*inv(~ephI.184))
         z.1   = 'g'
         z.2   = 'g'^~ephI.184
         z.3   = 'g'^~ltkI.185
         z.4   = 'g'^x.366
    
     40. ~ephI = ~ephI.184
         ~ltkI = ~ltkI.185
         ltkR  = (x.366*inv(~ephI.184))
         z     = 'g'^(x.366*inv(~ephI.184))
         z.1   = 'g'^inv(~ephI.184)
         z.2   = 'g'
         z.3   = 'g'^(~ltkI.185*inv(~ephI.184))
         z.4   = 'g'^x.366
    
     41. ~ephI = ~ephI.185
         ~ltkI = ~ephI.185
         ltkR  = ltkR.190
         z     = 'g'^ltkR.190
         z.1   = 'g'^(x.368*inv((~ephI.185*x.367)))
         z.2   = 'g'^(x.368*inv(x.367))
         z.3   = 'g'^(x.368*inv(x.367))
         z.4   = 'g'^(~ephI.185*ltkR.190)
    
     42. ~ephI = ~ephI.185
         ~ltkI = ~ephI.185
         ltkR  = inv(~ephI.185)
         z     = 'g'^inv(~ephI.185)
         z.1   = 'g'^(x.368*inv((~ephI.185*x.367)))
         z.2   = 'g'^(x.368*inv(x.367))
         z.3   = 'g'^(x.368*inv(x.367))
         z.4   = 'g'
    
     43. ~ephI = ~ephI.185
         ~ltkI = ~ephI.185
         ltkR  = inv((~ephI.185*x.367))
         z     = 'g'^inv((~ephI.185*x.367))
         z.1   = 'g'^(x.368*inv(~ephI.185))
         z.2   = 'g'^x.368
         z.3   = 'g'^x.368
         z.4   = 'g'^inv(x.367)
    
     44. ~ephI = ~ephI.185
         ~ltkI = ~ephI.185
         ltkR  = inv((~ephI.185*x.368))
         z     = 'g'^inv((~ephI.185*x.368))
         z.1   = 'g'^inv((~ephI.185*x.367))
         z.2   = 'g'^inv(x.367)
         z.3   = 'g'^inv(x.367)
         z.4   = 'g'^inv(x.368)
    
     45. ~ephI = ~ephI.185
         ~ltkI = ~ephI.185
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^(x.368*inv((~ephI.185*x.367)))
         z.2   = 'g'^(x.368*inv(x.367))
         z.3   = 'g'^(x.368*inv(x.367))
         z.4   = 'g'^~ephI.185
    
     46. ~ephI = ~ephI.185
         ~ltkI = ~ephI.185
         ltkR  = (x.368*inv(~ephI.185))
         z     = 'g'^(x.368*inv(~ephI.185))
         z.1   = 'g'^inv((~ephI.185*x.367))
         z.2   = 'g'^inv(x.367)
         z.3   = 'g'^inv(x.367)
         z.4   = 'g'^x.368
    
     47. ~ephI = ~ephI.185
         ~ltkI = ~ephI.185
         ltkR  = (x.368*inv(~ephI.185))
         z     = 'g'^(x.368*inv(~ephI.185))
         z.1   = 'g'^(x.367*inv(~ephI.185))
         z.2   = 'g'^x.367
         z.3   = 'g'^x.367
         z.4   = 'g'^x.368
    
     48. ~ephI = ~ephI.185
         ~ltkI = ~ephI.185
         ltkR  = (x.368*inv((~ephI.185*x.367)))
         z     = 'g'^(x.368*inv((~ephI.185*x.367)))
         z.1   = 'g'^inv(~ephI.185)
         z.2   = 'g'
         z.3   = 'g'
         z.4   = 'g'^(x.368*inv(x.367))
    
     49. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = ltkR.190
         z     = 'g'^ltkR.190
         z.1   = 'g'^inv((~ephI.185*~ltkI.186*x.368))
         z.2   = 'g'^inv((~ltkI.186*x.368))
         z.3   = 'g'^inv((~ephI.185*x.368))
         z.4   = 'g'^(~ephI.185*ltkR.190)
    
     50. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = ltkR.190
         z     = 'g'^ltkR.190
         z.1   = 'g'^(x.368*inv((~ephI.185*~ltkI.186)))
         z.2   = 'g'^(x.368*inv(~ltkI.186))
         z.3   = 'g'^(x.368*inv(~ephI.185))
         z.4   = 'g'^(~ephI.185*ltkR.190)
    
     51. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = ltkR.190
         z     = 'g'^ltkR.190
         z.1   = 'g'^(x.368*inv((~ephI.185*x.367)))
         z.2   = 'g'^(x.368*inv(x.367))
         z.3   = 'g'^(~ltkI.186*x.368*inv((~ephI.185*x.367)))
         z.4   = 'g'^(~ephI.185*ltkR.190)
    
     52. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = ltkR.190
         z     = 'g'^ltkR.190
         z.1   = 'g'^(x.368*inv((~ltkI.186*x.367)))
         z.2   = 'g'^(~ephI.185*x.368*inv((~ltkI.186*x.367)))
         z.3   = 'g'^(x.368*inv(x.367))
         z.4   = 'g'^(~ephI.185*ltkR.190)
    
     53. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = inv(~ephI.185)
         z     = 'g'^inv(~ephI.185)
         z.1   = 'g'^inv((~ephI.185*~ltkI.186*x.368))
         z.2   = 'g'^inv((~ltkI.186*x.368))
         z.3   = 'g'^inv((~ephI.185*x.368))
         z.4   = 'g'
    
     54. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = inv(~ephI.185)
         z     = 'g'^inv(~ephI.185)
         z.1   = 'g'^inv((~ltkI.186*x.368))
         z.2   = 'g'^(~ephI.185*inv((~ltkI.186*x.368)))
         z.3   = 'g'^inv(x.368)
         z.4   = 'g'
    
     55. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = inv(~ephI.185)
         z     = 'g'^inv(~ephI.185)
         z.1   = 'g'^(x.368*inv(~ltkI.186))
         z.2   = 'g'^(~ephI.185*x.368*inv(~ltkI.186))
         z.3   = 'g'^x.368
         z.4   = 'g'
    
     56. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = inv(~ephI.185)
         z     = 'g'^inv(~ephI.185)
         z.1   = 'g'^(x.368*inv((~ephI.185*~ltkI.186)))
         z.2   = 'g'^(x.368*inv(~ltkI.186))
         z.3   = 'g'^(x.368*inv(~ephI.185))
         z.4   = 'g'
    
     57. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = inv(~ephI.185)
         z     = 'g'^inv(~ephI.185)
         z.1   = 'g'^(x.368*inv((~ephI.185*x.367)))
         z.2   = 'g'^(x.368*inv(x.367))
         z.3   = 'g'^(~ltkI.186*x.368*inv((~ephI.185*x.367)))
         z.4   = 'g'
    
     58. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = inv((~ephI.185*x.367))
         z     = 'g'^inv((~ephI.185*x.367))
         z.1   = 'g'^ephR.368
         z.2   = 'g'^(~ephI.185*ephR.368)
         z.3   = 'g'^(~ltkI.186*ephR.368)
         z.4   = 'g'^inv(x.367)
    
     59. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = inv((~ephI.185*x.367))
         z     = 'g'^inv((~ephI.185*x.367))
         z.1   = 'g'^(x.368*inv(~ephI.185))
         z.2   = 'g'^x.368
         z.3   = 'g'^(~ltkI.186*x.368*inv(~ephI.185))
         z.4   = 'g'^inv(x.367)
    
     60. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = inv((~ephI.185*x.368))
         z     = 'g'^inv((~ephI.185*x.368))
         z.1   = 'g'^inv(~ltkI.186)
         z.2   = 'g'^(~ephI.185*inv(~ltkI.186))
         z.3   = 'g'
         z.4   = 'g'^inv(x.368)
    
     61. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = inv((~ephI.185*x.368))
         z     = 'g'^inv((~ephI.185*x.368))
         z.1   = 'g'^inv((~ephI.185*~ltkI.186))
         z.2   = 'g'^inv(~ltkI.186)
         z.3   = 'g'^inv(~ephI.185)
         z.4   = 'g'^inv(x.368)
    
     62. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = inv((~ephI.185*x.368))
         z     = 'g'^inv((~ephI.185*x.368))
         z.1   = 'g'^inv((~ephI.185*x.367))
         z.2   = 'g'^inv(x.367)
         z.3   = 'g'^(~ltkI.186*inv((~ephI.185*x.367)))
         z.4   = 'g'^inv(x.368)
    
     63. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^inv((~ephI.185*~ltkI.186*x.368))
         z.2   = 'g'^inv((~ltkI.186*x.368))
         z.3   = 'g'^inv((~ephI.185*x.368))
         z.4   = 'g'^~ephI.185
    
     64. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^(x.368*inv((~ephI.185*~ltkI.186)))
         z.2   = 'g'^(x.368*inv(~ltkI.186))
         z.3   = 'g'^(x.368*inv(~ephI.185))
         z.4   = 'g'^~ephI.185
    
     65. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^(x.368*inv((~ephI.185*x.367)))
         z.2   = 'g'^(x.368*inv(x.367))
         z.3   = 'g'^(~ltkI.186*x.368*inv((~ephI.185*x.367)))
         z.4   = 'g'^~ephI.185
    
     66. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^(x.368*inv((~ltkI.186*x.367)))
         z.2   = 'g'^(~ephI.185*x.368*inv((~ltkI.186*x.367)))
         z.3   = 'g'^(x.368*inv(x.367))
         z.4   = 'g'^~ephI.185
    
     67. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = (x.367*inv(~ephI.185))
         z     = 'g'^(x.367*inv(~ephI.185))
         z.1   = 'g'^ephR.368
         z.2   = 'g'^(~ephI.185*ephR.368)
         z.3   = 'g'^(~ltkI.186*ephR.368)
         z.4   = 'g'^x.367
    
     68. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = (x.368*inv(~ephI.185))
         z     = 'g'^(x.368*inv(~ephI.185))
         z.1   = 'g'^inv(~ltkI.186)
         z.2   = 'g'^(~ephI.185*inv(~ltkI.186))
         z.3   = 'g'
         z.4   = 'g'^x.368
    
     69. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = (x.368*inv(~ephI.185))
         z     = 'g'^(x.368*inv(~ephI.185))
         z.1   = 'g'^inv((~ephI.185*~ltkI.186))
         z.2   = 'g'^inv(~ltkI.186)
         z.3   = 'g'^inv(~ephI.185)
         z.4   = 'g'^x.368
    
     70. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = (x.368*inv(~ephI.185))
         z     = 'g'^(x.368*inv(~ephI.185))
         z.1   = 'g'^inv((~ephI.185*x.367))
         z.2   = 'g'^inv(x.367)
         z.3   = 'g'^(~ltkI.186*inv((~ephI.185*x.367)))
         z.4   = 'g'^x.368
    
     71. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = (x.368*inv(~ephI.185))
         z     = 'g'^(x.368*inv(~ephI.185))
         z.1   = 'g'^(x.367*inv(~ephI.185))
         z.2   = 'g'^x.367
         z.3   = 'g'^(~ltkI.186*x.367*inv(~ephI.185))
         z.4   = 'g'^x.368
    
     72. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = (x.368*inv((~ephI.185*x.367)))
         z     = 'g'^(x.368*inv((~ephI.185*x.367)))
         z.1   = 'g'
         z.2   = 'g'^~ephI.185
         z.3   = 'g'^~ltkI.186
         z.4   = 'g'^(x.368*inv(x.367))
    
     73. ~ephI = ~ephI.185
         ~ltkI = ~ltkI.186
         ltkR  = (x.368*inv((~ephI.185*x.367)))
         z     = 'g'^(x.368*inv((~ephI.185*x.367)))
         z.1   = 'g'^inv(~ephI.185)
         z.2   = 'g'
         z.3   = 'g'^(~ltkI.186*inv(~ephI.185))
         z.4   = 'g'^(x.368*inv(x.367))
    
     74. ~ephI = ~ephI.186
         ~ltkI = ~ephI.186
         ltkR  = inv((~ephI.186*x.368))
         z     = 'g'^inv((~ephI.186*x.368))
         z.1   = 'g'^(x.370*inv((~ephI.186*x.369)))
         z.2   = 'g'^(x.370*inv(x.369))
         z.3   = 'g'^(x.370*inv(x.369))
         z.4   = 'g'^inv(x.368)
    
     75. ~ephI = ~ephI.186
         ~ltkI = ~ephI.186
         ltkR  = (x.370*inv(~ephI.186))
         z     = 'g'^(x.370*inv(~ephI.186))
         z.1   = 'g'^(x.369*inv((~ephI.186*x.368)))
         z.2   = 'g'^(x.369*inv(x.368))
         z.3   = 'g'^(x.369*inv(x.368))
         z.4   = 'g'^x.370
    
     76. ~ephI = ~ephI.186
         ~ltkI = ~ephI.186
         ltkR  = (x.370*inv((~ephI.186*x.368)))
         z     = 'g'^(x.370*inv((~ephI.186*x.368)))
         z.1   = 'g'^(x.369*inv(~ephI.186))
         z.2   = 'g'^x.369
         z.3   = 'g'^x.369
         z.4   = 'g'^(x.370*inv(x.368))
    
     77. ~ephI = ~ephI.186
         ~ltkI = ~ephI.186
         ltkR  = (x.370*inv((~ephI.186*x.369)))
         z     = 'g'^(x.370*inv((~ephI.186*x.369)))
         z.1   = 'g'^inv((~ephI.186*x.368))
         z.2   = 'g'^inv(x.368)
         z.3   = 'g'^inv(x.368)
         z.4   = 'g'^(x.370*inv(x.369))
    
     78. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = ltkR.191
         z     = 'g'^ltkR.191
         z.1   = 'g'^(x.370*inv((~ephI.186*~ltkI.187*x.369)))
         z.2   = 'g'^(x.370*inv((~ltkI.187*x.369)))
         z.3   = 'g'^(x.370*inv((~ephI.186*x.369)))
         z.4   = 'g'^(~ephI.186*ltkR.191)
    
     79. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = inv(~ephI.186)
         z     = 'g'^inv(~ephI.186)
         z.1   = 'g'^(x.370*inv((~ephI.186*~ltkI.187*x.369)))
         z.2   = 'g'^(x.370*inv((~ltkI.187*x.369)))
         z.3   = 'g'^(x.370*inv((~ephI.186*x.369)))
         z.4   = 'g'
    
     80. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = inv(~ephI.186)
         z     = 'g'^inv(~ephI.186)
         z.1   = 'g'^(x.370*inv((~ltkI.187*x.369)))
         z.2   = 'g'^(~ephI.186*x.370*inv((~ltkI.187*x.369)))
         z.3   = 'g'^(x.370*inv(x.369))
         z.4   = 'g'
    
     81. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = inv((~ephI.186*x.368))
         z     = 'g'^inv((~ephI.186*x.368))
         z.1   = 'g'^(x.370*inv((~ephI.186*x.369)))
         z.2   = 'g'^(x.370*inv(x.369))
         z.3   = 'g'^(~ltkI.187*x.370*inv((~ephI.186*x.369)))
         z.4   = 'g'^inv(x.368)
    
     82. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = inv((~ephI.186*x.369))
         z     = 'g'^inv((~ephI.186*x.369))
         z.1   = 'g'^(x.370*inv(~ltkI.187))
         z.2   = 'g'^(~ephI.186*x.370*inv(~ltkI.187))
         z.3   = 'g'^x.370
         z.4   = 'g'^inv(x.369)
    
     83. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = inv((~ephI.186*x.369))
         z     = 'g'^inv((~ephI.186*x.369))
         z.1   = 'g'^(x.370*inv((~ephI.186*~ltkI.187)))
         z.2   = 'g'^(x.370*inv(~ltkI.187))
         z.3   = 'g'^(x.370*inv(~ephI.186))
         z.4   = 'g'^inv(x.369)
    
     84. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = inv((~ephI.186*x.370))
         z     = 'g'^inv((~ephI.186*x.370))
         z.1   = 'g'^inv((~ephI.186*~ltkI.187*x.369))
         z.2   = 'g'^inv((~ltkI.187*x.369))
         z.3   = 'g'^inv((~ephI.186*x.369))
         z.4   = 'g'^inv(x.370)
    
     85. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = inv((~ephI.186*x.370))
         z     = 'g'^inv((~ephI.186*x.370))
         z.1   = 'g'^inv((~ltkI.187*x.369))
         z.2   = 'g'^(~ephI.186*inv((~ltkI.187*x.369)))
         z.3   = 'g'^inv(x.369)
         z.4   = 'g'^inv(x.370)
    
     86. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = one
         z     = 'g'
         z.1   = 'g'^(x.370*inv((~ephI.186*~ltkI.187*x.369)))
         z.2   = 'g'^(x.370*inv((~ltkI.187*x.369)))
         z.3   = 'g'^(x.370*inv((~ephI.186*x.369)))
         z.4   = 'g'^~ephI.186
    
     87. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = (x.369*inv((~ephI.186*x.368)))
         z     = 'g'^(x.369*inv((~ephI.186*x.368)))
         z.1   = 'g'^ephR.370
         z.2   = 'g'^(~ephI.186*ephR.370)
         z.3   = 'g'^(~ltkI.187*ephR.370)
         z.4   = 'g'^(x.369*inv(x.368))
    
     88. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = (x.370*inv(~ephI.186))
         z     = 'g'^(x.370*inv(~ephI.186))
         z.1   = 'g'^inv((~ephI.186*~ltkI.187*x.369))
         z.2   = 'g'^inv((~ltkI.187*x.369))
         z.3   = 'g'^inv((~ephI.186*x.369))
         z.4   = 'g'^x.370
    
     89. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = (x.370*inv(~ephI.186))
         z     = 'g'^(x.370*inv(~ephI.186))
         z.1   = 'g'^inv((~ltkI.187*x.369))
         z.2   = 'g'^(~ephI.186*inv((~ltkI.187*x.369)))
         z.3   = 'g'^inv(x.369)
         z.4   = 'g'^x.370
    
     90. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = (x.370*inv(~ephI.186))
         z     = 'g'^(x.370*inv(~ephI.186))
         z.1   = 'g'^(x.369*inv(~ltkI.187))
         z.2   = 'g'^(~ephI.186*x.369*inv(~ltkI.187))
         z.3   = 'g'^x.369
         z.4   = 'g'^x.370
    
     91. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = (x.370*inv(~ephI.186))
         z     = 'g'^(x.370*inv(~ephI.186))
         z.1   = 'g'^(x.369*inv((~ephI.186*~ltkI.187)))
         z.2   = 'g'^(x.369*inv(~ltkI.187))
         z.3   = 'g'^(x.369*inv(~ephI.186))
         z.4   = 'g'^x.370
    
     92. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = (x.370*inv(~ephI.186))
         z     = 'g'^(x.370*inv(~ephI.186))
         z.1   = 'g'^(x.369*inv((~ephI.186*x.368)))
         z.2   = 'g'^(x.369*inv(x.368))
         z.3   = 'g'^(~ltkI.187*x.369*inv((~ephI.186*x.368)))
         z.4   = 'g'^x.370
    
     93. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = (x.370*inv((~ephI.186*x.368)))
         z     = 'g'^(x.370*inv((~ephI.186*x.368)))
         z.1   = 'g'^(x.369*inv(~ephI.186))
         z.2   = 'g'^x.369
         z.3   = 'g'^(~ltkI.187*x.369*inv(~ephI.186))
         z.4   = 'g'^(x.370*inv(x.368))
    
     94. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = (x.370*inv((~ephI.186*x.369)))
         z     = 'g'^(x.370*inv((~ephI.186*x.369)))
         z.1   = 'g'^inv(~ltkI.187)
         z.2   = 'g'^(~ephI.186*inv(~ltkI.187))
         z.3   = 'g'
         z.4   = 'g'^(x.370*inv(x.369))
    
     95. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = (x.370*inv((~ephI.186*x.369)))
         z     = 'g'^(x.370*inv((~ephI.186*x.369)))
         z.1   = 'g'^inv((~ephI.186*~ltkI.187))
         z.2   = 'g'^inv(~ltkI.187)
         z.3   = 'g'^inv(~ephI.186)
         z.4   = 'g'^(x.370*inv(x.369))
    
     96. ~ephI = ~ephI.186
         ~ltkI = ~ltkI.187
         ltkR  = (x.370*inv((~ephI.186*x.369)))
         z     = 'g'^(x.370*inv((~ephI.186*x.369)))
         z.1   = 'g'^inv((~ephI.186*x.368))
         z.2   = 'g'^inv(x.368)
         z.3   = 'g'^(~ltkI.187*inv((~ephI.186*x.368)))
         z.4   = 'g'^(x.370*inv(x.369))
    
     97. ~ephI = ~ephI.187
         ~ltkI = ~ephI.187
         ltkR  = (x.372*inv((~ephI.187*x.370)))
         z     = 'g'^(x.372*inv((~ephI.187*x.370)))
         z.1   = 'g'^(x.371*inv((~ephI.187*x.369)))
         z.2   = 'g'^(x.371*inv(x.369))
         z.3   = 'g'^(x.371*inv(x.369))
         z.4   = 'g'^(x.372*inv(x.370))
    
     98. ~ephI = ~ephI.187
         ~ltkI = ~ltkI.188
         ltkR  = inv((~ephI.187*x.370))
         z     = 'g'^inv((~ephI.187*x.370))
         z.1   = 'g'^(x.372*inv((~ephI.187*~ltkI.188*x.371)))
         z.2   = 'g'^(x.372*inv((~ltkI.188*x.371)))
         z.3   = 'g'^(x.372*inv((~ephI.187*x.371)))
         z.4   = 'g'^inv(x.370)
    
     99. ~ephI = ~ephI.187
         ~ltkI = ~ltkI.188
         ltkR  = inv((~ephI.187*x.370))
         z     = 'g'^inv((~ephI.187*x.370))
         z.1   = 'g'^(x.372*inv((~ltkI.188*x.371)))
         z.2   = 'g'^(~ephI.187*x.372*inv((~ltkI.188*x.371)))
         z.3   = 'g'^(x.372*inv(x.371))
         z.4   = 'g'^inv(x.370)
    
    100. ~ephI = ~ephI.187
         ~ltkI = ~ltkI.188
         ltkR  = (x.372*inv(~ephI.187))
         z     = 'g'^(x.372*inv(~ephI.187))
         z.1   = 'g'^(x.371*inv((~ephI.187*~ltkI.188*x.370)))
         z.2   = 'g'^(x.371*inv((~ltkI.188*x.370)))
         z.3   = 'g'^(x.371*inv((~ephI.187*x.370)))
         z.4   = 'g'^x.372
    
    101. ~ephI = ~ephI.187
         ~ltkI = ~ltkI.188
         ltkR  = (x.372*inv(~ephI.187))
         z     = 'g'^(x.372*inv(~ephI.187))
         z.1   = 'g'^(x.371*inv((~ltkI.188*x.370)))
         z.2   = 'g'^(~ephI.187*x.371*inv((~ltkI.188*x.370)))
         z.3   = 'g'^(x.371*inv(x.370))
         z.4   = 'g'^x.372
    
    102. ~ephI = ~ephI.187
         ~ltkI = ~ltkI.188
         ltkR  = (x.372*inv((~ephI.187*x.370)))
         z     = 'g'^(x.372*inv((~ephI.187*x.370)))
         z.1   = 'g'^(x.371*inv(~ltkI.188))
         z.2   = 'g'^(~ephI.187*x.371*inv(~ltkI.188))
         z.3   = 'g'^x.371
         z.4   = 'g'^(x.372*inv(x.370))
    
    103. ~ephI = ~ephI.187
         ~ltkI = ~ltkI.188
         ltkR  = (x.372*inv((~ephI.187*x.370)))
         z     = 'g'^(x.372*inv((~ephI.187*x.370)))
         z.1   = 'g'^(x.371*inv((~ephI.187*~ltkI.188)))
         z.2   = 'g'^(x.371*inv(~ltkI.188))
         z.3   = 'g'^(x.371*inv(~ephI.187))
         z.4   = 'g'^(x.372*inv(x.370))
    
    104. ~ephI = ~ephI.187
         ~ltkI = ~ltkI.188
         ltkR  = (x.372*inv((~ephI.187*x.370)))
         z     = 'g'^(x.372*inv((~ephI.187*x.370)))
         z.1   = 'g'^(x.371*inv((~ephI.187*x.369)))
         z.2   = 'g'^(x.371*inv(x.369))
         z.3   = 'g'^(~ltkI.188*x.371*inv((~ephI.187*x.369)))
         z.4   = 'g'^(x.372*inv(x.370))
    
    105. ~ephI = ~ephI.187
         ~ltkI = ~ltkI.188
         ltkR  = (x.372*inv((~ephI.187*x.371)))
         z     = 'g'^(x.372*inv((~ephI.187*x.371)))
         z.1   = 'g'^inv((~ephI.187*~ltkI.188*x.370))
         z.2   = 'g'^inv((~ltkI.188*x.370))
         z.3   = 'g'^inv((~ephI.187*x.370))
         z.4   = 'g'^(x.372*inv(x.371))
    
    106. ~ephI = ~ephI.187
         ~ltkI = ~ltkI.188
         ltkR  = (x.372*inv((~ephI.187*x.371)))
         z     = 'g'^(x.372*inv((~ephI.187*x.371)))
         z.1   = 'g'^inv((~ltkI.188*x.370))
         z.2   = 'g'^(~ephI.187*inv((~ltkI.188*x.370)))
         z.3   = 'g'^inv(x.370)
         z.4   = 'g'^(x.372*inv(x.371))
    
    107. ~ephI = ~ephI.188
         ~ltkI = ~ltkI.189
         ltkR  = (x.374*inv((~ephI.188*x.372)))
         z     = 'g'^(x.374*inv((~ephI.188*x.372)))
         z.1   = 'g'^(x.373*inv((~ephI.188*~ltkI.189*x.371)))
         z.2   = 'g'^(x.373*inv((~ltkI.189*x.371)))
         z.3   = 'g'^(x.373*inv((~ephI.188*x.371)))
         z.4   = 'g'^(x.374*inv(x.372))
    
    108. ~ephI = ~ephI.188
         ~ltkI = ~ltkI.189
         ltkR  = (x.374*inv((~ephI.188*x.372)))
         z     = 'g'^(x.374*inv((~ephI.188*x.372)))
         z.1   = 'g'^(x.373*inv((~ltkI.189*x.371)))
         z.2   = 'g'^(~ephI.188*x.373*inv((~ltkI.189*x.371)))
         z.3   = 'g'^(x.373*inv(x.371))
         z.4   = 'g'^(x.374*inv(x.372))
  */

lemma cpa_resistance:
  all-traces
  "∀ k sid1 sid2 #secret1 #secret2 #acc1 #acc2.
    ((((SessionAccept( sid1 ) @ #acc1) ∧
       (SessionAccept( sid2 ) @ #acc2)) ∧
      (SessionKey( sid1, k ) @ #secret1)) ∧
     (SessionKey( sid2, k ) @ #secret2)) ⇒
    (∃ protoKey #proto1 #proto2.
      (SessionProtoKey( sid1, protoKey ) @ #proto1) ∧
      (SessionProtoKey( sid2, protoKey ) @ #proto2))"
/*
guarded formula characterizing all counter-examples:
"∃ k sid1 sid2 #secret1 #secret2 #acc1 #acc2.
  (SessionAccept( sid1 ) @ #acc1) ∧
  (SessionAccept( sid2 ) @ #acc2) ∧
  (SessionKey( sid1, k ) @ #secret1) ∧
  (SessionKey( sid2, k ) @ #secret2)
 ∧
  ∀ protoKey #proto1 #proto2.
   (SessionProtoKey( sid1, protoKey ) @ #proto1) ∧
   (SessionProtoKey( sid2, protoKey ) @ #proto2)
  ⇒
   ⊥"
*/
simplify
solve( SessionAccept( sid1 ) @ #acc1 )
  case Initiator_recvAuth
  solve( Initiator_authSent( <'g'^~ltkI, pk(~ltkI)>, <z, pk(ltkR)>,
                             ~ltkI, ~ephI, z.1, ~protoKey, ~sid
         ) ▶₀ #acc1 )
    case Initiator_recvChal_case_1
    solve( SessionAccept( sid2 ) @ #acc2 )
      case Initiator_recvAuth
      solve( Initiator_authSent( <'g'^~ltkI.1, pk(~ltkI.1)>,
                                 <z.3, pk(ltkR)>, ~ltkI.1, ~ephI.1, z.4, ~protoKey.1, ~sid.1
             ) ▶₀ #acc2 )
        case Initiator_recvChal_case_1
        solve( SessionKey( ~sid, k ) @ #secret1 )
          case Initiator_recvChal
          solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                     ~ltkI.2, ~ephI.2, ~protoKey.2, ~sid
                 ) ▶₀ #secret1 )
            case Initiator_sendChal
            solve( SessionKey( ~sid.1,
                               h(<~protoKey, z.6, z.7, 'g'^(~ephI*~ltkI)>)
                   ) @ #secret2 )
              case Initiator_recvChal_case_1
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                         ~ltkI.2, ~ephI, ~protoKey, ~sid.1
                     ) ▶₀ #secret2 )
                case Initiator_sendChal
                by contradiction
              qed
            next
              case Initiator_recvChal_case_2
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                            ~ltkI.2, ~ltkI, ~protoKey, ~sid.1
                        ) ▶₀ #secret2 )
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.3, ~protoKey,
                                            ~sid.1
                        ) ▶₀ #secret2 )
            qed
          qed
        next
          case Responder_recvAuth
          by solve( Responder_chalSent( ~ltkR, ~ephR, z.6, ~protoKey.2, ~sid
                    ) ▶₀ #secret1 )
        qed
      next
        case Initiator_recvChal_case_2
        solve( SessionKey( ~sid, k ) @ #secret1 )
          case Initiator_recvChal
          solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                     ~ltkI.2, ~ephI.2, ~protoKey.2, ~sid
                 ) ▶₀ #secret1 )
            case Initiator_sendChal
            solve( SessionKey( ~sid.1,
                               h(<~protoKey, z.6, z.7, 'g'^(~ephI*~ltkI)>)
                   ) @ #secret2 )
              case Initiator_recvChal_case_1
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                            ~ltkI.2, ~ephI, ~protoKey, ~sid.1
                        ) ▶₀ #secret2 )
            next
              case Initiator_recvChal_case_2
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                            ~ltkI.2, ~ltkI, ~protoKey, ~sid.1
                        ) ▶₀ #secret2 )
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.4, ~protoKey,
                                            ~sid.1
                        ) ▶₀ #secret2 )
            qed
          qed
        next
          case Responder_recvAuth
          by solve( Responder_chalSent( ~ltkR, ~ephR, z.6, ~protoKey.2, ~sid
                    ) ▶₀ #secret1 )
        qed
      qed
    next
      case Responder_recvAuth
      solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid.1
             ) ▶₀ #acc2 )
        case Responder_recvChal
        solve( SessionKey( ~sid, k ) @ #secret1 )
          case Initiator_recvChal
          solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                     ~ltkI.2, ~ephI.1, ~protoKey.2, ~sid
                 ) ▶₀ #secret1 )
            case Initiator_sendChal
            solve( SessionKey( ~sid.1,
                               h(<~protoKey, z.8, z.9, 'g'^(~ephI*~ltkI)>)
                   ) @ #secret2 )
              case Initiator_recvChal_case_1
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                            ~ltkI.2, ~ephI, ~protoKey, ~sid.1
                        ) ▶₀ #secret2 )
            next
              case Initiator_recvChal_case_2
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                            ~ltkI.2, ~ltkI, ~protoKey, ~sid.1
                        ) ▶₀ #secret2 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.3, ~protoKey,
                                         ~sid.1
                     ) ▶₀ #secret2 )
                case Responder_recvChal
                by contradiction
              qed
            qed
          qed
        next
          case Responder_recvAuth
          by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.8, ~protoKey.2,
                                        ~sid
                    ) ▶₀ #secret1 )
        qed
      qed
    qed
  next
    case Initiator_recvChal_case_2
    solve( SessionAccept( sid2 ) @ #acc2 )
      case Initiator_recvAuth
      solve( Initiator_authSent( <'g'^~ltkI.1, pk(~ltkI.1)>,
                                 <z.3, pk(ltkR)>, ~ltkI.1, ~ephI.1, z.4, ~protoKey.1, ~sid.1
             ) ▶₀ #acc2 )
        case Initiator_recvChal_case_1
        solve( SessionKey( ~sid, k ) @ #secret1 )
          case Initiator_recvChal
          solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                     ~ltkI.2, ~ephI.2, ~protoKey.2, ~sid
                 ) ▶₀ #secret1 )
            case Initiator_sendChal
            solve( SessionKey( ~sid.1, h(<~protoKey, z.6, z.7, 'g'^(~ephI*~x)>)
                   ) @ #secret2 )
              case Initiator_recvChal_case_1
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                            ~ltkI.2, ~ephI, ~protoKey, ~sid.1
                        ) ▶₀ #secret2 )
            next
              case Initiator_recvChal_case_2
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                            ~ltkI.2, ~x, ~protoKey, ~sid.1
                        ) ▶₀ #secret2 )
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.4, ~protoKey,
                                            ~sid.1
                        ) ▶₀ #secret2 )
            qed
          qed
        next
          case Responder_recvAuth
          by solve( Responder_chalSent( ~ltkR, ~ephR, z.6, ~protoKey.2, ~sid
                    ) ▶₀ #secret1 )
        qed
      next
        case Initiator_recvChal_case_2
        solve( SessionKey( ~sid, k ) @ #secret1 )
          case Initiator_recvChal
          solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.2, pkRed>,
                                     ~ltkI.2, ~ephI.2, ~protoKey.2, ~sid
                 ) ▶₀ #secret1 )
            case Initiator_sendChal
            solve( SessionKey( ~sid.1, h(<~protoKey, z.6, z.7, 'g'^(~ephI*~x)>)
                   ) @ #secret2 )
              case Initiator_recvChal_case_1
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                         ~ltkI.2, ~ephI, ~protoKey, ~sid.1
                     ) ▶₀ #secret2 )
                case Initiator_sendChal
                by contradiction
              qed
            next
              case Initiator_recvChal_case_2
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                         ~ltkI.2, ~x, ~protoKey, ~sid.1
                     ) ▶₀ #secret2 )
                case Initiator_sendChal
                by contradiction
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.5, ~protoKey,
                                            ~sid.1
                        ) ▶₀ #secret2 )
            qed
          qed
        next
          case Responder_recvAuth
          by solve( Responder_chalSent( ~ltkR, ~ephR, z.6, ~protoKey.2, ~sid
                    ) ▶₀ #secret1 )
        qed
      qed
    next
      case Responder_recvAuth
      solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid.1
             ) ▶₀ #acc2 )
        case Responder_recvChal
        solve( SessionKey( ~sid, k ) @ #secret1 )
          case Initiator_recvChal
          solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                     ~ltkI.2, ~ephI.1, ~protoKey.2, ~sid
                 ) ▶₀ #secret1 )
            case Initiator_sendChal
            solve( SessionKey( ~sid.1, h(<~protoKey, z.8, z.9, 'g'^(~ephI*~x)>)
                   ) @ #secret2 )
              case Initiator_recvChal_case_1
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                            ~ltkI.2, ~ephI, ~protoKey, ~sid.1
                        ) ▶₀ #secret2 )
            next
              case Initiator_recvChal_case_2
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                            ~ltkI.2, ~x, ~protoKey, ~sid.1
                        ) ▶₀ #secret2 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.4, ~protoKey,
                                         ~sid.1
                     ) ▶₀ #secret2 )
                case Responder_recvChal
                by contradiction
              qed
            qed
          qed
        next
          case Responder_recvAuth
          by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.8, ~protoKey.2,
                                        ~sid
                    ) ▶₀ #secret1 )
        qed
      qed
    qed
  qed
next
  case Responder_recvAuth
  solve( Responder_chalSent( ~ltkR, ~ephR, z, ~protoKey, ~sid
         ) ▶₀ #acc1 )
    case Responder_recvChal
    solve( SessionAccept( sid2 ) @ #acc2 )
      case Initiator_recvAuth
      solve( Initiator_authSent( <'g'^~ltkI.1, pk(~ltkI.1)>,
                                 <z.5, pk(ltkR.1)>, ~ltkI.1, ~ephI, z.6, ~protoKey.1, ~sid.1
             ) ▶₀ #acc2 )
        case Initiator_recvChal_case_1
        solve( SessionKey( ~sid, k ) @ #secret1 )
          case Initiator_recvChal
          by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                        ~ltkI.2, ~ephI.1, ~protoKey.2, ~sid
                    ) ▶₀ #secret1 )
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.8, ~protoKey.2, ~sid
                 ) ▶₀ #secret1 )
            case Responder_recvChal
            solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                   ) @ #secret2 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                         ~ltkI.2, ~ephI, ~protoKey, ~sid.1
                     ) ▶₀ #secret2 )
                case Initiator_sendChal
                by contradiction
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.8, ~protoKey,
                                            ~sid.1
                        ) ▶₀ #secret2 )
            qed
          qed
        qed
      next
        case Initiator_recvChal_case_2
        solve( SessionKey( ~sid, k ) @ #secret1 )
          case Initiator_recvChal
          by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                        ~ltkI.2, ~ephI.1, ~protoKey.2, ~sid
                    ) ▶₀ #secret1 )
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.8, ~protoKey.2, ~sid
                 ) ▶₀ #secret1 )
            case Responder_recvChal
            solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                   ) @ #secret2 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                         ~ltkI.2, ~ephI, ~protoKey, ~sid.1
                     ) ▶₀ #secret2 )
                case Initiator_sendChal
                by contradiction
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.8, ~protoKey,
                                            ~sid.1
                        ) ▶₀ #secret2 )
            qed
          qed
        qed
      qed
    next
      case Responder_recvAuth
      solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.5, ~protoKey.1,
                                 ~sid.1
             ) ▶₀ #acc2 )
        case Responder_recvChal
        solve( SessionKey( ~sid, k ) @ #secret1 )
          case Initiator_recvChal
          by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                        ~ltkI.2, ~ephI, ~protoKey.2, ~sid
                    ) ▶₀ #secret1 )
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.10, ~protoKey.2,
                                     ~sid
                 ) ▶₀ #secret1 )
            case Responder_recvChal
            solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                   ) @ #secret2 )
              case Initiator_recvChal
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                            ~ltkI.2, ~ephI, ~protoKey, ~sid.1
                        ) ▶₀ #secret2 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.10, ~protoKey,
                                         ~sid.1
                     ) ▶₀ #secret2 )
                case Responder_recvChal
                by contradiction
              qed
            qed
          qed
        qed
      qed
    qed
  qed
qed

lemma caps_pubkey:
  all-traces
  "∀ pk pkI pkDH pkSign sid1 k #mk #acc1 #init #resp1 #role1 #sec1.
    ((((((((AgentPubkey( pk, pkDH, pkSign ) @ #mk) ∧
           (¬(∃ #kpk. !KU( pkSign ) @ #kpk))) ∧
          (¬(∃ #kpk. !KU( pkDH ) @ #kpk))) ∧
         (SessionAccept( sid1 ) @ #acc1)) ∧
        (SessionResponder( sid1, pk ) @ #resp1)) ∧
       (SessionInitiator( sid1, pkI ) @ #init)) ∧
      (SessionRole( sid1, 'R' ) @ #role1)) ∧
     (SessionKey( sid1, k ) @ #sec1)) ⇒
    (∃ sid2 #role2 #sec2 #t.
      (((SessionRole( sid2, 'I' ) @ #role2) ∧
        (SessionKey( sid2, k ) @ #sec2)) ∧
       (HasCapability( pkI, pk ) @ #t)) ∧
      (∀ #ku. (!KU( k ) @ #ku) ⇒ (∃ #r. RevealSessionKey( k ) @ #r)))"
/*
guarded formula characterizing all counter-examples:
"∃ pk pkI pkDH pkSign sid1 k #mk #acc1 #init #resp1 #role1 #sec1.
  (AgentPubkey( pk, pkDH, pkSign ) @ #mk) ∧
  (SessionAccept( sid1 ) @ #acc1) ∧
  (SessionResponder( sid1, pk ) @ #resp1) ∧
  (SessionInitiator( sid1, pkI ) @ #init) ∧
  (SessionRole( sid1, 'R' ) @ #role1) ∧
  (SessionKey( sid1, k ) @ #sec1)
 ∧
  (∀ #kpk. (!KU( pkSign ) @ #kpk) ⇒ ⊥) ∧
  (∀ #kpk. (!KU( pkDH ) @ #kpk) ⇒ ⊥) ∧
  (∀ sid2 #role2 #sec2 #t.
    (SessionRole( sid2, 'I' ) @ #role2) ∧
    (SessionKey( sid2, k ) @ #sec2) ∧
    (HasCapability( pkI, pk ) @ #t)
   ⇒
    ∃ #ku. (!KU( k ) @ #ku) ∧ ∀ #r. (RevealSessionKey( k ) @ #r) ⇒ ⊥)"
*/
simplify
solve( SessionAccept( sid1 ) @ #acc1 )
  case Initiator_recvAuth
  solve( Initiator_authSent( <'g'^~ltkI, pk(~ltkI)>, <z, pk(ltkR)>,
                             ~ltkI, ~ephI, z.1, ~protoKey, ~sid
         ) ▶₀ #acc1 )
    case Initiator_recvChal_case_1
    solve( SessionResponder( ~sid, <'g'^~ltk, pk(~ltk)> ) @ #resp1 )
      case Dial
      solve( SessionInitiator( ~sid, pkI ) @ #init )
        case Dial
        by solve( SessionRole( ~sid, 'R' ) @ #role1 )
      next
        case Responder_recvAuth
        by solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid
                  ) ▶₀ #init )
      qed
    qed
  next
    case Initiator_recvChal_case_2
    solve( SessionResponder( ~sid, <'g'^~ltk, pk(~ltk)> ) @ #resp1 )
      case Dial
      solve( SessionInitiator( ~sid, pkI ) @ #init )
        case Dial
        by solve( SessionRole( ~sid, 'R' ) @ #role1 )
      next
        case Responder_recvAuth
        by solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid
                  ) ▶₀ #init )
      qed
    qed
  qed
next
  case Responder_recvAuth
  solve( Responder_chalSent( ~ltkR, ~ephR, z, ~protoKey, ~sid
         ) ▶₀ #acc1 )
    case Responder_recvChal
    solve( SessionResponder( ~sid, <'g'^~ltk, pk(~ltk)> ) @ #resp1 )
      case Listen
      solve( SessionInitiator( ~sid, pkI ) @ #init )
        case Responder_recvAuth
        solve( Responder_chalSent( ~ltkR, ~ephR.1, z.5, ~protoKey.1, ~sid
               ) ▶₀ #init )
          case Responder_recvChal
          solve( SessionRole( ~sid, 'R' ) @ #role1 )
            case Listen
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                            ~ltkI.1, ~ephI, ~protoKey.1, ~sid
                        ) ▶₀ #sec1 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR, ~ephR.1, z.5, ~protoKey.1, ~sid
                     ) ▶₀ #sec1 )
                case Responder_recvChal
                solve( !KU( senc(<<z.1, pk(ltkI)>, 
                                  sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h(z.2)>, ltkI)>,
                                 h(<~protoKey, z.2, z.3>))
                       ) @ #vk )
                  case Initiator_recvChal_case_1
                  solve( !KU( mac('g'^~ephI, h(~protoKey)) ) @ #vk.3 )
                    case Initiator_sendChal
                    solve( !KU( mac('g'^~ephR, h(<'g'^(~ephI*~ephR), ~protoKey>))
                           ) @ #vk.6 )
                      case Responder_recvChal
                      solve( !KU( 'g'^~ephI ) @ #vk.4 )
                        case Initiator_sendChal
                        solve( !KU( 'g'^~ephR ) @ #vk.6 )
                          case Responder_recvChal
                          solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                                         'g'^(~ephI*~ltk)>)
                                 ) @ #ku )
                            case RevealSessionKey_case_1
                            by contradiction
                          next
                            case RevealSessionKey_case_2
                            by contradiction
                          next
                            case c_h
                            solve( !KU( ~protoKey ) @ #vk.8 )
                              case NewProto
                              solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.10 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.14 )
                              next
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.14 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.16 )
                              qed
                            qed
                          qed
                        next
                          case cexp
                          by solve( !KU( ~ephR ) @ #vk.8 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.8 )
                      qed
                    next
                      case c_mac
                      solve( !KU( 'g'^~ephI ) @ #vk.4 )
                        case Initiator_sendChal
                        solve( !KU( 'g'^~ephR ) @ #vk.6 )
                          case Responder_recvChal
                          solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                                         'g'^(~ephI*~ltk)>)
                                 ) @ #ku )
                            case RevealSessionKey_case_1
                            by contradiction
                          next
                            case RevealSessionKey_case_2
                            by contradiction
                          next
                            case c_h
                            solve( !KU( ~protoKey ) @ #vk.9 )
                              case NewProto
                              solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.11 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.15 )
                              next
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.15 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.17 )
                              qed
                            qed
                          qed
                        next
                          case cexp
                          by solve( !KU( ~ephR ) @ #vk.9 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.9 )
                      qed
                    qed
                  next
                    case c_mac
                    solve( !KU( mac('g'^~ephR, h(<'g'^(~ephI*~ephR), ~protoKey>))
                           ) @ #vk.6 )
                      case Responder_recvChal
                      solve( !KU( 'g'^~ephI ) @ #vk.4 )
                        case Initiator_sendChal
                        solve( !KU( 'g'^~ephR ) @ #vk.6 )
                          case Responder_recvChal
                          solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                                         'g'^(~ephI*~ltk)>)
                                 ) @ #ku )
                            case RevealSessionKey_case_1
                            by contradiction
                          next
                            case RevealSessionKey_case_2
                            by contradiction
                          next
                            case c_h
                            solve( !KU( ~protoKey ) @ #vk.9 )
                              case NewProto
                              solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.11 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.15 )
                              next
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.15 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.17 )
                              qed
                            qed
                          qed
                        next
                          case cexp
                          by solve( !KU( ~ephR ) @ #vk.9 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.9 )
                      qed
                    next
                      case c_mac
                      solve( !KU( 'g'^~ephI ) @ #vk.4 )
                        case Initiator_sendChal
                        solve( !KU( 'g'^~ephR ) @ #vk.6 )
                          case Responder_recvChal
                          solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                                         'g'^(~ephI*~ltk)>)
                                 ) @ #ku )
                            case RevealSessionKey_case_1
                            by contradiction
                          next
                            case RevealSessionKey_case_2
                            by contradiction
                          next
                            case c_h
                            solve( !KU( ~protoKey ) @ #vk.10 )
                              case NewProto
                              solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.12 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.16 )
                              next
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.16 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.18 )
                              qed
                            qed
                          qed
                        next
                          case cexp
                          by solve( !KU( ~ephR ) @ #vk.10 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.10 )
                      qed
                    qed
                  qed
                next
                  case Initiator_recvChal_case_2
                  solve( !KU( mac('g'^~ephI, h(~protoKey)) ) @ #vk.3 )
                    case Initiator_sendChal
                    solve( !KU( mac('g'^~ephR, h(<'g'^(~ephI*~ephR), ~protoKey>))
                           ) @ #vk.6 )
                      case Responder_recvChal
                      solve( !KU( 'g'^~ephI ) @ #vk.4 )
                        case Initiator_sendChal
                        solve( !KU( 'g'^~ephR ) @ #vk.6 )
                          case Responder_recvChal
                          solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltkI), 
                                         'g'^(~ephI*~ltk)>)
                                 ) @ #ku )
                            case RevealSessionKey_case_1
                            by contradiction
                          next
                            case RevealSessionKey_case_2
                            by contradiction
                          next
                            case c_h
                            solve( !KU( ~protoKey ) @ #vk.8 )
                              case NewProto
                              solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.10 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.14 )
                              next
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.14 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.16 )
                              qed
                            qed
                          qed
                        next
                          case cexp
                          by solve( !KU( ~ephR ) @ #vk.8 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.8 )
                      qed
                    next
                      case c_mac
                      solve( !KU( 'g'^~ephI ) @ #vk.4 )
                        case Initiator_sendChal
                        solve( !KU( 'g'^~ephR ) @ #vk.6 )
                          case Responder_recvChal
                          solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltkI), 
                                         'g'^(~ephI*~ltk)>)
                                 ) @ #ku )
                            case RevealSessionKey_case_1
                            by contradiction
                          next
                            case RevealSessionKey_case_2
                            by contradiction
                          next
                            case c_h
                            solve( !KU( ~protoKey ) @ #vk.9 )
                              case NewProto
                              solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.11 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.15 )
                              next
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.15 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.17 )
                              qed
                            qed
                          qed
                        next
                          case cexp
                          by solve( !KU( ~ephR ) @ #vk.9 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.9 )
                      qed
                    qed
                  next
                    case c_mac
                    solve( !KU( mac('g'^~ephR, h(<'g'^(~ephI*~ephR), ~protoKey>))
                           ) @ #vk.6 )
                      case Responder_recvChal
                      solve( !KU( 'g'^~ephI ) @ #vk.4 )
                        case Initiator_sendChal
                        solve( !KU( 'g'^~ephR ) @ #vk.6 )
                          case Responder_recvChal
                          solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltkI), 
                                         'g'^(~ephI*~ltk)>)
                                 ) @ #ku )
                            case RevealSessionKey_case_1
                            by contradiction
                          next
                            case RevealSessionKey_case_2
                            by contradiction
                          next
                            case c_h
                            solve( !KU( ~protoKey ) @ #vk.9 )
                              case NewProto
                              solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.11 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.15 )
                              next
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.15 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.17 )
                              qed
                            qed
                          qed
                        next
                          case cexp
                          by solve( !KU( ~ephR ) @ #vk.9 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.9 )
                      qed
                    next
                      case c_mac
                      solve( !KU( 'g'^~ephI ) @ #vk.4 )
                        case Initiator_sendChal
                        solve( !KU( 'g'^~ephR ) @ #vk.6 )
                          case Responder_recvChal
                          solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltkI), 
                                         'g'^(~ephI*~ltk)>)
                                 ) @ #ku )
                            case RevealSessionKey_case_1
                            by contradiction
                          next
                            case RevealSessionKey_case_2
                            by contradiction
                          next
                            case c_h
                            solve( !KU( ~protoKey ) @ #vk.10 )
                              case NewProto
                              solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.12 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.16 )
                              next
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.16 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.18 )
                              qed
                            qed
                          qed
                        next
                          case cexp
                          by solve( !KU( ~ephR ) @ #vk.10 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.10 )
                      qed
                    qed
                  qed
                next
                  case c_senc
                  solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h(z.2)>, ltkI)
                         ) @ #vk.9 )
                    case Initiator_recvChal_case_1
                    by contradiction
                  next
                    case Initiator_recvChal_case_2
                    solve( !KU( mac(z, h(~protoKey)) ) @ #vk.4 )
                      case Initiator_sendChal_case_1
                      solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltk)>)
                             ) @ #vk.6 )
                        case c_h
                        solve( !KU( ~protoKey ) @ #vk.15 )
                          case NewProto
                          solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                            case Initiator_sendChal
                            by solve( !KU( ~ephR ) @ #vk.19 )
                          next
                            case Responder_recvChal
                            by solve( !KU( ~ephI ) @ #vk.19 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.21 )
                          qed
                        qed
                      qed
                    next
                      case Initiator_sendChal_case_2
                      solve( splitEqs(10) )
                        case split_case_1
                        solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltk)>)
                               ) @ #vk.6 )
                          case c_h
                          solve( !KU( ~protoKey ) @ #vk.15 )
                            case NewProto
                            solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.19 )
                            next
                              case Responder_recvChal
                              by solve( !KU( ~ephI ) @ #vk.19 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.21 )
                            qed
                          qed
                        qed
                      next
                        case split_case_2
                        solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltk)>)
                               ) @ #vk.6 )
                          case c_h
                          solve( !KU( ~protoKey ) @ #vk.15 )
                            case NewProto
                            solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.19 )
                            next
                              case Responder_recvChal
                              by solve( !KU( ~ephI ) @ #vk.19 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.21 )
                            qed
                          qed
                        qed
                      qed
                    next
                      case c_mac
                      solve( !KU( h(<~protoKey, z.1, z.2>) ) @ #vk.6 )
                        case c_h
                        solve( !KU( ~protoKey ) @ #vk.16 )
                          case NewProto
                          solve( !KU( h(<~protoKey, z.1, 'g'^(~ephI*~ltk)>) ) @ #vk.14 )
                            case c_h
                            solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.22 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.27 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.27 )
                            next
                              case Initiator_sendChal
                              solve( !KU( ~ltk ) @ #vk.23 )
                                case Corrupt_ltk
                                solve( splitEqs(1) )
                                  case split_case_01
                                  by contradiction
                                next
                                  case split_case_02
                                  solve( splitEqs(9) )
                                    case split
                                    solve( !KU( 'g'^(~ltk*inv(~ephR)) ) @ #vk.23 )
                                      case Initiator_recvChal_case_1
                                      by solve( !KU( ~ephR ) @ #vk.29 )
                                    next
                                      case Initiator_recvChal_case_2
                                      by solve( !KU( ~ephR ) @ #vk.29 )
                                    next
                                      case RevealPubkey
                                      by solve( !KU( ~ephR ) @ #vk.25 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    qed
                                  qed
                                next
                                  case split_case_03
                                  solve( splitEqs(9) )
                                    case split_case_1
                                    by contradiction
                                  next
                                    case split_case_2
                                    solve( !KU( 'g'^(~ephR*inv((~ephI*~ltk))) ) @ #vk.18 )
                                      case Responder_recvChal
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    qed
                                  qed
                                next
                                  case split_case_04
                                  solve( splitEqs(9) )
                                    case split_case_1
                                    by contradiction
                                  next
                                    case split_case_2
                                    solve( !KU( pk(~ltkI) ) @ #vk.16 )
                                      case Initiator_recvChal_case_1
                                      solve( !KU( mac('g'^inv((~ephI*~ltk)),
                                                      h(<'g'^inv(~ltk), ~protoKey>))
                                             ) @ #vk.19 )
                                        case c_mac
                                        solve( !KU( 'g'^~ltkI ) @ #vk.17 )
                                          case Initiator_recvChal
                                          solve( !KU( h(~protoKey) ) @ #vk.20 )
                                            case c_h
                                            solve( !KU( 'g'^inv((~ephR*~ltk)) ) @ #vk.19 )
                                              case cexp
                                              by solve( !KU( ~ephR ) @ #vk.32 )
                                            qed
                                          qed
                                        next
                                          case cexp
                                          solve( !KU( ~ltkI ) @ #vk.30 )
                                            case Corrupt_ltk
                                            solve( !KU( h(~protoKey) ) @ #vk.21 )
                                              case c_h
                                              solve( !KU( 'g'^inv((~ephR*~ltk)) ) @ #vk.20 )
                                                case cexp
                                                by solve( !KU( ~ephR ) @ #vk.33 )
                                              qed
                                            qed
                                          qed
                                        qed
                                      qed
                                    next
                                      case Initiator_recvChal_case_2
                                      solve( !KU( mac('g'^inv((~ephI*~ltk)),
                                                      h(<'g'^inv(~ltk), ~protoKey>))
                                             ) @ #vk.19 )
                                        case c_mac
                                        solve( !KU( 'g'^~ltkI ) @ #vk.17 )
                                          case Initiator_recvChal
                                          solve( !KU( h(~protoKey) ) @ #vk.20 )
                                            case c_h
                                            solve( !KU( 'g'^inv((~ephR*~ltk)) ) @ #vk.19 )
                                              case cexp
                                              by solve( !KU( ~ephR ) @ #vk.32 )
                                            qed
                                          qed
                                        next
                                          case cexp
                                          solve( !KU( ~ltkI ) @ #vk.30 )
                                            case Corrupt_ltk
                                            solve( !KU( h(~protoKey) ) @ #vk.21 )
                                              case c_h
                                              solve( !KU( 'g'^inv((~ephR*~ltk)) ) @ #vk.20 )
                                                case cexp
                                                by solve( !KU( ~ephR ) @ #vk.33 )
                                              qed
                                            qed
                                          qed
                                        qed
                                      qed
                                    next
                                      case RevealPubkey
                                      solve( !KU( mac('g'^inv((~ephI*~ltk)),
                                                      h(<'g'^inv(~ltk), ~protoKey>))
                                             ) @ #vk.19 )
                                        case c_mac
                                        solve( !KU( 'g'^~ltkI ) @ #vk.17 )
                                          case RevealPubkey
                                          solve( !KU( h(~protoKey) ) @ #vk.20 )
                                            case c_h
                                            solve( !KU( 'g'^inv((~ephR*~ltk)) ) @ #vk.19 )
                                              case cexp
                                              by solve( !KU( ~ephR ) @ #vk.28 )
                                            qed
                                          qed
                                        next
                                          case cexp
                                          solve( !KU( ~ltkI ) @ #vk.26 )
                                            case Corrupt_ltk
                                            solve( !KU( h(~protoKey) ) @ #vk.21 )
                                              case c_h
                                              solve( !KU( 'g'^inv((~ephR*~ltk)) ) @ #vk.20 )
                                                case cexp
                                                by solve( !KU( ~ephR ) @ #vk.29 )
                                              qed
                                            qed
                                          qed
                                        qed
                                      qed
                                    next
                                      case c_pk
                                      solve( !KU( ~ltkI ) @ #vk.24 )
                                        case Corrupt_ltk
                                        solve( !KU( mac('g'^inv((~ephI*~ltk)),
                                                        h(<'g'^inv(~ltk), ~protoKey>))
                                               ) @ #vk.20 )
                                          case c_mac
                                          solve( !KU( 'g'^~ltkI ) @ #vk.18 )
                                            case Initiator_recvChal_case_1
                                            solve( !KU( h(~protoKey) ) @ #vk.21 )
                                              case c_h
                                              solve( !KU( 'g'^inv((~ephR*~ltk)) ) @ #vk.20 )
                                                case cexp
                                                by solve( !KU( ~ephR ) @ #vk.33 )
                                              qed
                                            qed
                                          next
                                            case Initiator_recvChal_case_2
                                            solve( !KU( h(~protoKey) ) @ #vk.21 )
                                              case c_h
                                              solve( !KU( 'g'^inv((~ephR*~ltk)) ) @ #vk.20 )
                                                case cexp
                                                by solve( !KU( ~ephR ) @ #vk.33 )
                                              qed
                                            qed
                                          next
                                            case RevealPubkey
                                            solve( !KU( h(~protoKey) ) @ #vk.21 )
                                              case c_h
                                              solve( !KU( 'g'^inv((~ephR*~ltk)) ) @ #vk.20 )
                                                case cexp
                                                by solve( !KU( ~ephR ) @ #vk.29 )
                                              qed
                                            qed
                                          next
                                            case cexp
                                            solve( !KU( h(~protoKey) ) @ #vk.21 )
                                              case c_h
                                              solve( !KU( 'g'^inv((~ephR*~ltk)) ) @ #vk.20 )
                                                case cexp
                                                by solve( !KU( ~ephR ) @ #vk.29 )
                                              qed
                                            qed
                                          qed
                                        qed
                                      qed
                                    qed
                                  qed
                                next
                                  case split_case_05
                                  solve( !KU( 'g'^(~ephR*ephI) ) @ #vk.22 )
                                    case Initiator_recvChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case Initiator_recvChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.29 )
                                  next
                                    case Initiator_recvChal_case_3
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case Initiator_recvChal_case_4
                                    by solve( !KU( ~ephR ) @ #vk.29 )
                                  next
                                    case Initiator_sendChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.24 )
                                  next
                                    case Initiator_sendChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.25 )
                                  next
                                    case Initiator_sendChal_case_3
                                    by solve( !KU( ~ephR ) @ #vk.24 )
                                  next
                                    case Initiator_sendChal_case_4
                                    by solve( !KU( ~ephR ) @ #vk.25 )
                                  next
                                    case Responder_recvChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.27 )
                                  next
                                    case Responder_recvChal_case_2
                                    solve( splitEqs(9) )
                                      case split_case_01
                                      solve( !KU( 'g'^(~ephR*ephI*inv(~ephI.1)) ) @ #vk.20 )
                                        case Initiator_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_recvChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_sendChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.26 )
                                      next
                                        case Initiator_sendChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.26 )
                                      next
                                        case Initiator_sendChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.26 )
                                      next
                                        case Initiator_sendChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.26 )
                                      next
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.29 )
                                      next
                                        case Responder_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.29 )
                                      next
                                        case Responder_recvChal_case_3
                                        by solve( !KU( ~ephI.1 ) @ #vk.27 )
                                      next
                                        case RevealPubkey_case_1
                                        by solve( !KU( ~ephR ) @ #vk.26 )
                                      next
                                        case RevealPubkey_case_2
                                        by solve( !KU( ~ephR ) @ #vk.26 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.27 )
                                      qed
                                    next
                                      case split_case_02
                                      by solve( !KU( ~ephI ) @ #vk.20 )
                                    next
                                      case split_case_03
                                      solve( !KU( ~ltkI ) @ #vk.25 )
                                        case Corrupt_ltk
                                        solve( !KU( 'g'^(~ephR*inv((~ephI*~ltkI))) ) @ #vk.21 )
                                          case Responder_recvChal
                                          by solve( !KU( ~ephI ) @ #vk.28 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.29 )
                                        qed
                                      qed
                                    next
                                      case split_case_04
                                      by solve( !KU( ~ephI ) @ #vk.25 )
                                    next
                                      case split_case_05
                                      solve( !KU( 'g'^(~ephR*inv((~ephI*x))) ) @ #vk.20 )
                                        case Responder_recvChal
                                        by solve( !KU( ~ephI ) @ #vk.28 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.29 )
                                      qed
                                    next
                                      case split_case_06
                                      solve( !KU( ~ltkI ) @ #vk.26 )
                                        case Corrupt_ltk
                                        solve( !KU( 'g'^(~ephR*inv((~ephI*~ltkI*x))) ) @ #vk.21 )
                                          case Responder_recvChal
                                          by solve( !KU( ~ephI ) @ #vk.30 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.31 )
                                        qed
                                      qed
                                    next
                                      case split_case_07
                                      by solve( !KU( ~ephI ) @ #vk.25 )
                                    next
                                      case split_case_08
                                      by solve( !KU( ~ephI ) @ #vk.25 )
                                    next
                                      case split_case_09
                                      solve( !KU( 'g'^(~ephR*x*inv((~ephI*~ltkI))) ) @ #vk.20 )
                                        case Initiator_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_recvChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_sendChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_sendChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_sendChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_sendChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.33 )
                                      next
                                        case Responder_recvChal_case_2
                                        by solve( !KU( ~ephI ) @ #vk.31 )
                                      next
                                        case Responder_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.33 )
                                      next
                                        case RevealPubkey_case_1
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case RevealPubkey_case_2
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      qed
                                    next
                                      case split_case_10
                                      by solve( !KU( ~ephI ) @ #vk.25 )
                                    next
                                      case split_case_11
                                      solve( !KU( 'g'^(~ephR*x*inv((~ephI*x.1))) ) @ #vk.20 )
                                        case Initiator_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_recvChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_sendChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_sendChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_sendChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_sendChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.33 )
                                      next
                                        case Responder_recvChal_case_2
                                        by solve( !KU( ~ephI ) @ #vk.31 )
                                      next
                                        case Responder_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.33 )
                                      next
                                        case RevealPubkey_case_1
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case RevealPubkey_case_2
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      qed
                                    next
                                      case split_case_12
                                      solve( !KU( 'g'^(~ephR*x*inv((~ephI*~ltkI*x.1))) ) @ #vk.20 )
                                        case Initiator_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.36 )
                                      next
                                        case Initiator_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.36 )
                                      next
                                        case Initiator_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.36 )
                                      next
                                        case Initiator_recvChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.36 )
                                      next
                                        case Initiator_sendChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case Initiator_sendChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case Initiator_sendChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case Initiator_sendChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Responder_recvChal_case_2
                                        by solve( !KU( ~ephI ) @ #vk.33 )
                                      next
                                        case Responder_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case RevealPubkey_case_1
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case RevealPubkey_case_2
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.33 )
                                      qed
                                    next
                                      case split_case_13
                                      by solve( !KU( ~ephI ) @ #vk.25 )
                                    qed
                                  next
                                    case Responder_recvChal_case_3
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case RevealPubkey_case_1
                                    by solve( !KU( ~ephR ) @ #vk.24 )
                                  next
                                    case RevealPubkey_case_2
                                    by solve( !KU( ~ephR ) @ #vk.25 )
                                  next
                                    case cexp
                                    by solve( !KU( ~ephR ) @ #vk.26 )
                                  qed
                                next
                                  case split_case_06
                                  solve( !KU( 'g'^(~ltk*inv((~ephR*x))) ) @ #vk.23 )
                                    case Initiator_recvChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.30 )
                                  next
                                    case Initiator_recvChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.30 )
                                  next
                                    case RevealPubkey
                                    by solve( !KU( ~ephR ) @ #vk.26 )
                                  next
                                    case cexp
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  qed
                                next
                                  case split_case_07
                                  solve( splitEqs(9) )
                                    case split_case_1
                                    solve( !KU( 'g'^(~ephR*inv((~ephI*~ltk*~ltkI))) ) @ #vk.18 )
                                      case Responder_recvChal
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephR ) @ #vk.27 )
                                    qed
                                  next
                                    case split_case_2
                                    by contradiction
                                  next
                                    case split_case_3
                                    solve( !KU( 'g'^(~ephR*inv((~ephI*~ltk*x))) ) @ #vk.18 )
                                      case Responder_recvChal
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephR ) @ #vk.27 )
                                    qed
                                  next
                                    case split_case_4
                                    solve( !KU( 'g'^(~ephR*inv((~ephI*~ltk*~ltkI*x))) ) @ #vk.18 )
                                      case Responder_recvChal
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephR ) @ #vk.27 )
                                    qed
                                  qed
                                next
                                  case split_case_08
                                  solve( !KU( 'g'^(x*inv(~ephR)) ) @ #vk.13 )
                                    case Initiator_recvChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.29 )
                                  next
                                    case Initiator_recvChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.31 )
                                  next
                                    case Initiator_recvChal_case_3
                                    by solve( !KU( ~ephR ) @ #vk.29 )
                                  next
                                    case Initiator_recvChal_case_4
                                    by solve( !KU( ~ephR ) @ #vk.31 )
                                  next
                                    case Initiator_sendChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.25 )
                                  next
                                    case Initiator_sendChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.27 )
                                  next
                                    case Initiator_sendChal_case_3
                                    by solve( !KU( ~ephR ) @ #vk.25 )
                                  next
                                    case Initiator_sendChal_case_4
                                    by solve( !KU( ~ephR ) @ #vk.27 )
                                  next
                                    case Responder_recvChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case Responder_recvChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.30 )
                                  next
                                    case RevealPubkey_case_1
                                    by solve( !KU( ~ephR ) @ #vk.25 )
                                  next
                                    case RevealPubkey_case_2
                                    by solve( !KU( ~ephR ) @ #vk.27 )
                                  next
                                    case cexp
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  qed
                                next
                                  case split_case_09
                                  solve( splitEqs(9) )
                                    case split_case_1
                                    by contradiction
                                  next
                                    case split_case_2
                                    solve( !KU( 'g'^(~ephI*inv(~ltk)) ) @ #vk.14 )
                                      case Initiator_sendChal
                                      solve( !KU( 'g'^(~ephR*inv(~ltk)) ) @ #vk.21 )
                                        case Responder_recvChal
                                        solve( !KU( 'g'^(~ephI*~ephR*inv(~ltk)) ) @ #vk.24 )
                                          case Initiator_sendChal
                                          by solve( !KU( ~ephR ) @ #vk.26 )
                                        next
                                          case Responder_recvChal
                                          by solve( !KU( ~ephI ) @ #vk.26 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephI ) @ #vk.27 )
                                        qed
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.27 )
                                      qed
                                    next
                                      case cexp
                                      by solve( !KU( ~ephI ) @ #vk.27 )
                                    qed
                                  next
                                    case split_case_3
                                    by contradiction
                                  next
                                    case split_case_4
                                    solve( !KU( 'g'^(~ephR*x*inv((~ephI*~ltk))) ) @ #vk.18 )
                                      case Initiator_recvChal_case_1
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_2
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_3
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_4
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_sendChal_case_1
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_2
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_3
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_4
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Responder_recvChal_case_1
                                      by solve( !KU( ~ephR ) @ #vk.29 )
                                    next
                                      case Responder_recvChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.28 )
                                    next
                                      case Responder_recvChal_case_3
                                      by solve( !KU( ~ephR ) @ #vk.29 )
                                    next
                                      case RevealPubkey_case_1
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case RevealPubkey_case_2
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephR ) @ #vk.27 )
                                    qed
                                  next
                                    case split_case_5
                                    by contradiction
                                  next
                                    case split_case_6
                                    solve( !KU( 'g'^(~ephI*~ephR*x*inv(~ltk)) ) @ #vk.22 )
                                      case Initiator_recvChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_3
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_4
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_sendChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_3
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_4
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_5
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Responder_recvChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.29 )
                                    next
                                      case Responder_recvChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.29 )
                                    next
                                      case Responder_recvChal_case_3
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case RevealPubkey_case_1
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case RevealPubkey_case_2
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephI ) @ #vk.27 )
                                    qed
                                  qed
                                next
                                  case split_case_10
                                  solve( !KU( 'g'^inv((~ephR*x)) ) @ #vk.23 )
                                    case cexp
                                    by solve( !KU( ~ephR ) @ #vk.27 )
                                  qed
                                next
                                  case split_case_11
                                  solve( !KU( 'g'^(x*inv((~ephR*~ltk))) ) @ #vk.13 )
                                    case Initiator_recvChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.30 )
                                  next
                                    case Initiator_recvChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.32 )
                                  next
                                    case Initiator_recvChal_case_3
                                    by solve( !KU( ~ephR ) @ #vk.30 )
                                  next
                                    case Initiator_recvChal_case_4
                                    by solve( !KU( ~ephR ) @ #vk.32 )
                                  next
                                    case Initiator_sendChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.26 )
                                  next
                                    case Initiator_sendChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case Initiator_sendChal_case_3
                                    by solve( !KU( ~ephR ) @ #vk.26 )
                                  next
                                    case Initiator_sendChal_case_4
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case Responder_recvChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.29 )
                                  next
                                    case Responder_recvChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.31 )
                                  next
                                    case RevealPubkey_case_1
                                    by solve( !KU( ~ephR ) @ #vk.26 )
                                  next
                                    case RevealPubkey_case_2
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case cexp
                                    by solve( !KU( ~ephR ) @ #vk.29 )
                                  qed
                                next
                                  case split_case_12
                                  solve( !KU( 'g'^(x*inv((~ephR*x.1))) ) @ #vk.13 )
                                    case Initiator_recvChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.30 )
                                  next
                                    case Initiator_recvChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.32 )
                                  next
                                    case Initiator_recvChal_case_3
                                    by solve( !KU( ~ephR ) @ #vk.30 )
                                  next
                                    case Initiator_recvChal_case_4
                                    by solve( !KU( ~ephR ) @ #vk.32 )
                                  next
                                    case Initiator_sendChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.26 )
                                  next
                                    case Initiator_sendChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case Initiator_sendChal_case_3
                                    by solve( !KU( ~ephR ) @ #vk.26 )
                                  next
                                    case Initiator_sendChal_case_4
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case Responder_recvChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.29 )
                                  next
                                    case Responder_recvChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.31 )
                                  next
                                    case RevealPubkey_case_1
                                    by solve( !KU( ~ephR ) @ #vk.26 )
                                  next
                                    case RevealPubkey_case_2
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case cexp
                                    by solve( !KU( ~ephR ) @ #vk.29 )
                                  qed
                                next
                                  case split_case_13
                                  solve( splitEqs(9) )
                                    case split_case_01
                                    solve( !KU( 'g'^(~ephI*inv((~ltk*~ltkI))) ) @ #vk.13 )
                                      case Initiator_sendChal
                                      solve( !KU( ~ltkI ) @ #vk.26 )
                                        case Corrupt_ltk
                                        solve( !KU( 'g'^(~ephR*inv((~ltk*~ltkI))) ) @ #vk.21 )
                                          case Responder_recvChal
                                          solve( !KU( 'g'^(~ephI*~ephR*inv((~ltk*~ltkI)))
                                                 ) @ #vk.25 )
                                            case Initiator_sendChal
                                            by solve( !KU( ~ephR ) @ #vk.28 )
                                          next
                                            case Responder_recvChal
                                            by solve( !KU( ~ephI ) @ #vk.28 )
                                          next
                                            case cexp
                                            by solve( !KU( ~ephI ) @ #vk.29 )
                                          qed
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.29 )
                                        qed
                                      qed
                                    next
                                      case cexp
                                      by solve( !KU( ~ephI ) @ #vk.27 )
                                    qed
                                  next
                                    case split_case_02
                                    solve( !KU( 'g'^(~ephR*x*inv((~ephI*~ltk*~ltkI))) ) @ #vk.18 )
                                      case Initiator_recvChal_case_1
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_2
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_3
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_4
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_sendChal_case_1
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_2
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_3
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_4
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Responder_recvChal_case_1
                                      by solve( !KU( ~ephR ) @ #vk.29 )
                                    next
                                      case Responder_recvChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.28 )
                                    next
                                      case Responder_recvChal_case_3
                                      by solve( !KU( ~ephR ) @ #vk.29 )
                                    next
                                      case RevealPubkey_case_1
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case RevealPubkey_case_2
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephR ) @ #vk.27 )
                                    qed
                                  next
                                    case split_case_03
                                    by contradiction
                                  next
                                    case split_case_04
                                    by contradiction
                                  next
                                    case split_case_05
                                    solve( !KU( 'g'^(~ephI*~ephR*inv((~ltk*x))) ) @ #vk.22 )
                                      case Initiator_sendChal
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Responder_recvChal
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephI ) @ #vk.27 )
                                    qed
                                  next
                                    case split_case_06
                                    solve( !KU( 'g'^(x*inv((~ltk*x.1))) ) @ #vk.13 )
                                      case Initiator_recvChal_case_1
                                      solve( !KU( 'g'^(~ephR*~x*inv((~ephI*~ltk*x.1))) ) @ #vk.19 )
                                        case Initiator_recvChal
                                        by solve( !KU( ~ephR ) @ #vk.33 )
                                      next
                                        case Responder_recvChal
                                        solve( !KU( ~x ) @ #vk.33 )
                                          case Corrupt_ltk
                                          by solve( !KU( ~ephI ) @ #vk.35 )
                                        qed
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      qed
                                    next
                                      case Initiator_recvChal_case_2
                                      solve( !KU( 'g'^(~ephR*~ltkI*x*inv((~ephI*~ltk*x.1)))
                                             ) @ #vk.19 )
                                        case Initiator_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.39 )
                                      next
                                        case Initiator_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.39 )
                                      next
                                        case Initiator_recvChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.39 )
                                      next
                                        case Initiator_recvChal_case_5
                                        by solve( !KU( ~ephR ) @ #vk.39 )
                                      next
                                        case Initiator_sendChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_sendChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_sendChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_sendChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.38 )
                                      next
                                        case Responder_recvChal_case_2
                                        solve( !KU( ~ltkI ) @ #vk.35 )
                                          case Corrupt_ltk
                                          by solve( !KU( ~ephI ) @ #vk.37 )
                                        qed
                                      next
                                        case Responder_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.38 )
                                      next
                                        case RevealPubkey_case_1
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case RevealPubkey_case_2
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.36 )
                                      qed
                                    next
                                      case Initiator_recvChal_case_3
                                      solve( !KU( 'g'^(~ephR*~x*inv((~ephI*~ltk*x.1))) ) @ #vk.19 )
                                        case Initiator_recvChal
                                        by solve( !KU( ~ephR ) @ #vk.33 )
                                      next
                                        case Responder_recvChal
                                        solve( !KU( ~x ) @ #vk.33 )
                                          case Corrupt_ltk
                                          by solve( !KU( ~ephI ) @ #vk.35 )
                                        qed
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      qed
                                    next
                                      case Initiator_recvChal_case_4
                                      solve( !KU( 'g'^(~ephR*~ltkI*x*inv((~ephI*~ltk*x.1)))
                                             ) @ #vk.19 )
                                        case Initiator_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.39 )
                                      next
                                        case Initiator_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.39 )
                                      next
                                        case Initiator_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.39 )
                                      next
                                        case Initiator_recvChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_recvChal_case_5
                                        by solve( !KU( ~ephR ) @ #vk.39 )
                                      next
                                        case Initiator_sendChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_sendChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_sendChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_sendChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.38 )
                                      next
                                        case Responder_recvChal_case_2
                                        solve( !KU( ~ltkI ) @ #vk.35 )
                                          case Corrupt_ltk
                                          by solve( !KU( ~ephI ) @ #vk.37 )
                                        qed
                                      next
                                        case Responder_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.38 )
                                      next
                                        case RevealPubkey_case_1
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case RevealPubkey_case_2
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.36 )
                                      qed
                                    next
                                      case Initiator_sendChal_case_1
                                      solve( !KU( 'g'^(~ephR*~x*inv((~ephI*~ltk*x.1))) ) @ #vk.19 )
                                        case Initiator_sendChal
                                        by solve( !KU( ~ephR ) @ #vk.29 )
                                      next
                                        case Responder_recvChal
                                        by solve( !KU( ~x ) @ #vk.29 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      qed
                                    next
                                      case Initiator_sendChal_case_2
                                      solve( !KU( 'g'^(~ephI*~ephR*x*inv((~ltk*~ephI.1*x.1)))
                                             ) @ #vk.19 )
                                        case Initiator_recvChal_case_1
                                        by solve( !KU( ~ephI ) @ #vk.35 )
                                      next
                                        case Initiator_recvChal_case_2
                                        by solve( !KU( ~ephI ) @ #vk.35 )
                                      next
                                        case Initiator_recvChal_case_3
                                        by solve( !KU( ~ephI ) @ #vk.35 )
                                      next
                                        case Initiator_recvChal_case_4
                                        by solve( !KU( ~ephI ) @ #vk.35 )
                                      next
                                        case Initiator_sendChal_case_1
                                        by solve( !KU( ~ephI ) @ #vk.31 )
                                      next
                                        case Initiator_sendChal_case_2
                                        by solve( !KU( ~ephI ) @ #vk.31 )
                                      next
                                        case Initiator_sendChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      next
                                        case Initiator_sendChal_case_4
                                        by solve( !KU( ~ephI ) @ #vk.31 )
                                      next
                                        case Initiator_sendChal_case_5
                                        by solve( !KU( ~ephI ) @ #vk.31 )
                                      next
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephI ) @ #vk.34 )
                                      next
                                        case Responder_recvChal_case_2
                                        by solve( !KU( ~ephI ) @ #vk.34 )
                                      next
                                        case Responder_recvChal_case_3
                                        by solve( !KU( ~ephI ) @ #vk.31 )
                                      next
                                        case RevealPubkey_case_1
                                        by solve( !KU( ~ephI ) @ #vk.31 )
                                      next
                                        case RevealPubkey_case_2
                                        by solve( !KU( ~ephI ) @ #vk.31 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephI ) @ #vk.32 )
                                      qed
                                    next
                                      case Initiator_sendChal_case_3
                                      solve( splitEqs(13) )
                                        case split_case_1
                                        solve( !KU( 'g'^(~ephR*~x*inv((~ephI*~ltk*x.1)))
                                               ) @ #vk.20 )
                                          case Initiator_sendChal
                                          by solve( !KU( ~ephR ) @ #vk.29 )
                                        next
                                          case Responder_recvChal
                                          by solve( !KU( ~x ) @ #vk.29 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.30 )
                                        qed
                                      next
                                        case split_case_2
                                        solve( !KU( 'g'^(~ephR*~x*inv((~ephI*~ltk*x.1)))
                                               ) @ #vk.20 )
                                          case Initiator_sendChal
                                          by solve( !KU( ~ephR ) @ #vk.29 )
                                        next
                                          case Responder_recvChal
                                          by solve( !KU( ~x ) @ #vk.29 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.30 )
                                        qed
                                      qed
                                    next
                                      case Initiator_sendChal_case_4
                                      solve( splitEqs(13) )
                                        case split_case_1
                                        solve( !KU( 'g'^(~ephI*~ephR*x*inv((~ltk*~ephI.1*x.1)))
                                               ) @ #vk.20 )
                                          case Initiator_recvChal_case_1
                                          by solve( !KU( ~ephI ) @ #vk.35 )
                                        next
                                          case Initiator_recvChal_case_2
                                          by solve( !KU( ~ephI ) @ #vk.35 )
                                        next
                                          case Initiator_recvChal_case_3
                                          by solve( !KU( ~ephI ) @ #vk.35 )
                                        next
                                          case Initiator_recvChal_case_4
                                          by solve( !KU( ~ephI ) @ #vk.35 )
                                        next
                                          case Initiator_sendChal_case_1
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case Initiator_sendChal_case_2
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case Initiator_sendChal_case_3
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case Initiator_sendChal_case_4
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case Initiator_sendChal_case_5
                                          by solve( !KU( ~ephR ) @ #vk.31 )
                                        next
                                          case Responder_recvChal_case_1
                                          by solve( !KU( ~ephI ) @ #vk.34 )
                                        next
                                          case Responder_recvChal_case_2
                                          by solve( !KU( ~ephI ) @ #vk.34 )
                                        next
                                          case Responder_recvChal_case_3
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case RevealPubkey_case_1
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case RevealPubkey_case_2
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephI ) @ #vk.32 )
                                        qed
                                      next
                                        case split_case_2
                                        solve( !KU( 'g'^(~ephI*~ephR*x*inv((~ltk*~ephI.1*x.1)))
                                               ) @ #vk.20 )
                                          case Initiator_recvChal_case_1
                                          by solve( !KU( ~ephI ) @ #vk.35 )
                                        next
                                          case Initiator_recvChal_case_2
                                          by solve( !KU( ~ephI ) @ #vk.35 )
                                        next
                                          case Initiator_recvChal_case_3
                                          by solve( !KU( ~ephI ) @ #vk.35 )
                                        next
                                          case Initiator_recvChal_case_4
                                          by solve( !KU( ~ephI ) @ #vk.35 )
                                        next
                                          case Initiator_sendChal_case_1
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case Initiator_sendChal_case_2
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case Initiator_sendChal_case_3
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case Initiator_sendChal_case_4
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case Initiator_sendChal_case_5
                                          by solve( !KU( ~ephR ) @ #vk.31 )
                                        next
                                          case Responder_recvChal_case_1
                                          by solve( !KU( ~ephI ) @ #vk.34 )
                                        next
                                          case Responder_recvChal_case_2
                                          by solve( !KU( ~ephI ) @ #vk.34 )
                                        next
                                          case Responder_recvChal_case_3
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case RevealPubkey_case_1
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case RevealPubkey_case_2
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephI ) @ #vk.32 )
                                        qed
                                      qed
                                    next
                                      case Responder_recvChal_case_1
                                      solve( !KU( 'g'^(~ephR*~x*inv((~ephI*~ltk*x.1))) ) @ #vk.19 )
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case Responder_recvChal_case_2
                                        by solve( !KU( ~x ) @ #vk.32 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.33 )
                                      qed
                                    next
                                      case Responder_recvChal_case_2
                                      solve( !KU( 'g'^(~ephR*x*~ephR.1*inv((~ephI*~ltk*x.1)))
                                             ) @ #vk.19 )
                                        case Initiator_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.38 )
                                      next
                                        case Initiator_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.38 )
                                      next
                                        case Initiator_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.38 )
                                      next
                                        case Initiator_recvChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.38 )
                                      next
                                        case Initiator_sendChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_sendChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_sendChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_sendChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.37 )
                                      next
                                        case Responder_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Responder_recvChal_case_3
                                        by solve( !KU( ~ephR.1 ) @ #vk.34 )
                                      next
                                        case Responder_recvChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.37 )
                                      next
                                        case RevealPubkey_case_1
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case RevealPubkey_case_2
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      qed
                                    next
                                      case RevealPubkey_case_1
                                      solve( !KU( 'g'^(~ephR*~x*inv((~ephI*~ltk*x.1))) ) @ #vk.19 )
                                        case Responder_recvChal
                                        solve( !KU( ~x ) @ #vk.29 )
                                          case Corrupt_ltk
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        qed
                                      next
                                        case RevealPubkey
                                        by solve( !KU( ~ephR ) @ #vk.29 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      qed
                                    next
                                      case RevealPubkey_case_2
                                      solve( !KU( 'g'^(~ephR*x*~ltk.1*inv((~ephI*~ltk*x.1)))
                                             ) @ #vk.19 )
                                        case Initiator_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_recvChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Initiator_sendChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      next
                                        case Initiator_sendChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      next
                                        case Initiator_sendChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      next
                                        case Initiator_sendChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      next
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Responder_recvChal_case_2
                                        solve( !KU( ~ltk.1 ) @ #vk.31 )
                                          case Corrupt_ltk
                                          by solve( !KU( ~ephI ) @ #vk.33 )
                                        qed
                                      next
                                        case Responder_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case RevealPubkey_case_1
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      next
                                        case RevealPubkey_case_2
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      next
                                        case RevealPubkey_case_3
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      qed
                                    next
                                      case cexp
                                      solve( !KU( 'g'^(~ephR*x*inv((~ephI*~ltk*x.1))) ) @ #vk.19 )
                                        case Initiator_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.36 )
                                      next
                                        case Initiator_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.36 )
                                      next
                                        case Initiator_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.36 )
                                      next
                                        case Initiator_recvChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.36 )
                                      next
                                        case Initiator_sendChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case Initiator_sendChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case Initiator_sendChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case Initiator_sendChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case Responder_recvChal_case_2
                                        by solve( !KU( ~ephI ) @ #vk.33 )
                                      next
                                        case Responder_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.35 )
                                      next
                                        case RevealPubkey_case_1
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case RevealPubkey_case_2
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      qed
                                    qed
                                  next
                                    case split_case_07
                                    by contradiction
                                  next
                                    case split_case_08
                                    solve( !KU( 'g'^(~ephI*x*inv((~ltk*~ltkI))) ) @ #vk.13 )
                                      case Initiator_recvChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_3
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_4
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_sendChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_3
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_4
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_5
                                      solve( !KU( ~ltkI ) @ #vk.28 )
                                        case Corrupt_ltk
                                        solve( !KU( 'g'^(~ephR*x*inv((~ltk*~ltkI))) ) @ #vk.21 )
                                          case Initiator_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.34 )
                                        next
                                          case Initiator_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.34 )
                                        next
                                          case Initiator_recvChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.34 )
                                        next
                                          case Initiator_recvChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.34 )
                                        next
                                          case Initiator_sendChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.30 )
                                        next
                                          case Initiator_sendChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.30 )
                                        next
                                          case Initiator_sendChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.30 )
                                        next
                                          case Initiator_sendChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.30 )
                                        next
                                          case Responder_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Responder_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Responder_recvChal_case_3
                                          solve( !KU( 'g'^(~ephI*~ephR*x*inv((~ltk*~ltkI)))
                                                 ) @ #vk.26 )
                                            case Initiator_recvChal_case_1
                                            by solve( !KU( ~ephI ) @ #vk.34 )
                                          next
                                            case Initiator_recvChal_case_2
                                            by solve( !KU( ~ephI ) @ #vk.34 )
                                          next
                                            case Initiator_recvChal_case_3
                                            by solve( !KU( ~ephI ) @ #vk.34 )
                                          next
                                            case Initiator_recvChal_case_4
                                            by solve( !KU( ~ephI ) @ #vk.34 )
                                          next
                                            case Initiator_sendChal_case_1
                                            by solve( !KU( ~ephI ) @ #vk.30 )
                                          next
                                            case Initiator_sendChal_case_2
                                            by solve( !KU( ~ephI ) @ #vk.30 )
                                          next
                                            case Initiator_sendChal_case_3
                                            by solve( !KU( ~ephI ) @ #vk.30 )
                                          next
                                            case Initiator_sendChal_case_4
                                            by solve( !KU( ~ephI ) @ #vk.30 )
                                          next
                                            case Initiator_sendChal_case_5
                                            by solve( !KU( ~ephR ) @ #vk.30 )
                                          next
                                            case Responder_recvChal_case_1
                                            by solve( !KU( ~ephI ) @ #vk.33 )
                                          next
                                            case Responder_recvChal_case_2
                                            by solve( !KU( ~ephI ) @ #vk.33 )
                                          next
                                            case Responder_recvChal_case_3
                                            by solve( !KU( ~ephI ) @ #vk.30 )
                                          next
                                            case RevealPubkey_case_1
                                            by solve( !KU( ~ephI ) @ #vk.30 )
                                          next
                                            case RevealPubkey_case_2
                                            by solve( !KU( ~ephI ) @ #vk.30 )
                                          next
                                            case cexp
                                            by solve( !KU( ~ephI ) @ #vk.31 )
                                          qed
                                        next
                                          case RevealPubkey_case_1
                                          by solve( !KU( ~ephR ) @ #vk.30 )
                                        next
                                          case RevealPubkey_case_2
                                          by solve( !KU( ~ephR ) @ #vk.30 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.31 )
                                        qed
                                      qed
                                    next
                                      case Responder_recvChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.29 )
                                    next
                                      case Responder_recvChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.29 )
                                    next
                                      case RevealPubkey_case_1
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case RevealPubkey_case_2
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephI ) @ #vk.27 )
                                    qed
                                  next
                                    case split_case_09
                                    solve( !KU( 'g'^(~ephI*x*inv((~ltk*x.1))) ) @ #vk.13 )
                                      case Initiator_recvChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_3
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_4
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_sendChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_3
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_4
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_5
                                      solve( !KU( 'g'^(~ephR*x*inv((~ltk*x.1))) ) @ #vk.19 )
                                        case Initiator_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_recvChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_recvChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.34 )
                                      next
                                        case Initiator_sendChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_sendChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_sendChal_case_3
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Initiator_sendChal_case_4
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Responder_recvChal_case_1
                                        by solve( !KU( ~ephR ) @ #vk.33 )
                                      next
                                        case Responder_recvChal_case_2
                                        by solve( !KU( ~ephR ) @ #vk.33 )
                                      next
                                        case Responder_recvChal_case_3
                                        solve( !KU( 'g'^(~ephI*~ephR*x*inv((~ltk*x.1))) ) @ #vk.24 )
                                          case Initiator_recvChal_case_1
                                          by solve( !KU( ~ephI ) @ #vk.34 )
                                        next
                                          case Initiator_recvChal_case_2
                                          by solve( !KU( ~ephI ) @ #vk.34 )
                                        next
                                          case Initiator_recvChal_case_3
                                          by solve( !KU( ~ephI ) @ #vk.34 )
                                        next
                                          case Initiator_recvChal_case_4
                                          by solve( !KU( ~ephI ) @ #vk.34 )
                                        next
                                          case Initiator_sendChal_case_1
                                          by solve( !KU( ~ephI ) @ #vk.30 )
                                        next
                                          case Initiator_sendChal_case_2
                                          by solve( !KU( ~ephI ) @ #vk.30 )
                                        next
                                          case Initiator_sendChal_case_3
                                          by solve( !KU( ~ephI ) @ #vk.30 )
                                        next
                                          case Initiator_sendChal_case_4
                                          by solve( !KU( ~ephI ) @ #vk.30 )
                                        next
                                          case Initiator_sendChal_case_5
                                          by solve( !KU( ~ephR ) @ #vk.30 )
                                        next
                                          case Responder_recvChal_case_1
                                          by solve( !KU( ~ephI ) @ #vk.33 )
                                        next
                                          case Responder_recvChal_case_2
                                          by solve( !KU( ~ephI ) @ #vk.33 )
                                        next
                                          case Responder_recvChal_case_3
                                          by solve( !KU( ~ephI ) @ #vk.30 )
                                        next
                                          case RevealPubkey_case_1
                                          by solve( !KU( ~ephI ) @ #vk.30 )
                                        next
                                          case RevealPubkey_case_2
                                          by solve( !KU( ~ephI ) @ #vk.30 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephI ) @ #vk.31 )
                                        qed
                                      next
                                        case RevealPubkey_case_1
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case RevealPubkey_case_2
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      qed
                                    next
                                      case Responder_recvChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.29 )
                                    next
                                      case Responder_recvChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.29 )
                                    next
                                      case RevealPubkey_case_1
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case RevealPubkey_case_2
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephI ) @ #vk.27 )
                                    qed
                                  next
                                    case split_case_10
                                    solve( !KU( 'g'^(~ephI*inv((~ltk*~ltkI*x))) ) @ #vk.13 )
                                      case Initiator_sendChal
                                      solve( !KU( ~ltkI ) @ #vk.26 )
                                        case Corrupt_ltk
                                        solve( !KU( 'g'^(~ephR*inv((~ltk*~ltkI*x))) ) @ #vk.21 )
                                          case Responder_recvChal
                                          solve( !KU( 'g'^(~ephI*~ephR*inv((~ltk*~ltkI*x)))
                                                 ) @ #vk.25 )
                                            case Initiator_sendChal
                                            by solve( !KU( ~ephR ) @ #vk.29 )
                                          next
                                            case Responder_recvChal
                                            by solve( !KU( ~ephI ) @ #vk.29 )
                                          next
                                            case cexp
                                            by solve( !KU( ~ephI ) @ #vk.30 )
                                          qed
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.30 )
                                        qed
                                      qed
                                    next
                                      case cexp
                                      by solve( !KU( ~ephI ) @ #vk.27 )
                                    qed
                                  next
                                    case split_case_11
                                    solve( !KU( 'g'^(~ephR*x*inv((~ephI*~ltk*~ltkI*x.1)))
                                           ) @ #vk.18 )
                                      case Initiator_recvChal_case_1
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_2
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_3
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_4
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Initiator_sendChal_case_1
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_2
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_3
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_4
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Responder_recvChal_case_1
                                      by solve( !KU( ~ephR ) @ #vk.29 )
                                    next
                                      case Responder_recvChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.28 )
                                    next
                                      case Responder_recvChal_case_3
                                      by solve( !KU( ~ephR ) @ #vk.29 )
                                    next
                                      case RevealPubkey_case_1
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case RevealPubkey_case_2
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephR ) @ #vk.27 )
                                    qed
                                  next
                                    case split_case_12
                                    solve( !KU( 'g'^(~ephI*~ephR*x*inv((~ltk*~ltkI*x.1)))
                                           ) @ #vk.22 )
                                      case Initiator_recvChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_3
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_recvChal_case_4
                                      by solve( !KU( ~ephI ) @ #vk.30 )
                                    next
                                      case Initiator_sendChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_3
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_4
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case Initiator_sendChal_case_5
                                      by solve( !KU( ~ephR ) @ #vk.26 )
                                    next
                                      case Responder_recvChal_case_1
                                      by solve( !KU( ~ephI ) @ #vk.29 )
                                    next
                                      case Responder_recvChal_case_2
                                      by solve( !KU( ~ephI ) @ #vk.29 )
                                    next
                                      case Responder_recvChal_case_3
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case RevealPubkey_case_1
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case RevealPubkey_case_2
                                      by solve( !KU( ~ephI ) @ #vk.26 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephI ) @ #vk.27 )
                                    qed
                                  qed
                                next
                                  case split_case_14
                                  solve( !KU( 'g'^(x*inv((~ephR*~ltk*x.1))) ) @ #vk.13 )
                                    case Initiator_recvChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.30 )
                                  next
                                    case Initiator_recvChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.32 )
                                  next
                                    case Initiator_recvChal_case_3
                                    by solve( !KU( ~ephR ) @ #vk.30 )
                                  next
                                    case Initiator_recvChal_case_4
                                    by solve( !KU( ~ephR ) @ #vk.32 )
                                  next
                                    case Initiator_sendChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.26 )
                                  next
                                    case Initiator_sendChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case Initiator_sendChal_case_3
                                    by solve( !KU( ~ephR ) @ #vk.26 )
                                  next
                                    case Initiator_sendChal_case_4
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case Responder_recvChal_case_1
                                    by solve( !KU( ~ephR ) @ #vk.29 )
                                  next
                                    case Responder_recvChal_case_2
                                    by solve( !KU( ~ephR ) @ #vk.31 )
                                  next
                                    case RevealPubkey_case_1
                                    by solve( !KU( ~ephR ) @ #vk.26 )
                                  next
                                    case RevealPubkey_case_2
                                    by solve( !KU( ~ephR ) @ #vk.28 )
                                  next
                                    case cexp
                                    by solve( !KU( ~ephR ) @ #vk.29 )
                                  qed
                                qed
                              qed
                            next
                              case RevealPubkey
                              by solve( !KU( ~ephI ) @ #vk.23 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.25 )
                            qed
                          qed
                        qed
                      qed
                    qed
                  next
                    case c_sign
                    by contradiction
                  qed
                qed
              qed
            qed
          qed
        qed
      qed
    qed
  qed
qed

lemma delegation_reuse [reuse, use_induction]:
  all-traces
  "∀ sub rsc #cap.
    ((HasCapability( sub, rsc ) @ #cap) ∧ (¬(IsAgent( sub ) @ #cap))) ⇒
    (∃ #mk. (IsAgent( sub ) @ #mk) ∧ (#mk < #cap))"
/*
guarded formula characterizing all counter-examples:
"∃ sub rsc #cap.
  (HasCapability( sub, rsc ) @ #cap)
 ∧
  (¬(IsAgent( sub ) @ #cap)) ∧
  (∀ #mk. (IsAgent( sub ) @ #mk) ⇒ ¬(#mk < #cap))"
*/
induction
  case empty_trace
  by contradiction
next
  case non_empty_trace
  simplify
  solve( (last(#cap))  ∥ (IsAgent( sub ) @ #cap)  ∥
         (∃ #mk. (IsAgent( sub ) @ #mk) ∧ (¬(last(#mk))) ∧ (#mk < #cap)) )
    case case_1
    solve( HasCapability( sub, rsc ) @ #cap )
      case Delegate
      solve( !Agent( sub, ~ltk ) ▶₁ #cap )
        case NewAgent
        by contradiction
      qed
    next
      case NewAgent
      by contradiction
    qed
  next
    case case_2
    by contradiction
  next
    case case_3
    by contradiction
  qed
qed

lemma secrecy_capabilities:
  all-traces
  "∀ pk pkDH pkSign #mk.
    (((((IsAgent( pk ) @ #mk) ∧
        (AgentPubkey( pk, pkDH, pkSign ) @ #mk)) ∧
       (¬(∃ #c. LtkCorrupt( pk ) @ #c))) ∧
      (¬(∃ #r. RevealPublicKey( pk ) @ #r))) ∧
     (¬(∃ isid pkR k2 #dial #gotsecret.
         ((((SessionRole( isid, 'I' ) @ #dial) ∧
            (SessionInitiator( isid, pk ) @ #dial)) ∧
           (SessionResponder( isid, pkR ) @ #dial)) ∧
          (SessionKey( isid, k2 ) @ #gotsecret)) ∧
         (∀ #mk.1.
           (IsAgent( pkR ) @ #mk.1) ⇒
           (∃ #corr. LtkCorrupt( pkR ) @ #corr))))) ⇒
    ((¬(∃ #kpkDH. !KU( pkDH ) @ #kpkDH)) ∧
     (¬(∃ #kpkSign. !KU( pkSign ) @ #kpkSign)))"
/*
guarded formula characterizing all counter-examples:
"∃ pk pkDH pkSign #mk.
  (IsAgent( pk ) @ #mk) ∧ (AgentPubkey( pk, pkDH, pkSign ) @ #mk)
 ∧
  (∀ #c. (LtkCorrupt( pk ) @ #c) ⇒ ⊥) ∧
  (∀ #r. (RevealPublicKey( pk ) @ #r) ⇒ ⊥) ∧
  (∀ isid pkR k2 #dial #gotsecret.
    (SessionRole( isid, 'I' ) @ #dial) ∧
    (SessionInitiator( isid, pk ) @ #dial) ∧
    (SessionResponder( isid, pkR ) @ #dial) ∧
    (SessionKey( isid, k2 ) @ #gotsecret)
   ⇒
    ∃ #mk.1.
     (IsAgent( pkR ) @ #mk.1)
    ∧
     ∀ #corr. (LtkCorrupt( pkR ) @ #corr) ⇒ ⊥) ∧
  (((∃ #kpkDH. (!KU( pkDH ) @ #kpkDH)) ∨
    (∃ #kpkSign. (!KU( pkSign ) @ #kpkSign))))"
*/
simplify
solve( (∃ #kpkDH. (!KU( 'g'^~ltk ) @ #kpkDH))  ∥
       (∃ #kpkSign. (!KU( pk(~ltk) ) @ #kpkSign)) )
  case case_1
  solve( !KU( 'g'^~ltk ) @ #kpkDH )
    case Initiator_recvChal_case_1
    solve( !KU( mac(z.1, h(<z, ~protoKey>)) ) @ #vk.2 )
      case Responder_recvChal
      solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltk)>)
             ) @ #vk.3 )
        case c_h
        solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.10 )
          case Initiator_sendChal
          by solve( !KU( ~ephR ) @ #vk.12 )
        next
          case Responder_recvChal
          by solve( !KU( ~ephI ) @ #vk.12 )
        next
          case cexp
          by solve( !KU( ~ephI ) @ #vk.14 )
        qed
      qed
    next
      case c_mac
      solve( !KU( h(<~protoKey, z, 'g'^(~ephI*~ltk)>) ) @ #vk.3 )
        case c_h
        solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.9 )
          case Initiator_recvChal
          by contradiction
        next
          case Initiator_sendChal
          solve( !KU( ~ltk ) @ #vk.10 )
            case Corrupt_ltk
            by contradiction
          qed
        next
          case cexp
          by solve( !KU( ~ephI ) @ #vk.12 )
        qed
      qed
    qed
  next
    case Initiator_recvChal_case_2
    solve( !KU( mac(z.1, h(<z, ~protoKey>)) ) @ #vk.2 )
      case Responder_recvChal
      solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~x)>)
             ) @ #vk.3 )
        case c_h
        solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.10 )
          case Initiator_sendChal
          by solve( !KU( ~ephR ) @ #vk.12 )
        next
          case Responder_recvChal
          by solve( !KU( ~ephI ) @ #vk.12 )
        next
          case cexp
          by solve( !KU( ~ephI ) @ #vk.14 )
        qed
      qed
    next
      case c_mac
      solve( !KU( h(<~protoKey, z, 'g'^(~ephI*~x)>) ) @ #vk.3 )
        case c_h
        solve( !KU( 'g'^(~ephI*~x) ) @ #vk.9 )
          case Initiator_recvChal_case_1
          by solve( !KU( ~ephI ) @ #vk.14 )
        next
          case Initiator_recvChal_case_2
          by solve( !KU( ~ephI ) @ #vk.14 )
        next
          case Initiator_sendChal
          solve( !KU( ~x ) @ #vk.10 )
            case Corrupt_ltk
            by contradiction
          qed
        next
          case RevealPubkey
          by solve( !KU( ~ephI ) @ #vk.10 )
        next
          case cexp
          by solve( !KU( ~ephI ) @ #vk.12 )
        qed
      qed
    qed
  next
    case RevealPubkey
    by contradiction
  next
    case cexp
    solve( !KU( ~ltk ) @ #vk.1 )
      case Corrupt_ltk
      by contradiction
    qed
  qed
next
  case case_2
  solve( !KU( pk(~ltk) ) @ #kpkSign )
    case Initiator_recvChal_case_1
    solve( !KU( mac(z.1, h(<z, ~protoKey>)) ) @ #vk.2 )
      case Responder_recvChal
      solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltk)>)
             ) @ #vk.3 )
        case c_h
        solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.10 )
          case Initiator_sendChal
          by solve( !KU( ~ephR ) @ #vk.12 )
        next
          case Responder_recvChal
          by solve( !KU( ~ephI ) @ #vk.12 )
        next
          case cexp
          by solve( !KU( ~ephI ) @ #vk.14 )
        qed
      qed
    next
      case c_mac
      solve( !KU( h(<~protoKey, z, 'g'^(~ephI*~ltk)>) ) @ #vk.3 )
        case c_h
        solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.9 )
          case Initiator_recvChal
          by contradiction
        next
          case Initiator_sendChal
          solve( !KU( ~ltk ) @ #vk.10 )
            case Corrupt_ltk
            by contradiction
          qed
        next
          case cexp
          by solve( !KU( ~ephI ) @ #vk.12 )
        qed
      qed
    qed
  next
    case Initiator_recvChal_case_2
    solve( !KU( mac(z.1, h(<z, ~protoKey>)) ) @ #vk.2 )
      case Responder_recvChal
      solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~x)>)
             ) @ #vk.3 )
        case c_h
        solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.10 )
          case Initiator_sendChal
          by solve( !KU( ~ephR ) @ #vk.12 )
        next
          case Responder_recvChal
          by solve( !KU( ~ephI ) @ #vk.12 )
        next
          case cexp
          by solve( !KU( ~ephI ) @ #vk.14 )
        qed
      qed
    next
      case c_mac
      solve( !KU( h(<~protoKey, z, 'g'^(~ephI*~x)>) ) @ #vk.3 )
        case c_h
        solve( !KU( 'g'^(~ephI*~x) ) @ #vk.9 )
          case Initiator_recvChal_case_1
          by solve( !KU( ~ephI ) @ #vk.14 )
        next
          case Initiator_recvChal_case_2
          by solve( !KU( ~ephI ) @ #vk.14 )
        next
          case Initiator_sendChal
          solve( !KU( ~x ) @ #vk.10 )
            case Corrupt_ltk
            by contradiction
          qed
        next
          case RevealPubkey
          by solve( !KU( ~ephI ) @ #vk.10 )
        next
          case cexp
          by solve( !KU( ~ephI ) @ #vk.12 )
        qed
      qed
    qed
  next
    case RevealPubkey
    by contradiction
  next
    case c_pk
    solve( !KU( ~ltk ) @ #vk )
      case Corrupt_ltk
      by contradiction
    qed
  qed
qed

lemma uniqueness:
  all-traces
  "∀ k sid1 sid2 sid3 #acc1 #acc2 #acc3 #sec1 #sec2 #sec3.
    ((((((SessionAccept( sid1 ) @ #acc1) ∧
         (SessionAccept( sid2 ) @ #acc2)) ∧
        (SessionAccept( sid3 ) @ #acc3)) ∧
       (SessionKey( sid1, k ) @ #sec1)) ∧
      (SessionKey( sid2, k ) @ #sec2)) ∧
     (SessionKey( sid3, k ) @ #sec3)) ⇒
    (((sid1 = sid2) ∨ (sid1 = sid3)) ∨ (sid2 = sid3))"
/*
guarded formula characterizing all counter-examples:
"∃ k sid1 sid2 sid3 #acc1 #acc2 #acc3 #sec1 #sec2 #sec3.
  (SessionAccept( sid1 ) @ #acc1) ∧
  (SessionAccept( sid2 ) @ #acc2) ∧
  (SessionAccept( sid3 ) @ #acc3) ∧
  (SessionKey( sid1, k ) @ #sec1) ∧
  (SessionKey( sid2, k ) @ #sec2) ∧
  (SessionKey( sid3, k ) @ #sec3)
 ∧
  (¬(sid1 = sid2)) ∧ (¬(sid1 = sid3)) ∧ (¬(sid2 = sid3))"
*/
simplify
solve( SessionAccept( sid1 ) @ #acc1 )
  case Initiator_recvAuth
  solve( Initiator_authSent( <'g'^~ltkI, pk(~ltkI)>, <z, pk(ltkR)>,
                             ~ltkI, ~ephI, z.1, ~protoKey, ~sid
         ) ▶₀ #acc1 )
    case Initiator_recvChal_case_1
    solve( SessionAccept( sid2 ) @ #acc2 )
      case Initiator_recvAuth
      solve( Initiator_authSent( <'g'^~ltkI.1, pk(~ltkI.1)>,
                                 <z.3, pk(ltkR)>, ~ltkI.1, ~ephI.1, z.4, ~protoKey.1, ~sid.1
             ) ▶₀ #acc2 )
        case Initiator_recvChal_case_1
        solve( SessionAccept( sid3 ) @ #acc3 )
          case Initiator_recvAuth
          solve( Initiator_authSent( <'g'^~ltkI.2, pk(~ltkI.2)>,
                                     <z.6, pk(ltkR)>, ~ltkI.2, ~ephI.2, z.7, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Initiator_recvChal_case_1
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                         ~ltkI.3, ~ephI.3, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.9, z.10, 'g'^(~ephI*~ltkI)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~ltkI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.3, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, z.9, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            qed
          next
            case Initiator_recvChal_case_2
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                         ~ltkI.3, ~ephI.3, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.9, z.10, 'g'^(~ephI*~ltkI)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~ltkI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.4, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, z.9, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR, ~ephR, z.6, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Responder_recvChal
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                         ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.11, z.12, 'g'^(~ephI*~ltkI)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~ltkI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.3, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                            ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        qed
      next
        case Initiator_recvChal_case_2
        solve( SessionAccept( sid3 ) @ #acc3 )
          case Initiator_recvAuth
          solve( Initiator_authSent( <'g'^~ltkI.2, pk(~ltkI.2)>,
                                     <z.6, pk(ltkR)>, ~ltkI.2, ~ephI.2, z.7, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Initiator_recvChal_case_1
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                         ~ltkI.3, ~ephI.3, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.9, z.10, 'g'^(~ephI*~ltkI)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~ltkI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.4, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, z.9, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            qed
          next
            case Initiator_recvChal_case_2
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.2, pkRed>,
                                         ~ltkI.3, ~ephI.3, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.9, z.10, 'g'^(~ephI*~ltkI)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~ltkI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.5, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, z.9, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR, ~ephR, z.6, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Responder_recvChal
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                         ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.11, z.12, 'g'^(~ephI*~ltkI)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~ltkI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.4, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                            ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        qed
      qed
    next
      case Responder_recvAuth
      solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid.1
             ) ▶₀ #acc2 )
        case Responder_recvChal
        solve( SessionAccept( sid3 ) @ #acc3 )
          case Initiator_recvAuth
          solve( Initiator_authSent( <'g'^~ltkI.2, pk(~ltkI.2)>,
                                     <z.8, pk(ltkR.1)>, ~ltkI.2, ~ephI.1, z.9, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Initiator_recvChal_case_1
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                         ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.11, z.12, 'g'^(~ephI*~ltkI)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~ltkI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.3, ~protoKey,
                                             ~sid.1
                         ) ▶₀ #sec2 )
                    case Responder_recvChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.2*~x.3), z.3, 'g'^(~ephI*~ltkI)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                                 ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                             ) ▶₀ #sec3 )
                        case Initiator_sendChal
                        by contradiction
                      qed
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~ltkI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.4, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                            ~sid
                        ) ▶₀ #sec1 )
            qed
          next
            case Initiator_recvChal_case_2
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                         ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.11, z.12, 'g'^(~ephI*~ltkI)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~ltkI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.4, ~protoKey,
                                             ~sid.1
                         ) ▶₀ #sec2 )
                    case Responder_recvChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.2*~x.3), z.3, 'g'^(~ephI*~ltkI)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                                    ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~ltkI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.5, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                            ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.8, ~protoKey.2,
                                     ~sid.2
                 ) ▶₀ #acc3 )
            case Responder_recvChal
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                         ~ltkI.3, ~ephI.1, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.13, z.14, 'g'^(~ephI*~ltkI)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~ltkI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  solve( Responder_chalSent( ~ltkR.2, ~ephR.2, 'g'^x.3, ~protoKey,
                                             ~sid.1
                         ) ▶₀ #sec2 )
                    case Responder_recvChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.2*~x.3), z.3, 'g'^(~ephI*~ltkI)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI, pkRed>,
                                                    ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~ltkI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      solve( Responder_chalSent( ~ltkR.2, ~ephR.2, 'g'^x.4, ~protoKey,
                                                 ~sid.2
                             ) ▶₀ #sec3 )
                        case Responder_recvChal
                        solve( !KU( senc(sign(<~protoKey, 
                                               <<'g'^~ltkI, pk(~ltkI)>, 
                                                sign(<~protoKey, <'g'^~ltkI, pk(~ltkI)>, h(z)>,
                                                     ~ltkI)
                                               >, 
                                               h(z)>,
                                              ~ltkI),
                                         h(<~protoKey, z, z.1, 'g'^(~ephI*~ltkI)>))
                               ) @ #vk )
                          case Responder_recvAuth
                          solve( splitEqs(1) )
                            case split_case_1
                            by solve( splitEqs(2) )
                          next
                            case split_case_2
                            solve( splitEqs(2) )
                              case split
                              solve( splitEqs(4) )
                                case split
                                by contradiction
                              qed
                            qed
                          qed
                        next
                          case c_senc
                          solve( splitEqs(2) )
                            case split_case_1
                            solve( splitEqs(4) )
                              case split
                              by contradiction
                            qed
                          next
                            case split_case_2
                            by contradiction
                          qed
                        qed
                      qed
                    qed
                  qed
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.13, ~protoKey.3,
                                            ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        qed
      qed
    qed
  next
    case Initiator_recvChal_case_2
    solve( SessionAccept( sid2 ) @ #acc2 )
      case Initiator_recvAuth
      solve( Initiator_authSent( <'g'^~ltkI.1, pk(~ltkI.1)>,
                                 <z.3, pk(ltkR)>, ~ltkI.1, ~ephI.1, z.4, ~protoKey.1, ~sid.1
             ) ▶₀ #acc2 )
        case Initiator_recvChal_case_1
        solve( SessionAccept( sid3 ) @ #acc3 )
          case Initiator_recvAuth
          solve( Initiator_authSent( <'g'^~ltkI.2, pk(~ltkI.2)>,
                                     <z.6, pk(ltkR)>, ~ltkI.2, ~ephI.2, z.7, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Initiator_recvChal_case_1
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                         ~ltkI.3, ~ephI.3, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.9, z.10, 'g'^(~ephI*~x)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~x, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.4, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, z.9, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            qed
          next
            case Initiator_recvChal_case_2
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.2, pkRed>,
                                         ~ltkI.3, ~ephI.3, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.9, z.10, 'g'^(~ephI*~x)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~x, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.5, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, z.9, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR, ~ephR, z.6, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Responder_recvChal
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                         ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.11, z.12, 'g'^(~ephI*~x)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~x, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.4, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                            ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        qed
      next
        case Initiator_recvChal_case_2
        solve( SessionAccept( sid3 ) @ #acc3 )
          case Initiator_recvAuth
          solve( Initiator_authSent( <'g'^~ltkI.2, pk(~ltkI.2)>,
                                     <z.6, pk(ltkR)>, ~ltkI.2, ~ephI.2, z.7, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Initiator_recvChal_case_1
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.2, pkRed>,
                                         ~ltkI.3, ~ephI.3, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.9, z.10, 'g'^(~ephI*~x)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_2
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                             ~ltkI.3, ~x, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, z.9, z.10, 'g'^(~ephI*~x)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                    ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~x, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.5, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.5, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, z.9, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            qed
          next
            case Initiator_recvChal_case_2
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                         ~ltkI.3, ~ephI.3, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.9, z.10, 'g'^(~ephI*~x)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_2
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                             ~ltkI.3, ~x, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, z.9, z.10, 'g'^(~ephI*~x)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                 ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                             ) ▶₀ #sec3 )
                        case Initiator_sendChal
                        by contradiction
                      qed
                    next
                      case Initiator_recvChal_case_2
                      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                 ~ltkI.3, ~x, ~protoKey, ~sid.2
                             ) ▶₀ #sec3 )
                        case Initiator_sendChal
                        by contradiction
                      qed
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.6, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR, ~ephR, 'g'^x.6, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR, ~ephR, z.9, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR, ~ephR, z.6, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Responder_recvChal
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.2, pkRed>,
                                         ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.11, z.12, 'g'^(~ephI*~x)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_2
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                             ~ltkI.3, ~x, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, z.11, z.12, 'g'^(~ephI*~x)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                    ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~x, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.5, ~protoKey,
                                                 ~sid.2
                             ) ▶₀ #sec3 )
                        case Responder_recvChal
                        solve( !KU( senc(sign(<~protoKey, 
                                               <<'g'^~ltkI, pk(~ltkI)>, 
                                                sign(<~protoKey, <'g'^~x, pk(~x)>, h(z)>, ~ltkI)>, 
                                               h(z)>,
                                              ~x),
                                         h(<~protoKey, z, z.1, 'g'^(~ephI*~x)>))
                               ) @ #vk )
                          case c_senc
                          solve( !KU( sign(<~protoKey, 
                                            <<'g'^~ltkI, pk(~ltkI)>, 
                                             sign(<~protoKey, <'g'^~x, pk(~x)>, h(z)>, ~ltkI)>, 
                                            h(z)>,
                                           ~x)
                                 ) @ #vk.12 )
                            case c_sign
                            by solve( !KU( ~x ) @ #vk.15 )
                          qed
                        qed
                      qed
                    qed
                  qed
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.5, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                            ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        qed
      qed
    next
      case Responder_recvAuth
      solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid.1
             ) ▶₀ #acc2 )
        case Responder_recvChal
        solve( SessionAccept( sid3 ) @ #acc3 )
          case Initiator_recvAuth
          solve( Initiator_authSent( <'g'^~ltkI.2, pk(~ltkI.2)>,
                                     <z.8, pk(ltkR.1)>, ~ltkI.2, ~ephI.1, z.9, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Initiator_recvChal_case_1
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                         ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.11, z.12, 'g'^(~ephI*~x)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~x, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.4, ~protoKey,
                                             ~sid.1
                         ) ▶₀ #sec2 )
                    case Responder_recvChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.3*~x.4), z.3, 'g'^(~ephI*~x)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                    ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~x, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.5, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                            ~sid
                        ) ▶₀ #sec1 )
            qed
          next
            case Initiator_recvChal_case_2
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.2, pkRed>,
                                         ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.11, z.12, 'g'^(~ephI*~x)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~x, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.5, ~protoKey,
                                             ~sid.1
                         ) ▶₀ #sec2 )
                    case Responder_recvChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.3*~x.4), z.3, 'g'^(~ephI*~x)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                 ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                             ) ▶₀ #sec3 )
                        case Initiator_sendChal
                        by contradiction
                      qed
                    next
                      case Initiator_recvChal_case_2
                      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                 ~ltkI.3, ~x, ~protoKey, ~sid.2
                             ) ▶₀ #sec3 )
                        case Initiator_sendChal
                        solve( !KU( senc(sign(<~protoKey, 
                                               <<'g'^~ltkI, pk(~ltkI)>, 
                                                sign(<~protoKey, <'g'^~x, pk(~x)>, h(z)>, ~ltkI)>, 
                                               h(z)>,
                                              ~x),
                                         h(<~protoKey, z, z.1, 'g'^(~ephI*~x)>))
                               ) @ #vk )
                          case c_senc
                          solve( !KU( sign(<~protoKey, 
                                            <<'g'^~ltkI, pk(~ltkI)>, 
                                             sign(<~protoKey, <'g'^~x, pk(~x)>, h(z)>, ~ltkI)>, 
                                            h(z)>,
                                           ~x)
                                 ) @ #vk.12 )
                            case c_sign
                            by solve( !KU( ~x ) @ #vk.15 )
                          qed
                        qed
                      qed
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.6, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                            ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.8, ~protoKey.2,
                                     ~sid.2
                 ) ▶₀ #acc3 )
            case Responder_recvChal
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                         ~ltkI.3, ~ephI.1, ~protoKey.3, ~sid
                     ) ▶₀ #sec1 )
                case Initiator_sendChal
                solve( SessionKey( ~sid.1,
                                   h(<~protoKey, z.13, z.14, 'g'^(~ephI*~x)>)
                       ) @ #sec2 )
                  case Initiator_recvChal_case_1
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Initiator_recvChal_case_2
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                ~ltkI.3, ~x, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  solve( Responder_chalSent( ~ltkR.2, ~ephR.2, 'g'^x.4, ~protoKey,
                                             ~sid.1
                         ) ▶₀ #sec2 )
                    case Responder_recvChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.3*~x.4), z.3, 'g'^(~ephI*~x)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                                    ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~x, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      solve( Responder_chalSent( ~ltkR.2, ~ephR.2, 'g'^x.5, ~protoKey,
                                                 ~sid.2
                             ) ▶₀ #sec3 )
                        case Responder_recvChal
                        solve( !KU( senc(sign(<~protoKey, 
                                               <<'g'^~ltkI, pk(~ltkI)>, 
                                                sign(<~protoKey, <'g'^~x, pk(~x)>, h(z)>, ~ltkI)>, 
                                               h(z)>,
                                              ~x),
                                         h(<~protoKey, z, z.1, 'g'^(~ephI*~x)>))
                               ) @ #vk )
                          case Responder_recvAuth
                          solve( splitEqs(7) )
                            case split_case_1
                            solve( splitEqs(6) )
                              case split
                              solve( splitEqs(5) )
                                case split
                                by solve( splitEqs(4) )
                              qed
                            qed
                          next
                            case split_case_2
                            solve( !KU( senc(<<'g'^ltkI.1, pk(ltkI.1)>, 
                                              sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, 
                                                    h('g'^(~ephI*~x.1))>,
                                                   ltkI.1)
                                             >,
                                             h(<~protoKey, 'g'^(~ephI*~x.1), 'g'^(~ephI*~x)>))
                                   ) @ #vk.4 )
                              case Initiator_recvChal
                              solve( !KU( senc(<<'g'^ltkI.1, pk(ltkI.1)>, 
                                                sign(<~protoKey, <'g'^~ltkR.1, pk(~ltkR.1)>, 
                                                      h('g'^(~ephI*~x))>,
                                                     ltkI.1)
                                               >,
                                               h(<~protoKey, 'g'^(~ephI*~x), 'g'^(~ephI*~ltkR)>))
                                     ) @ #vk.8 )
                                case Initiator_recvChal
                                by contradiction /* from formulas */
                              next
                                case c_senc
                                solve( splitEqs(6) )
                                  case split
                                  by solve( splitEqs(5) )
                                qed
                              qed
                            next
                              case c_senc
                              solve( splitEqs(6) )
                                case split
                                solve( splitEqs(5) )
                                  case split
                                  solve( splitEqs(4) )
                                    case split
                                    by contradiction /* from formulas */
                                  qed
                                qed
                              qed
                            qed
                          qed
                        next
                          case c_senc
                          solve( splitEqs(5) )
                            case split_case_1
                            by solve( splitEqs(4) )
                          next
                            case split_case_2
                            solve( splitEqs(4) )
                              case split
                              by contradiction /* from formulas */
                            qed
                          next
                            case split_case_3
                            by contradiction /* from formulas */
                          next
                            case split_case_4
                            by contradiction /* from formulas */
                          qed
                        qed
                      qed
                    qed
                  qed
                qed
              qed
            next
              case Responder_recvAuth
              by solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.13, ~protoKey.3,
                                            ~sid
                        ) ▶₀ #sec1 )
            qed
          qed
        qed
      qed
    qed
  qed
next
  case Responder_recvAuth
  solve( Responder_chalSent( ~ltkR, ~ephR, z, ~protoKey, ~sid
         ) ▶₀ #acc1 )
    case Responder_recvChal
    solve( SessionAccept( sid2 ) @ #acc2 )
      case Initiator_recvAuth
      solve( Initiator_authSent( <'g'^~ltkI.1, pk(~ltkI.1)>,
                                 <z.5, pk(ltkR.1)>, ~ltkI.1, ~ephI, z.6, ~protoKey.1, ~sid.1
             ) ▶₀ #acc2 )
        case Initiator_recvChal_case_1
        solve( SessionAccept( sid3 ) @ #acc3 )
          case Initiator_recvAuth
          solve( Initiator_authSent( <'g'^~ltkI.2, pk(~ltkI.2)>,
                                     <z.8, pk(ltkR.1)>, ~ltkI.2, ~ephI.1, z.9, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Initiator_recvChal_case_1
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                            ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                         ~sid
                     ) ▶₀ #sec1 )
                case Responder_recvChal
                solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                       ) @ #sec2 )
                  case Initiator_recvChal
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.1*~x.2), z.1, 'g'^(~ephI*~ltkI.1)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI.1, pkRed>,
                                                 ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                             ) ▶₀ #sec3 )
                        case Initiator_sendChal
                        by contradiction
                      qed
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~ltkI.1, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.4, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            qed
          next
            case Initiator_recvChal_case_2
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                            ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                         ~sid
                     ) ▶₀ #sec1 )
                case Responder_recvChal
                solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                       ) @ #sec2 )
                  case Initiator_recvChal
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.1*~x.2), z.1, 'g'^(~ephI*~ltkI.1)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI.1, pkRed>,
                                                    ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~ltkI.1, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.5, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            qed
          qed
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.8, ~protoKey.2,
                                     ~sid.2
                 ) ▶₀ #acc3 )
            case Responder_recvChal
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                            ~ltkI.3, ~ephI.1, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.13, ~protoKey.3,
                                         ~sid
                     ) ▶₀ #sec1 )
                case Responder_recvChal
                solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                       ) @ #sec2 )
                  case Initiator_recvChal
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.1*~x.2), z.1, 'g'^(~ephI*~ltkI.1)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ltkI.1, pkRed>,
                                                    ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~ltkI.1, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      solve( Responder_chalSent( ~ltkR.2, ~ephR.2, 'g'^x.4, ~protoKey,
                                                 ~sid.2
                             ) ▶₀ #sec3 )
                        case Responder_recvChal
                        solve( !KU( senc(<<z, pk(ltkI)>, 
                                          sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, h('g'^(x.1*~x.2))
                                               >,
                                               ltkI)
                                         >,
                                         h(<~protoKey, 'g'^(x.1*~x.2), 'g'^(~ephI*~ltkI.1)>))
                               ) @ #vk )
                          case Initiator_recvChal
                          solve( splitEqs(11) )
                            case split
                            solve( !KU( senc(<<'g'^ltkI, pk(ltkI)>, 
                                              sign(<~protoKey, <'g'^~ltkR.1, pk(~ltkR.1)>, 
                                                    h('g'^(~ephR*~x))>,
                                                   ltkI)
                                             >,
                                             h(<~protoKey, 'g'^(~ephR*~x), 'g'^(~ltkR*~x)>))
                                   ) @ #vk.8 )
                              case Initiator_recvChal
                              by contradiction
                            next
                              case c_senc
                              solve( !KU( sign(<~protoKey, <'g'^~ltkR.1, pk(~ltkR.1)>, 
                                                h('g'^(~ephR*~x))>,
                                               ltkI)
                                     ) @ #vk.17 )
                                case c_sign
                                solve( !KU( mac('g'^x.1, h(~protoKey)) ) @ #vk.12 )
                                  case Initiator_sendChal_case_1
                                  solve( !KU( h(<~protoKey, 'g'^(~ephR*~x), 'g'^(~ltkR*~x)>)
                                         ) @ #vk.14 )
                                    case c_h
                                    solve( !KU( 'g'^(~ephR*~x) ) @ #vk.28 )
                                      case Initiator_sendChal
                                      by solve( !KU( ~ephR ) @ #vk.30 )
                                    next
                                      case Responder_recvChal
                                      by solve( !KU( ~x ) @ #vk.30 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephR ) @ #vk.32 )
                                    qed
                                  qed
                                next
                                  case Initiator_sendChal_case_2
                                  solve( splitEqs(14) )
                                    case split_case_1
                                    solve( !KU( h(<~protoKey, 'g'^(~ephR*~x), 'g'^(~ltkR*~x)>)
                                           ) @ #vk.14 )
                                      case c_h
                                      solve( !KU( 'g'^(~ephR*~x) ) @ #vk.28 )
                                        case Initiator_sendChal
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Responder_recvChal
                                        by solve( !KU( ~x ) @ #vk.30 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      qed
                                    qed
                                  next
                                    case split_case_2
                                    solve( !KU( h(<~protoKey, 'g'^(~ephR*~x), 'g'^(~ltkR*~x)>)
                                           ) @ #vk.14 )
                                      case c_h
                                      solve( !KU( 'g'^(~ephR*~x) ) @ #vk.28 )
                                        case Initiator_sendChal
                                        by solve( !KU( ~ephR ) @ #vk.30 )
                                      next
                                        case Responder_recvChal
                                        by solve( !KU( ~x ) @ #vk.30 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephR ) @ #vk.32 )
                                      qed
                                    qed
                                  qed
                                next
                                  case c_mac
                                  solve( !KU( h(<~protoKey, 'g'^(~ephR*~x), 'g'^(~ltkR*~x)>)
                                         ) @ #vk.14 )
                                    case c_h
                                    solve( !KU( 'g'^(~ephR*~x) ) @ #vk.29 )
                                      case Initiator_sendChal
                                      by solve( !KU( ~ephR ) @ #vk.31 )
                                    next
                                      case Responder_recvChal
                                      by solve( !KU( ~x ) @ #vk.31 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephR ) @ #vk.33 )
                                    qed
                                  qed
                                qed
                              qed
                            qed
                          qed
                        next
                          case c_senc
                          solve( splitEqs(4) )
                            case split_case_1
                            solve( splitEqs(6) )
                              case split
                              by contradiction
                            qed
                          next
                            case split_case_2
                            by solve( splitEqs(6) )
                          next
                            case split_case_3
                            by contradiction
                          qed
                        qed
                      qed
                    qed
                  qed
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.13, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            qed
          qed
        qed
      next
        case Initiator_recvChal_case_2
        solve( SessionAccept( sid3 ) @ #acc3 )
          case Initiator_recvAuth
          solve( Initiator_authSent( <'g'^~ltkI.2, pk(~ltkI.2)>,
                                     <z.8, pk(ltkR.1)>, ~ltkI.2, ~ephI.1, z.9, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Initiator_recvChal_case_1
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                            ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                         ~sid
                     ) ▶₀ #sec1 )
                case Responder_recvChal
                solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                       ) @ #sec2 )
                  case Initiator_recvChal
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.1*~x.2), z.1, 'g'^(~ephI*~x.3)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                                    ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~x.3, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.5, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            qed
          next
            case Initiator_recvChal_case_2
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.2, pkRed>,
                                            ~ltkI.3, ~ephI.2, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey.3,
                                         ~sid
                     ) ▶₀ #sec1 )
                case Responder_recvChal
                solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                       ) @ #sec2 )
                  case Initiator_recvChal
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.1*~x.2), z.1, 'g'^(~ephI*~x.3)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                                 ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                             ) ▶₀ #sec3 )
                        case Initiator_sendChal
                        by contradiction
                      qed
                    next
                      case Initiator_recvChal_case_2
                      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                 ~ltkI.3, ~x.3, ~protoKey, ~sid.2
                             ) ▶₀ #sec3 )
                        case Initiator_sendChal
                        solve( splitEqs(1) )
                          case split
                          solve( splitEqs(6) )
                            case split_case_1
                            solve( !KU( 'g'^(~ephI*~ephI.1*inv(~ltkR)) ) @ #vk.2 )
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~ephI.1 ) @ #vk.13 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~ephI.1 ) @ #vk.13 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.14 )
                            qed
                          next
                            case split_case_2
                            by contradiction /* from formulas */
                          qed
                        qed
                      qed
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, 'g'^x.6, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.11, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            qed
          qed
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.8, ~protoKey.2,
                                     ~sid.2
                 ) ▶₀ #acc3 )
            case Responder_recvChal
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                            ~ltkI.3, ~ephI.1, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.13, ~protoKey.3,
                                         ~sid
                     ) ▶₀ #sec1 )
                case Responder_recvChal
                solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                       ) @ #sec2 )
                  case Initiator_recvChal
                  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                             ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                         ) ▶₀ #sec2 )
                    case Initiator_sendChal
                    solve( SessionKey( ~sid.2,
                                       h(<~protoKey, 'g'^(x.1*~x.2), z.1, 'g'^(~ephI*~x.3)>)
                           ) @ #sec3 )
                      case Initiator_recvChal_case_1
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                                    ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~ephI, pkRed>,
                                                    ~ltkI.3, ~x.3, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      solve( splitEqs(7) )
                        case split_case_1
                        solve( splitEqs(6) )
                          case split_case_1
                          by solve( Responder_chalSent( ~ltkR.2, ~ephR.2, 'g'^x, ~protoKey,
                                                        ~sid.2
                                    ) ▶₀ #sec3 )
                        next
                          case split_case_2
                          solve( Responder_chalSent( ~ltkR.2, ~ephR.2, 'g'^x, ~protoKey,
                                                     ~sid.2
                                 ) ▶₀ #sec3 )
                            case Responder_recvChal
                            solve( splitEqs(5) )
                              case split
                              by contradiction /* from formulas */
                            qed
                          qed
                        next
                          case split_case_3
                          by solve( Responder_chalSent( ~ltkR.2, ~ephR.2, 'g'^x, ~protoKey,
                                                        ~sid.2
                                    ) ▶₀ #sec3 )
                        next
                          case split_case_4
                          by solve( Responder_chalSent( ~ltkR.2, ~ephR.2, 'g'^x.2, ~protoKey,
                                                        ~sid.2
                                    ) ▶₀ #sec3 )
                        next
                          case split_case_5
                          by solve( Responder_chalSent( ~ltkR.2, ~ephR.2, 'g'^x.2, ~protoKey,
                                                        ~sid.2
                                    ) ▶₀ #sec3 )
                        next
                          case split_case_6
                          by solve( Responder_chalSent( ~ltkR.2, ~ephR.2, 'g'^x.4, ~protoKey,
                                                        ~sid.2
                                    ) ▶₀ #sec3 )
                        qed
                      next
                        case split_case_2
                        solve( Responder_chalSent( ~ltkR, ~ephR,
                                                   'g'^(~x.3*~x.4*inv(~ltkR)), ~protoKey, ~sid.2
                               ) ▶₀ #sec3 )
                          case Responder_recvChal
                          by contradiction /* from formulas */
                        qed
                      qed
                    qed
                  qed
                next
                  case Responder_recvAuth
                  by solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.13, ~protoKey,
                                                ~sid.1
                            ) ▶₀ #sec2 )
                qed
              qed
            qed
          qed
        qed
      qed
    next
      case Responder_recvAuth
      solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.5, ~protoKey.1,
                                 ~sid.1
             ) ▶₀ #acc2 )
        case Responder_recvChal
        solve( SessionAccept( sid3 ) @ #acc3 )
          case Initiator_recvAuth
          solve( Initiator_authSent( <'g'^~ltkI.2, pk(~ltkI.2)>,
                                     <z.10, pk(ltkR.2)>, ~ltkI.2, ~ephI, z.11, ~protoKey.2, ~sid.2
                 ) ▶₀ #acc3 )
            case Initiator_recvChal_case_1
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                            ~ltkI.3, ~ephI.1, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.13, ~protoKey.3,
                                         ~sid
                     ) ▶₀ #sec1 )
                case Responder_recvChal
                solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                       ) @ #sec2 )
                  case Initiator_recvChal
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.13, ~protoKey,
                                             ~sid.1
                         ) ▶₀ #sec2 )
                    case Responder_recvChal
                    solve( SessionKey( ~sid.2, h(<~protoKey, z.2, z.4, z.3>)
                           ) @ #sec3 )
                      case Initiator_recvChal
                      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                                 ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                             ) ▶₀ #sec3 )
                        case Initiator_sendChal
                        solve( !KU( senc(<<z, pk(ltkI)>, 
                                          sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, h('g'^(x.1*~x.2))
                                               >,
                                               ltkI)
                                         >,
                                         h(<~protoKey, 'g'^(x.1*~x.2), 'g'^(~ephI*~ltkI.1)>))
                               ) @ #vk )
                          case Initiator_recvChal
                          solve( splitEqs(10) )
                            case split_case_1
                            solve( !KU( senc(<<'g'^ltkI, pk(ltkI)>, 
                                              sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, 
                                                    h('g'^(~ephI*~ephR))>,
                                                   ltkI)
                                             >,
                                             h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~x)>))
                                   ) @ #vk.4 )
                              case c_senc
                              solve( !KU( sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, 
                                                h('g'^(~ephI*~ephR))>,
                                               ltkI)
                                     ) @ #vk.17 )
                                case c_sign
                                solve( !KU( mac('g'^x.1, h(~protoKey)) ) @ #vk.8 )
                                  case c_mac
                                  solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~x)>)
                                         ) @ #vk.14 )
                                    case c_h
                                    solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.29 )
                                      case Initiator_sendChal
                                      by solve( !KU( ~ephR ) @ #vk.31 )
                                    next
                                      case Responder_recvChal
                                      by solve( !KU( ~ephI ) @ #vk.31 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephI ) @ #vk.33 )
                                    qed
                                  qed
                                qed
                              qed
                            qed
                          next
                            case split_case_2
                            solve( !KU( senc(<<'g'^ltkI, pk(ltkI)>, 
                                              sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, 
                                                    h('g'^(~ephI*~ephR))>,
                                                   ltkI)
                                             >,
                                             h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~x)>))
                                   ) @ #vk.4 )
                              case Initiator_recvChal
                              by contradiction
                            next
                              case c_senc
                              solve( !KU( sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, 
                                                h('g'^(~ephI*~ephR))>,
                                               ltkI)
                                     ) @ #vk.17 )
                                case c_sign
                                solve( !KU( mac('g'^x.1, h(~protoKey)) ) @ #vk.8 )
                                  case c_mac
                                  solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~x)>)
                                         ) @ #vk.14 )
                                    case c_h
                                    solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.29 )
                                      case Initiator_sendChal
                                      by solve( !KU( ~ephR ) @ #vk.31 )
                                    next
                                      case Responder_recvChal
                                      by solve( !KU( ~ephI ) @ #vk.31 )
                                    next
                                      case cexp
                                      by solve( !KU( ~ephI ) @ #vk.33 )
                                    qed
                                  qed
                                qed
                              qed
                            qed
                          qed
                        next
                          case c_senc
                          solve( splitEqs(6) )
                            case split_case_1
                            solve( splitEqs(8) )
                              case split
                              by contradiction
                            qed
                          next
                            case split_case_2
                            solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltkR)>)
                                   ) @ #vk.13 )
                              case c_h
                              solve( !KU( sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, 
                                                h('g'^(~ephI*~ephR))>,
                                               ~ltkR)
                                     ) @ #vk.17 )
                                case Initiator_recvChal_case_1
                                solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.21 )
                                  case Initiator_sendChal
                                  by solve( !KU( ~ephR ) @ #vk.27 )
                                next
                                  case Responder_recvChal
                                  by solve( !KU( ~ephI ) @ #vk.27 )
                                next
                                  case cexp
                                  by solve( !KU( ~ephI ) @ #vk.29 )
                                qed
                              next
                                case Initiator_recvChal_case_2
                                solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.21 )
                                  case Initiator_sendChal
                                  by solve( !KU( ~ephR ) @ #vk.27 )
                                next
                                  case Responder_recvChal
                                  by solve( !KU( ~ephI ) @ #vk.27 )
                                next
                                  case cexp
                                  by solve( !KU( ~ephI ) @ #vk.29 )
                                qed
                              next
                                case c_sign
                                solve( !KU( ~ltkR ) @ #vk.25 )
                                  case Corrupt_ltk
                                  solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.24 )
                                    case Initiator_sendChal
                                    by solve( !KU( ~ephR ) @ #vk.27 )
                                  next
                                    case Responder_recvChal
                                    by solve( !KU( ~ephI ) @ #vk.27 )
                                  next
                                    case cexp
                                    by solve( !KU( ~ephI ) @ #vk.29 )
                                  qed
                                qed
                              qed
                            qed
                          next
                            case split_case_3
                            by contradiction
                          qed
                        qed
                      qed
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.10, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                qed
              qed
            qed
          next
            case Initiator_recvChal_case_2
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                            ~ltkI.3, ~ephI.1, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.13, ~protoKey.3,
                                         ~sid
                     ) ▶₀ #sec1 )
                case Responder_recvChal
                solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                       ) @ #sec2 )
                  case Initiator_recvChal
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.13, ~protoKey,
                                             ~sid.1
                         ) ▶₀ #sec2 )
                    case Responder_recvChal
                    solve( SessionKey( ~sid.2, h(<~protoKey, z.2, z.4, z.3>)
                           ) @ #sec3 )
                      case Initiator_recvChal
                      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                                 ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                             ) ▶₀ #sec3 )
                        case Initiator_sendChal
                        solve( !KU( senc(<<z, pk(ltkI)>, 
                                          sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, h('g'^(x.1*~x.2))
                                               >,
                                               ltkI)
                                         >,
                                         h(<~protoKey, 'g'^(x.1*~x.2), 'g'^(~ephI*~x.3)>))
                               ) @ #vk )
                          case Initiator_recvChal
                          solve( splitEqs(7) )
                            case split_case_1
                            solve( splitEqs(13) )
                              case split
                              solve( !KU( senc(<<'g'^ltkI.1, pk(ltkI.1)>, 
                                                sign(<~protoKey, <'g'^~ltkR.1, pk(~ltkR.1)>, 
                                                      h('g'^(~ephI*~ephR))>,
                                                     ltkI.1)
                                               >,
                                               h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltkR)>))
                                     ) @ #vk.4 )
                                case c_senc
                                solve( !KU( sign(<~protoKey, <'g'^~ltkR.1, pk(~ltkR.1)>, 
                                                  h('g'^(~ephI*~ephR))>,
                                                 ltkI.1)
                                       ) @ #vk.17 )
                                  case Initiator_recvChal
                                  solve( !KU( mac('g'^x, h(~protoKey)) ) @ #vk.8 )
                                    case c_mac
                                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltkR)>)
                                           ) @ #vk.14 )
                                      case c_h
                                      solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.26 )
                                        case Initiator_sendChal
                                        by solve( !KU( ~ephR ) @ #vk.28 )
                                      next
                                        case Responder_recvChal
                                        by solve( !KU( ~ephI ) @ #vk.28 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephI ) @ #vk.30 )
                                      qed
                                    qed
                                  qed
                                next
                                  case c_sign
                                  solve( !KU( mac('g'^x, h(~protoKey)) ) @ #vk.8 )
                                    case c_mac
                                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltkR)>)
                                           ) @ #vk.14 )
                                      case c_h
                                      solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.29 )
                                        case Initiator_sendChal
                                        by solve( !KU( ~ephR ) @ #vk.31 )
                                      next
                                        case Responder_recvChal
                                        by solve( !KU( ~ephI ) @ #vk.31 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephI ) @ #vk.33 )
                                      qed
                                    qed
                                  qed
                                qed
                              qed
                            qed
                          next
                            case split_case_2
                            solve( splitEqs(9) )
                              case split
                              by contradiction /* from formulas */
                            qed
                          qed
                        next
                          case c_senc
                          solve( splitEqs(7) )
                            case split_case_1
                            solve( !KU( sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, 
                                              h('g'^(~ephI*~ephR))>,
                                             ~ltkI)
                                   ) @ #vk.17 )
                              case Initiator_recvChal_case_1
                              solve( splitEqs(9) )
                                case split
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_2
                              solve( !KU( senc(<<'g'^ltkI.1, pk(ltkI.1)>, 
                                                sign(<~protoKey, <'g'^~ltkR.1, pk(~ltkR.1)>, 
                                                      h('g'^(~ephI*~ephR))>,
                                                     ltkI.1)
                                               >,
                                               h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltkR)>))
                                     ) @ #vk.5 )
                                case c_senc
                                solve( !KU( sign(<~protoKey, <'g'^~ltkR.1, pk(~ltkR.1)>, 
                                                  h('g'^(~ephI*~ephR))>,
                                                 ltkI.1)
                                       ) @ #vk.26 )
                                  case Initiator_recvChal
                                  solve( splitEqs(9) )
                                    case split
                                    by contradiction /* from formulas */
                                  qed
                                next
                                  case c_sign
                                  solve( !KU( mac('g'^x, h(~protoKey)) ) @ #vk.10 )
                                    case c_mac
                                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltkR)>)
                                           ) @ #vk.16 )
                                      case c_h
                                      solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.38 )
                                        case Initiator_sendChal
                                        by solve( !KU( ~ephR ) @ #vk.40 )
                                      next
                                        case Responder_recvChal
                                        by solve( !KU( ~ephI ) @ #vk.40 )
                                      next
                                        case cexp
                                        by solve( !KU( ~ephI ) @ #vk.42 )
                                      qed
                                    qed
                                  qed
                                qed
                              qed
                            next
                              case c_sign
                              solve( !KU( ~ltkI ) @ #vk.19 )
                                case Corrupt_ltk
                                solve( !KU( senc(<<'g'^ltkI.1, pk(ltkI.1)>, 
                                                  sign(<~protoKey, <'g'^~ltkR.1, pk(~ltkR.1)>, 
                                                        h('g'^(~ephI*~ephR))>,
                                                       ltkI.1)
                                                 >,
                                                 h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltkR)
                                                   >))
                                       ) @ #vk.7 )
                                  case c_senc
                                  solve( !KU( sign(<~protoKey, <'g'^~ltkR.1, pk(~ltkR.1)>, 
                                                    h('g'^(~ephI*~ephR))>,
                                                   ltkI.1)
                                         ) @ #vk.30 )
                                    case Initiator_recvChal
                                    by solve( splitEqs(9) )
                                  next
                                    case c_sign
                                    solve( !KU( mac('g'^x, h(~protoKey)) ) @ #vk.11 )
                                      case Initiator_sendChal
                                      by contradiction /* from formulas */
                                    next
                                      case c_mac
                                      solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltkR)
                                                    >)
                                             ) @ #vk.17 )
                                        case c_h
                                        solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.40 )
                                          case Initiator_sendChal
                                          by solve( !KU( ~ephR ) @ #vk.42 )
                                        next
                                          case Responder_recvChal
                                          by solve( !KU( ~ephI ) @ #vk.42 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephI ) @ #vk.44 )
                                        qed
                                      qed
                                    qed
                                  qed
                                qed
                              qed
                            qed
                          next
                            case split_case_2
                            solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltkR)>)
                                   ) @ #vk.13 )
                              case c_h
                              solve( !KU( sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, 
                                                h('g'^(~ephI*~ephR))>,
                                               ~ltkI)
                                     ) @ #vk.17 )
                                case Initiator_recvChal_case_1
                                solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.21 )
                                  case Initiator_sendChal
                                  by solve( !KU( ~ephR ) @ #vk.27 )
                                next
                                  case Responder_recvChal
                                  by solve( !KU( ~ephI ) @ #vk.27 )
                                next
                                  case cexp
                                  by solve( !KU( ~ephI ) @ #vk.29 )
                                qed
                              next
                                case Initiator_recvChal_case_2
                                solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.21 )
                                  case Initiator_sendChal
                                  by solve( !KU( ~ephR ) @ #vk.27 )
                                next
                                  case Responder_recvChal
                                  by solve( !KU( ~ephI ) @ #vk.27 )
                                next
                                  case cexp
                                  by solve( !KU( ~ephI ) @ #vk.29 )
                                qed
                              next
                                case c_sign
                                solve( !KU( ~ltkI ) @ #vk.24 )
                                  case Corrupt_ltk
                                  solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.23 )
                                    case Initiator_sendChal
                                    by solve( !KU( ~ephR ) @ #vk.30 )
                                  next
                                    case Responder_recvChal
                                    by solve( !KU( ~ephI ) @ #vk.30 )
                                  next
                                    case cexp
                                    by solve( !KU( ~ephI ) @ #vk.32 )
                                  qed
                                qed
                              qed
                            qed
                          next
                            case split_case_3
                            by contradiction /* from formulas */
                          next
                            case split_case_4
                            by contradiction /* from formulas */
                          qed
                        qed
                      qed
                    next
                      case Responder_recvAuth
                      by solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.10, ~protoKey,
                                                    ~sid.2
                                ) ▶₀ #sec3 )
                    qed
                  qed
                qed
              qed
            qed
          qed
        next
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR.2, ~ephR.2, z.10, ~protoKey.2,
                                     ~sid.2
                 ) ▶₀ #acc3 )
            case Responder_recvChal
            solve( SessionKey( ~sid, k ) @ #sec1 )
              case Initiator_recvChal
              by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                            ~ltkI.3, ~ephI, ~protoKey.3, ~sid
                        ) ▶₀ #sec1 )
            next
              case Responder_recvAuth
              solve( Responder_chalSent( ~ltkR.3, ~ephR.3, z.15, ~protoKey.3,
                                         ~sid
                     ) ▶₀ #sec1 )
                case Responder_recvChal
                solve( SessionKey( ~sid.1, h(<~protoKey, z.2, z.4, z.3>)
                       ) @ #sec2 )
                  case Initiator_recvChal
                  by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                                ~ltkI.3, ~ephI, ~protoKey, ~sid.1
                            ) ▶₀ #sec2 )
                next
                  case Responder_recvAuth
                  solve( Responder_chalSent( ~ltkR.3, ~ephR.3, z.15, ~protoKey,
                                             ~sid.1
                         ) ▶₀ #sec2 )
                    case Responder_recvChal
                    solve( SessionKey( ~sid.2, h(<~protoKey, z.2, z.4, z.3>)
                           ) @ #sec3 )
                      case Initiator_recvChal
                      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.3, pkRed>,
                                                    ~ltkI.3, ~ephI, ~protoKey, ~sid.2
                                ) ▶₀ #sec3 )
                    next
                      case Responder_recvAuth
                      solve( Responder_chalSent( ~ltkR.3, ~ephR.3, z.12, ~protoKey,
                                                 ~sid.2
                             ) ▶₀ #sec3 )
                        case Responder_recvChal
                        solve( splitEqs(2) )
                          case split_case_01
                          by contradiction
                        next
                          case split_case_02
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_03
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_04
                          by contradiction
                        next
                          case split_case_05
                          by contradiction
                        next
                          case split_case_06
                          solve( splitEqs(0) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_07
                          solve( splitEqs(0) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_08
                          by contradiction
                        next
                          case split_case_09
                          by contradiction
                        next
                          case split_case_10
                          solve( splitEqs(0) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_11
                          solve( splitEqs(0) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_12
                          by contradiction
                        next
                          case split_case_13
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_14
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_15
                          by contradiction
                        next
                          case split_case_16
                          by contradiction
                        next
                          case split_case_17
                          by contradiction
                        next
                          case split_case_18
                          by contradiction
                        next
                          case split_case_19
                          by contradiction
                        next
                          case split_case_20
                          by contradiction
                        next
                          case split_case_21
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_22
                          by contradiction
                        next
                          case split_case_23
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_24
                          by contradiction
                        next
                          case split_case_25
                          by contradiction
                        next
                          case split_case_26
                          by contradiction
                        next
                          case split_case_27
                          by contradiction
                        next
                          case split_case_28
                          by contradiction
                        next
                          case split_case_29
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_30
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_31
                          by contradiction
                        next
                          case split_case_32
                          solve( splitEqs(6) )
                            case split_case_1
                            by contradiction
                          next
                            case split_case_2
                            by contradiction
                          next
                            case split_case_3
                            by contradiction
                          qed
                        next
                          case split_case_33
                          by contradiction
                        next
                          case split_case_34
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_35
                          by contradiction
                        next
                          case split_case_36
                          by contradiction
                        next
                          case split_case_37
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_38
                          by contradiction
                        next
                          case split_case_39
                          by contradiction
                        next
                          case split_case_40
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_41
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_42
                          by contradiction
                        next
                          case split_case_43
                          by contradiction
                        next
                          case split_case_44
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_45
                          by contradiction
                        next
                          case split_case_46
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_47
                          by contradiction
                        next
                          case split_case_48
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_49
                          by contradiction
                        next
                          case split_case_50
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_51
                          by contradiction
                        next
                          case split_case_52
                          by contradiction
                        next
                          case split_case_53
                          by contradiction
                        next
                          case split_case_54
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_55
                          solve( splitEqs(6) )
                            case split_case_1
                            by contradiction
                          next
                            case split_case_2
                            by contradiction
                          next
                            case split_case_3
                            by contradiction
                          qed
                        next
                          case split_case_56
                          by contradiction
                        next
                          case split_case_57
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_58
                          by contradiction
                        next
                          case split_case_59
                          by contradiction
                        next
                          case split_case_60
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_61
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_62
                          by contradiction
                        next
                          case split_case_63
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_64
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_65
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_66
                          by contradiction
                        next
                          case split_case_67
                          by contradiction
                        next
                          case split_case_68
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_69
                          by contradiction
                        next
                          case split_case_70
                          by contradiction
                        next
                          case split_case_71
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_72
                          by contradiction
                        next
                          case split_case_73
                          by contradiction
                        next
                          case split_case_74
                          by contradiction
                        next
                          case split_case_75
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_76
                          by contradiction
                        next
                          case split_case_77
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_78
                          by contradiction
                        next
                          case split_case_79
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_80
                          by contradiction
                        next
                          case split_case_81
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        next
                          case split_case_82
                          by contradiction
                        next
                          case split_case_83
                          by contradiction
                        next
                          case split_case_84
                          solve( splitEqs(6) )
                            case split
                            by contradiction
                          qed
                        qed
                      qed
                    qed
                  qed
                qed
              qed
            qed
          qed
        qed
      qed
    qed
  qed
qed

lemma auth_explicit:
  all-traces
  "∀ sid role pkI pkR k protoKeyR pkRemote #set #accept #remote
     #mkRemote.
    (((((SessionAgreementSet( sid, role, pkI, pkR, k, protoKeyR
         ) @ #set) ∧
        (SessionAccept( sid ) @ #accept)) ∧
       (SessionPeer( sid, pkRemote ) @ #remote)) ∧
      (IsAgent( pkRemote ) @ #mkRemote)) ∧
     (¬(∃ #c. LtkCorrupt( pkRemote ) @ #c))) ⇒
    (∃ sid2 role2 #set2.
      (SessionAgreementSet( sid2, role2, pkI, pkR, k, protoKeyR
       ) @ #set2) ∧
      (¬(role = role2)))"
/*
guarded formula characterizing all counter-examples:
"∃ sid role pkI pkR k protoKeyR pkRemote #set #accept #remote
   #mkRemote.
  (SessionAgreementSet( sid, role, pkI, pkR, k, protoKeyR ) @ #set) ∧
  (SessionAccept( sid ) @ #accept) ∧
  (SessionPeer( sid, pkRemote ) @ #remote) ∧
  (IsAgent( pkRemote ) @ #mkRemote)
 ∧
  (∀ #c. (LtkCorrupt( pkRemote ) @ #c) ⇒ ⊥) ∧
  (∀ sid2 role2 #set2.
    (SessionAgreementSet( sid2, role2, pkI, pkR, k, protoKeyR
     ) @ #set2)
   ⇒
    role = role2)"
*/
simplify
solve( SessionAgreementSet( sid, role, pkI, pkR, k, protoKeyR
       ) @ #set )
  case Initiator_recvChal
  solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>, ~ltkI,
                             ~ephI, ~protoKey, ~sid
         ) ▶₀ #set )
    case Initiator_sendChal_case_1
    solve( SessionAccept( ~sid ) @ #accept )
      case Initiator_recvAuth
      solve( Initiator_authSent( <'g'^~ltkI, pk(~ltkI)>, <z, pk(ltkR)>,
                                 ~ltkI, ~ephI, z.1, ~protoKey, ~sid
             ) ▶₀ #accept )
        case Initiator_recvChal
        solve( SessionPeer( ~sid, <'g'^~ltk, pk(~ltk)> ) @ #remote )
          case Dial
          solve( !KU( mac(z, h(<z.3, ~protoKey>)) ) @ #vk.2 )
            case Responder_recvChal
            solve( !KU( senc(sign(<~protoKey, 
                                   <<'g'^~ltk, pk(~ltk)>, 
                                    sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h('g'^(~ephI*~ephR))>,
                                         ~ltk)
                                   >, 
                                   h('g'^(~ephI*~ephR))>,
                                  ~ltk),
                             h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 'g'^(~ephI*~ltk)
                               >))
                   ) @ #vk.3 )
              case c_senc
              solve( !KU( sign(<~protoKey, 
                                <<'g'^~ltk, pk(~ltk)>, 
                                 sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h('g'^(~ephI*~ephR))>, ~ltk)
                                >, 
                                h('g'^(~ephI*~ephR))>,
                               ~ltk)
                     ) @ #vk.7 )
                case Responder_recvAuth
                solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                               'g'^(~ephI*~ltk)>)
                       ) @ #vk.8 )
                  case RevealSessionKey_case_1
                  solve( !KU( senc(<<'g'^~ltk, pk(~ltk)>, 
                                    sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h('g'^(~ephI*~ephR))>,
                                         ~ltk)
                                   >,
                                   h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(x.2*~x.3)>))
                         ) @ #vk.9 )
                    case Initiator_recvChal_case_1
                    by solve( splitEqs(7) )
                  next
                    case Initiator_recvChal_case_2
                    by solve( splitEqs(7) )
                  next
                    case c_senc
                    solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                      h('g'^(~ephI*~ephR))>,
                                     ~ltk)
                           ) @ #vk.19 )
                      case Initiator_recvChal_case_1
                      solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~x*~x.1), 
                                     'g'^(x.2*~x.3)>)
                             ) @ #vk.11 )
                        case RevealSessionKey_case_1
                        by solve( splitEqs(7) )
                      next
                        case RevealSessionKey_case_2
                        by solve( splitEqs(7) )
                      next
                        case RevealSessionKey_case_3
                        by solve( splitEqs(7) )
                      next
                        case RevealSessionKey_case_4
                        by solve( splitEqs(7) )
                      next
                        case RevealSessionKey_case_5
                        solve( !KU( mac('g'^x.4, h(~protoKey)) ) @ #vk.15 )
                          case Initiator_sendChal_case_1
                          by solve( splitEqs(7) )
                        next
                          case Initiator_sendChal_case_2
                          by solve( splitEqs(7) )
                        next
                          case c_mac
                          solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(x.2*~x.3)>)
                                 ) @ #vk.16 )
                            case c_h
                            solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.32 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.34 )
                            next
                              case Responder_recvChal
                              by solve( !KU( ~ephI ) @ #vk.34 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.36 )
                            qed
                          qed
                        qed
                      next
                        case c_h
                        solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.27 )
                          case Initiator_sendChal
                          by solve( !KU( ~ephR ) @ #vk.31 )
                        next
                          case Responder_recvChal
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        qed
                      qed
                    next
                      case Initiator_recvChal_case_2
                      solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~x*~x.1), 
                                     'g'^(x.2*~x.3)>)
                             ) @ #vk.11 )
                        case RevealSessionKey_case_1
                        by solve( splitEqs(7) )
                      next
                        case RevealSessionKey_case_2
                        by solve( splitEqs(7) )
                      next
                        case RevealSessionKey_case_3
                        by solve( splitEqs(7) )
                      next
                        case RevealSessionKey_case_4
                        by solve( splitEqs(7) )
                      next
                        case RevealSessionKey_case_5
                        solve( !KU( mac('g'^x.4, h(~protoKey)) ) @ #vk.15 )
                          case Initiator_sendChal_case_1
                          by solve( splitEqs(7) )
                        next
                          case Initiator_sendChal_case_2
                          by solve( splitEqs(7) )
                        next
                          case c_mac
                          solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(x.2*~x.3)>)
                                 ) @ #vk.16 )
                            case c_h
                            solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.32 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.34 )
                            next
                              case Responder_recvChal
                              by solve( !KU( ~ephI ) @ #vk.34 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.36 )
                            qed
                          qed
                        qed
                      next
                        case c_h
                        solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.27 )
                          case Initiator_sendChal
                          by solve( !KU( ~ephR ) @ #vk.31 )
                        next
                          case Responder_recvChal
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        qed
                      qed
                    next
                      case c_sign
                      solve( !KU( ~ltk ) @ #vk.22 )
                        case Corrupt_ltk
                        by contradiction
                      qed
                    qed
                  qed
                next
                  case RevealSessionKey_case_2
                  by solve( splitEqs(9) )
                next
                  case c_h
                  solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.21 )
                  next
                    case Responder_recvChal
                    by solve( !KU( ~ephI ) @ #vk.21 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.23 )
                  qed
                qed
              next
                case c_sign
                solve( !KU( ~ltk ) @ #vk.10 )
                  case Corrupt_ltk
                  by contradiction
                qed
              qed
            qed
          next
            case c_mac
            solve( !KU( senc(sign(<~protoKey, 
                                   <<'g'^~ltk, pk(~ltk)>, 
                                    sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h(z.1)>, ~ltk)>, 
                                   h(z.1)>,
                                  ~ltk),
                             h(<~protoKey, z.1, z.2, 'g'^(~ephI*~ltk)>))
                   ) @ #vk.3 )
              case c_senc
              solve( !KU( sign(<~protoKey, 
                                <<'g'^~ltk, pk(~ltk)>, 
                                 sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h(z.1)>, ~ltk)>, 
                                h(z.1)>,
                               ~ltk)
                     ) @ #vk.5 )
                case Responder_recvAuth
                solve( splitEqs(6) )
                  case split_case_01
                  solve( !KU( 'g'^inv(~ephI) ) @ #vk.4 )
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.14 )
                  qed
                next
                  case split_case_02
                  solve( splitEqs(2) )
                    case split
                    solve( !KU( 'g'^(~ephR*inv(~ephI)) ) @ #vk.4 )
                      case Responder_recvChal
                      by solve( !KU( ~ephI ) @ #vk.13 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    qed
                  qed
                next
                  case split_case_03
                  solve( !KU( 'g'^inv((~ephI*~ltk)) ) @ #vk.4 )
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.15 )
                  qed
                next
                  case split_case_04
                  solve( splitEqs(2) )
                    case split
                    solve( !KU( 'g'^(~ephR*inv((~ephI*~ltk))) ) @ #vk.4 )
                      case Responder_recvChal
                      by solve( !KU( ~ephI ) @ #vk.14 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.14 )
                    qed
                  qed
                next
                  case split_case_05
                  solve( splitEqs(2) )
                    case split_case_1
                    solve( !KU( 'g'^(~ephR*ephI.1*inv(~ephI)) ) @ #vk.4 )
                      case Initiator_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_recvChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_recvChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_sendChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case Initiator_sendChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case Initiator_sendChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case Initiator_sendChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case Responder_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.16 )
                    next
                      case Responder_recvChal_case_2
                      by solve( !KU( ~ephI ) @ #vk.15 )
                    next
                      case Responder_recvChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.16 )
                    next
                      case RevealPubkey_case_1
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case RevealPubkey_case_2
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.14 )
                    qed
                  next
                    case split_case_2
                    solve( !KU( 'g'^(~ephR*x) ) @ #vk.4 )
                      case Initiator_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.16 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_recvChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.16 )
                    next
                      case Initiator_recvChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_sendChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.12 )
                    next
                      case Initiator_sendChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case Initiator_sendChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.12 )
                    next
                      case Initiator_sendChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case Responder_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.15 )
                    next
                      case Responder_recvChal_case_2
                      solve( !KU( 'g'^(~ephI*x) ) @ #vk.10 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.13 )
                      next
                        case Initiator_sendChal_case_2
                        solve( !KU( h(<'g'^(~ephI*~ephR*x), ~protoKey>) ) @ #vk.6 )
                          case c_h
                          solve( !KU( 'g'^(~ephI*~ephR*x) ) @ #vk.14 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.21 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.21 )
                          next
                            case Initiator_recvChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.21 )
                          next
                            case Initiator_recvChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.21 )
                          next
                            case Initiator_sendChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.17 )
                          next
                            case Initiator_sendChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.17 )
                          next
                            case Initiator_sendChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.17 )
                          next
                            case Initiator_sendChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.17 )
                          next
                            case Initiator_sendChal_case_5
                            by solve( !KU( ~ephI ) @ #vk.17 )
                          next
                            case Responder_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.20 )
                          next
                            case Responder_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.17 )
                          next
                            case Responder_recvChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.20 )
                          next
                            case RevealPubkey_case_1
                            by solve( !KU( ~ephI ) @ #vk.17 )
                          next
                            case RevealPubkey_case_2
                            by solve( !KU( ~ephI ) @ #vk.17 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.18 )
                          qed
                        qed
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.14 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.13 )
                      next
                        case Initiator_sendChal_case_5
                        by solve( !KU( ~ephI ) @ #vk.14 )
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.13 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.14 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.15 )
                      qed
                    next
                      case Responder_recvChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.16 )
                    next
                      case RevealPubkey_case_1
                      by solve( !KU( ~ephR ) @ #vk.12 )
                    next
                      case RevealPubkey_case_2
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.14 )
                    qed
                  next
                    case split_case_3
                    solve( !KU( 'g'^(~ephR*inv((~ephI*x))) ) @ #vk.4 )
                      case Responder_recvChal
                      by solve( !KU( ~ephI ) @ #vk.14 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.14 )
                    qed
                  next
                    case split_case_4
                    solve( !KU( 'g'^(~ephR*x*inv((~ephI*x.1))) ) @ #vk.4 )
                      case Initiator_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_recvChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_recvChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_sendChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case Initiator_sendChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case Initiator_sendChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case Initiator_sendChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case Responder_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.16 )
                    next
                      case Responder_recvChal_case_2
                      by solve( !KU( ~ephI ) @ #vk.16 )
                    next
                      case Responder_recvChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.16 )
                    next
                      case RevealPubkey_case_1
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case RevealPubkey_case_2
                      by solve( !KU( ~ephR ) @ #vk.13 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.14 )
                    qed
                  qed
                next
                  case split_case_06
                  solve( !KU( 'g'^(x*inv(~ephR)) ) @ #vk.10 )
                    case Initiator_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.17 )
                  next
                    case Initiator_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.19 )
                  next
                    case Initiator_recvChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.17 )
                  next
                    case Initiator_recvChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.19 )
                  next
                    case Initiator_sendChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.13 )
                  next
                    case Initiator_sendChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_sendChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.13 )
                  next
                    case Initiator_sendChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Responder_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case Responder_recvChal_case_2
                    by solve( !KU( ~ephR.1 ) @ #vk.18 )
                  next
                    case RevealPubkey_case_1
                    by solve( !KU( ~ephR ) @ #vk.13 )
                  next
                    case RevealPubkey_case_2
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  qed
                next
                  case split_case_07
                  solve( splitEqs(1) )
                    case split_case_1
                    solve( !KU( 'g'^inv((~ephI*~ephI)) ) @ #vk.4 )
                      case cexp
                      by solve( !KU( ~ephI ) @ #vk.15 )
                    qed
                  next
                    case split_case_2
                    solve( !KU( 'g'^inv((~ephR*x)) ) @ #vk.10 )
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.15 )
                    qed
                  next
                    case split_case_3
                    solve( !KU( 'g'^inv((~ephI*~ephI*x)) ) @ #vk.4 )
                      case cexp
                      by solve( !KU( ~ephI ) @ #vk.15 )
                    qed
                  qed
                next
                  case split_case_08
                  solve( !KU( 'g'^(x.2*inv(~ltk)) ) @ #vk.10 )
                    case Initiator_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.17 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.19 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_recvChal_case_3
                    solve( !KU( ~ltk ) @ #vk.17 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_recvChal_case_4
                    solve( !KU( ~ltk ) @ #vk.19 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_sendChal_case_1
                    solve( !KU( ~ltk ) @ #vk.13 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_sendChal_case_2
                    solve( !KU( ~ltk ) @ #vk.15 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_sendChal_case_3
                    solve( !KU( ~ltk ) @ #vk.13 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_sendChal_case_4
                    solve( !KU( ~ltk ) @ #vk.15 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Responder_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Responder_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.18 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case RevealPubkey_case_1
                    solve( !KU( ~ltk ) @ #vk.13 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case RevealPubkey_case_2
                    solve( !KU( ~ltk ) @ #vk.15 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case cexp
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  qed
                next
                  case split_case_09
                  solve( splitEqs(2) )
                    case split
                    solve( !KU( 'g'^(~ephR*inv((~ephI*~ltk*x))) ) @ #vk.4 )
                      case Responder_recvChal
                      by solve( !KU( ~ephI ) @ #vk.14 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.14 )
                    qed
                  qed
                next
                  case split_case_10
                  solve( !KU( 'g'^inv((~ephI*~ltk*x)) ) @ #vk.4 )
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.15 )
                  qed
                next
                  case split_case_11
                  solve( !KU( 'g'^(x.2*inv((~ltk*x.3))) ) @ #vk.10 )
                    case Initiator_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.18 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.20 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_recvChal_case_3
                    solve( !KU( ~ltk ) @ #vk.18 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_recvChal_case_4
                    solve( !KU( ~ltk ) @ #vk.20 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_sendChal_case_1
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_sendChal_case_2
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_sendChal_case_3
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Initiator_sendChal_case_4
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Responder_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.17 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case Responder_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.19 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case RevealPubkey_case_1
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case RevealPubkey_case_2
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  next
                    case cexp
                    solve( !KU( ~ltk ) @ #vk.17 )
                      case Corrupt_ltk
                      by contradiction
                    qed
                  qed
                next
                  case split_case_12
                  solve( !KU( 'g'^(x.1*inv((~ephR*~ltk))) ) @ #vk.10 )
                    case Initiator_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case Initiator_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.20 )
                  next
                    case Initiator_recvChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case Initiator_recvChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.20 )
                  next
                    case Initiator_sendChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Initiator_sendChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case Initiator_sendChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Initiator_sendChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case Responder_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.17 )
                  next
                    case Responder_recvChal_case_2
                    by solve( !KU( ~ephR.1 ) @ #vk.19 )
                  next
                    case RevealPubkey_case_1
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case RevealPubkey_case_2
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.17 )
                  qed
                next
                  case split_case_13
                  solve( !KU( 'g'^(x.1*inv((~ephR*x.2))) ) @ #vk.10 )
                    case Initiator_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case Initiator_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.20 )
                  next
                    case Initiator_recvChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case Initiator_recvChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.20 )
                  next
                    case Initiator_sendChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Initiator_sendChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case Initiator_sendChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Initiator_sendChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case Responder_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.17 )
                  next
                    case Responder_recvChal_case_2
                    by solve( !KU( ~ephR.1 ) @ #vk.19 )
                  next
                    case RevealPubkey_case_1
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case RevealPubkey_case_2
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.17 )
                  qed
                next
                  case split_case_14
                  solve( !KU( 'g'^(x.1*inv((~ephR*~ltk*x.2))) ) @ #vk.10 )
                    case Initiator_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case Initiator_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.20 )
                  next
                    case Initiator_recvChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case Initiator_recvChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.20 )
                  next
                    case Initiator_sendChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Initiator_sendChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case Initiator_sendChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Initiator_sendChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case Responder_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.17 )
                  next
                    case Responder_recvChal_case_2
                    by solve( !KU( ~ephR.1 ) @ #vk.19 )
                  next
                    case RevealPubkey_case_1
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case RevealPubkey_case_2
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.17 )
                  qed
                qed
              next
                case c_sign
                solve( !KU( ~ltk ) @ #vk.8 )
                  case Corrupt_ltk
                  by contradiction
                qed
              qed
            qed
          qed
        next
          case Responder_recvAuth
          by solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid
                    ) ▶₀ #remote )
        qed
      qed
    next
      case Responder_recvAuth
      by solve( Responder_chalSent( ~ltkR, ~ephR, z, ~protoKey, ~sid
                ) ▶₀ #accept )
    qed
  next
    case Initiator_sendChal_case_2
    solve( SessionAccept( ~sid ) @ #accept )
      case Initiator_recvAuth
      solve( Initiator_authSent( <'g'^~ltkI, pk(~ltkI)>, <z, pk(ltkR)>,
                                 ~ltkI, ~ephI, z.1, ~protoKey, ~sid
             ) ▶₀ #accept )
        case Initiator_recvChal
        solve( SessionPeer( ~sid, <'g'^~ltk, pk(~ltk)> ) @ #remote )
          case Dial
          solve( !KU( mac(z, h(<z.3, ~protoKey>)) ) @ #vk.2 )
            case Responder_recvChal
            solve( !KU( senc(sign(<~protoKey, 
                                   <<'g'^~ltkI, pk(~ltkI)>, 
                                    sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h('g'^(~ephI*~ephR))>,
                                         ~ltkI)
                                   >, 
                                   h('g'^(~ephI*~ephR))>,
                                  ~ltk),
                             h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltkI), 
                                'g'^(~ephI*~ltk)>))
                   ) @ #vk.3 )
              case c_senc
              solve( !KU( sign(<~protoKey, 
                                <<'g'^~ltkI, pk(~ltkI)>, 
                                 sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h('g'^(~ephI*~ephR))>,
                                      ~ltkI)
                                >, 
                                h('g'^(~ephI*~ephR))>,
                               ~ltk)
                     ) @ #vk.7 )
                case Responder_recvAuth
                solve( splitEqs(9) )
                  case split
                  solve( !KU( 'g'^(~ephI*~ephR*inv(~ephR.1)) ) @ #vk.12 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Responder_recvChal
                    by solve( !KU( ~ephI ) @ #vk.15 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.16 )
                  qed
                qed
              next
                case c_sign
                solve( !KU( ~ltk ) @ #vk.10 )
                  case Corrupt_ltk
                  by contradiction /* from formulas */
                qed
              qed
            qed
          next
            case c_mac
            solve( !KU( senc(sign(<~protoKey, 
                                   <<'g'^~ltkI, pk(~ltkI)>, 
                                    sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h(z.1)>, ~ltkI)>, 
                                   h(z.1)>,
                                  ~ltk),
                             h(<~protoKey, z.1, z.2, 'g'^(~ephI*~ltk)>))
                   ) @ #vk.3 )
              case c_senc
              solve( !KU( sign(<~protoKey, 
                                <<'g'^~ltkI, pk(~ltkI)>, 
                                 sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h(z.1)>, ~ltkI)>, 
                                h(z.1)>,
                               ~ltk)
                     ) @ #vk.5 )
                case Responder_recvAuth
                solve( !KU( senc(<<'g'^~ltkI, pk(~ltkI)>, 
                                  sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h(z.1)>, ~ltkI)>,
                                 h(<~protoKey, z.1, z.5>))
                       ) @ #vk.7 )
                  case Initiator_recvChal_case_1
                  solve( splitEqs(1) )
                    case split_case_1
                    by solve( splitEqs(3) )
                  next
                    case split_case_2
                    solve( !KU( 'g'^(~ephR*~ephI.1*inv(~ephI)) ) @ #vk.5 )
                      case Initiator_sendChal
                      by solve( !KU( ~ephR ) @ #vk.16 )
                    next
                      case Responder_recvChal
                      by solve( !KU( ~ephI.1 ) @ #vk.16 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    qed
                  qed
                next
                  case Initiator_recvChal_case_2
                  solve( splitEqs(1) )
                    case split_case_1
                    by solve( splitEqs(3) )
                  next
                    case split_case_2
                    solve( !KU( 'g'^(~ephR*~ephI.1*inv(~ephI)) ) @ #vk.5 )
                      case Initiator_sendChal
                      by solve( !KU( ~ephR ) @ #vk.16 )
                    next
                      case Responder_recvChal
                      by solve( !KU( ~ephI.1 ) @ #vk.16 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    qed
                  qed
                next
                  case c_senc
                  solve( !KU( h(<~protoKey, z.1, z.5>) ) @ #vk.13 )
                    case c_h
                    solve( splitEqs(1) )
                      case split_case_01
                      solve( splitEqs(8) )
                        case split
                        solve( !KU( 'g'^(~ephI*~ltk*inv(~ephR)) ) @ #vk.22 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_sendChal
                          solve( !KU( ~ltk ) @ #vk.24 )
                            case Corrupt_ltk
                            by contradiction /* from formulas */
                          qed
                        next
                          case RevealPubkey
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        qed
                      qed
                    next
                      case split_case_02
                      solve( splitEqs(8) )
                        case split
                        solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h('g')>, ~ltkI)
                               ) @ #vk.17 )
                          case Initiator_recvChal_case_1
                          solve( splitEqs(11) )
                            case split
                            solve( !KU( 'g'^(~ltk*inv(~ephR)) ) @ #vk.22 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~ephR ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~ephR ) @ #vk.32 )
                            next
                              case RevealPubkey
                              by solve( !KU( ~ephR ) @ #vk.28 )
                            next
                              case cexp
                              solve( !KU( ~ltk ) @ #vk.28 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            qed
                          qed
                        next
                          case Initiator_recvChal_case_2
                          solve( splitEqs(11) )
                            case split
                            solve( !KU( 'g'^(~ltk*inv(~ephR)) ) @ #vk.22 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~ephR ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~ephR ) @ #vk.32 )
                            next
                              case RevealPubkey
                              by solve( !KU( ~ephR ) @ #vk.28 )
                            next
                              case cexp
                              solve( !KU( ~ltk ) @ #vk.28 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            qed
                          qed
                        next
                          case c_sign
                          solve( !KU( ~ltkI ) @ #vk.24 )
                            case Corrupt_ltk
                            solve( !KU( 'g'^(~ltk*inv(~ephR)) ) @ #vk.24 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~ephR ) @ #vk.35 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~ephR ) @ #vk.35 )
                            next
                              case RevealPubkey
                              by solve( !KU( ~ephR ) @ #vk.31 )
                            next
                              case cexp
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            qed
                          qed
                        qed
                      qed
                    next
                      case split_case_03
                      solve( splitEqs(7) )
                        case split
                        solve( splitEqs(8) )
                          case split_case_1
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*inv(~ltk)))>,
                                           ~ltk)
                                 ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            solve( splitEqs(12) )
                              case split
                              solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk))) ) @ #vk.13 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.29 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.29 )
                              qed
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( splitEqs(12) )
                              case split_case_1
                              solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk))) ) @ #vk.13 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.26 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.26 )
                              qed
                            next
                              case split_case_2
                              solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk))) ) @ #vk.13 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.29 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.29 )
                              qed
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltk ) @ #vk.25 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          qed
                        next
                          case split_case_2
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*inv(~ltkI)))>,
                                           ~ltkI)
                                 ) @ #vk.17 )
                            case Initiator_recvChal
                            solve( splitEqs(12) )
                              case split_case_1
                              solve( !KU( 'g'^(~ephI*inv((~ephR*~ltkI))) ) @ #vk.13 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.26 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.26 )
                              qed
                            next
                              case split_case_2
                              solve( !KU( 'g'^(~ephI*inv((~ephR*~ltkI))) ) @ #vk.13 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.29 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.29 )
                              qed
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltkI ) @ #vk.24 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~ephI*inv((~ephR*~ltkI))) ) @ #vk.14 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.32 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              qed
                            qed
                          qed
                        qed
                      qed
                    next
                      case split_case_04
                      solve( splitEqs(8) )
                        case split_case_1
                        solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h('g'^inv(~ltk))
                                         >,
                                         ~ltk)
                               ) @ #vk.17 )
                          case Initiator_recvChal_case_1
                          solve( !KU( h(<'g'^inv(~ltk), ~protoKey>) ) @ #vk.8 )
                            case c_h
                            solve( !KU( h(<~protoKey, 'g'^inv(~ltk), 'g'^inv(~ephI), 
                                           'g'^(~ephI*~ltk)>)
                                   ) @ #vk.10 )
                              case RevealSessionKey
                              solve( !KU( h(<~protoKey, 'g'^inv(~ltk), 'g'^(~ephR*~ltk), 
                                             'g'^inv(~ephR)>)
                                     ) @ #vk.11 )
                                case RevealSessionKey
                                solve( splitEqs(12) )
                                  case split
                                  solve( !KU( mac('g'^inv((~ephR*~ltk)), h(~protoKey)) ) @ #vk.14 )
                                    case c_mac
                                    solve( !KU( 'g'^inv((~ephI*~ltk)) ) @ #vk.12 )
                                      case cexp
                                      by solve( !KU( ~ephI ) @ #vk.32 )
                                    qed
                                  qed
                                qed
                              next
                                case c_h
                                solve( !KU( 'g'^(~ephR*~ltk) ) @ #vk.31 )
                                  case Initiator_recvChal_case_1
                                  by solve( !KU( ~ephR ) @ #vk.36 )
                                next
                                  case Initiator_recvChal_case_2
                                  by solve( !KU( ~ephR ) @ #vk.36 )
                                next
                                  case Responder_recvChal
                                  solve( !KU( ~ltk ) @ #vk.32 )
                                    case Corrupt_ltk
                                    by contradiction /* from formulas */
                                  qed
                                next
                                  case RevealPubkey
                                  by solve( !KU( ~ephR ) @ #vk.32 )
                                next
                                  case cexp
                                  by solve( !KU( ~ephR ) @ #vk.34 )
                                qed
                              qed
                            next
                              case c_h
                              solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.32 )
                                case Initiator_recvChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.37 )
                              next
                                case Initiator_recvChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.37 )
                              next
                                case Initiator_sendChal
                                solve( !KU( ~ltk ) @ #vk.33 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case RevealPubkey
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.35 )
                              qed
                            qed
                          qed
                        next
                          case Initiator_recvChal_case_2
                          solve( !KU( h(<'g'^inv(~ltk), ~protoKey>) ) @ #vk.8 )
                            case c_h
                            solve( !KU( 'g'^inv(~ephR) ) @ #vk.23 )
                              case cexp
                              by solve( !KU( ~ephR ) @ #vk.30 )
                            qed
                          qed
                        next
                          case c_sign
                          solve( !KU( ~ltk ) @ #vk.25 )
                            case Corrupt_ltk
                            by contradiction /* from formulas */
                          qed
                        qed
                      next
                        case split_case_2
                        solve( !KU( 'g'^inv((~ephI*~ltkI)) ) @ #vk.6 )
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.26 )
                        qed
                      qed
                    next
                      case split_case_05
                      solve( !KU( 'g'^(~ephI*ephR) ) @ #vk.21 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.27 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.28 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.27 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.28 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_sendChal_case_4
                        solve( splitEqs(8) )
                          case split_case_01
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*ephR))>,
                                           ~ltkI)
                                 ) @ #vk.19 )
                            case Initiator_recvChal_case_1
                            solve( !KU( 'g'^(~ephI*ephR*inv(~ephR.1)) ) @ #vk.15 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case Initiator_sendChal_case_5
                              by solve( !KU( ~ephR.1 ) @ #vk.30 )
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case Responder_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.30 )
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( 'g'^(~ephI*ephR*inv(~ephR.1)) ) @ #vk.15 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case Initiator_sendChal_case_5
                              by solve( !KU( ~ephR.1 ) @ #vk.30 )
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case Responder_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.30 )
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltkI ) @ #vk.25 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~ephI*ephR*inv(~ephR.1)) ) @ #vk.17 )
                                case Initiator_recvChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_3
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_4
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_sendChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_3
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_4
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_5
                                by solve( !KU( ~ephR.1 ) @ #vk.33 )
                              next
                                case Responder_recvChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.35 )
                              next
                                case Responder_recvChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.35 )
                              next
                                case RevealPubkey_case_1
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case RevealPubkey_case_2
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              qed
                            qed
                          qed
                        next
                          case split_case_02
                          solve( !KU( ~ltk ) @ #vk.24 )
                            case Corrupt_ltk
                            by contradiction /* from formulas */
                          qed
                        next
                          case split_case_03
                          by solve( !KU( ~ephR ) @ #vk.24 )
                        next
                          case split_case_04
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*inv(x)))>,
                                           ~ltkI)
                                 ) @ #vk.19 )
                            case Initiator_recvChal_case_1
                            solve( splitEqs(13) )
                              case split
                              solve( !KU( 'g'^(~ephI*inv((~ephR*x))) ) @ #vk.16 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.31 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              qed
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( splitEqs(13) )
                              case split_case_1
                              solve( !KU( 'g'^(~ephI*inv((~ephR*x))) ) @ #vk.16 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.28 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.29 )
                              qed
                            next
                              case split_case_2
                              solve( !KU( 'g'^(~ephI*inv((~ephR*x))) ) @ #vk.16 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.31 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              qed
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltkI ) @ #vk.26 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~ephI*inv((~ephR*x))) ) @ #vk.17 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.34 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.35 )
                              qed
                            qed
                          qed
                        next
                          case split_case_05
                          solve( !KU( ~ltk ) @ #vk.25 )
                            case Corrupt_ltk
                            by contradiction /* from formulas */
                          qed
                        next
                          case split_case_06
                          by solve( !KU( ~ephR ) @ #vk.24 )
                        next
                          case split_case_07
                          by solve( !KU( ~ephR ) @ #vk.24 )
                        next
                          case split_case_08
                          solve( !KU( ~ltk ) @ #vk.26 )
                            case Corrupt_ltk
                            by contradiction /* from formulas */
                          qed
                        next
                          case split_case_09
                          by solve( !KU( ~ephR ) @ #vk.24 )
                        next
                          case split_case_10
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*x*inv(x.1)))>,
                                           ~ltkI)
                                 ) @ #vk.19 )
                            case Initiator_recvChal_case_1
                            solve( !KU( 'g'^(~ephI*x*inv((~ephR*x.1))) ) @ #vk.15 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.37 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.37 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.37 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.37 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_sendChal_case_5
                              by solve( !KU( ~ephR ) @ #vk.34 )
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.36 )
                            next
                              case Responder_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.36 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.34 )
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( 'g'^(~ephI*x*inv((~ephR*x.1))) ) @ #vk.15 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.37 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.37 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.37 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.37 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case Initiator_sendChal_case_5
                              by solve( !KU( ~ephR ) @ #vk.34 )
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.36 )
                            next
                              case Responder_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.36 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.34 )
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltkI ) @ #vk.28 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~ephI*x*inv((~ephR*x.1))) ) @ #vk.17 )
                                case Initiator_recvChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.40 )
                              next
                                case Initiator_recvChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.40 )
                              next
                                case Initiator_recvChal_case_3
                                by solve( !KU( ~ephI ) @ #vk.40 )
                              next
                                case Initiator_recvChal_case_4
                                by solve( !KU( ~ephI ) @ #vk.40 )
                              next
                                case Initiator_sendChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_sendChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_sendChal_case_3
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_sendChal_case_4
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_sendChal_case_5
                                by solve( !KU( ~ephR ) @ #vk.37 )
                              next
                                case Responder_recvChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.39 )
                              next
                                case Responder_recvChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.39 )
                              next
                                case RevealPubkey_case_1
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case RevealPubkey_case_2
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.37 )
                              qed
                            qed
                          qed
                        next
                          case split_case_11
                          solve( !KU( ~ltk ) @ #vk.27 )
                            case Corrupt_ltk
                            by contradiction /* from formulas */
                          qed
                        next
                          case split_case_12
                          by solve( !KU( ~ephR ) @ #vk.24 )
                        qed
                      next
                        case Initiator_sendChal_case_5
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.27 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.25 )
                      qed
                    next
                      case split_case_06
                      solve( !KU( 'g'^inv((~ephI*x)) ) @ #vk.6 )
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      qed
                    next
                      case split_case_07
                      solve( splitEqs(8) )
                        case split_case_1
                        solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*inv((~ltk*~ltkI))))>,
                                         ~ltkI)
                               ) @ #vk.17 )
                          case Initiator_recvChal_case_1
                          solve( splitEqs(11) )
                            case split
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*~ltk))) ) @ #vk.13 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.29 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            qed
                          qed
                        next
                          case Initiator_recvChal_case_2
                          solve( splitEqs(11) )
                            case split_case_1
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*~ltkI))) ) @ #vk.13 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.26 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.26 )
                            qed
                          next
                            case split_case_2
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*~ltkI))) ) @ #vk.13 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.29 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            qed
                          qed
                        next
                          case c_sign
                          solve( !KU( ~ltkI ) @ #vk.24 )
                            case Corrupt_ltk
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*~ltkI))) ) @ #vk.14 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.32 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            qed
                          qed
                        qed
                      next
                        case split_case_2
                        solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*inv((~ltk*x))))>,
                                         ~ltk)
                               ) @ #vk.17 )
                          case Initiator_recvChal_case_1
                          solve( splitEqs(11) )
                            case split
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*x))) ) @ #vk.13 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.29 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            qed
                          qed
                        next
                          case Initiator_recvChal_case_2
                          solve( splitEqs(11) )
                            case split_case_1
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*x))) ) @ #vk.13 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.26 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.26 )
                            qed
                          next
                            case split_case_2
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*x))) ) @ #vk.13 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.29 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            qed
                          qed
                        next
                          case c_sign
                          solve( !KU( ~ltk ) @ #vk.25 )
                            case Corrupt_ltk
                            by contradiction /* from formulas */
                          qed
                        qed
                      next
                        case split_case_3
                        solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*inv((~ltkI*x))))>,
                                         ~ltkI)
                               ) @ #vk.17 )
                          case Initiator_recvChal
                          solve( splitEqs(11) )
                            case split_case_1
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltkI*x))) ) @ #vk.13 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.26 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.26 )
                            qed
                          next
                            case split_case_2
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltkI*x))) ) @ #vk.13 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.29 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            qed
                          qed
                        next
                          case c_sign
                          solve( !KU( ~ltkI ) @ #vk.24 )
                            case Corrupt_ltk
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltkI*x))) ) @ #vk.14 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.32 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            qed
                          qed
                        qed
                      next
                        case split_case_4
                        solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*inv((~ltk*~ltkI*x))))>,
                                         ~ltkI)
                               ) @ #vk.17 )
                          case Initiator_recvChal_case_1
                          solve( splitEqs(11) )
                            case split
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*~ltk*x))) ) @ #vk.13 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.29 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            qed
                          qed
                        next
                          case Initiator_recvChal_case_2
                          solve( splitEqs(11) )
                            case split_case_1
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*~ltkI*x))) ) @ #vk.13 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.26 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.26 )
                            qed
                          next
                            case split_case_2
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*~ltkI*x))) ) @ #vk.13 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.29 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.29 )
                            qed
                          qed
                        next
                          case c_sign
                          solve( !KU( ~ltkI ) @ #vk.24 )
                            case Corrupt_ltk
                            solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*~ltkI*x))) ) @ #vk.14 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR ) @ #vk.32 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            qed
                          qed
                        qed
                      qed
                    next
                      case split_case_08
                      solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h('g'^x)>,
                                       ~ltkI)
                             ) @ #vk.17 )
                        case Initiator_recvChal_case_1
                        solve( !KU( 'g'^(x*inv(~ephI)) ) @ #vk.7 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.34 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.34 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.30 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.30 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.30 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        qed
                      next
                        case Initiator_recvChal_case_2
                        solve( !KU( 'g'^(x*inv(~ephI)) ) @ #vk.7 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.34 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.34 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.30 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.30 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.30 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        qed
                      next
                        case c_sign
                        solve( !KU( ~ltkI ) @ #vk.24 )
                          case Corrupt_ltk
                          solve( !KU( 'g'^(x*inv(~ephI)) ) @ #vk.9 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.35 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.37 )
                          next
                            case Initiator_recvChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.35 )
                          next
                            case Initiator_recvChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.37 )
                          next
                            case Initiator_sendChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.31 )
                          next
                            case Initiator_sendChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.33 )
                          next
                            case Initiator_sendChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.31 )
                          next
                            case Initiator_sendChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.33 )
                          next
                            case Responder_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.34 )
                          next
                            case Responder_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.36 )
                          next
                            case RevealPubkey_case_1
                            by solve( !KU( ~ephI ) @ #vk.31 )
                          next
                            case RevealPubkey_case_2
                            by solve( !KU( ~ephI ) @ #vk.33 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.34 )
                          qed
                        qed
                      qed
                    next
                      case split_case_09
                      solve( splitEqs(8) )
                        case split_case_1
                        solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*~ephR*inv(~ltk)))>,
                                         ~ltk)
                               ) @ #vk.17 )
                          case Initiator_recvChal_case_1
                          solve( !KU( 'g'^(~ephR*inv(~ltk)) ) @ #vk.7 )
                            case Responder_recvChal
                            solve( !KU( ~ltk ) @ #vk.28 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case cexp
                            by solve( !KU( ~ephR ) @ #vk.29 )
                          qed
                        next
                          case Initiator_recvChal_case_2
                          solve( !KU( 'g'^(~ephR*inv(~ltk)) ) @ #vk.7 )
                            case Responder_recvChal
                            solve( !KU( ~ltk ) @ #vk.28 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case cexp
                            by solve( !KU( ~ephR ) @ #vk.29 )
                          qed
                        next
                          case c_sign
                          solve( !KU( ~ltk ) @ #vk.25 )
                            case Corrupt_ltk
                            by contradiction /* from formulas */
                          qed
                        qed
                      next
                        case split_case_2
                        solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*~ephR*inv(~ltkI)))>,
                                         ~ltkI)
                               ) @ #vk.17 )
                          case Initiator_recvChal
                          solve( !KU( 'g'^(~ephR*inv(~ltkI)) ) @ #vk.7 )
                            case Responder_recvChal
                            solve( !KU( ~ltkI ) @ #vk.28 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~ephI*inv(~ltkI)) ) @ #vk.14 )
                                case Initiator_sendChal
                                solve( !KU( 'g'^(~ephI*~ephR*inv(~ltkI)) ) @ #vk.23 )
                                  case Initiator_sendChal
                                  by solve( !KU( ~ephR ) @ #vk.30 )
                                next
                                  case Responder_recvChal
                                  by solve( !KU( ~ephI ) @ #vk.30 )
                                next
                                  case cexp
                                  by solve( !KU( ~ephI ) @ #vk.31 )
                                qed
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.31 )
                              qed
                            qed
                          next
                            case cexp
                            by solve( !KU( ~ephR ) @ #vk.29 )
                          qed
                        next
                          case c_sign
                          solve( !KU( ~ltkI ) @ #vk.24 )
                            case Corrupt_ltk
                            solve( !KU( 'g'^(~ephR*inv(~ltkI)) ) @ #vk.9 )
                              case Responder_recvChal
                              solve( !KU( 'g'^(~ephI*inv(~ltkI)) ) @ #vk.15 )
                                case Initiator_sendChal
                                solve( !KU( 'g'^(~ephI*~ephR*inv(~ltkI)) ) @ #vk.24 )
                                  case Initiator_sendChal
                                  by solve( !KU( ~ephR ) @ #vk.32 )
                                next
                                  case Responder_recvChal
                                  by solve( !KU( ~ephI ) @ #vk.32 )
                                next
                                  case cexp
                                  by solve( !KU( ~ephI ) @ #vk.33 )
                                qed
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              qed
                            next
                              case cexp
                              by solve( !KU( ~ephR ) @ #vk.33 )
                            qed
                          qed
                        qed
                      next
                        case split_case_3
                        solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*x*inv(~ltk)))>,
                                         ~ltk)
                               ) @ #vk.17 )
                          case Initiator_recvChal_case_1
                          solve( !KU( 'g'^(x*inv(~ltk)) ) @ #vk.7 )
                            case Initiator_recvChal_case_1
                            solve( !KU( ~ltk ) @ #vk.32 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( ~ltk ) @ #vk.34 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_recvChal_case_3
                            solve( !KU( ~ltk ) @ #vk.32 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_recvChal_case_4
                            solve( !KU( ~ltk ) @ #vk.34 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_sendChal_case_1
                            solve( !KU( ~ltk ) @ #vk.28 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_sendChal_case_2
                            solve( !KU( ~ltk ) @ #vk.30 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_sendChal_case_3
                            solve( !KU( ~ltk ) @ #vk.28 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_sendChal_case_4
                            solve( !KU( ~ltk ) @ #vk.30 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Responder_recvChal_case_1
                            solve( !KU( ~ltk ) @ #vk.31 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Responder_recvChal_case_2
                            solve( !KU( ~ltk ) @ #vk.33 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case RevealPubkey_case_1
                            solve( !KU( ~ltk ) @ #vk.28 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case RevealPubkey_case_2
                            solve( !KU( ~ltk ) @ #vk.30 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case cexp
                            solve( !KU( ~ltk ) @ #vk.31 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          qed
                        next
                          case Initiator_recvChal_case_2
                          solve( !KU( 'g'^(x*inv(~ltk)) ) @ #vk.7 )
                            case Initiator_recvChal_case_1
                            solve( !KU( ~ltk ) @ #vk.32 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( ~ltk ) @ #vk.34 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_recvChal_case_3
                            solve( !KU( ~ltk ) @ #vk.32 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_recvChal_case_4
                            solve( !KU( ~ltk ) @ #vk.34 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_sendChal_case_1
                            solve( !KU( ~ltk ) @ #vk.28 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_sendChal_case_2
                            solve( !KU( ~ltk ) @ #vk.30 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_sendChal_case_3
                            solve( !KU( ~ltk ) @ #vk.28 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Initiator_sendChal_case_4
                            solve( !KU( ~ltk ) @ #vk.30 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Responder_recvChal_case_1
                            solve( !KU( ~ltk ) @ #vk.31 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case Responder_recvChal_case_2
                            solve( !KU( ~ltk ) @ #vk.33 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case RevealPubkey_case_1
                            solve( !KU( ~ltk ) @ #vk.28 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case RevealPubkey_case_2
                            solve( !KU( ~ltk ) @ #vk.30 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case cexp
                            solve( !KU( ~ltk ) @ #vk.31 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          qed
                        next
                          case c_sign
                          solve( !KU( ~ltk ) @ #vk.25 )
                            case Corrupt_ltk
                            by contradiction /* from formulas */
                          qed
                        qed
                      next
                        case split_case_4
                        solve( !KU( 'g'^(~ephI*x*inv((~ephR*~ltkI))) ) @ #vk.11 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case Initiator_sendChal_case_5
                          by solve( !KU( ~ephR ) @ #vk.27 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.27 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.27 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.25 )
                        qed
                      next
                        case split_case_5
                        solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*~ephR*x*inv(~ltk)))>,
                                         ~ltk)
                               ) @ #vk.17 )
                          case Initiator_recvChal_case_1
                          solve( !KU( 'g'^(~ephR*x*inv(~ltk)) ) @ #vk.7 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_recvChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_recvChal_case_4
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_sendChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_sendChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_sendChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_sendChal_case_4
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Responder_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.31 )
                          next
                            case Responder_recvChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.31 )
                          next
                            case Responder_recvChal_case_3
                            solve( !KU( ~ltk ) @ #vk.30 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case RevealPubkey_case_1
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case RevealPubkey_case_2
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case cexp
                            by solve( !KU( ~ephR ) @ #vk.29 )
                          qed
                        next
                          case Initiator_recvChal_case_2
                          solve( !KU( 'g'^(~ephR*x*inv(~ltk)) ) @ #vk.7 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_recvChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_recvChal_case_4
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_sendChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_sendChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_sendChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_sendChal_case_4
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Responder_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.31 )
                          next
                            case Responder_recvChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.31 )
                          next
                            case Responder_recvChal_case_3
                            solve( !KU( ~ltk ) @ #vk.30 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case RevealPubkey_case_1
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case RevealPubkey_case_2
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case cexp
                            by solve( !KU( ~ephR ) @ #vk.29 )
                          qed
                        next
                          case c_sign
                          solve( !KU( ~ltk ) @ #vk.25 )
                            case Corrupt_ltk
                            by contradiction /* from formulas */
                          qed
                        qed
                      next
                        case split_case_6
                        solve( !KU( 'g'^(~ephI*~ephR*x*inv(~ltkI)) ) @ #vk.21 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.28 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case Initiator_sendChal_case_5
                          by solve( !KU( ~ephR ) @ #vk.24 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.27 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.27 )
                        next
                          case Responder_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.24 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.25 )
                        qed
                      qed
                    next
                      case split_case_10
                      solve( !KU( 'g'^inv((~ephR*~ltkI*x)) ) @ #vk.11 )
                        case cexp
                        by solve( !KU( ~ephR ) @ #vk.26 )
                      qed
                    next
                      case split_case_11
                      solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                        h('g'^(x*inv(~ltkI)))>,
                                       ~ltkI)
                             ) @ #vk.17 )
                        case Initiator_recvChal_case_1
                        solve( !KU( 'g'^(x*inv((~ephI*~ltk))) ) @ #vk.7 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.34 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        qed
                      next
                        case Initiator_recvChal_case_2
                        solve( !KU( 'g'^(x*inv((~ephI*~ltkI))) ) @ #vk.7 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.34 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        qed
                      next
                        case c_sign
                        solve( !KU( ~ltkI ) @ #vk.24 )
                          case Corrupt_ltk
                          solve( !KU( 'g'^(x*inv((~ephI*~ltkI))) ) @ #vk.9 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.36 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.38 )
                          next
                            case Initiator_recvChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.36 )
                          next
                            case Initiator_recvChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.38 )
                          next
                            case Initiator_sendChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.32 )
                          next
                            case Initiator_sendChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.34 )
                          next
                            case Initiator_sendChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.32 )
                          next
                            case Initiator_sendChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.34 )
                          next
                            case Responder_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.35 )
                          next
                            case Responder_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.37 )
                          next
                            case RevealPubkey_case_1
                            by solve( !KU( ~ephI ) @ #vk.32 )
                          next
                            case RevealPubkey_case_2
                            by solve( !KU( ~ephI ) @ #vk.34 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.35 )
                          qed
                        qed
                      qed
                    next
                      case split_case_12
                      solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                        h('g'^(x*inv(x.1)))>,
                                       ~ltkI)
                             ) @ #vk.17 )
                        case Initiator_recvChal_case_1
                        solve( !KU( 'g'^(x*inv((~ephI*x.1))) ) @ #vk.7 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.34 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        qed
                      next
                        case Initiator_recvChal_case_2
                        solve( !KU( 'g'^(x*inv((~ephI*x.1))) ) @ #vk.7 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.34 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        qed
                      next
                        case c_sign
                        solve( !KU( ~ltkI ) @ #vk.24 )
                          case Corrupt_ltk
                          solve( !KU( 'g'^(x*inv((~ephI*x.1))) ) @ #vk.9 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.36 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.38 )
                          next
                            case Initiator_recvChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.36 )
                          next
                            case Initiator_recvChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.38 )
                          next
                            case Initiator_sendChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.32 )
                          next
                            case Initiator_sendChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.34 )
                          next
                            case Initiator_sendChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.32 )
                          next
                            case Initiator_sendChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.34 )
                          next
                            case Responder_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.35 )
                          next
                            case Responder_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.37 )
                          next
                            case RevealPubkey_case_1
                            by solve( !KU( ~ephI ) @ #vk.32 )
                          next
                            case RevealPubkey_case_2
                            by solve( !KU( ~ephI ) @ #vk.34 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.35 )
                          qed
                        qed
                      qed
                    next
                      case split_case_13
                      solve( splitEqs(7) )
                        case split_case_1
                        solve( splitEqs(8) )
                          case split_case_1
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*~x*inv((~ltk*x.1))))>,
                                           ~ltk)
                                 ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            solve( !KU( 'g'^(~x*inv((~ltk*x.1))) ) @ #vk.7 )
                              case Responder_recvChal
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( 'g'^(~x*inv((~ltk*x.1))) ) @ #vk.7 )
                              case Responder_recvChal
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltk ) @ #vk.25 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          qed
                        next
                          case split_case_2
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*~x*inv((~ltk*~ltkI))))>,
                                           ~ltkI)
                                 ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            solve( !KU( 'g'^(~x*inv((~ltk*~ltk))) ) @ #vk.7 )
                              case Responder_recvChal
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( 'g'^(~x*inv((~ltk*~ltkI))) ) @ #vk.7 )
                              case Responder_recvChal
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltkI ) @ #vk.24 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~x*inv((~ltk*~ltkI))) ) @ #vk.9 )
                                case Responder_recvChal
                                solve( !KU( ~ltk ) @ #vk.32 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case cexp
                                by solve( !KU( ~x ) @ #vk.33 )
                              qed
                            qed
                          qed
                        next
                          case split_case_3
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*~x*inv((~ltkI*x.1))))>,
                                           ~ltkI)
                                 ) @ #vk.17 )
                            case Initiator_recvChal
                            solve( !KU( 'g'^(~x*inv((~ltkI*x.1))) ) @ #vk.7 )
                              case Responder_recvChal
                              solve( !KU( ~ltkI ) @ #vk.29 )
                                case Corrupt_ltk
                                solve( !KU( 'g'^(~ephI*inv((~ltkI*x.1))) ) @ #vk.14 )
                                  case Initiator_sendChal
                                  solve( !KU( 'g'^(~ephI*~x*inv((~ltkI*x.1))) ) @ #vk.23 )
                                    case Initiator_sendChal
                                    by solve( !KU( ~x ) @ #vk.32 )
                                  next
                                    case Responder_recvChal
                                    by solve( !KU( ~ephI ) @ #vk.32 )
                                  next
                                    case cexp
                                    by solve( !KU( ~ephI ) @ #vk.33 )
                                  qed
                                next
                                  case cexp
                                  by solve( !KU( ~ephI ) @ #vk.33 )
                                qed
                              qed
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltkI ) @ #vk.24 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~x*inv((~ltkI*x.1))) ) @ #vk.9 )
                                case Responder_recvChal
                                solve( !KU( 'g'^(~ephI*inv((~ltkI*x.1))) ) @ #vk.15 )
                                  case Initiator_sendChal
                                  solve( !KU( 'g'^(~ephI*~x*inv((~ltkI*x.1))) ) @ #vk.25 )
                                    case Initiator_sendChal
                                    by solve( !KU( ~x ) @ #vk.34 )
                                  next
                                    case Responder_recvChal
                                    by solve( !KU( ~ephI ) @ #vk.34 )
                                  next
                                    case cexp
                                    by solve( !KU( ~ephI ) @ #vk.35 )
                                  qed
                                next
                                  case cexp
                                  by solve( !KU( ~ephI ) @ #vk.35 )
                                qed
                              next
                                case cexp
                                by solve( !KU( ~x ) @ #vk.33 )
                              qed
                            qed
                          qed
                        next
                          case split_case_4
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*~x*x.1*inv((~ltk*x.2))))>,
                                           ~ltk)
                                 ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            solve( !KU( 'g'^(~x*x.1*inv((~ltk*x.2))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( 'g'^(~x*x.1*inv((~ltk*x.2))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltk ) @ #vk.25 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          qed
                        next
                          case split_case_5
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*~x*x.1*inv((~ltk*~ltkI))))>,
                                           ~ltkI)
                                 ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            solve( !KU( 'g'^(~x*x.1*inv((~ltk*~ltk))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( 'g'^(~x*x.1*inv((~ltk*~ltkI))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltkI ) @ #vk.24 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~x*x.1*inv((~ltk*~ltkI))) ) @ #vk.9 )
                                case Initiator_recvChal_case_1
                                by solve( !KU( ~x ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_2
                                by solve( !KU( ~x ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_3
                                by solve( !KU( ~x ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_4
                                by solve( !KU( ~x ) @ #vk.36 )
                              next
                                case Initiator_sendChal_case_1
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_2
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_3
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_4
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case Responder_recvChal_case_1
                                by solve( !KU( ~x ) @ #vk.35 )
                              next
                                case Responder_recvChal_case_2
                                solve( !KU( ~ltk ) @ #vk.34 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Responder_recvChal_case_3
                                by solve( !KU( ~x ) @ #vk.35 )
                              next
                                case RevealPubkey_case_1
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case RevealPubkey_case_2
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case cexp
                                by solve( !KU( ~x ) @ #vk.33 )
                              qed
                            qed
                          qed
                        next
                          case split_case_6
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*~x*x.1*inv((~ltkI*x.2))))>,
                                           ~ltkI)
                                 ) @ #vk.17 )
                            case Initiator_recvChal
                            solve( !KU( 'g'^(~x*x.1*inv((~ltkI*x.2))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltkI ) @ #vk.31 )
                                case Corrupt_ltk
                                solve( !KU( 'g'^(~ephI*x.1*inv((~ltkI*x.2))) ) @ #vk.14 )
                                  case Initiator_recvChal_case_1
                                  by solve( !KU( ~ephI ) @ #vk.38 )
                                next
                                  case Initiator_recvChal_case_2
                                  by solve( !KU( ~ephI ) @ #vk.38 )
                                next
                                  case Initiator_recvChal_case_3
                                  by solve( !KU( ~ephI ) @ #vk.38 )
                                next
                                  case Initiator_recvChal_case_4
                                  by solve( !KU( ~ephI ) @ #vk.38 )
                                next
                                  case Initiator_sendChal_case_1
                                  by solve( !KU( ~ephI ) @ #vk.34 )
                                next
                                  case Initiator_sendChal_case_2
                                  by solve( !KU( ~ephI ) @ #vk.34 )
                                next
                                  case Initiator_sendChal_case_3
                                  by solve( !KU( ~ephI ) @ #vk.34 )
                                next
                                  case Initiator_sendChal_case_4
                                  by solve( !KU( ~ephI ) @ #vk.34 )
                                next
                                  case Initiator_sendChal_case_5
                                  solve( !KU( 'g'^(~ephI*~x*x.1*inv((~ltkI*x.2))) ) @ #vk.23 )
                                    case Initiator_recvChal_case_1
                                    by solve( !KU( ~ephI ) @ #vk.38 )
                                  next
                                    case Initiator_recvChal_case_2
                                    by solve( !KU( ~ephI ) @ #vk.38 )
                                  next
                                    case Initiator_recvChal_case_3
                                    by solve( !KU( ~ephI ) @ #vk.38 )
                                  next
                                    case Initiator_recvChal_case_4
                                    by solve( !KU( ~ephI ) @ #vk.38 )
                                  next
                                    case Initiator_sendChal_case_1
                                    by solve( !KU( ~ephI ) @ #vk.34 )
                                  next
                                    case Initiator_sendChal_case_2
                                    by solve( !KU( ~ephI ) @ #vk.34 )
                                  next
                                    case Initiator_sendChal_case_3
                                    by solve( !KU( ~ephI ) @ #vk.34 )
                                  next
                                    case Initiator_sendChal_case_4
                                    by solve( !KU( ~ephI ) @ #vk.34 )
                                  next
                                    case Initiator_sendChal_case_5
                                    by solve( !KU( ~x ) @ #vk.34 )
                                  next
                                    case Responder_recvChal_case_1
                                    by solve( !KU( ~ephI ) @ #vk.37 )
                                  next
                                    case Responder_recvChal_case_2
                                    by solve( !KU( ~ephI ) @ #vk.34 )
                                  next
                                    case Responder_recvChal_case_3
                                    by solve( !KU( ~ephI ) @ #vk.37 )
                                  next
                                    case RevealPubkey_case_1
                                    by solve( !KU( ~ephI ) @ #vk.34 )
                                  next
                                    case RevealPubkey_case_2
                                    by solve( !KU( ~ephI ) @ #vk.34 )
                                  next
                                    case cexp
                                    by solve( !KU( ~ephI ) @ #vk.35 )
                                  qed
                                next
                                  case Responder_recvChal_case_1
                                  by solve( !KU( ~ephI ) @ #vk.37 )
                                next
                                  case Responder_recvChal_case_2
                                  by solve( !KU( ~ephI ) @ #vk.37 )
                                next
                                  case RevealPubkey_case_1
                                  by solve( !KU( ~ephI ) @ #vk.34 )
                                next
                                  case RevealPubkey_case_2
                                  by solve( !KU( ~ephI ) @ #vk.34 )
                                next
                                  case cexp
                                  by solve( !KU( ~ephI ) @ #vk.35 )
                                qed
                              qed
                            next
                              case Responder_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case c_sign
                            solve( !KU( 'g'^(~ephI*~ltk*x.1*inv((~ltkI*x.2))) ) @ #vk.23 )
                              case Initiator_recvChal_case_1
                              solve( !KU( ~ltkI ) @ #vk.24 )
                                case Corrupt_ltk
                                by solve( !KU( ~ephI ) @ #vk.37 )
                              qed
                            next
                              case Initiator_recvChal_case_2
                              solve( !KU( ~ltkI ) @ #vk.24 )
                                case Corrupt_ltk
                                by solve( !KU( ~ephI ) @ #vk.37 )
                              qed
                            next
                              case Initiator_recvChal_case_3
                              solve( !KU( ~ltkI ) @ #vk.24 )
                                case Corrupt_ltk
                                by solve( !KU( ~ephI ) @ #vk.37 )
                              qed
                            next
                              case Initiator_recvChal_case_4
                              solve( !KU( ~ltkI ) @ #vk.24 )
                                case Corrupt_ltk
                                by solve( !KU( ~ephI ) @ #vk.37 )
                              qed
                            next
                              case Initiator_recvChal_case_5
                              solve( !KU( ~ltkI ) @ #vk.24 )
                                case Corrupt_ltk
                                by solve( !KU( ~ephI ) @ #vk.37 )
                              qed
                            next
                              case Initiator_recvChal_case_6
                              solve( !KU( ~ltkI ) @ #vk.24 )
                                case Corrupt_ltk
                                by solve( !KU( ~ephI ) @ #vk.37 )
                              qed
                            next
                              case Initiator_sendChal_case_1
                              solve( !KU( ~ltkI ) @ #vk.24 )
                                case Corrupt_ltk
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              qed
                            next
                              case Initiator_sendChal_case_2
                              solve( !KU( ~ltkI ) @ #vk.24 )
                                case Corrupt_ltk
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              qed
                            next
                              case Initiator_sendChal_case_3
                              solve( !KU( ~ltkI ) @ #vk.24 )
                                case Corrupt_ltk
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              qed
                            next
                              case Initiator_sendChal_case_4
                              solve( !KU( ~ltkI ) @ #vk.24 )
                                case Corrupt_ltk
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              qed
                            next
                              case Initiator_sendChal_case_5
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.35 )
                            next
                              case Responder_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.35 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case RevealPubkey_case_3
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            qed
                          qed
                        next
                          case split_case_7
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*~x*inv((~ltk*~ltkI*x.1))))>,
                                           ~ltkI)
                                 ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            solve( !KU( 'g'^(~x*inv((~ltk*~ltk*x.1))) ) @ #vk.7 )
                              case Responder_recvChal
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( 'g'^(~x*inv((~ltk*~ltkI*x.1))) ) @ #vk.7 )
                              case Responder_recvChal
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltkI ) @ #vk.24 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~x*inv((~ltk*~ltkI*x.1))) ) @ #vk.9 )
                                case Responder_recvChal
                                solve( !KU( ~ltk ) @ #vk.32 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case cexp
                                by solve( !KU( ~x ) @ #vk.33 )
                              qed
                            qed
                          qed
                        next
                          case split_case_8
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*~x*x.1*inv((~ltk*~ltkI*x.2))))>,
                                           ~ltkI)
                                 ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            solve( !KU( 'g'^(~x*x.1*inv((~ltk*~ltk*x.2))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( 'g'^(~x*x.1*inv((~ltk*~ltkI*x.2))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~x ) @ #vk.32 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_3
                              by solve( !KU( ~x ) @ #vk.31 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~x ) @ #vk.28 )
                            next
                              case cexp
                              by solve( !KU( ~x ) @ #vk.29 )
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltkI ) @ #vk.24 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~x*x.1*inv((~ltk*~ltkI*x.2))) ) @ #vk.9 )
                                case Initiator_recvChal_case_1
                                by solve( !KU( ~x ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_2
                                by solve( !KU( ~x ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_3
                                by solve( !KU( ~x ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_4
                                by solve( !KU( ~x ) @ #vk.36 )
                              next
                                case Initiator_sendChal_case_1
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_2
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_3
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_4
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case Responder_recvChal_case_1
                                by solve( !KU( ~x ) @ #vk.35 )
                              next
                                case Responder_recvChal_case_2
                                solve( !KU( ~ltk ) @ #vk.34 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Responder_recvChal_case_3
                                by solve( !KU( ~x ) @ #vk.35 )
                              next
                                case RevealPubkey_case_1
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case RevealPubkey_case_2
                                by solve( !KU( ~x ) @ #vk.32 )
                              next
                                case cexp
                                by solve( !KU( ~x ) @ #vk.33 )
                              qed
                            qed
                          qed
                        qed
                      next
                        case split_case_2
                        solve( splitEqs(8) )
                          case split_case_1
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*x*inv((~ltk*x.1))))>,
                                           ~ltk)
                                 ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            solve( !KU( 'g'^(x*inv((~ltk*x.1))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_3
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_4
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_3
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_4
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.34 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( 'g'^(x*inv((~ltk*x.1))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_3
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_4
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_3
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_4
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.34 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltk ) @ #vk.25 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          qed
                        next
                          case split_case_2
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*x*inv((~ltk*~ltkI))))>,
                                           ~ltkI)
                                 ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            solve( !KU( 'g'^(x*inv((~ltk*~ltk))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_3
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_4
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_3
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_4
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.34 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( 'g'^(x*inv((~ltk*~ltkI))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_3
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_4
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_3
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_4
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.34 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltkI ) @ #vk.24 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(x*inv((~ltk*~ltkI))) ) @ #vk.9 )
                                case Initiator_recvChal_case_1
                                solve( !KU( ~ltk ) @ #vk.36 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_recvChal_case_2
                                solve( !KU( ~ltk ) @ #vk.38 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_recvChal_case_3
                                solve( !KU( ~ltk ) @ #vk.36 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_recvChal_case_4
                                solve( !KU( ~ltk ) @ #vk.38 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_sendChal_case_1
                                solve( !KU( ~ltk ) @ #vk.32 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_sendChal_case_2
                                solve( !KU( ~ltk ) @ #vk.34 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_sendChal_case_3
                                solve( !KU( ~ltk ) @ #vk.32 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_sendChal_case_4
                                solve( !KU( ~ltk ) @ #vk.34 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Responder_recvChal_case_1
                                solve( !KU( ~ltk ) @ #vk.35 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Responder_recvChal_case_2
                                solve( !KU( ~ltk ) @ #vk.37 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case RevealPubkey_case_1
                                solve( !KU( ~ltk ) @ #vk.32 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case RevealPubkey_case_2
                                solve( !KU( ~ltk ) @ #vk.34 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case cexp
                                solve( !KU( ~ltk ) @ #vk.35 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              qed
                            qed
                          qed
                        next
                          case split_case_3
                          solve( !KU( 'g'^(~ephI*x*inv((~ephR*~ltkI*x.1))) ) @ #vk.11 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.28 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.28 )
                          next
                            case Initiator_recvChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.28 )
                          next
                            case Initiator_recvChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.28 )
                          next
                            case Initiator_sendChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.24 )
                          next
                            case Initiator_sendChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.24 )
                          next
                            case Initiator_sendChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.24 )
                          next
                            case Initiator_sendChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.24 )
                          next
                            case Initiator_sendChal_case_5
                            by solve( !KU( ~ephR ) @ #vk.27 )
                          next
                            case Responder_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.27 )
                          next
                            case Responder_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.27 )
                          next
                            case RevealPubkey_case_1
                            by solve( !KU( ~ephI ) @ #vk.24 )
                          next
                            case RevealPubkey_case_2
                            by solve( !KU( ~ephI ) @ #vk.24 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.25 )
                          qed
                        next
                          case split_case_4
                          solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                            h('g'^(~ephI*x*inv((~ltk*~ltkI*x.1))))>,
                                           ~ltkI)
                                 ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            solve( !KU( 'g'^(x*inv((~ltk*~ltk*x.1))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_3
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_4
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_3
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_4
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.34 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            qed
                          next
                            case Initiator_recvChal_case_2
                            solve( !KU( 'g'^(x*inv((~ltk*~ltkI*x.1))) ) @ #vk.7 )
                              case Initiator_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_3
                              solve( !KU( ~ltk ) @ #vk.33 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_recvChal_case_4
                              solve( !KU( ~ltk ) @ #vk.35 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_3
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Initiator_sendChal_case_4
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_1
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case Responder_recvChal_case_2
                              solve( !KU( ~ltk ) @ #vk.34 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_1
                              solve( !KU( ~ltk ) @ #vk.29 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case RevealPubkey_case_2
                              solve( !KU( ~ltk ) @ #vk.31 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            next
                              case cexp
                              solve( !KU( ~ltk ) @ #vk.32 )
                                case Corrupt_ltk
                                by contradiction /* from formulas */
                              qed
                            qed
                          next
                            case c_sign
                            solve( !KU( ~ltkI ) @ #vk.24 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(x*inv((~ltk*~ltkI*x.1))) ) @ #vk.9 )
                                case Initiator_recvChal_case_1
                                solve( !KU( ~ltk ) @ #vk.36 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_recvChal_case_2
                                solve( !KU( ~ltk ) @ #vk.38 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_recvChal_case_3
                                solve( !KU( ~ltk ) @ #vk.36 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_recvChal_case_4
                                solve( !KU( ~ltk ) @ #vk.38 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_sendChal_case_1
                                solve( !KU( ~ltk ) @ #vk.32 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_sendChal_case_2
                                solve( !KU( ~ltk ) @ #vk.34 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_sendChal_case_3
                                solve( !KU( ~ltk ) @ #vk.32 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Initiator_sendChal_case_4
                                solve( !KU( ~ltk ) @ #vk.34 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Responder_recvChal_case_1
                                solve( !KU( ~ltk ) @ #vk.35 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case Responder_recvChal_case_2
                                solve( !KU( ~ltk ) @ #vk.37 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case RevealPubkey_case_1
                                solve( !KU( ~ltk ) @ #vk.32 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case RevealPubkey_case_2
                                solve( !KU( ~ltk ) @ #vk.34 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              next
                                case cexp
                                solve( !KU( ~ltk ) @ #vk.35 )
                                  case Corrupt_ltk
                                  by contradiction /* from formulas */
                                qed
                              qed
                            qed
                          qed
                        qed
                      qed
                    next
                      case split_case_14
                      solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                        h('g'^(x*inv((~ltkI*x.1))))>,
                                       ~ltkI)
                             ) @ #vk.17 )
                        case Initiator_recvChal_case_1
                        solve( !KU( 'g'^(x*inv((~ephI*~ltk*x.1))) ) @ #vk.7 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.34 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        qed
                      next
                        case Initiator_recvChal_case_2
                        solve( !KU( 'g'^(x*inv((~ephI*~ltkI*x.1))) ) @ #vk.7 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.33 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.35 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.34 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.29 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.31 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.32 )
                        qed
                      next
                        case c_sign
                        solve( !KU( ~ltkI ) @ #vk.24 )
                          case Corrupt_ltk
                          solve( !KU( 'g'^(x*inv((~ephI*~ltkI*x.1))) ) @ #vk.9 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.36 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.38 )
                          next
                            case Initiator_recvChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.36 )
                          next
                            case Initiator_recvChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.38 )
                          next
                            case Initiator_sendChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.32 )
                          next
                            case Initiator_sendChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.34 )
                          next
                            case Initiator_sendChal_case_3
                            by solve( !KU( ~ephI ) @ #vk.32 )
                          next
                            case Initiator_sendChal_case_4
                            by solve( !KU( ~ephI ) @ #vk.34 )
                          next
                            case Responder_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.35 )
                          next
                            case Responder_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.37 )
                          next
                            case RevealPubkey_case_1
                            by solve( !KU( ~ephI ) @ #vk.32 )
                          next
                            case RevealPubkey_case_2
                            by solve( !KU( ~ephI ) @ #vk.34 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.35 )
                          qed
                        qed
                      qed
                    qed
                  qed
                qed
              next
                case c_sign
                solve( !KU( ~ltk ) @ #vk.8 )
                  case Corrupt_ltk
                  by contradiction
                qed
              qed
            qed
          qed
        next
          case Responder_recvAuth
          by solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid
                    ) ▶₀ #remote )
        qed
      qed
    next
      case Responder_recvAuth
      by solve( Responder_chalSent( ~ltkR, ~ephR, z, ~protoKey, ~sid
                ) ▶₀ #accept )
    qed
  qed
next
  case Responder_recvAuth
  solve( Responder_chalSent( ~ltkR, ~ephR, z, ~protoKey, ~sid
         ) ▶₀ #set )
    case Responder_recvChal
    solve( SessionAccept( ~sid ) @ #accept )
      case Initiator_recvAuth
      by solve( Initiator_authSent( <'g'^~ltkI, pk(~ltkI)>,
                                    <z, pk(ltkR)>, ~ltkI, ~ephI, z.1, ~protoKey, ~sid
                ) ▶₀ #accept )
    next
      case Responder_recvAuth
      solve( Responder_chalSent( ~ltkR, ~ephR, z, ~protoKey, ~sid
             ) ▶₀ #accept )
        case Responder_recvChal
        solve( SessionPeer( ~sid, <'g'^~ltk, pk(~ltk)> ) @ #remote )
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.5, ~protoKey.1, ~sid
                 ) ▶₀ #remote )
            case Responder_recvChal
            solve( !KU( senc(<<'g'^~ltk, pk(~ltk)>, 
                              sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, h(z.1)>, ~ltk)>,
                             h(<~protoKey, z.1, z.2>))
                   ) @ #vk )
              case c_senc
              solve( !KU( sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, h(z.1)>, ~ltk)
                     ) @ #vk.9 )
                case Initiator_recvChal_case_1
                solve( splitEqs(6) )
                  case split_case_1
                  solve( splitEqs(7) )
                    case split
                    solve( !KU( 'g'^(~ephR*inv(~ephI)) ) @ #vk.11 )
                      case Responder_recvChal
                      by solve( !KU( ~ephI ) @ #vk.15 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.15 )
                    qed
                  qed
                next
                  case split_case_2
                  solve( splitEqs(1) )
                    case split
                    solve( splitEqs(7) )
                      case split
                      solve( !KU( mac('g'^inv(~ephR), h(~protoKey)) ) @ #vk.5 )
                        case c_mac
                        solve( !KU( h(<~protoKey, 'g', 'g'^(~ltk*inv(~ephR))>) ) @ #vk.6 )
                          case c_h
                          solve( !KU( 'g'^(~ltk*inv(~ephR)) ) @ #vk.19 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.25 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.25 )
                          next
                            case RevealPubkey
                            by solve( !KU( ~ephR ) @ #vk.21 )
                          next
                            case cexp
                            solve( !KU( ~ltk ) @ #vk.21 )
                              case Corrupt_ltk
                              by contradiction
                            qed
                          qed
                        qed
                      qed
                    qed
                  qed
                next
                  case split_case_3
                  solve( !KU( mac('g'^ephI, h(~protoKey)) ) @ #vk.5 )
                    case Initiator_sendChal_case_1
                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltk)>)
                           ) @ #vk.6 )
                      case c_h
                      solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                        case Initiator_sendChal
                        by solve( !KU( ~ephR ) @ #vk.19 )
                      next
                        case Responder_recvChal
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      qed
                    qed
                  next
                    case Initiator_sendChal_case_2
                    solve( splitEqs(9) )
                      case split_case_1
                      solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltk)>)
                             ) @ #vk.6 )
                        case c_h
                        solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                          case Initiator_sendChal
                          by solve( !KU( ~ephR ) @ #vk.19 )
                        next
                          case Responder_recvChal
                          by solve( !KU( ~ephI ) @ #vk.19 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.21 )
                        qed
                      qed
                    next
                      case split_case_2
                      solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephI*~ltk)>)
                             ) @ #vk.6 )
                        case c_h
                        solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                          case Initiator_sendChal
                          by solve( !KU( ~ephR ) @ #vk.19 )
                        next
                          case Responder_recvChal
                          by solve( !KU( ~ephI ) @ #vk.19 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.21 )
                        qed
                      qed
                    qed
                  next
                    case c_mac
                    solve( !KU( h(<~protoKey, 'g'^(~ephR*ephI), z>) ) @ #vk.6 )
                      case c_h
                      solve( !KU( 'g'^(~ephR*ephI) ) @ #vk.18 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephR ) @ #vk.24 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephR ) @ #vk.25 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephR ) @ #vk.24 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephR ) @ #vk.25 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephR ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephR ) @ #vk.21 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephR ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephR ) @ #vk.21 )
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephR ) @ #vk.23 )
                      next
                        case Responder_recvChal_case_2
                        solve( !KU( mac('g'^x, h(<'g'^(~ephR*ephI), ~protoKey>))
                               ) @ #vk.13 )
                          case Responder_recvChal
                          solve( !KU( ~ephI ) @ #vk.20 )
                            case Corrupt_ltk
                            by solve( splitEqs(7) )
                          next
                            case NewProto
                            by solve( splitEqs(7) )
                          next
                            case fresh
                            by solve( splitEqs(7) )
                          qed
                        next
                          case c_mac
                          solve( !KU( h(<~protoKey, 'g'^(~ephR*ephI), 'g'^(~ltk*~ephI.1)>)
                                 ) @ #vk.15 )
                            case c_h
                            solve( !KU( 'g'^(~ltk*~ephI.1) ) @ #vk.24 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~ephI.1 ) @ #vk.29 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~ephI.1 ) @ #vk.29 )
                            next
                              case Initiator_sendChal
                              solve( !KU( ~ltk ) @ #vk.25 )
                                case Corrupt_ltk
                                by contradiction
                              qed
                            next
                              case RevealPubkey
                              by solve( !KU( ~ephI.1 ) @ #vk.25 )
                            next
                              case cexp
                              solve( !KU( ~ltk ) @ #vk.27 )
                                case Corrupt_ltk
                                by contradiction
                              qed
                            qed
                          qed
                        qed
                      next
                        case Responder_recvChal_case_3
                        by solve( !KU( ~ephR ) @ #vk.24 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephR ) @ #vk.20 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephR ) @ #vk.21 )
                      next
                        case cexp
                        by solve( !KU( ~ephR ) @ #vk.22 )
                      qed
                    qed
                  qed
                next
                  case split_case_4
                  solve( !KU( mac('g'^inv((~ephR*x)), h(~protoKey)) ) @ #vk.5 )
                    case c_mac
                    solve( !KU( h(<~protoKey, 'g'^inv(x), 'g'^x.1>) ) @ #vk.6 )
                      case c_h
                      solve( !KU( mac('g'^inv((~ephI*x)), h(<'g'^inv(x), ~protoKey>))
                             ) @ #vk.12 )
                        case c_mac
                        solve( !KU( h(<~protoKey, 'g'^inv(x), 'g'^(~ephI*~ltk)>)
                               ) @ #vk.13 )
                          case c_h
                          solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.23 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.28 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.28 )
                          next
                            case Initiator_sendChal
                            solve( !KU( ~ltk ) @ #vk.24 )
                              case Corrupt_ltk
                              by contradiction
                            qed
                          next
                            case RevealPubkey
                            by solve( !KU( ~ephI ) @ #vk.24 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.26 )
                          qed
                        qed
                      qed
                    qed
                  qed
                next
                  case split_case_5
                  solve( splitEqs(1) )
                    case split
                    solve( !KU( 'g'^(x*inv(~ephR)) ) @ #vk.4 )
                      case Initiator_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.19 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.21 )
                    next
                      case Initiator_recvChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.19 )
                    next
                      case Initiator_recvChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.21 )
                    next
                      case Initiator_sendChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.15 )
                    next
                      case Initiator_sendChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_sendChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.15 )
                    next
                      case Initiator_sendChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Responder_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.18 )
                    next
                      case Responder_recvChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.20 )
                    next
                      case RevealPubkey_case_1
                      by solve( !KU( ~ephR ) @ #vk.15 )
                    next
                      case RevealPubkey_case_2
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.18 )
                    qed
                  qed
                next
                  case split_case_6
                  solve( !KU( 'g'^(x*inv((~ephR*x.1))) ) @ #vk.4 )
                    case Initiator_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.20 )
                  next
                    case Initiator_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.22 )
                  next
                    case Initiator_recvChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.20 )
                  next
                    case Initiator_recvChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.22 )
                  next
                    case Initiator_sendChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case Initiator_sendChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case Initiator_sendChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case Initiator_sendChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case Responder_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.19 )
                  next
                    case Responder_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.21 )
                  next
                    case RevealPubkey_case_1
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case RevealPubkey_case_2
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.19 )
                  qed
                qed
              next
                case Initiator_recvChal_case_2
                solve( splitEqs(6) )
                  case split_case_1
                  solve( splitEqs(7) )
                    case split
                    solve( !KU( 'g'^(~ephR*inv(~ephI)) ) @ #vk.11 )
                      case Responder_recvChal
                      by solve( !KU( ~ephI ) @ #vk.15 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.15 )
                    qed
                  qed
                next
                  case split_case_2
                  solve( splitEqs(1) )
                    case split
                    solve( splitEqs(7) )
                      case split
                      solve( !KU( mac('g'^inv(~ephR), h(~protoKey)) ) @ #vk.5 )
                        case c_mac
                        solve( !KU( h(<~protoKey, 'g', 'g'^(~ltkR*inv(~ephR))>) ) @ #vk.6 )
                          case c_h
                          solve( !KU( 'g'^(~ltkR*inv(~ephR)) ) @ #vk.19 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.25 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.25 )
                          next
                            case RevealPubkey
                            by solve( !KU( ~ephR ) @ #vk.21 )
                          next
                            case cexp
                            solve( !KU( ~ltkR ) @ #vk.21 )
                              case Corrupt_ltk
                              by solve( !KU( ~ephR ) @ #vk.23 )
                            qed
                          qed
                        qed
                      qed
                    qed
                  qed
                next
                  case split_case_3
                  solve( !KU( h(<~protoKey, 'g'^(~ephR*ephI), 'g'^(~ltkR*~ephI.1)>)
                         ) @ #vk.13 )
                    case c_h
                    solve( !KU( 'g'^(~ephR*ephI) ) @ #vk.17 )
                      case Initiator_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.23 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.24 )
                    next
                      case Initiator_recvChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.23 )
                    next
                      case Initiator_recvChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.24 )
                    next
                      case Initiator_sendChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.19 )
                    next
                      case Initiator_sendChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.20 )
                    next
                      case Initiator_sendChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.19 )
                    next
                      case Initiator_sendChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.20 )
                    next
                      case Responder_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.22 )
                    next
                      case Responder_recvChal_case_2
                      solve( !KU( h(<~protoKey, 'g'^(~ephR*ephI), z>) ) @ #vk.8 )
                        case c_h
                        solve( splitEqs(7) )
                          case split_case_01
                          solve( !KU( 'g'^(~ephR*ephI*inv(~ephI.1)) ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_recvChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_recvChal_case_4
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_sendChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.24 )
                          next
                            case Initiator_sendChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.24 )
                          next
                            case Initiator_sendChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.24 )
                          next
                            case Initiator_sendChal_case_4
                            by solve( !KU( ~ephR ) @ #vk.24 )
                          next
                            case Responder_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.27 )
                          next
                            case Responder_recvChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.27 )
                          next
                            case Responder_recvChal_case_3
                            by solve( !KU( ~ephI.1 ) @ #vk.25 )
                          next
                            case RevealPubkey_case_1
                            by solve( !KU( ~ephR ) @ #vk.24 )
                          next
                            case RevealPubkey_case_2
                            by solve( !KU( ~ephR ) @ #vk.24 )
                          next
                            case cexp
                            by solve( !KU( ~ephR ) @ #vk.25 )
                          qed
                        next
                          case split_case_02
                          solve( !KU( ~ltk ) @ #vk.23 )
                            case Corrupt_ltk
                            by contradiction
                          qed
                        next
                          case split_case_03
                          by solve( !KU( ~ephI ) @ #vk.23 )
                        next
                          case split_case_04
                          solve( splitEqs(1) )
                            case split_case_1
                            solve( !KU( ~ltkR ) @ #vk.23 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~ephR*inv((~ephI*~ltkR))) ) @ #vk.18 )
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.26 )
                              next
                                case cexp
                                by solve( !KU( ~ephR ) @ #vk.26 )
                              qed
                            qed
                          next
                            case split_case_2
                            solve( !KU( 'g'^(~ephR*inv((~ephI*x))) ) @ #vk.17 )
                              case Responder_recvChal
                              by solve( !KU( ~ephI ) @ #vk.26 )
                            next
                              case cexp
                              by solve( !KU( ~ephR ) @ #vk.27 )
                            qed
                          next
                            case split_case_3
                            solve( !KU( ~ltkR ) @ #vk.24 )
                              case Corrupt_ltk
                              solve( !KU( 'g'^(~ephR*inv((~ephI*~ltkR*x))) ) @ #vk.18 )
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.28 )
                              next
                                case cexp
                                by solve( !KU( ~ephR ) @ #vk.29 )
                              qed
                            qed
                          qed
                        next
                          case split_case_05
                          solve( !KU( ~ltk ) @ #vk.24 )
                            case Corrupt_ltk
                            by contradiction
                          qed
                        next
                          case split_case_06
                          by solve( !KU( ~ephI ) @ #vk.23 )
                        next
                          case split_case_07
                          by solve( !KU( ~ephI ) @ #vk.23 )
                        next
                          case split_case_08
                          solve( !KU( ~ltk ) @ #vk.25 )
                            case Corrupt_ltk
                            by contradiction
                          qed
                        next
                          case split_case_09
                          by solve( !KU( ~ephI ) @ #vk.23 )
                        next
                          case split_case_10
                          solve( !KU( 'g'^(~ephR*x*inv((~ephI*x.1))) ) @ #vk.17 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_recvChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_recvChal_case_4
                            by solve( !KU( ~ephR ) @ #vk.32 )
                          next
                            case Initiator_sendChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_sendChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_sendChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Initiator_sendChal_case_4
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case Responder_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.31 )
                          next
                            case Responder_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.29 )
                          next
                            case Responder_recvChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.31 )
                          next
                            case RevealPubkey_case_1
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case RevealPubkey_case_2
                            by solve( !KU( ~ephR ) @ #vk.28 )
                          next
                            case cexp
                            by solve( !KU( ~ephR ) @ #vk.29 )
                          qed
                        next
                          case split_case_11
                          solve( !KU( ~ltk ) @ #vk.26 )
                            case Corrupt_ltk
                            by contradiction
                          qed
                        next
                          case split_case_12
                          by solve( !KU( ~ephI ) @ #vk.23 )
                        qed
                      qed
                    next
                      case Responder_recvChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.23 )
                    next
                      case RevealPubkey_case_1
                      by solve( !KU( ~ephR ) @ #vk.19 )
                    next
                      case RevealPubkey_case_2
                      by solve( !KU( ~ephR ) @ #vk.20 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.21 )
                    qed
                  qed
                next
                  case split_case_4
                  solve( !KU( 'g'^inv((~ephR*x)) ) @ #vk.4 )
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.17 )
                  qed
                next
                  case split_case_5
                  solve( splitEqs(1) )
                    case split
                    solve( !KU( 'g'^(x*inv(~ephR)) ) @ #vk.4 )
                      case Initiator_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.19 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.21 )
                    next
                      case Initiator_recvChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.19 )
                    next
                      case Initiator_recvChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.21 )
                    next
                      case Initiator_sendChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.15 )
                    next
                      case Initiator_sendChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Initiator_sendChal_case_3
                      by solve( !KU( ~ephR ) @ #vk.15 )
                    next
                      case Initiator_sendChal_case_4
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case Responder_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.18 )
                    next
                      case Responder_recvChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.20 )
                    next
                      case RevealPubkey_case_1
                      by solve( !KU( ~ephR ) @ #vk.15 )
                    next
                      case RevealPubkey_case_2
                      by solve( !KU( ~ephR ) @ #vk.17 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.18 )
                    qed
                  qed
                next
                  case split_case_6
                  solve( !KU( 'g'^(x*inv((~ephR*x.1))) ) @ #vk.4 )
                    case Initiator_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.20 )
                  next
                    case Initiator_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.22 )
                  next
                    case Initiator_recvChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.20 )
                  next
                    case Initiator_recvChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.22 )
                  next
                    case Initiator_sendChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case Initiator_sendChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case Initiator_sendChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case Initiator_sendChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case Responder_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.19 )
                  next
                    case Responder_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.21 )
                  next
                    case RevealPubkey_case_1
                    by solve( !KU( ~ephR ) @ #vk.16 )
                  next
                    case RevealPubkey_case_2
                    by solve( !KU( ~ephR ) @ #vk.18 )
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.19 )
                  qed
                qed
              next
                case c_sign
                solve( !KU( ~ltk ) @ #vk.11 )
                  case Corrupt_ltk
                  by contradiction
                qed
              qed
            qed
          qed
        qed
      qed
    qed
  qed
qed

lemma secrecy_sessionkey:
  all-traces
  "∀ sid k pkPeer #accept #peer #secret.
    ((((((SessionAccept( sid ) @ #accept) ∧
         (SessionKey( sid, k ) @ #secret)) ∧
        (SessionPeer( sid, pkPeer ) @ #peer)) ∧
       (∃ #mk. IsAgent( pkPeer ) @ #mk)) ∧
      (¬(∃ #c. (LtkCorrupt( pkPeer ) @ #c) ∧ (#c < #accept)))) ∧
     (¬(∃ #r. RevealSessionKey( k ) @ #r))) ⇒
    (¬(∃ #kk. !KU( k ) @ #kk))"
/*
guarded formula characterizing all counter-examples:
"∃ sid k pkPeer #accept #peer #secret.
  (SessionAccept( sid ) @ #accept) ∧
  (SessionKey( sid, k ) @ #secret) ∧
  (SessionPeer( sid, pkPeer ) @ #peer)
 ∧
  (∃ #mk. (IsAgent( pkPeer ) @ #mk)) ∧
  (∀ #c. (LtkCorrupt( pkPeer ) @ #c) ⇒ ¬(#c < #accept)) ∧
  (∀ #r. (RevealSessionKey( k ) @ #r) ⇒ ⊥) ∧
  (∃ #kk. (!KU( k ) @ #kk))"
*/
simplify
solve( SessionAccept( sid ) @ #accept )
  case Initiator_recvAuth
  solve( Initiator_authSent( <'g'^~ltkI, pk(~ltkI)>, <z, pk(ltkR)>,
                             ~ltkI, ~ephI, z.1, ~protoKey, ~sid
         ) ▶₀ #accept )
    case Initiator_recvChal_case_1
    solve( SessionKey( ~sid, k ) @ #secret )
      case Initiator_recvChal
      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                 ~ltkI.1, ~ephI.1, ~protoKey.1, ~sid
             ) ▶₀ #secret )
        case Initiator_sendChal
        solve( SessionPeer( ~sid, <'g'^~ltk, pk(~ltk)> ) @ #peer )
          case Dial
          solve( !KU( senc(sign(<~protoKey, 
                                 <<'g'^~ltk, pk(~ltk)>, 
                                  sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h(z.1)>, ~ltk)>, 
                                 h(z.1)>,
                                ~ltk),
                           h(<~protoKey, z.1, z.2, 'g'^(~ephI*~ltk)>))
                 ) @ #vk )
            case Responder_recvAuth
            solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                           'g'^(~ephI*~ltk)>)
                   ) @ #kk )
              case RevealSessionKey_case_1
              by contradiction
            next
              case RevealSessionKey_case_2
              by contradiction
            next
              case c_h
              solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.11 )
                case Initiator_sendChal
                by solve( !KU( ~ephR ) @ #vk.15 )
              next
                case Responder_recvChal
                by solve( !KU( ~ephI ) @ #vk.15 )
              next
                case cexp
                by solve( !KU( ~ephI ) @ #vk.17 )
              qed
            qed
          next
            case c_senc
            solve( !KU( sign(<~protoKey, 
                              <<'g'^~ltk, pk(~ltk)>, 
                               sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h(z.1)>, ~ltk)>, 
                              h(z.1)>,
                             ~ltk)
                   ) @ #vk.4 )
              case Responder_recvAuth
              solve( splitEqs(3) )
                case split_case_01
                solve( splitEqs(6) )
                  case split
                  solve( !KU( 'g'^(~ephI*inv(~ephR)) ) @ #vk.8 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.11 )
                  qed
                qed
              next
                case split_case_02
                solve( splitEqs(6) )
                  case split
                  solve( !KU( mac('g'^inv(~ephI), h(<'g', ~protoKey>)) ) @ #vk.4 )
                    case c_mac
                    solve( !KU( h(<~protoKey, 'g', 'g'^(~ltk*inv(~ephI)), 
                                   'g'^(~ephI*~ltk)>)
                           ) @ #kk )
                      case RevealSessionKey
                      by contradiction
                    next
                      case c_h
                      solve( !KU( 'g'^(~ltk*inv(~ephI)) ) @ #vk.16 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case cexp
                        solve( !KU( ~ltk ) @ #vk.19 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      qed
                    qed
                  qed
                qed
              next
                case split_case_03
                solve( splitEqs(6) )
                  case split
                  solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk))) ) @ #vk.8 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.12 )
                  qed
                qed
              next
                case split_case_04
                solve( !KU( mac('g'^inv((~ephI*~ltk)),
                                h(<'g'^inv(~ltk), ~protoKey>))
                       ) @ #vk.4 )
                  case c_mac
                  solve( !KU( h(<~protoKey, 'g'^inv(~ltk), 'g'^inv(~ephI), 
                                 'g'^(~ephI*~ltk)>)
                         ) @ #kk )
                    case RevealSessionKey
                    by contradiction
                  next
                    case c_h
                    solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.17 )
                      case Initiator_recvChal_case_1
                      by solve( !KU( ~ephI ) @ #vk.22 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( !KU( ~ephI ) @ #vk.22 )
                    next
                      case Initiator_sendChal
                      solve( !KU( ~ltk ) @ #vk.18 )
                        case Corrupt_ltk
                        by contradiction
                      qed
                    next
                      case RevealPubkey
                      by solve( !KU( ~ephI ) @ #vk.18 )
                    next
                      case cexp
                      by solve( !KU( ~ephI ) @ #vk.20 )
                    qed
                  qed
                qed
              next
                case split_case_05
                solve( !KU( mac('g'^ephR, h(<'g'^(~ephI*ephR), ~protoKey>))
                       ) @ #vk.4 )
                  case Responder_recvChal
                  solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                                 'g'^(~ephI*~ltk)>)
                         ) @ #kk )
                    case RevealSessionKey_case_1
                    by contradiction
                  next
                    case RevealSessionKey_case_2
                    by contradiction
                  next
                    case c_h
                    solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.16 )
                      case Initiator_sendChal
                      by solve( !KU( ~ephR ) @ #vk.20 )
                    next
                      case Responder_recvChal
                      by solve( !KU( ~ephI ) @ #vk.20 )
                    next
                      case cexp
                      by solve( !KU( ~ephI ) @ #vk.22 )
                    qed
                  qed
                next
                  case c_mac
                  solve( !KU( h(<~protoKey, 'g'^(~ephI*ephR), 'g'^(~ltk*ephR), 
                                 'g'^(~ephI*~ltk)>)
                         ) @ #kk )
                    case RevealSessionKey_case_1
                    by contradiction
                  next
                    case RevealSessionKey_case_2
                    by contradiction
                  next
                    case c_h
                    solve( !KU( 'g'^(~ephI*ephR) ) @ #vk.14 )
                      case Initiator_recvChal_case_1
                      by solve( !KU( ~ephI ) @ #vk.22 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( !KU( ~ephI ) @ #vk.23 )
                    next
                      case Initiator_recvChal_case_3
                      by solve( !KU( ~ephI ) @ #vk.22 )
                    next
                      case Initiator_recvChal_case_4
                      by solve( !KU( ~ephI ) @ #vk.23 )
                    next
                      case Initiator_sendChal_case_1
                      by solve( !KU( ~ephI ) @ #vk.18 )
                    next
                      case Initiator_sendChal_case_2
                      solve( !KU( 'g'^(~ltk*ephR) ) @ #vk.16 )
                        case Initiator_recvChal_case_1
                        solve( !KU( ~ltk ) @ #vk.23 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case Initiator_recvChal_case_2
                        solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.17 )
                          case Initiator_recvChal
                          by solve( !KU( ~ephI ) @ #vk.23 )
                        next
                          case Initiator_sendChal
                          solve( !KU( ~ltk ) @ #vk.23 )
                            case Corrupt_ltk
                            by contradiction
                          qed
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.25 )
                        qed
                      next
                        case Initiator_recvChal_case_3
                        solve( !KU( ~ltk ) @ #vk.24 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case Initiator_recvChal_case_4
                        solve( !KU( ~ltk ) @ #vk.23 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case Initiator_recvChal_case_5
                        solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.17 )
                          case Initiator_recvChal
                          by solve( !KU( ~ephI ) @ #vk.23 )
                        next
                          case Initiator_sendChal
                          solve( !KU( ~ltk ) @ #vk.23 )
                            case Corrupt_ltk
                            by contradiction
                          qed
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.25 )
                        qed
                      next
                        case Initiator_recvChal_case_6
                        solve( !KU( ~ltk ) @ #vk.24 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case Initiator_sendChal_case_1
                        solve( !KU( ~ltk ) @ #vk.19 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case Initiator_sendChal_case_2
                        solve( !KU( ~ltk ) @ #vk.20 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case Initiator_sendChal_case_3
                        solve( !KU( ~ltk ) @ #vk.19 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case Initiator_sendChal_case_4
                        solve( !KU( ~ltk ) @ #vk.20 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case Responder_recvChal_case_1
                        solve( !KU( ~ltk ) @ #vk.22 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case Responder_recvChal_case_2
                        solve( !KU( ~ltk ) @ #vk.23 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case RevealPubkey_case_1
                        solve( !KU( ~ltk ) @ #vk.19 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case RevealPubkey_case_2
                        solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.17 )
                          case Initiator_sendChal
                          solve( !KU( ~ltk ) @ #vk.19 )
                            case Corrupt_ltk
                            by contradiction
                          qed
                        next
                          case RevealPubkey
                          by solve( !KU( ~ephI ) @ #vk.19 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.21 )
                        qed
                      next
                        case RevealPubkey_case_3
                        solve( !KU( ~ltk ) @ #vk.20 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      next
                        case cexp
                        solve( !KU( ~ltk ) @ #vk.21 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      qed
                    next
                      case Initiator_sendChal_case_3
                      by solve( !KU( ~ephI ) @ #vk.19 )
                    next
                      case Initiator_sendChal_case_4
                      by solve( !KU( ~ephI ) @ #vk.18 )
                    next
                      case Initiator_sendChal_case_5
                      by solve( !KU( ~ephI ) @ #vk.19 )
                    next
                      case Responder_recvChal_case_1
                      by solve( !KU( ~ephI ) @ #vk.21 )
                    next
                      case Responder_recvChal_case_2
                      by solve( !KU( ~ephI ) @ #vk.22 )
                    next
                      case RevealPubkey_case_1
                      by solve( !KU( ~ephI ) @ #vk.18 )
                    next
                      case RevealPubkey_case_2
                      by solve( !KU( ~ephI ) @ #vk.19 )
                    next
                      case cexp
                      by solve( !KU( ~ephI ) @ #vk.20 )
                    qed
                  qed
                qed
              next
                case split_case_06
                solve( splitEqs(6) )
                  case split
                  solve( !KU( mac('g'^inv((~ephI*x)), h(<'g'^inv(x), ~protoKey>))
                         ) @ #vk.4 )
                    case c_mac
                    solve( !KU( h(<~protoKey, 'g'^inv(x), 'g'^(~ltk*inv((~ephI*x))), 
                                   'g'^(~ephI*~ltk)>)
                           ) @ #kk )
                      case RevealSessionKey
                      by contradiction
                    next
                      case c_h
                      solve( !KU( 'g'^(~ltk*inv((~ephI*x))) ) @ #vk.16 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case cexp
                        solve( !KU( ~ltk ) @ #vk.20 )
                          case Corrupt_ltk
                          by contradiction
                        qed
                      qed
                    qed
                  qed
                qed
              next
                case split_case_07
                solve( splitEqs(6) )
                  case split
                  solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*x))) ) @ #vk.8 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.12 )
                  qed
                qed
              next
                case split_case_08
                solve( !KU( 'g'^(x*inv(~ephI)) ) @ #vk.3 )
                  case Initiator_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.15 )
                next
                  case Initiator_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.17 )
                next
                  case Initiator_recvChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.15 )
                next
                  case Initiator_recvChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.17 )
                next
                  case Initiator_sendChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.11 )
                next
                  case Initiator_sendChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.13 )
                next
                  case Initiator_sendChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.11 )
                next
                  case Initiator_sendChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.13 )
                next
                  case Responder_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Responder_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case RevealPubkey_case_1
                  by solve( !KU( ~ephI ) @ #vk.11 )
                next
                  case RevealPubkey_case_2
                  by solve( !KU( ~ephI ) @ #vk.13 )
                next
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.14 )
                qed
              next
                case split_case_09
                solve( !KU( 'g'^(x*inv(~ltk)) ) @ #vk.3 )
                  case Initiator_recvChal_case_1
                  solve( !KU( ~ltk ) @ #vk.15 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_2
                  solve( !KU( ~ltk ) @ #vk.17 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_3
                  solve( !KU( ~ltk ) @ #vk.15 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_4
                  solve( !KU( ~ltk ) @ #vk.17 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_sendChal_case_1
                  solve( !KU( ~ltk ) @ #vk.11 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_sendChal_case_2
                  solve( !KU( ~ltk ) @ #vk.13 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_sendChal_case_3
                  solve( !KU( ~ltk ) @ #vk.11 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_sendChal_case_4
                  solve( !KU( ~ltk ) @ #vk.13 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Responder_recvChal_case_1
                  solve( !KU( ~ltk ) @ #vk.14 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Responder_recvChal_case_2
                  solve( !KU( ~ltk ) @ #vk.16 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case RevealPubkey_case_1
                  solve( !KU( ~ltk ) @ #vk.11 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case RevealPubkey_case_2
                  solve( !KU( ~ltk ) @ #vk.13 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case cexp
                  solve( !KU( ~ltk ) @ #vk.14 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                qed
              next
                case split_case_10
                solve( !KU( mac('g'^inv((~ephI*~ltk*x)),
                                h(<'g'^inv((~ltk*x)), ~protoKey>))
                       ) @ #vk.4 )
                  case c_mac
                  solve( !KU( h(<~protoKey, 'g'^inv((~ltk*x)), 'g'^inv((~ephI*x)), 
                                 'g'^(~ephI*~ltk)>)
                         ) @ #kk )
                    case RevealSessionKey
                    by contradiction
                  next
                    case c_h
                    solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.17 )
                      case Initiator_recvChal_case_1
                      by solve( !KU( ~ephI ) @ #vk.22 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( !KU( ~ephI ) @ #vk.22 )
                    next
                      case Initiator_sendChal
                      solve( !KU( ~ltk ) @ #vk.18 )
                        case Corrupt_ltk
                        by contradiction
                      qed
                    next
                      case RevealPubkey
                      by solve( !KU( ~ephI ) @ #vk.18 )
                    next
                      case cexp
                      by solve( !KU( ~ephI ) @ #vk.20 )
                    qed
                  qed
                qed
              next
                case split_case_11
                solve( !KU( 'g'^(x*inv((~ephI*~ltk))) ) @ #vk.3 )
                  case Initiator_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_recvChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_sendChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Initiator_sendChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Responder_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.15 )
                next
                  case Responder_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.17 )
                next
                  case RevealPubkey_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case RevealPubkey_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.15 )
                qed
              next
                case split_case_12
                solve( !KU( 'g'^(x*inv((~ephI*x.1))) ) @ #vk.3 )
                  case Initiator_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_recvChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_sendChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Initiator_sendChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Responder_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.15 )
                next
                  case Responder_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.17 )
                next
                  case RevealPubkey_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case RevealPubkey_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.15 )
                qed
              next
                case split_case_13
                solve( !KU( 'g'^(x*inv((~ltk*x.1))) ) @ #vk.3 )
                  case Initiator_recvChal_case_1
                  solve( !KU( ~ltk ) @ #vk.16 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_2
                  solve( !KU( ~ltk ) @ #vk.18 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_3
                  solve( !KU( ~ltk ) @ #vk.16 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_recvChal_case_4
                  solve( !KU( ~ltk ) @ #vk.18 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_sendChal_case_1
                  solve( !KU( ~ltk ) @ #vk.12 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_sendChal_case_2
                  solve( !KU( ~ltk ) @ #vk.14 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_sendChal_case_3
                  solve( !KU( ~ltk ) @ #vk.12 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Initiator_sendChal_case_4
                  solve( !KU( ~ltk ) @ #vk.14 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Responder_recvChal_case_1
                  solve( !KU( ~ltk ) @ #vk.15 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case Responder_recvChal_case_2
                  solve( !KU( ~ltk ) @ #vk.17 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case RevealPubkey_case_1
                  solve( !KU( ~ltk ) @ #vk.12 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case RevealPubkey_case_2
                  solve( !KU( ~ltk ) @ #vk.14 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                next
                  case cexp
                  solve( !KU( ~ltk ) @ #vk.15 )
                    case Corrupt_ltk
                    by contradiction
                  qed
                qed
              next
                case split_case_14
                solve( !KU( 'g'^(x*inv((~ephI*~ltk*x.1))) ) @ #vk.3 )
                  case Initiator_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_recvChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_sendChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Initiator_sendChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Responder_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.15 )
                next
                  case Responder_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.17 )
                next
                  case RevealPubkey_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case RevealPubkey_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.15 )
                qed
              qed
            next
              case c_sign
              solve( !KU( ~ltk ) @ #vk.7 )
                case Corrupt_ltk
                by contradiction
              qed
            qed
          qed
        next
          case Responder_recvAuth
          by solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid
                    ) ▶₀ #peer )
        qed
      qed
    next
      case Responder_recvAuth
      by solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid
                ) ▶₀ #secret )
    qed
  next
    case Initiator_recvChal_case_2
    solve( SessionKey( ~sid, k ) @ #secret )
      case Initiator_recvChal
      solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x.1, pkRed>,
                                 ~ltkI.1, ~ephI.1, ~protoKey.1, ~sid
             ) ▶₀ #secret )
        case Initiator_sendChal
        solve( SessionPeer( ~sid, <'g'^~ltk, pk(~ltk)> ) @ #peer )
          case Dial
          solve( !KU( senc(sign(<~protoKey, 
                                 <<'g'^~ltkI, pk(~ltkI)>, 
                                  sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h(z.1)>, ~ltkI)>, 
                                 h(z.1)>,
                                ~ltk),
                           h(<~protoKey, z.1, z.2, 'g'^(~ephI*~ltk)>))
                 ) @ #vk )
            case Responder_recvAuth
            solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltkI), 
                           'g'^(~ephI*~ltk)>)
                   ) @ #kk )
              case RevealSessionKey_case_1
              by contradiction
            next
              case RevealSessionKey_case_2
              by contradiction
            next
              case c_h
              solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.11 )
                case Initiator_sendChal
                by solve( !KU( ~ephR ) @ #vk.15 )
              next
                case Responder_recvChal
                by solve( !KU( ~ephI ) @ #vk.15 )
              next
                case cexp
                by solve( !KU( ~ephI ) @ #vk.17 )
              qed
            qed
          next
            case c_senc
            solve( !KU( sign(<~protoKey, 
                              <<'g'^~ltkI, pk(~ltkI)>, 
                               sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, h(z.1)>, ~ltkI)>, 
                              h(z.1)>,
                             ~ltk)
                   ) @ #vk.4 )
              case Responder_recvAuth
              solve( splitEqs(4) )
                case split_case_01
                solve( splitEqs(8) )
                  case split
                  solve( !KU( 'g'^(~ephI*inv(~ephR)) ) @ #vk.8 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.11 )
                  qed
                qed
              next
                case split_case_02
                solve( splitEqs(8) )
                  case split
                  solve( !KU( mac('g'^inv(~ephI), h(<'g', ~protoKey>)) ) @ #vk.4 )
                    case c_mac
                    solve( !KU( h(<~protoKey, 'g', 'g'^(~ltkI*inv(~ephI)), 
                                   'g'^(~ephI*~ltk)>)
                           ) @ #kk )
                      case RevealSessionKey
                      by contradiction /* from formulas */
                    next
                      case c_h
                      solve( !KU( 'g'^(~ltkI*inv(~ephI)) ) @ #vk.16 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case cexp
                        solve( !KU( ~ltkI ) @ #vk.19 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephI ) @ #vk.21 )
                        qed
                      qed
                    qed
                  qed
                qed
              next
                case split_case_03
                solve( splitEqs(8) )
                  case split_case_1
                  solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk))) ) @ #vk.8 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.12 )
                  qed
                next
                  case split_case_2
                  solve( !KU( 'g'^(~ephI*inv((~ephR*~ltkI))) ) @ #vk.8 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.12 )
                  qed
                qed
              next
                case split_case_04
                solve( splitEqs(8) )
                  case split_case_1
                  solve( !KU( mac('g'^inv((~ephI*~ltk)),
                                  h(<'g'^inv(~ltk), ~protoKey>))
                         ) @ #vk.4 )
                    case c_mac
                    solve( !KU( h(<~protoKey, 'g'^inv(~ltk), 'g'^inv(~ephI), 
                                   'g'^(~ephI*~ltk)>)
                           ) @ #kk )
                      case RevealSessionKey
                      by contradiction /* from formulas */
                    next
                      case c_h
                      solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.17 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~ltk ) @ #vk.18 )
                          case Corrupt_ltk
                          by contradiction /* from formulas */
                        qed
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      qed
                    qed
                  qed
                next
                  case split_case_2
                  solve( !KU( mac('g'^inv((~ephI*~ltkI)),
                                  h(<'g'^inv(~ltkI), ~protoKey>))
                         ) @ #vk.4 )
                    case c_mac
                    solve( !KU( h(<~protoKey, 'g'^inv(~ltkI), 'g'^inv(~ephI), 
                                   'g'^(~ephI*~ltk)>)
                           ) @ #kk )
                      case RevealSessionKey
                      by contradiction /* from formulas */
                    next
                      case c_h
                      solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.17 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~ltk ) @ #vk.18 )
                          case Corrupt_ltk
                          by contradiction /* from formulas */
                        qed
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      qed
                    qed
                  qed
                qed
              next
                case split_case_05
                solve( !KU( h(<~protoKey, 'g'^(~ephI*ephR), 'g'^(~ltkI*ephR), 
                               'g'^(~ephI*~ltk)>)
                       ) @ #kk )
                  case RevealSessionKey_case_1
                  by contradiction /* from formulas */
                next
                  case RevealSessionKey_case_2
                  by contradiction /* from formulas */
                next
                  case c_h
                  solve( !KU( 'g'^(~ephI*ephR) ) @ #vk.13 )
                    case Initiator_recvChal_case_1
                    by solve( !KU( ~ephI ) @ #vk.21 )
                  next
                    case Initiator_recvChal_case_2
                    by solve( !KU( ~ephI ) @ #vk.22 )
                  next
                    case Initiator_recvChal_case_3
                    by solve( !KU( ~ephI ) @ #vk.21 )
                  next
                    case Initiator_recvChal_case_4
                    by solve( !KU( ~ephI ) @ #vk.22 )
                  next
                    case Initiator_sendChal_case_1
                    by solve( !KU( ~ephI ) @ #vk.17 )
                  next
                    case Initiator_sendChal_case_2
                    by solve( !KU( ~ephI ) @ #vk.18 )
                  next
                    case Initiator_sendChal_case_3
                    by solve( !KU( ~ephI ) @ #vk.17 )
                  next
                    case Initiator_sendChal_case_4
                    solve( !KU( 'g'^(~ltkI*ephR) ) @ #vk.15 )
                      case Initiator_recvChal_case_1
                      solve( !KU( ~ltkI ) @ #vk.22 )
                        case Corrupt_ltk
                        solve( !KU( ~ephR ) @ #vk.18 )
                          case Corrupt_ltk
                          solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.18 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.27 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.27 )
                          next
                            case Initiator_sendChal
                            solve( !KU( ~ltk ) @ #vk.23 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case RevealPubkey
                            by solve( !KU( ~ephI ) @ #vk.23 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.25 )
                          qed
                        qed
                      qed
                    next
                      case Initiator_recvChal_case_2
                      solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.16 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~ltk ) @ #vk.22 )
                          case Corrupt_ltk
                          by contradiction /* from formulas */
                        qed
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      qed
                    next
                      case Initiator_recvChal_case_3
                      solve( !KU( ~ltkI ) @ #vk.23 )
                        case Corrupt_ltk
                        solve( !KU( ~ltkI.1 ) @ #vk.25 )
                          case Corrupt_ltk
                          solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.19 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.30 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.30 )
                          next
                            case Initiator_sendChal
                            solve( !KU( ~ltk ) @ #vk.26 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case RevealPubkey
                            by solve( !KU( ~ephI ) @ #vk.26 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.28 )
                          qed
                        qed
                      qed
                    next
                      case Initiator_recvChal_case_4
                      solve( !KU( ~ltkI ) @ #vk.22 )
                        case Corrupt_ltk
                        solve( !KU( ~ephR ) @ #vk.18 )
                          case Corrupt_ltk
                          solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.18 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.27 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.27 )
                          next
                            case Initiator_sendChal
                            solve( !KU( ~ltk ) @ #vk.23 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case RevealPubkey
                            by solve( !KU( ~ephI ) @ #vk.23 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.25 )
                          qed
                        qed
                      qed
                    next
                      case Initiator_recvChal_case_5
                      solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.16 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~ltk ) @ #vk.22 )
                          case Corrupt_ltk
                          by contradiction /* from formulas */
                        qed
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      qed
                    next
                      case Initiator_recvChal_case_6
                      solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.16 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.30 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.30 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~ltk ) @ #vk.26 )
                          case Corrupt_ltk
                          by contradiction /* from formulas */
                        qed
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.28 )
                      qed
                    next
                      case Initiator_sendChal_case_1
                      solve( !KU( ~ltkI ) @ #vk.18 )
                        case Corrupt_ltk
                        by solve( !KU( ~ephR ) @ #vk.18 )
                      qed
                    next
                      case Initiator_sendChal_case_2
                      solve( !KU( ~ltkI ) @ #vk.19 )
                        case Corrupt_ltk
                        by solve( !KU( ~ephI.1 ) @ #vk.21 )
                      qed
                    next
                      case Initiator_sendChal_case_3
                      solve( !KU( ~ltkI ) @ #vk.18 )
                        case Corrupt_ltk
                        by solve( !KU( ~ephR ) @ #vk.18 )
                      qed
                    next
                      case Initiator_sendChal_case_4
                      solve( !KU( ~ltkI ) @ #vk.19 )
                        case Corrupt_ltk
                        by solve( !KU( ~ephI.1 ) @ #vk.21 )
                      qed
                    next
                      case Responder_recvChal_case_1
                      solve( !KU( ~ltkI ) @ #vk.21 )
                        case Corrupt_ltk
                        by solve( !KU( ~ephR ) @ #vk.18 )
                      qed
                    next
                      case Responder_recvChal_case_2
                      solve( !KU( ~ltkI ) @ #vk.22 )
                        case Corrupt_ltk
                        by solve( !KU( ~ephR ) @ #vk.24 )
                      qed
                    next
                      case RevealPubkey_case_1
                      solve( !KU( ~ltkI ) @ #vk.18 )
                        case Corrupt_ltk
                        solve( !KU( ~ephR ) @ #vk.18 )
                          case Corrupt_ltk
                          solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.18 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephI ) @ #vk.23 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephI ) @ #vk.23 )
                          next
                            case Initiator_sendChal
                            solve( !KU( ~ltk ) @ #vk.19 )
                              case Corrupt_ltk
                              by contradiction /* from formulas */
                            qed
                          next
                            case RevealPubkey
                            by solve( !KU( ~ephI ) @ #vk.19 )
                          next
                            case cexp
                            by solve( !KU( ~ephI ) @ #vk.21 )
                          qed
                        qed
                      qed
                    next
                      case RevealPubkey_case_2
                      solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.16 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~ltk ) @ #vk.18 )
                          case Corrupt_ltk
                          by contradiction /* from formulas */
                        qed
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      qed
                    next
                      case RevealPubkey_case_3
                      solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.16 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~ltk ) @ #vk.22 )
                          case Corrupt_ltk
                          by contradiction /* from formulas */
                        qed
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      qed
                    next
                      case cexp
                      solve( !KU( ~ltkI ) @ #vk.20 )
                        case Corrupt_ltk
                        solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.17 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.25 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.25 )
                        next
                          case Initiator_sendChal
                          solve( !KU( ~ltk ) @ #vk.21 )
                            case Corrupt_ltk
                            by contradiction /* from formulas */
                          qed
                        next
                          case RevealPubkey
                          by solve( !KU( ~ephI ) @ #vk.21 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.22 )
                        qed
                      qed
                    qed
                  next
                    case Initiator_sendChal_case_5
                    by solve( !KU( ~ephI ) @ #vk.18 )
                  next
                    case Responder_recvChal_case_1
                    by solve( !KU( ~ephI ) @ #vk.20 )
                  next
                    case Responder_recvChal_case_2
                    by solve( !KU( ~ephI ) @ #vk.21 )
                  next
                    case RevealPubkey_case_1
                    by solve( !KU( ~ephI ) @ #vk.17 )
                  next
                    case RevealPubkey_case_2
                    by solve( !KU( ~ephI ) @ #vk.18 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.19 )
                  qed
                qed
              next
                case split_case_06
                solve( !KU( 'g'^inv((~ephI*x)) ) @ #vk.3 )
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.13 )
                qed
              next
                case split_case_07
                solve( splitEqs(8) )
                  case split_case_1
                  solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*~ltkI))) ) @ #vk.8 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.12 )
                  qed
                next
                  case split_case_2
                  solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*x))) ) @ #vk.8 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.12 )
                  qed
                next
                  case split_case_3
                  solve( !KU( 'g'^(~ephI*inv((~ephR*~ltkI*x))) ) @ #vk.8 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.12 )
                  qed
                next
                  case split_case_4
                  solve( !KU( 'g'^(~ephI*inv((~ephR*~ltk*~ltkI*x))) ) @ #vk.8 )
                    case Initiator_sendChal
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  next
                    case cexp
                    by solve( !KU( ~ephI ) @ #vk.12 )
                  qed
                qed
              next
                case split_case_08
                solve( !KU( 'g'^(x*inv(~ephI)) ) @ #vk.3 )
                  case Initiator_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.15 )
                next
                  case Initiator_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.17 )
                next
                  case Initiator_recvChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.15 )
                next
                  case Initiator_recvChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.17 )
                next
                  case Initiator_sendChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.11 )
                next
                  case Initiator_sendChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.13 )
                next
                  case Initiator_sendChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.11 )
                next
                  case Initiator_sendChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.13 )
                next
                  case Responder_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Responder_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case RevealPubkey_case_1
                  by solve( !KU( ~ephI ) @ #vk.11 )
                next
                  case RevealPubkey_case_2
                  by solve( !KU( ~ephI ) @ #vk.13 )
                next
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.14 )
                qed
              next
                case split_case_09
                solve( splitEqs(8) )
                  case split_case_1
                  solve( !KU( 'g'^(~ephR*inv(~ltk)) ) @ #vk.3 )
                    case Responder_recvChal
                    solve( !KU( ~ltk ) @ #vk.11 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  qed
                next
                  case split_case_2
                  solve( !KU( senc(<<'g'^~ltkI, pk(~ltkI)>, 
                                    sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*~ephR*inv(~ltkI)))>,
                                         ~ltkI)
                                   >,
                                   h(<~protoKey, 'g'^(~ephI*~ephR*inv(~ltkI)), 
                                      'g'^(~ephI*~ltk*inv(~ltkI))>))
                         ) @ #vk.5 )
                    case c_senc
                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR*inv(~ltkI)), 
                                   'g'^(~ephI*~ltk*inv(~ltkI))>)
                           ) @ #vk.11 )
                      case c_h
                      solve( !KU( 'g'^(~ephI*~ltk*inv(~ltkI)) ) @ #vk.20 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~ltk ) @ #vk.22 )
                          case Corrupt_ltk
                          by contradiction /* from formulas */
                        qed
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      qed
                    qed
                  qed
                next
                  case split_case_3
                  solve( !KU( 'g'^(x*inv(~ltk)) ) @ #vk.3 )
                    case Initiator_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.15 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.17 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_3
                    solve( !KU( ~ltk ) @ #vk.15 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_4
                    solve( !KU( ~ltk ) @ #vk.17 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_1
                    solve( !KU( ~ltk ) @ #vk.11 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_2
                    solve( !KU( ~ltk ) @ #vk.13 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_3
                    solve( !KU( ~ltk ) @ #vk.11 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_4
                    solve( !KU( ~ltk ) @ #vk.13 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Responder_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Responder_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_1
                    solve( !KU( ~ltk ) @ #vk.11 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_2
                    solve( !KU( ~ltk ) @ #vk.13 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case cexp
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  qed
                next
                  case split_case_4
                  solve( !KU( 'g'^(x*inv(~ltkI)) ) @ #vk.3 )
                    case Initiator_recvChal_case_1
                    solve( !KU( ~ltkI ) @ #vk.15 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI))) ) @ #vk.9 )
                        case Initiator_recvChal
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~x ) @ #vk.18 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.20 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      qed
                    qed
                  next
                    case Initiator_recvChal_case_2
                    solve( !KU( ~ltkI ) @ #vk.17 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*x*~ltkI.1*inv((~ephR*~ltkI))) ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Initiator_recvChal_case_5
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_5
                        solve( !KU( ~ltkI.1 ) @ #vk.20 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.22 )
                        qed
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      qed
                    qed
                  next
                    case Initiator_recvChal_case_3
                    solve( !KU( ~ltkI ) @ #vk.15 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI))) ) @ #vk.9 )
                        case Initiator_recvChal
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~x ) @ #vk.18 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.20 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      qed
                    qed
                  next
                    case Initiator_recvChal_case_4
                    solve( !KU( ~ltkI ) @ #vk.17 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*x*~ltkI.1*inv((~ephR*~ltkI))) ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_recvChal_case_5
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_5
                        solve( !KU( ~ltkI.1 ) @ #vk.20 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.22 )
                        qed
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      qed
                    qed
                  next
                    case Initiator_sendChal_case_1
                    solve( !KU( ~ltkI ) @ #vk.11 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI))) ) @ #vk.9 )
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.14 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~x ) @ #vk.14 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.15 )
                      qed
                    qed
                  next
                    case Initiator_sendChal_case_2
                    solve( !KU( ~ltkI ) @ #vk.13 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*x*~ephI.1*inv((~ephR*~ltkI))) ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case Initiator_sendChal_case_5
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case Initiator_sendChal_case_6
                        by solve( !KU( ~ephI.1 ) @ #vk.16 )
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      qed
                    qed
                  next
                    case Initiator_sendChal_case_3
                    solve( !KU( ~ltkI ) @ #vk.11 )
                      case Corrupt_ltk
                      solve( splitEqs(11) )
                        case split_case_1
                        solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI))) ) @ #vk.10 )
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.14 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~x ) @ #vk.14 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.15 )
                        qed
                      next
                        case split_case_2
                        solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI))) ) @ #vk.10 )
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.14 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~x ) @ #vk.14 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.15 )
                        qed
                      qed
                    qed
                  next
                    case Initiator_sendChal_case_4
                    solve( !KU( ~ltkI ) @ #vk.13 )
                      case Corrupt_ltk
                      solve( splitEqs(11) )
                        case split_case_1
                        solve( !KU( 'g'^(~ephI*x*~ephI.1*inv((~ephR*~ltkI))) ) @ #vk.10 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.20 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.20 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.20 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.20 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_5
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_6
                          by solve( !KU( ~ephI.1 ) @ #vk.16 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.19 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.19 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.17 )
                        qed
                      next
                        case split_case_2
                        solve( !KU( 'g'^(~ephI*x*~ephI.1*inv((~ephR*~ltkI))) ) @ #vk.10 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.20 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.20 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.20 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.20 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_5
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_6
                          by solve( !KU( ~ephI.1 ) @ #vk.16 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.19 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.19 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.17 )
                        qed
                      qed
                    qed
                  next
                    case Responder_recvChal_case_1
                    solve( !KU( ~ltkI ) @ #vk.14 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI))) ) @ #vk.9 )
                        case Initiator_sendChal
                        by solve( !KU( ~x ) @ #vk.17 )
                      next
                        case Responder_recvChal
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      qed
                    qed
                  next
                    case Responder_recvChal_case_2
                    solve( !KU( ~ltkI ) @ #vk.16 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~ephR*x*inv((~ltkI*~ephR.1))) ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case Initiator_sendChal_case_5
                        by solve( !KU( ~ephR ) @ #vk.19 )
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Responder_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      qed
                    qed
                  next
                    case RevealPubkey_case_1
                    solve( !KU( ~ltkI ) @ #vk.11 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI))) ) @ #vk.9 )
                        case Initiator_sendChal
                        solve( !KU( ~x ) @ #vk.14 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.16 )
                        qed
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.14 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.15 )
                      qed
                    qed
                  next
                    case RevealPubkey_case_2
                    solve( !KU( ~ltkI ) @ #vk.13 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*x*~ltk.1*inv((~ephR*~ltkI))) ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case Initiator_sendChal_case_5
                        solve( !KU( ~ltk.1 ) @ #vk.16 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.18 )
                        qed
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case RevealPubkey_case_3
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      qed
                    qed
                  next
                    case cexp
                    solve( !KU( ~ltkI ) @ #vk.14 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*x*inv((~ephR*~ltkI))) ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      next
                        case Initiator_sendChal_case_5
                        by solve( !KU( ~ephR ) @ #vk.18 )
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      qed
                    qed
                  qed
                next
                  case split_case_5
                  solve( !KU( 'g'^(~ephR*x*inv(~ltk)) ) @ #vk.3 )
                    case Initiator_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_sendChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Responder_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Responder_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Responder_recvChal_case_3
                    solve( !KU( ~ltk ) @ #vk.13 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_1
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case RevealPubkey_case_2
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  qed
                next
                  case split_case_6
                  solve( !KU( senc(<<'g'^~ltkI, pk(~ltkI)>, 
                                    sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*~ephR*x*inv(~ltkI)))>,
                                         ~ltkI)
                                   >,
                                   h(<~protoKey, 'g'^(~ephI*~ephR*x*inv(~ltkI)), 
                                      'g'^(~ephI*~ltk*x*inv(~ltkI))>))
                         ) @ #vk.5 )
                    case c_senc
                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR*x*inv(~ltkI)), 
                                   'g'^(~ephI*~ltk*x*inv(~ltkI))>)
                           ) @ #vk.11 )
                      case c_h
                      solve( !KU( 'g'^(~ephI*~ltk*x*inv(~ltkI)) ) @ #vk.20 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_5
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_6
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_5
                        solve( !KU( ~ltk ) @ #vk.22 )
                          case Corrupt_ltk
                          by contradiction /* from formulas */
                        qed
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.25 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.25 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case RevealPubkey_case_3
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      qed
                    qed
                  qed
                qed
              next
                case split_case_10
                solve( !KU( 'g'^inv((~ephI*~ltkI*x)) ) @ #vk.3 )
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.13 )
                qed
              next
                case split_case_11
                solve( !KU( 'g'^(x*inv((~ephI*~ltkI))) ) @ #vk.3 )
                  case Initiator_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_recvChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_sendChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Initiator_sendChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Responder_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.15 )
                next
                  case Responder_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.17 )
                next
                  case RevealPubkey_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case RevealPubkey_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.15 )
                qed
              next
                case split_case_12
                solve( !KU( 'g'^(x*inv((~ephI*x.1))) ) @ #vk.3 )
                  case Initiator_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_recvChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_sendChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Initiator_sendChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Responder_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.15 )
                next
                  case Responder_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.17 )
                next
                  case RevealPubkey_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case RevealPubkey_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.15 )
                qed
              next
                case split_case_13
                solve( splitEqs(8) )
                  case split_case_01
                  solve( !KU( 'g'^(~ephR*inv((~ltk*~ltkI))) ) @ #vk.3 )
                    case Responder_recvChal
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  qed
                next
                  case split_case_02
                  solve( !KU( 'g'^(x*inv((~ltk*~ltkI))) ) @ #vk.3 )
                    case Initiator_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.18 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_3
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_4
                    solve( !KU( ~ltk ) @ #vk.18 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_1
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_2
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_3
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_4
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Responder_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.15 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Responder_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.17 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_1
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_2
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case cexp
                    solve( !KU( ~ltk ) @ #vk.15 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  qed
                next
                  case split_case_03
                  solve( !KU( 'g'^(~ephR*inv((~ltk*x))) ) @ #vk.3 )
                    case Responder_recvChal
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  qed
                next
                  case split_case_04
                  solve( !KU( 'g'^(x*inv((~ltk*x.1))) ) @ #vk.3 )
                    case Initiator_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.18 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_3
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_4
                    solve( !KU( ~ltk ) @ #vk.18 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_1
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_2
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_3
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_4
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Responder_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.15 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Responder_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.17 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_1
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_2
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case cexp
                    solve( !KU( ~ltk ) @ #vk.15 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  qed
                next
                  case split_case_05
                  solve( !KU( senc(<<'g'^~ltkI, pk(~ltkI)>, 
                                    sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*~ephR*inv((~ltkI*x))))>,
                                         ~ltkI)
                                   >,
                                   h(<~protoKey, 'g'^(~ephI*~ephR*inv((~ltkI*x))), 
                                      'g'^(~ephI*~ltk*inv((~ltkI*x)))>))
                         ) @ #vk.5 )
                    case c_senc
                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR*inv((~ltkI*x))), 
                                   'g'^(~ephI*~ltk*inv((~ltkI*x)))>)
                           ) @ #vk.11 )
                      case c_h
                      solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                        h('g'^(~ephI*~ephR*inv((~ltkI*x))))>,
                                       ~ltkI)
                             ) @ #vk.15 )
                        case Initiator_recvChal
                        solve( !KU( 'g'^(~ephR*inv((~ltkI*x))) ) @ #vk.6 )
                          case Responder_recvChal
                          solve( !KU( ~ltkI ) @ #vk.27 )
                            case Corrupt_ltk
                            solve( !KU( 'g'^(~ephI*inv((~ltkI*x))) ) @ #vk.12 )
                              case Initiator_sendChal
                              solve( !KU( 'g'^(~ephI*~ephR*inv((~ltkI*x))) ) @ #vk.21 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.30 )
                              next
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.30 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.31 )
                              qed
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.31 )
                            qed
                          qed
                        next
                          case cexp
                          by solve( !KU( ~ephR ) @ #vk.27 )
                        qed
                      next
                        case c_sign
                        solve( !KU( ~ltkI ) @ #vk.22 )
                          case Corrupt_ltk
                          solve( !KU( 'g'^(~ephR*inv((~ltkI*x))) ) @ #vk.8 )
                            case Responder_recvChal
                            solve( !KU( 'g'^(~ephI*inv((~ltkI*x))) ) @ #vk.13 )
                              case Initiator_sendChal
                              solve( !KU( 'g'^(~ephI*~ephR*inv((~ltkI*x))) ) @ #vk.23 )
                                case Initiator_sendChal
                                by solve( !KU( ~ephR ) @ #vk.32 )
                              next
                                case Responder_recvChal
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              qed
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            qed
                          next
                            case cexp
                            by solve( !KU( ~ephR ) @ #vk.31 )
                          qed
                        qed
                      qed
                    qed
                  qed
                next
                  case split_case_06
                  solve( !KU( 'g'^(x*inv((~ltkI*x.1))) ) @ #vk.3 )
                    case Initiator_recvChal_case_1
                    solve( !KU( ~ltkI ) @ #vk.16 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI*x.1))) ) @ #vk.9 )
                        case Initiator_recvChal
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~x ) @ #vk.20 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.22 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      qed
                    qed
                  next
                    case Initiator_recvChal_case_2
                    solve( !KU( ~ltkI ) @ #vk.18 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*x*~ltkI.1*inv((~ephR*~ltkI*x.1)))
                             ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_5
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_5
                        solve( !KU( ~ltkI.1 ) @ #vk.22 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.24 )
                        qed
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.25 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.25 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      qed
                    qed
                  next
                    case Initiator_recvChal_case_3
                    solve( !KU( ~ltkI ) @ #vk.16 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI*x.1))) ) @ #vk.9 )
                        case Initiator_recvChal
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      next
                        case Initiator_sendChal
                        solve( !KU( ~x ) @ #vk.20 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.22 )
                        qed
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      qed
                    qed
                  next
                    case Initiator_recvChal_case_4
                    solve( !KU( ~ltkI ) @ #vk.18 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*x*~ltkI.1*inv((~ephR*~ltkI*x.1)))
                             ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_recvChal_case_5
                        by solve( !KU( ~ephI ) @ #vk.26 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_5
                        solve( !KU( ~ltkI.1 ) @ #vk.22 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.24 )
                        qed
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.25 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.25 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      qed
                    qed
                  next
                    case Initiator_sendChal_case_1
                    solve( !KU( ~ltkI ) @ #vk.12 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI*x.1))) ) @ #vk.9 )
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~x ) @ #vk.16 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      qed
                    qed
                  next
                    case Initiator_sendChal_case_2
                    solve( !KU( ~ltkI ) @ #vk.14 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*x*~ephI.1*inv((~ephR*~ltkI*x.1)))
                             ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal_case_5
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal_case_6
                        by solve( !KU( ~ephI.1 ) @ #vk.18 )
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      qed
                    qed
                  next
                    case Initiator_sendChal_case_3
                    solve( !KU( ~ltkI ) @ #vk.12 )
                      case Corrupt_ltk
                      solve( splitEqs(11) )
                        case split_case_1
                        solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI*x.1))) ) @ #vk.10 )
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~x ) @ #vk.16 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.17 )
                        qed
                      next
                        case split_case_2
                        solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI*x.1))) ) @ #vk.10 )
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.16 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~x ) @ #vk.16 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.17 )
                        qed
                      qed
                    qed
                  next
                    case Initiator_sendChal_case_4
                    solve( !KU( ~ltkI ) @ #vk.14 )
                      case Corrupt_ltk
                      solve( splitEqs(11) )
                        case split_case_1
                        solve( !KU( 'g'^(~ephI*x*~ephI.1*inv((~ephR*~ltkI*x.1)))
                               ) @ #vk.10 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.22 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.22 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.22 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.22 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case Initiator_sendChal_case_5
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case Initiator_sendChal_case_6
                          by solve( !KU( ~ephI.1 ) @ #vk.18 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.21 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.21 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.19 )
                        qed
                      next
                        case split_case_2
                        solve( !KU( 'g'^(~ephI*x*~ephI.1*inv((~ephR*~ltkI*x.1)))
                               ) @ #vk.10 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.22 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.22 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.22 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.22 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case Initiator_sendChal_case_5
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case Initiator_sendChal_case_6
                          by solve( !KU( ~ephI.1 ) @ #vk.18 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephI ) @ #vk.21 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephI ) @ #vk.21 )
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephI ) @ #vk.18 )
                        next
                          case cexp
                          by solve( !KU( ~ephI ) @ #vk.19 )
                        qed
                      qed
                    qed
                  next
                    case Responder_recvChal_case_1
                    solve( !KU( ~ltkI ) @ #vk.15 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI*x.1))) ) @ #vk.9 )
                        case Initiator_sendChal
                        by solve( !KU( ~x ) @ #vk.19 )
                      next
                        case Responder_recvChal
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.20 )
                      qed
                    qed
                  next
                    case Responder_recvChal_case_2
                    solve( !KU( ~ltkI ) @ #vk.17 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~ephR*x*inv((~ltkI*~ephR.1*x.1)))
                             ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.25 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.25 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.25 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.25 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case Initiator_sendChal_case_5
                        by solve( !KU( ~ephR ) @ #vk.21 )
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.24 )
                      next
                        case Responder_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      qed
                    qed
                  next
                    case RevealPubkey_case_1
                    solve( !KU( ~ltkI ) @ #vk.12 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*~x*inv((~ephR*~ltkI*x.1))) ) @ #vk.9 )
                        case Initiator_sendChal
                        solve( !KU( ~x ) @ #vk.16 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.18 )
                        qed
                      next
                        case RevealPubkey
                        by solve( !KU( ~ephI ) @ #vk.16 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.17 )
                      qed
                    qed
                  next
                    case RevealPubkey_case_2
                    solve( !KU( ~ltkI ) @ #vk.14 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*x*~ltk.1*inv((~ephR*~ltkI*x.1))) ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case Initiator_sendChal_case_5
                        solve( !KU( ~ltk.1 ) @ #vk.18 )
                          case Corrupt_ltk
                          by solve( !KU( ~ephR ) @ #vk.20 )
                        qed
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case RevealPubkey_case_3
                        by solve( !KU( ~ephI ) @ #vk.18 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      qed
                    qed
                  next
                    case cexp
                    solve( !KU( ~ltkI ) @ #vk.15 )
                      case Corrupt_ltk
                      solve( !KU( 'g'^(~ephI*x*inv((~ephR*~ltkI*x.1))) ) @ #vk.9 )
                        case Initiator_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_recvChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_recvChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      next
                        case Initiator_sendChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case Initiator_sendChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case Initiator_sendChal_case_3
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case Initiator_sendChal_case_4
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case Initiator_sendChal_case_5
                        by solve( !KU( ~ephR ) @ #vk.20 )
                      next
                        case Responder_recvChal_case_1
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case Responder_recvChal_case_2
                        by solve( !KU( ~ephI ) @ #vk.22 )
                      next
                        case RevealPubkey_case_1
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case RevealPubkey_case_2
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.19 )
                      qed
                    qed
                  qed
                next
                  case split_case_07
                  solve( !KU( 'g'^(~ephR*x*inv((~ltk*x.1))) ) @ #vk.3 )
                    case Initiator_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_sendChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Responder_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Responder_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Responder_recvChal_case_3
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_1
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case RevealPubkey_case_2
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  qed
                next
                  case split_case_08
                  solve( !KU( 'g'^(~ephR*x*inv((~ltk*~ltkI))) ) @ #vk.3 )
                    case Initiator_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_sendChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Responder_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Responder_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Responder_recvChal_case_3
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_1
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case RevealPubkey_case_2
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  qed
                next
                  case split_case_09
                  solve( !KU( senc(<<'g'^~ltkI, pk(~ltkI)>, 
                                    sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                          h('g'^(~ephI*~ephR*x*inv((~ltkI*x.1))))>,
                                         ~ltkI)
                                   >,
                                   h(<~protoKey, 'g'^(~ephI*~ephR*x*inv((~ltkI*x.1))), 
                                      'g'^(~ephI*~ltk*x*inv((~ltkI*x.1)))>))
                         ) @ #vk.5 )
                    case c_senc
                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR*x*inv((~ltkI*x.1))), 
                                   'g'^(~ephI*~ltk*x*inv((~ltkI*x.1)))>)
                           ) @ #vk.11 )
                      case c_h
                      solve( !KU( sign(<~protoKey, <'g'^~ltk, pk(~ltk)>, 
                                        h('g'^(~ephI*~ephR*x*inv((~ltkI*x.1))))>,
                                       ~ltkI)
                             ) @ #vk.15 )
                        case Initiator_recvChal
                        solve( !KU( 'g'^(~ephR*x*inv((~ltkI*x.1))) ) @ #vk.6 )
                          case Initiator_recvChal_case_1
                          by solve( !KU( ~ephR ) @ #vk.30 )
                        next
                          case Initiator_recvChal_case_2
                          by solve( !KU( ~ephR ) @ #vk.30 )
                        next
                          case Initiator_recvChal_case_3
                          by solve( !KU( ~ephR ) @ #vk.30 )
                        next
                          case Initiator_recvChal_case_4
                          by solve( !KU( ~ephR ) @ #vk.30 )
                        next
                          case Initiator_sendChal_case_1
                          by solve( !KU( ~ephR ) @ #vk.26 )
                        next
                          case Initiator_sendChal_case_2
                          by solve( !KU( ~ephR ) @ #vk.26 )
                        next
                          case Initiator_sendChal_case_3
                          by solve( !KU( ~ephR ) @ #vk.26 )
                        next
                          case Initiator_sendChal_case_4
                          by solve( !KU( ~ephR ) @ #vk.26 )
                        next
                          case Responder_recvChal_case_1
                          by solve( !KU( ~ephR ) @ #vk.29 )
                        next
                          case Responder_recvChal_case_2
                          by solve( !KU( ~ephR ) @ #vk.29 )
                        next
                          case Responder_recvChal_case_3
                          solve( !KU( ~ltkI ) @ #vk.29 )
                            case Corrupt_ltk
                            solve( !KU( 'g'^(~ephI*x*inv((~ltkI*x.1))) ) @ #vk.12 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.36 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.36 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.36 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.36 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case Initiator_sendChal_case_5
                              solve( !KU( 'g'^(~ephI*~ephR*x*inv((~ltkI*x.1))) ) @ #vk.21 )
                                case Initiator_recvChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_3
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_recvChal_case_4
                                by solve( !KU( ~ephI ) @ #vk.36 )
                              next
                                case Initiator_sendChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_3
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_4
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case Initiator_sendChal_case_5
                                by solve( !KU( ~ephR ) @ #vk.32 )
                              next
                                case Responder_recvChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.35 )
                              next
                                case Responder_recvChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.35 )
                              next
                                case Responder_recvChal_case_3
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case RevealPubkey_case_1
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case RevealPubkey_case_2
                                by solve( !KU( ~ephI ) @ #vk.32 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              qed
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.35 )
                            next
                              case Responder_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.35 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~ephI ) @ #vk.32 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.33 )
                            qed
                          qed
                        next
                          case RevealPubkey_case_1
                          by solve( !KU( ~ephR ) @ #vk.26 )
                        next
                          case RevealPubkey_case_2
                          by solve( !KU( ~ephR ) @ #vk.26 )
                        next
                          case cexp
                          by solve( !KU( ~ephR ) @ #vk.27 )
                        qed
                      next
                        case c_sign
                        solve( !KU( ~ltkI ) @ #vk.22 )
                          case Corrupt_ltk
                          solve( !KU( 'g'^(~ephR*x*inv((~ltkI*x.1))) ) @ #vk.8 )
                            case Initiator_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.34 )
                          next
                            case Initiator_recvChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.34 )
                          next
                            case Initiator_recvChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.34 )
                          next
                            case Initiator_recvChal_case_4
                            by solve( !KU( ~ephR ) @ #vk.34 )
                          next
                            case Initiator_sendChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.30 )
                          next
                            case Initiator_sendChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.30 )
                          next
                            case Initiator_sendChal_case_3
                            by solve( !KU( ~ephR ) @ #vk.30 )
                          next
                            case Initiator_sendChal_case_4
                            by solve( !KU( ~ephR ) @ #vk.30 )
                          next
                            case Responder_recvChal_case_1
                            by solve( !KU( ~ephR ) @ #vk.33 )
                          next
                            case Responder_recvChal_case_2
                            by solve( !KU( ~ephR ) @ #vk.33 )
                          next
                            case Responder_recvChal_case_3
                            solve( !KU( 'g'^(~ephI*x*inv((~ltkI*x.1))) ) @ #vk.13 )
                              case Initiator_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.38 )
                            next
                              case Initiator_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.38 )
                            next
                              case Initiator_recvChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.38 )
                            next
                              case Initiator_recvChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.38 )
                            next
                              case Initiator_sendChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.34 )
                            next
                              case Initiator_sendChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.34 )
                            next
                              case Initiator_sendChal_case_3
                              by solve( !KU( ~ephI ) @ #vk.34 )
                            next
                              case Initiator_sendChal_case_4
                              by solve( !KU( ~ephI ) @ #vk.34 )
                            next
                              case Initiator_sendChal_case_5
                              solve( !KU( 'g'^(~ephI*~ephR*x*inv((~ltkI*x.1))) ) @ #vk.23 )
                                case Initiator_recvChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.38 )
                              next
                                case Initiator_recvChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.38 )
                              next
                                case Initiator_recvChal_case_3
                                by solve( !KU( ~ephI ) @ #vk.38 )
                              next
                                case Initiator_recvChal_case_4
                                by solve( !KU( ~ephI ) @ #vk.38 )
                              next
                                case Initiator_sendChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.34 )
                              next
                                case Initiator_sendChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.34 )
                              next
                                case Initiator_sendChal_case_3
                                by solve( !KU( ~ephI ) @ #vk.34 )
                              next
                                case Initiator_sendChal_case_4
                                by solve( !KU( ~ephI ) @ #vk.34 )
                              next
                                case Initiator_sendChal_case_5
                                by solve( !KU( ~ephR ) @ #vk.34 )
                              next
                                case Responder_recvChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.37 )
                              next
                                case Responder_recvChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.37 )
                              next
                                case Responder_recvChal_case_3
                                by solve( !KU( ~ephI ) @ #vk.34 )
                              next
                                case RevealPubkey_case_1
                                by solve( !KU( ~ephI ) @ #vk.34 )
                              next
                                case RevealPubkey_case_2
                                by solve( !KU( ~ephI ) @ #vk.34 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.35 )
                              qed
                            next
                              case Responder_recvChal_case_1
                              by solve( !KU( ~ephI ) @ #vk.37 )
                            next
                              case Responder_recvChal_case_2
                              by solve( !KU( ~ephI ) @ #vk.37 )
                            next
                              case RevealPubkey_case_1
                              by solve( !KU( ~ephI ) @ #vk.34 )
                            next
                              case RevealPubkey_case_2
                              by solve( !KU( ~ephI ) @ #vk.34 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.35 )
                            qed
                          next
                            case RevealPubkey_case_1
                            by solve( !KU( ~ephR ) @ #vk.30 )
                          next
                            case RevealPubkey_case_2
                            by solve( !KU( ~ephR ) @ #vk.30 )
                          next
                            case cexp
                            by solve( !KU( ~ephR ) @ #vk.31 )
                          qed
                        qed
                      qed
                    qed
                  qed
                next
                  case split_case_10
                  solve( !KU( 'g'^(~ephR*inv((~ltk*~ltkI*x))) ) @ #vk.3 )
                    case Responder_recvChal
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  qed
                next
                  case split_case_11
                  solve( !KU( 'g'^(x*inv((~ltk*~ltkI*x.1))) ) @ #vk.3 )
                    case Initiator_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.18 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_3
                    solve( !KU( ~ltk ) @ #vk.16 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_recvChal_case_4
                    solve( !KU( ~ltk ) @ #vk.18 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_1
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_2
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_3
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Initiator_sendChal_case_4
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Responder_recvChal_case_1
                    solve( !KU( ~ltk ) @ #vk.15 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case Responder_recvChal_case_2
                    solve( !KU( ~ltk ) @ #vk.17 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_1
                    solve( !KU( ~ltk ) @ #vk.12 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_2
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case cexp
                    solve( !KU( ~ltk ) @ #vk.15 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  qed
                next
                  case split_case_12
                  solve( !KU( 'g'^(~ephR*x*inv((~ltk*~ltkI*x.1))) ) @ #vk.3 )
                    case Initiator_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_recvChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.15 )
                  next
                    case Initiator_sendChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_3
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Initiator_sendChal_case_4
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case Responder_recvChal_case_1
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Responder_recvChal_case_2
                    by solve( !KU( ~ephR ) @ #vk.14 )
                  next
                    case Responder_recvChal_case_3
                    solve( !KU( ~ltk ) @ #vk.14 )
                      case Corrupt_ltk
                      by contradiction /* from formulas */
                    qed
                  next
                    case RevealPubkey_case_1
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case RevealPubkey_case_2
                    by solve( !KU( ~ephR ) @ #vk.11 )
                  next
                    case cexp
                    by solve( !KU( ~ephR ) @ #vk.12 )
                  qed
                qed
              next
                case split_case_14
                solve( !KU( 'g'^(x*inv((~ephI*~ltkI*x.1))) ) @ #vk.3 )
                  case Initiator_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_recvChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.16 )
                next
                  case Initiator_recvChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.18 )
                next
                  case Initiator_sendChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Initiator_sendChal_case_3
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case Initiator_sendChal_case_4
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case Responder_recvChal_case_1
                  by solve( !KU( ~ephI ) @ #vk.15 )
                next
                  case Responder_recvChal_case_2
                  by solve( !KU( ~ephI ) @ #vk.17 )
                next
                  case RevealPubkey_case_1
                  by solve( !KU( ~ephI ) @ #vk.12 )
                next
                  case RevealPubkey_case_2
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.15 )
                qed
              qed
            next
              case c_sign
              solve( !KU( ~ltk ) @ #vk.7 )
                case Corrupt_ltk
                by contradiction
              qed
            qed
          qed
        next
          case Responder_recvAuth
          by solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid
                    ) ▶₀ #peer )
        qed
      qed
    next
      case Responder_recvAuth
      by solve( Responder_chalSent( ~ltkR, ~ephR, z.3, ~protoKey.1, ~sid
                ) ▶₀ #secret )
    qed
  qed
next
  case Responder_recvAuth
  solve( Responder_chalSent( ~ltkR, ~ephR, z, ~protoKey, ~sid
         ) ▶₀ #accept )
    case Responder_recvChal
    solve( SessionKey( ~sid, k ) @ #secret )
      case Initiator_recvChal
      by solve( Initiator_chalSent( <pkIdh, pkIed>, <'g'^~x, pkRed>,
                                    ~ltkI.1, ~ephI, ~protoKey.1, ~sid
                ) ▶₀ #secret )
    next
      case Responder_recvAuth
      solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.5, ~protoKey.1, ~sid
             ) ▶₀ #secret )
        case Responder_recvChal
        solve( SessionPeer( ~sid, <'g'^~ltk, pk(~ltk)> ) @ #peer )
          case Responder_recvAuth
          solve( Responder_chalSent( ~ltkR.1, ~ephR.1, z.5, ~protoKey.1, ~sid
                 ) ▶₀ #peer )
            case Responder_recvChal
            solve( !KU( senc(<<'g'^~ltk, pk(~ltk)>, 
                              sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, h(z.1)>, ~ltk)>,
                             h(<~protoKey, z.1, z.2>))
                   ) @ #vk )
              case Initiator_recvChal_case_1
              solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                             'g'^(~ephI*~ltk)>)
                     ) @ #kk )
                case RevealSessionKey_case_1
                by contradiction
              next
                case RevealSessionKey_case_2
                by contradiction
              next
                case c_h
                solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.10 )
                  case Initiator_sendChal
                  by solve( !KU( ~ephR ) @ #vk.14 )
                next
                  case Responder_recvChal
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.16 )
                qed
              qed
            next
              case Initiator_recvChal_case_2
              solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                             'g'^(~ephI*~ltkR)>)
                     ) @ #kk )
                case RevealSessionKey_case_1
                by contradiction
              next
                case RevealSessionKey_case_2
                by contradiction
              next
                case c_h
                solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.10 )
                  case Initiator_sendChal
                  by solve( !KU( ~ephR ) @ #vk.14 )
                next
                  case Responder_recvChal
                  by solve( !KU( ~ephI ) @ #vk.14 )
                next
                  case cexp
                  by solve( !KU( ~ephI ) @ #vk.16 )
                qed
              qed
            next
              case c_senc
              solve( !KU( sign(<~protoKey, <'g'^~ltkR, pk(~ltkR)>, h(z.1)>, ~ltk)
                     ) @ #vk.9 )
                case Initiator_recvChal_case_1
                solve( !KU( mac(z, h(~protoKey)) ) @ #vk.4 )
                  case Initiator_sendChal_case_1
                  solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                                 'g'^(~ephI*~ltk)>)
                         ) @ #kk )
                    case RevealSessionKey_case_1
                    by contradiction
                  next
                    case RevealSessionKey_case_2
                    by contradiction
                  next
                    case c_h
                    solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                      case Initiator_sendChal
                      by solve( !KU( ~ephR ) @ #vk.21 )
                    next
                      case Responder_recvChal
                      by solve( !KU( ~ephI ) @ #vk.21 )
                    next
                      case cexp
                      by solve( !KU( ~ephI ) @ #vk.23 )
                    qed
                  qed
                next
                  case Initiator_sendChal_case_2
                  solve( splitEqs(8) )
                    case split_case_1
                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                                   'g'^(~ephI*~ltk)>)
                           ) @ #kk )
                      case RevealSessionKey
                      by contradiction
                    next
                      case c_h
                      solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                        case Initiator_sendChal
                        by solve( !KU( ~ephR ) @ #vk.21 )
                      next
                        case Responder_recvChal
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      qed
                    qed
                  next
                    case split_case_2
                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                                   'g'^(~ephI*~ltk)>)
                           ) @ #kk )
                      case RevealSessionKey_case_1
                      by contradiction
                    next
                      case RevealSessionKey_case_2
                      by contradiction
                    next
                      case c_h
                      solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                        case Initiator_sendChal
                        by solve( !KU( ~ephR ) @ #vk.21 )
                      next
                        case Responder_recvChal
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      qed
                    qed
                  qed
                next
                  case c_mac
                  solve( !KU( h(<~protoKey, z.1, 'g'^(~ephR*~ltk), z.2>) ) @ #kk )
                    case RevealSessionKey_case_1
                    by contradiction
                  next
                    case RevealSessionKey_case_2
                    by contradiction
                  next
                    case RevealSessionKey_case_3
                    by contradiction
                  next
                    case c_h
                    solve( !KU( 'g'^(~ephR*~ltk) ) @ #vk.20 )
                      case Initiator_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.26 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.26 )
                    next
                      case Responder_recvChal
                      solve( !KU( ~ltk ) @ #vk.22 )
                        case Corrupt_ltk
                        solve( !KU( h(<~protoKey, z.1, z.2>) ) @ #vk.9 )
                          case c_h
                          solve( !KU( mac(z.4, h(<z.1, ~protoKey>)) ) @ #vk.16 )
                            case Responder_recvChal
                            solve( !KU( 'g'^(~ephI*~ephR.1) ) @ #vk.22 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR.1 ) @ #vk.28 )
                            next
                              case Responder_recvChal
                              by solve( !KU( ~ephI ) @ #vk.28 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.30 )
                            qed
                          next
                            case c_mac
                            solve( !KU( h(<~protoKey, z.1, 'g'^(~ephI*~ltk)>) ) @ #vk.18 )
                              case c_h
                              solve( !KU( 'g'^(~ephI*~ltk) ) @ #vk.28 )
                                case Initiator_recvChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              next
                                case Initiator_recvChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              next
                                case Initiator_sendChal
                                by contradiction
                              next
                                case RevealPubkey
                                by solve( !KU( ~ephI ) @ #vk.29 )
                              next
                                case cexp
                                by contradiction
                              qed
                            qed
                          qed
                        qed
                      qed
                    next
                      case RevealPubkey
                      by solve( !KU( ~ephR ) @ #vk.22 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.24 )
                    qed
                  qed
                qed
              next
                case Initiator_recvChal_case_2
                solve( !KU( mac(z, h(~protoKey)) ) @ #vk.4 )
                  case Initiator_sendChal_case_1
                  solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                                 'g'^(~ephI*~ltkR)>)
                         ) @ #kk )
                    case RevealSessionKey_case_1
                    by contradiction
                  next
                    case RevealSessionKey_case_2
                    by contradiction
                  next
                    case c_h
                    solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                      case Initiator_sendChal
                      by solve( !KU( ~ephR ) @ #vk.21 )
                    next
                      case Responder_recvChal
                      by solve( !KU( ~ephI ) @ #vk.21 )
                    next
                      case cexp
                      by solve( !KU( ~ephI ) @ #vk.23 )
                    qed
                  qed
                next
                  case Initiator_sendChal_case_2
                  solve( splitEqs(9) )
                    case split_case_1
                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                                   'g'^(~ephI*~ltkR)>)
                           ) @ #kk )
                      case RevealSessionKey
                      by contradiction /* from formulas */
                    next
                      case c_h
                      solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                        case Initiator_sendChal
                        by solve( !KU( ~ephR ) @ #vk.21 )
                      next
                        case Responder_recvChal
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      qed
                    qed
                  next
                    case split_case_2
                    solve( !KU( h(<~protoKey, 'g'^(~ephI*~ephR), 'g'^(~ephR*~ltk), 
                                   'g'^(~ephI*~ltkR)>)
                           ) @ #kk )
                      case RevealSessionKey_case_1
                      by contradiction /* from formulas */
                    next
                      case RevealSessionKey_case_2
                      by contradiction /* from formulas */
                    next
                      case c_h
                      solve( !KU( 'g'^(~ephI*~ephR) ) @ #vk.17 )
                        case Initiator_sendChal
                        by solve( !KU( ~ephR ) @ #vk.21 )
                      next
                        case Responder_recvChal
                        by solve( !KU( ~ephI ) @ #vk.21 )
                      next
                        case cexp
                        by solve( !KU( ~ephI ) @ #vk.23 )
                      qed
                    qed
                  qed
                next
                  case c_mac
                  solve( !KU( h(<~protoKey, z.1, 'g'^(~ephR*~ltk), z.2>) ) @ #kk )
                    case RevealSessionKey_case_1
                    by contradiction
                  next
                    case RevealSessionKey_case_2
                    by contradiction
                  next
                    case RevealSessionKey_case_3
                    by contradiction
                  next
                    case c_h
                    solve( !KU( 'g'^(~ephR*~ltk) ) @ #vk.20 )
                      case Initiator_recvChal_case_1
                      by solve( !KU( ~ephR ) @ #vk.26 )
                    next
                      case Initiator_recvChal_case_2
                      by solve( !KU( ~ephR ) @ #vk.26 )
                    next
                      case Responder_recvChal
                      solve( !KU( ~ltk ) @ #vk.22 )
                        case Corrupt_ltk
                        solve( !KU( h(<~protoKey, z.1, z.2>) ) @ #vk.9 )
                          case c_h
                          solve( !KU( mac(z.4, h(<z.1, ~protoKey>)) ) @ #vk.16 )
                            case Responder_recvChal
                            solve( !KU( 'g'^(~ephI*~ephR.1) ) @ #vk.22 )
                              case Initiator_sendChal
                              by solve( !KU( ~ephR.1 ) @ #vk.28 )
                            next
                              case Responder_recvChal
                              by solve( !KU( ~ephI ) @ #vk.28 )
                            next
                              case cexp
                              by solve( !KU( ~ephI ) @ #vk.30 )
                            qed
                          next
                            case c_mac
                            solve( !KU( h(<~protoKey, z.1, 'g'^(~ephI*~ltkR)>) ) @ #vk.18 )
                              case c_h
                              solve( !KU( 'g'^(~ephI*~ltkR) ) @ #vk.28 )
                                case Initiator_recvChal_case_1
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              next
                                case Initiator_recvChal_case_2
                                by solve( !KU( ~ephI ) @ #vk.33 )
                              next
                                case Initiator_sendChal
                                solve( !KU( ~ltkR ) @ #vk.29 )
                                  case Corrupt_ltk
                                  solve( !KU( h(~protoKey) ) @ #vk.22 )
                                    case c_h
                                    solve( !KU( h(<z.1, ~protoKey>) ) @ #vk.29 )
                                      case c_h
                                      solve( splitEqs(1) )
                                        case split_case_01
                                        solve( splitEqs(7) )
                                          case split
                                          solve( !KU( 'g'^(~ephR*inv(~ephI)) ) @ #vk.27 )
                                            case Responder_recvChal
                                            by solve( !KU( ~ephI ) @ #vk.32 )
                                          next
                                            case cexp
                                            by solve( !KU( ~ephR ) @ #vk.32 )
                                          qed
                                        qed
                                      next
                                        case split_case_02
                                        solve( splitEqs(7) )
                                          case split
                                          solve( !KU( 'g'^(~ltkR*inv(~ephR)) ) @ #vk.30 )
                                            case Initiator_recvChal_case_1
                                            by solve( !KU( ~ephR ) @ #vk.36 )
                                          next
                                            case Initiator_recvChal_case_2
                                            by solve( !KU( ~ephR ) @ #vk.36 )
                                          next
                                            case RevealPubkey
                                            by solve( !KU( ~ephR ) @ #vk.32 )
                                          next
                                            case cexp
                                            by solve( !KU( ~ephR ) @ #vk.33 )
                                          qed
                                        qed
                                      next
                                        case split_case_03
                                        solve( !KU( 'g'^(~ephR*inv(~ltkR)) ) @ #vk.28 )
                                          case Responder_recvChal
                                          solve( !KU( 'g'^inv(~ltkR) ) @ #vk.22 )
                                            case cexp
                                            solve( splitEqs(7) )
                                              case split_case_1
                                              by contradiction
                                            next
                                              case split_case_2
                                              solve( !KU( 'g'^(~ephR*inv((~ephI*~ltkR)))
                                                     ) @ #vk.29 )
                                                case Responder_recvChal
                                                by solve( !KU( ~ephI ) @ #vk.34 )
                                              next
                                                case cexp
                                                by solve( !KU( ~ephR ) @ #vk.34 )
                                              qed
                                            qed
                                          qed
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        qed
                                      next
                                        case split_case_04
                                        solve( splitEqs(7) )
                                          case split_case_1
                                          by contradiction
                                        next
                                          case split_case_2
                                          solve( !KU( 'g'^inv((~ephR*~ltkR)) ) @ #vk.20 )
                                            case cexp
                                            by solve( !KU( ~ephR ) @ #vk.34 )
                                          qed
                                        qed
                                      next
                                        case split_case_05
                                        solve( !KU( 'g'^(~ephR*ephI) ) @ #vk.28 )
                                          case Initiator_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case Initiator_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        next
                                          case Initiator_recvChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case Initiator_recvChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        next
                                          case Initiator_sendChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.31 )
                                        next
                                          case Initiator_sendChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.32 )
                                        next
                                          case Initiator_sendChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.31 )
                                        next
                                          case Initiator_sendChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.32 )
                                        next
                                          case Responder_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.34 )
                                        next
                                          case Responder_recvChal_case_2
                                          solve( splitEqs(7) )
                                            case split_case_01
                                            by solve( !KU( ~ephI ) @ #vk.27 )
                                          next
                                            case split_case_02
                                            by contradiction
                                          next
                                            case split_case_03
                                            by contradiction
                                          next
                                            case split_case_04
                                            solve( !KU( 'g'^(~ephR*ephI*inv(~ephI.1)) ) @ #vk.27 )
                                              case Initiator_recvChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Initiator_recvChal_case_2
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Initiator_recvChal_case_3
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Initiator_recvChal_case_4
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Initiator_sendChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.33 )
                                            next
                                              case Initiator_sendChal_case_2
                                              by solve( !KU( ~ephR ) @ #vk.33 )
                                            next
                                              case Initiator_sendChal_case_3
                                              by solve( !KU( ~ephR ) @ #vk.33 )
                                            next
                                              case Initiator_sendChal_case_4
                                              by solve( !KU( ~ephR ) @ #vk.33 )
                                            next
                                              case Responder_recvChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.36 )
                                            next
                                              case Responder_recvChal_case_2
                                              by solve( !KU( ~ephR ) @ #vk.36 )
                                            next
                                              case Responder_recvChal_case_3
                                              by solve( !KU( ~ephI.1 ) @ #vk.34 )
                                            next
                                              case RevealPubkey_case_1
                                              by solve( !KU( ~ephR ) @ #vk.33 )
                                            next
                                              case RevealPubkey_case_2
                                              by solve( !KU( ~ephR ) @ #vk.33 )
                                            next
                                              case cexp
                                              by solve( !KU( ~ephR ) @ #vk.34 )
                                            qed
                                          next
                                            case split_case_05
                                            solve( !KU( 'g'^(~ephR*inv((~ephI*x))) ) @ #vk.27 )
                                              case Responder_recvChal
                                              by solve( !KU( ~ephI ) @ #vk.35 )
                                            next
                                              case cexp
                                              by solve( !KU( ~ephR ) @ #vk.36 )
                                            qed
                                          next
                                            case split_case_06
                                            by contradiction
                                          next
                                            case split_case_07
                                            by solve( !KU( ~ephI ) @ #vk.32 )
                                          next
                                            case split_case_08
                                            by contradiction
                                          next
                                            case split_case_09
                                            by contradiction
                                          next
                                            case split_case_10
                                            by contradiction
                                          next
                                            case split_case_11
                                            solve( !KU( 'g'^(~ephR*x*inv((~ephI*x.1))) ) @ #vk.27 )
                                              case Initiator_recvChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.41 )
                                            next
                                              case Initiator_recvChal_case_2
                                              by solve( !KU( ~ephR ) @ #vk.41 )
                                            next
                                              case Initiator_recvChal_case_3
                                              by solve( !KU( ~ephR ) @ #vk.41 )
                                            next
                                              case Initiator_recvChal_case_4
                                              by solve( !KU( ~ephR ) @ #vk.41 )
                                            next
                                              case Initiator_sendChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Initiator_sendChal_case_2
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Initiator_sendChal_case_3
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Initiator_sendChal_case_4
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Responder_recvChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.40 )
                                            next
                                              case Responder_recvChal_case_2
                                              by solve( !KU( ~ephI ) @ #vk.38 )
                                            next
                                              case Responder_recvChal_case_3
                                              by solve( !KU( ~ephR ) @ #vk.40 )
                                            next
                                              case RevealPubkey_case_1
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case RevealPubkey_case_2
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case cexp
                                              by solve( !KU( ~ephR ) @ #vk.38 )
                                            qed
                                          next
                                            case split_case_12
                                            by contradiction
                                          next
                                            case split_case_13
                                            by contradiction
                                          qed
                                        next
                                          case Responder_recvChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case RevealPubkey_case_1
                                          by solve( !KU( ~ephR ) @ #vk.31 )
                                        next
                                          case RevealPubkey_case_2
                                          by solve( !KU( ~ephR ) @ #vk.32 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        qed
                                      next
                                        case split_case_06
                                        solve( !KU( 'g'^(~ltkR*inv((~ephR*x))) ) @ #vk.30 )
                                          case Initiator_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case Initiator_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case RevealPubkey
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        qed
                                      next
                                        case split_case_07
                                        solve( !KU( 'g'^(~ephR*inv((~ltkR*x))) ) @ #vk.28 )
                                          case Responder_recvChal
                                          solve( !KU( 'g'^inv((~ltkR*x)) ) @ #vk.22 )
                                            case cexp
                                            solve( splitEqs(7) )
                                              case split_case_1
                                              by contradiction
                                            next
                                              case split_case_2
                                              by contradiction
                                            next
                                              case split_case_3
                                              solve( !KU( 'g'^(~ephR*inv((~ephI*~ltkR*x)))
                                                     ) @ #vk.30 )
                                                case Responder_recvChal
                                                by solve( !KU( ~ephI ) @ #vk.37 )
                                              next
                                                case cexp
                                                by solve( !KU( ~ephR ) @ #vk.37 )
                                              qed
                                            next
                                              case split_case_4
                                              by contradiction
                                            qed
                                          qed
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.34 )
                                        qed
                                      next
                                        case split_case_08
                                        solve( !KU( 'g'^(x*inv(~ephR)) ) @ #vk.20 )
                                          case Initiator_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        next
                                          case Initiator_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.38 )
                                        next
                                          case Initiator_recvChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        next
                                          case Initiator_recvChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.38 )
                                        next
                                          case Initiator_sendChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.32 )
                                        next
                                          case Initiator_sendChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.34 )
                                        next
                                          case Initiator_sendChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.32 )
                                        next
                                          case Initiator_sendChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.34 )
                                        next
                                          case Responder_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case Responder_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case RevealPubkey_case_1
                                          by solve( !KU( ~ephR ) @ #vk.32 )
                                        next
                                          case RevealPubkey_case_2
                                          by solve( !KU( ~ephR ) @ #vk.34 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        qed
                                      next
                                        case split_case_09
                                        solve( !KU( 'g'^(~ephR*x*inv(~ltkR)) ) @ #vk.28 )
                                          case Initiator_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case Initiator_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case Initiator_recvChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case Initiator_recvChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case Initiator_sendChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Initiator_sendChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Initiator_sendChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Initiator_sendChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Responder_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        next
                                          case Responder_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        next
                                          case Responder_recvChal_case_3
                                          solve( splitEqs(7) )
                                            case split_case_1
                                            by contradiction
                                          next
                                            case split_case_2
                                            by solve( !KU( ~ephI ) @ #vk.33 )
                                          next
                                            case split_case_3
                                            by contradiction
                                          next
                                            case split_case_4
                                            solve( !KU( 'g'^(~ephR*x*inv((~ephI*~ltkR)))
                                                   ) @ #vk.29 )
                                              case Initiator_recvChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.40 )
                                            next
                                              case Initiator_recvChal_case_2
                                              by solve( !KU( ~ephR ) @ #vk.40 )
                                            next
                                              case Initiator_recvChal_case_3
                                              by solve( !KU( ~ephR ) @ #vk.40 )
                                            next
                                              case Initiator_recvChal_case_4
                                              by solve( !KU( ~ephR ) @ #vk.40 )
                                            next
                                              case Initiator_sendChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.36 )
                                            next
                                              case Initiator_sendChal_case_2
                                              by solve( !KU( ~ephR ) @ #vk.36 )
                                            next
                                              case Initiator_sendChal_case_3
                                              by solve( !KU( ~ephR ) @ #vk.36 )
                                            next
                                              case Initiator_sendChal_case_4
                                              by solve( !KU( ~ephR ) @ #vk.36 )
                                            next
                                              case Responder_recvChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.39 )
                                            next
                                              case Responder_recvChal_case_2
                                              by solve( !KU( ~ephI ) @ #vk.37 )
                                            next
                                              case Responder_recvChal_case_3
                                              by solve( !KU( ~ephR ) @ #vk.39 )
                                            next
                                              case RevealPubkey_case_1
                                              by solve( !KU( ~ephR ) @ #vk.36 )
                                            next
                                              case RevealPubkey_case_2
                                              by solve( !KU( ~ephR ) @ #vk.36 )
                                            next
                                              case cexp
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            qed
                                          next
                                            case split_case_5
                                            by contradiction
                                          next
                                            case split_case_6
                                            by solve( !KU( ~ephI ) @ #vk.34 )
                                          qed
                                        next
                                          case RevealPubkey_case_1
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case RevealPubkey_case_2
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.34 )
                                        qed
                                      next
                                        case split_case_10
                                        solve( !KU( 'g'^inv((~ephR*~ltkR*x)) ) @ #vk.20 )
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.34 )
                                        qed
                                      next
                                        case split_case_11
                                        solve( !KU( 'g'^(x*inv((~ephR*~ltkR))) ) @ #vk.20 )
                                          case Initiator_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case Initiator_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.39 )
                                        next
                                          case Initiator_recvChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case Initiator_recvChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.39 )
                                        next
                                          case Initiator_sendChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Initiator_sendChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case Initiator_sendChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Initiator_sendChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case Responder_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        next
                                          case Responder_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.38 )
                                        next
                                          case RevealPubkey_case_1
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case RevealPubkey_case_2
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        qed
                                      next
                                        case split_case_12
                                        solve( !KU( 'g'^(x*inv((~ephR*x.1))) ) @ #vk.20 )
                                          case Initiator_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case Initiator_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.39 )
                                        next
                                          case Initiator_recvChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case Initiator_recvChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.39 )
                                        next
                                          case Initiator_sendChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Initiator_sendChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case Initiator_sendChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Initiator_sendChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case Responder_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        next
                                          case Responder_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.38 )
                                        next
                                          case RevealPubkey_case_1
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case RevealPubkey_case_2
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        qed
                                      next
                                        case split_case_13
                                        solve( splitEqs(7) )
                                          case split_case_01
                                          solve( !KU( 'g'^(~ephI*inv((~ltk*~ltkR))) ) @ #vk.20 )
                                            case Initiator_sendChal
                                            by contradiction
                                          next
                                            case cexp
                                            by contradiction
                                          qed
                                        next
                                          case split_case_02
                                          solve( !KU( 'g'^(x*inv((~ltk*~ltkR))) ) @ #vk.20 )
                                            case Initiator_recvChal_case_1
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_2
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_3
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_4
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_1
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_2
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_3
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_4
                                            by contradiction
                                          next
                                            case Responder_recvChal_case_1
                                            by contradiction
                                          next
                                            case Responder_recvChal_case_2
                                            by contradiction
                                          next
                                            case RevealPubkey_case_1
                                            by contradiction
                                          next
                                            case RevealPubkey_case_2
                                            by contradiction
                                          next
                                            case cexp
                                            by contradiction
                                          qed
                                        next
                                          case split_case_03
                                          by contradiction
                                        next
                                          case split_case_04
                                          by contradiction
                                        next
                                          case split_case_05
                                          solve( !KU( 'g'^(~ephI*inv((~ltkR*x))) ) @ #vk.20 )
                                            case Initiator_sendChal
                                            solve( !KU( 'g'^(~ephR*inv((~ltkR*x))) ) @ #vk.25 )
                                              case Responder_recvChal
                                              solve( !KU( 'g'^(~ephI*~ephR*inv((~ltkR*x)))
                                                     ) @ #vk.30 )
                                                case Initiator_sendChal
                                                by solve( !KU( ~ephR ) @ #vk.35 )
                                              next
                                                case Responder_recvChal
                                                by solve( !KU( ~ephI ) @ #vk.35 )
                                              next
                                                case cexp
                                                by solve( !KU( ~ephI ) @ #vk.36 )
                                              qed
                                            next
                                              case cexp
                                              by solve( !KU( ~ephR ) @ #vk.36 )
                                            qed
                                          next
                                            case cexp
                                            by solve( !KU( ~ephI ) @ #vk.34 )
                                          qed
                                        next
                                          case split_case_06
                                          solve( !KU( 'g'^(~ephR*x*inv((~ephI*~ltkR*x.1)))
                                                 ) @ #vk.24 )
                                            case Initiator_recvChal_case_1
                                            by solve( !KU( ~ephR ) @ #vk.37 )
                                          next
                                            case Initiator_recvChal_case_2
                                            by solve( !KU( ~ephR ) @ #vk.37 )
                                          next
                                            case Initiator_recvChal_case_3
                                            by solve( !KU( ~ephR ) @ #vk.37 )
                                          next
                                            case Initiator_recvChal_case_4
                                            by solve( !KU( ~ephR ) @ #vk.37 )
                                          next
                                            case Initiator_sendChal_case_1
                                            by solve( !KU( ~ephR ) @ #vk.33 )
                                          next
                                            case Initiator_sendChal_case_2
                                            by solve( !KU( ~ephR ) @ #vk.33 )
                                          next
                                            case Initiator_sendChal_case_3
                                            by solve( !KU( ~ephR ) @ #vk.33 )
                                          next
                                            case Initiator_sendChal_case_4
                                            by solve( !KU( ~ephR ) @ #vk.33 )
                                          next
                                            case Responder_recvChal_case_1
                                            by solve( !KU( ~ephR ) @ #vk.36 )
                                          next
                                            case Responder_recvChal_case_2
                                            by solve( !KU( ~ephI ) @ #vk.35 )
                                          next
                                            case Responder_recvChal_case_3
                                            by solve( !KU( ~ephR ) @ #vk.36 )
                                          next
                                            case RevealPubkey_case_1
                                            by solve( !KU( ~ephR ) @ #vk.33 )
                                          next
                                            case RevealPubkey_case_2
                                            by solve( !KU( ~ephR ) @ #vk.33 )
                                          next
                                            case cexp
                                            by solve( !KU( ~ephR ) @ #vk.34 )
                                          qed
                                        next
                                          case split_case_07
                                          by contradiction
                                        next
                                          case split_case_08
                                          solve( !KU( 'g'^(~ephI*x*inv((~ltk*~ltkR))) ) @ #vk.20 )
                                            case Initiator_recvChal_case_1
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_2
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_3
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_4
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_1
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_2
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_3
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_4
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_5
                                            by contradiction
                                          next
                                            case Responder_recvChal_case_1
                                            by contradiction
                                          next
                                            case Responder_recvChal_case_2
                                            by contradiction
                                          next
                                            case RevealPubkey_case_1
                                            by contradiction
                                          next
                                            case RevealPubkey_case_2
                                            by contradiction
                                          next
                                            case cexp
                                            by contradiction
                                          qed
                                        next
                                          case split_case_09
                                          solve( !KU( 'g'^(~ephI*x*inv((~ltkR*x.1))) ) @ #vk.20 )
                                            case Initiator_recvChal_case_1
                                            by solve( !KU( ~ephI ) @ #vk.37 )
                                          next
                                            case Initiator_recvChal_case_2
                                            by solve( !KU( ~ephI ) @ #vk.37 )
                                          next
                                            case Initiator_recvChal_case_3
                                            by solve( !KU( ~ephI ) @ #vk.37 )
                                          next
                                            case Initiator_recvChal_case_4
                                            by solve( !KU( ~ephI ) @ #vk.37 )
                                          next
                                            case Initiator_sendChal_case_1
                                            by solve( !KU( ~ephI ) @ #vk.33 )
                                          next
                                            case Initiator_sendChal_case_2
                                            by solve( !KU( ~ephI ) @ #vk.33 )
                                          next
                                            case Initiator_sendChal_case_3
                                            by solve( !KU( ~ephI ) @ #vk.33 )
                                          next
                                            case Initiator_sendChal_case_4
                                            by solve( !KU( ~ephI ) @ #vk.33 )
                                          next
                                            case Initiator_sendChal_case_5
                                            solve( !KU( 'g'^(~ephR*x*inv((~ltkR*x.1))) ) @ #vk.25 )
                                              case Initiator_recvChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.41 )
                                            next
                                              case Initiator_recvChal_case_2
                                              by solve( !KU( ~ephR ) @ #vk.41 )
                                            next
                                              case Initiator_recvChal_case_3
                                              by solve( !KU( ~ephR ) @ #vk.41 )
                                            next
                                              case Initiator_recvChal_case_4
                                              by solve( !KU( ~ephR ) @ #vk.41 )
                                            next
                                              case Initiator_sendChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Initiator_sendChal_case_2
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Initiator_sendChal_case_3
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Initiator_sendChal_case_4
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case Responder_recvChal_case_1
                                              by solve( !KU( ~ephR ) @ #vk.40 )
                                            next
                                              case Responder_recvChal_case_2
                                              by solve( !KU( ~ephR ) @ #vk.40 )
                                            next
                                              case Responder_recvChal_case_3
                                              solve( !KU( 'g'^(~ephI*~ephR*x*inv((~ltkR*x.1)))
                                                     ) @ #vk.30 )
                                                case Initiator_recvChal_case_1
                                                by solve( !KU( ~ephI ) @ #vk.41 )
                                              next
                                                case Initiator_recvChal_case_2
                                                by solve( !KU( ~ephI ) @ #vk.41 )
                                              next
                                                case Initiator_recvChal_case_3
                                                by solve( !KU( ~ephI ) @ #vk.41 )
                                              next
                                                case Initiator_recvChal_case_4
                                                by solve( !KU( ~ephI ) @ #vk.41 )
                                              next
                                                case Initiator_sendChal_case_1
                                                by solve( !KU( ~ephI ) @ #vk.37 )
                                              next
                                                case Initiator_sendChal_case_2
                                                by solve( !KU( ~ephI ) @ #vk.37 )
                                              next
                                                case Initiator_sendChal_case_3
                                                by solve( !KU( ~ephI ) @ #vk.37 )
                                              next
                                                case Initiator_sendChal_case_4
                                                by solve( !KU( ~ephI ) @ #vk.37 )
                                              next
                                                case Initiator_sendChal_case_5
                                                by solve( !KU( ~ephR ) @ #vk.37 )
                                              next
                                                case Responder_recvChal_case_1
                                                by solve( !KU( ~ephI ) @ #vk.40 )
                                              next
                                                case Responder_recvChal_case_2
                                                by solve( !KU( ~ephI ) @ #vk.40 )
                                              next
                                                case Responder_recvChal_case_3
                                                by solve( !KU( ~ephI ) @ #vk.37 )
                                              next
                                                case RevealPubkey_case_1
                                                by solve( !KU( ~ephI ) @ #vk.37 )
                                              next
                                                case RevealPubkey_case_2
                                                by solve( !KU( ~ephI ) @ #vk.37 )
                                              next
                                                case cexp
                                                by solve( !KU( ~ephI ) @ #vk.38 )
                                              qed
                                            next
                                              case RevealPubkey_case_1
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case RevealPubkey_case_2
                                              by solve( !KU( ~ephR ) @ #vk.37 )
                                            next
                                              case cexp
                                              by solve( !KU( ~ephR ) @ #vk.38 )
                                            qed
                                          next
                                            case Responder_recvChal_case_1
                                            by solve( !KU( ~ephI ) @ #vk.36 )
                                          next
                                            case Responder_recvChal_case_2
                                            by solve( !KU( ~ephI ) @ #vk.36 )
                                          next
                                            case RevealPubkey_case_1
                                            by solve( !KU( ~ephI ) @ #vk.33 )
                                          next
                                            case RevealPubkey_case_2
                                            by solve( !KU( ~ephI ) @ #vk.33 )
                                          next
                                            case cexp
                                            by solve( !KU( ~ephI ) @ #vk.34 )
                                          qed
                                        next
                                          case split_case_10
                                          solve( !KU( 'g'^(~ephI*inv((~ltk*~ltkR*x))) ) @ #vk.20 )
                                            case Initiator_sendChal
                                            by contradiction
                                          next
                                            case cexp
                                            by contradiction
                                          qed
                                        next
                                          case split_case_11
                                          solve( !KU( 'g'^(x*inv((~ltk*~ltkR*x.1))) ) @ #vk.20 )
                                            case Initiator_recvChal_case_1
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_2
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_3
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_4
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_1
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_2
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_3
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_4
                                            by contradiction
                                          next
                                            case Responder_recvChal_case_1
                                            by contradiction
                                          next
                                            case Responder_recvChal_case_2
                                            by contradiction
                                          next
                                            case RevealPubkey_case_1
                                            by contradiction
                                          next
                                            case RevealPubkey_case_2
                                            by contradiction
                                          next
                                            case cexp
                                            by contradiction
                                          qed
                                        next
                                          case split_case_12
                                          solve( !KU( 'g'^(~ephI*x*inv((~ltk*~ltkR*x.1)))
                                                 ) @ #vk.20 )
                                            case Initiator_recvChal_case_1
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_2
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_3
                                            by contradiction
                                          next
                                            case Initiator_recvChal_case_4
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_1
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_2
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_3
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_4
                                            by contradiction
                                          next
                                            case Initiator_sendChal_case_5
                                            by contradiction
                                          next
                                            case Responder_recvChal_case_1
                                            by contradiction
                                          next
                                            case Responder_recvChal_case_2
                                            by contradiction
                                          next
                                            case RevealPubkey_case_1
                                            by contradiction
                                          next
                                            case RevealPubkey_case_2
                                            by contradiction
                                          next
                                            case cexp
                                            by contradiction
                                          qed
                                        qed
                                      next
                                        case split_case_14
                                        solve( !KU( 'g'^(x*inv((~ephR*~ltkR*x.1))) ) @ #vk.20 )
                                          case Initiator_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case Initiator_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.39 )
                                        next
                                          case Initiator_recvChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.37 )
                                        next
                                          case Initiator_recvChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.39 )
                                        next
                                          case Initiator_sendChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Initiator_sendChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case Initiator_sendChal_case_3
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case Initiator_sendChal_case_4
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case Responder_recvChal_case_1
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        next
                                          case Responder_recvChal_case_2
                                          by solve( !KU( ~ephR ) @ #vk.38 )
                                        next
                                          case RevealPubkey_case_1
                                          by solve( !KU( ~ephR ) @ #vk.33 )
                                        next
                                          case RevealPubkey_case_2
                                          by solve( !KU( ~ephR ) @ #vk.35 )
                                        next
                                          case cexp
                                          by solve( !KU( ~ephR ) @ #vk.36 )
                                        qed
                                      qed
                                    qed
                                  qed
                                qed
                              next
                                case RevealPubkey
                                by solve( !KU( ~ephI ) @ #vk.29 )
                              next
                                case cexp
                                by solve( !KU( ~ephI ) @ #vk.31 )
                              qed
                            qed
                          qed
                        qed
                      qed
                    next
                      case RevealPubkey
                      by solve( !KU( ~ephR ) @ #vk.22 )
                    next
                      case cexp
                      by solve( !KU( ~ephR ) @ #vk.24 )
                    qed
                  qed
                qed
              next
                case c_sign
                solve( !KU( ~ltk ) @ #vk.11 )
                  case Corrupt_ltk
                  by contradiction
                qed
              qed
            qed
          qed
        qed
      qed
    qed
  qed
qed

/* All well-formedness checks were successful. */

end