packages feed

cpsa 2.2.2 → 2.2.3

raw patch · 91 files changed

+16959/−14265 lines, 91 filesnew-component:exe:cpsalogic

Files

ChangeLog view
@@ -1,3 +1,53 @@+2011-05-04  John D. Ramsdell  <ramsdell@mitre.org>++	* cpsa.cabal (Version):  Tagged as version 2.2.3.++2011-05-02  John D. Ramsdell  <ramsdell@mitre.org>++	* doc/cpsaprimer.tex: Added sections on macros, cpsaparameters,+	and cpsalogic.++	* doc/cpsaspec.tex: Extensively rewritten to improve readability+	and reflect the current code base.  Added Appendix B that+	describes the theory behind shape analysis sentences and+	cpsalogic.++	* src/CPSA/Lib/Strand.hs (pruneStrand): Added check for+	homomorphism.  This fix slightly reduces CPSA's ability to prune.+	This problem was notice while rewriting The CPSA Specification.++2011-04-25  John D. Ramsdell  <ramsdell@mitre.org>++	* src/CPSA/Lib/Reduction.hs (commentPreskel): The format of the+	homomorphism comment in a shape changed to (maps (STRAND-MAP+	SUBST) ...), where there may be more than one homomorphism.++2011-04-18  John D. Ramsdell  <ramsdell@mitre.org>++	* src/CPSA/Logic/Logic.hs (logic): Added the cpsalogic program.+	It extracts an axiom in the language of first-order logic for each+	problem and its shapes from a CPSA run. The axiom is modeled by+	all realized skeletons.++2011-04-14  John D. Ramsdell  <ramsdell@mitre.org>++	* src/CPSA/Lib/Reduction.hs (commentPreskel): Added the+	preskeleton symbol to input that is not the point-of-view+	skeleton, but is the one used to generate it.++2011-04-11  John D. Ramsdell  <ramsdell@mitre.org>++	* src/CPSA/Lib/Reduction.hs (commentPreskel): For each shape,+	added the homomorphism from the POV skeleton to it as a comment+	using the key map.  The format is (map STRAND-MAP SUBST...), where+	there may be more than one substitution depending on the algebra.++	* src/CPSA/Lib/Algebra.hs: Added displayEnv to a Context.++2011-04-06  John D. Ramsdell  <ramsdell@mitre.org>++	* doc/cpsadesign.tex: Updated to reflect the current code base.+ 2011-03-29  John D. Ramsdell  <ramsdell@mitre.org>  	* cpsa.cabal (Version):  Tagged as version 2.2.2.
NEWS view
@@ -1,5 +1,32 @@ CPSA NEWS -- history of user-visible changes. +* Changes in version 2.2.3++** New program added+   The cpsalogic program extracts a formula in the language of+   order-sorted first-order logic for each problem and its shapes from+   a CPSA run. The formula is called a shape analysis sentence. The+   formula is modeled by all realized skeletons when CPSA finds all+   the shapes for the problem.  The sentence can be use with an+   automated first-order theorem prover to verify security goals+   associated with a protocol.++   To support the cpsalogic program, cpsa was modified so that for+   each shape, it prints a homomorphism from the point-of-view+   skeleton to the shape.++** Documentation updated+   The CPSA Specification was extensively rewritten to improve+   readability and reflect the current code base.  Appendix B was+   added.  It describes the theory behind shape analysis sentences and+   cpsalogic.++   The CPSA Design was updated to reflect the current code base and a+   section was added that describes the modules in the source code.++** Pruning bug fixed+   A coding error that lead to unjustified pruning has been fixed.+ * Changes in version 2.2.2  ** Completeness problem corrected
cpsa.cabal view
@@ -1,5 +1,5 @@ Name:			cpsa-Version:		2.2.2+Version:		2.2.3 Maintainer:		ramsdell@mitre.org Cabal-Version:		>= 1.6 License:		BSD3@@ -96,6 +96,7 @@   tst/tor.tst tst/dh_cert.scm tst/dh_cert.tst   tst/epmo_acctnum-key-hash.scm tst/epmo_acctnum-key-hash.tst   tst/epmo-key-hash.scm tst/epmo-key-hash.tst tst/wang.lisp+  tst/pkinit.scm tst/pkinit.tst  -- Disable with -f-par option during configuration. @@ -204,3 +205,18 @@   Other-Modules:     Paths_cpsa CPSA.Lib.Utilities CPSA.Lib.Pretty CPSA.Lib.SExpr     CPSA.Lib.Printer CPSA.Lib.Entry CPSA.Lib.Algebra CPSA.Lib.CPSA++Executable cpsalogic+  Main-Is:		CPSA/Logic/Main.hs+  Build-Depends:	base >= 3 && < 5, containers+  GHC-Options:+    -Wall -fno-warn-name-shadowing -fwarn-unused-imports+  Hs-Source-Dirs:	src+  Other-Modules:+    Paths_cpsa CPSA.Lib.Utilities CPSA.Lib.Pretty CPSA.Lib.SExpr+    CPSA.Lib.Printer CPSA.Lib.Notation CPSA.Lib.Entry CPSA.Lib.Algebra+    CPSA.Lib.Protocol CPSA.Lib.Strand CPSA.Lib.Loader+    CPSA.Lib.Displayer CPSA.Lib.Cohort CPSA.Lib.CPSA+    CPSA.Logic.Logic+    CPSA.Basic.Algebra CPSA.DiffieHellman.Algebra+    CPSA.DiffieHellman.IntLinEq CPSA.SimpleDiffieHellman.Algebra
doc/README view
@@ -1,16 +1,18 @@ This directory contains CPSA documentation. -* cpsauser.html: The CPSA User Guide, a key reference document+* cpsauser.html: CPSA User Guide, an essential reference document -* cpsaprimer.pdf: The CPSA Primer, an introduction to using CPSA+* cpsaprimer.pdf: CPSA Primer, an introduction to using CPSA  * cpsaoverview.pdf: Another attempt at a gentle introduction to CPSA -The remaining documents must be built.+* cpsaspec.pdf: The CPSA Specification, a formal specification of the+  algorithm -* cpsaspec.pdf: The CPSA Specification, a formal specification of the algorithm+* cpsadesign.pdf: CPSA Design, a description of implementation choices -* cpsadesign.pdf: The CPSA Design, a description of implementation choices.+* cpsatheory.pdf: CPSA Theory, the beginnings of a connectness proof+  of the CPSA algorithm  To build the documentation, the file supp-pdf.tex must be installed. It is part of the TexLive texmf ConTeXt package.  On Linux, the name
doc/bcasyntax.tex view
@@ -42,6 +42,8 @@ $\mbox{id}\mid(\sym{pubk}\mbox{ id}) \mid(\sym{privk}\mbox{ id}) \mid(\sym{invk}\mbox{ id})$+\\ &$\mid$&$(\sym{pubk}\mbox{ id}\mbox{ string})+\mid(\sym{privk}\mbox{ id}\mbox{ string})$ \\ &$\mid$&$(\sym{ltk}\mbox{ id id})\mid\mbox{string}\mid(\sym{cat}\mbox{ term+})$ \\ &$\mid$&$(\sym{enc}\mbox{ term+ term})$ \\ role-alist&$\leftarrow$&$
doc/cpsa.bib view
@@ -59,7 +59,7 @@     journal = "Theoretical Computer Science",     volume = "105",     number = "2",-    pages = "217-273",+    pages = "217--273",     year = "1992",     url = "citeseer.ist.psu.edu/goguen92ordersorted.html" } @@ -106,7 +106,7 @@   volume    = {283},   number    = {2},   year      = {2002},-  pages     = {333-380},+  pages     = {333--380},   ee        = {http://dx.doi.org/10.1016/S0304-3975(01)00139-6},   bibsource = {DBLP, http://dblp.uni-trier.de} }@@ -161,6 +161,48 @@   OPTannote = 	 {} } +@Manual{cpsadesign09,+  title = 	 {{CPSA} Design},+  OPTkey = 	 {},+  author = 	 {John D.~Ramsdell and Joshua D.~Guttman},+  organization = {The MITRE Corporation},+  OPTaddress = 	 {},+  OPTedition = 	 {},+  OPTmonth = 	 {},+  year = 	 2009,+  note = 	 {In \url{http://hackage.haskell.org/package/cpsa} source+    distribution, \texttt{doc} directory},+  OPTannote = 	 {}+}++@Manual{cpsaprimer09,+  title = 	 {{CPSA} Primer},+  OPTkey = 	 {},+  author = 	 {John D.~Ramsdell and Joshua D.~Guttman},+  organization = {The MITRE Corporation},+  OPTaddress = 	 {},+  OPTedition = 	 {},+  OPTmonth = 	 {},+  year = 	 2009,+  note = 	 {In \url{http://hackage.haskell.org/package/cpsa} source+    distribution, \texttt{doc} directory},+  OPTannote = 	 {}+}++@Manual{cpsaoverview09,+  title = 	 {{CPSA} Overview},+  OPTkey = 	 {},+  author = 	 {John D.~Ramsdell and Joshua D.~Guttman},+  organization = {The MITRE Corporation},+  OPTaddress = 	 {},+  OPTedition = 	 {},+  OPTmonth = 	 {},+  year = 	 2009,+  note = 	 {In \url{http://hackage.haskell.org/package/cpsa} source+    distribution, \texttt{doc} directory},+  OPTannote = 	 {}+}+ @InCollection{cpsa09,   author = 	 {John D. Ramsdell and Joshua D. Guttman},   title = 	 {{CPSA}: A cryptographic protocol shapes analyzer},@@ -181,4 +223,90 @@   OPTmonth = 	 {},   note = 	 {\url{http://hackage.haskell.org/package/cpsa}},   OPTannote = 	 {}+}++@unpublished{algimpl,+  author = {Moses Liskov and John D. Ramsdell},+  title = {Implementing Strand Space Algebras},+  note = {Unpublished manuscript, submitted to {ESORICS} 2011},+  year = 2010+}++@incollection{ComonLundhMillen10,+    author=	 {H. Comon-Lundh and S. Delaune and J. Millen},+    title =	 {Constraint solving techniques and enriching+                  the model with equational theories},+    booktitle =	 {Formal Models and Techniques for Analyzing+                  Security Protocols},+    editor =	 {Veronique Cortier and Steve Kremer},+    series =	 {Cryptology and Information Security Series},+    volume = 	 5,+    year =	 2011,+    isbn =	 {978-1-60750-713-0},+    publisher =	 {{ISO} Press}+    }++@InCollection{Guttman11,+  author = 	 {Joshua D. Guttman},+  title = 	 {Shapes: Surveying Crypto Protocol Runs},+  booktitle = 	 {Formal Models and Techniques for Analyzing+                  Security Protocols},+  key = 	 {CortierKremer2011},+  publisher =	 {{IOS} Press},+  year = 	 2011,+  volume = 	 5,+  isbn =	 {978-1-60750-713-0},+  editor = 	 {Veronique Cortier and Steve Kremer},+  series = 	 {Cryptology and Information Security Series}}++@Article{CokerEtAl11,+  author = 	 {George Coker and Joshua Guttman and Peter Loscocco+                  and Amy Herzog and Jonathan Millen and Brian+                  O'Hanlon and John Ramsdell and Ariel Segall and+                  Justin Sheehy and Brian Sniffen},+  title = 	 {Principles of Remote Attestation},+  journal = 	 {International Journal of Information Security},+  year = 	 2011,+  note = 	 {Forthcoming}}++@InProceedings{Guttman09,+  author = 	 {Joshua D. Guttman},+  title = 	 {Security Theorems via Model Theory},+  OPTcrossref =  {},+  OPTkey = 	 {},+  booktitle =    {Express: Expressiveness in Concurrency,+                  Workshop affiliated with Concur},+  OPTpages = 	 {},+  year = 	 2009,+  OPTeditor = 	 {},+  OPTvolume = 	 {},+  OPTnumber = 	 {},+  OPTseries = 	 {},+  OPTaddress = 	 {},+  month = 	 sep,+  OPTorganization = {},+  OPTpublisher = {},+  note = 	 {Post-proceedings to appear in EPTCS,+                  \url{http://www.eptcs.org/}},+  OPTannote = 	 {}+}++@article{DenningSacco81,+  author =	 {Dorothy E. Denning and Giovanni M. Sacco},+  title =	 {Timestamps in key distribution protocols},+  journal =	 {Communications of the ACM},+  volume =	 24,+  number =	 8,+  pages =	 {533--536},+  month =	 aug,+  year =	 1981+}++@inproceedings{GuttmanEtAl04,+    author = {Joshua D. Guttman and F. Javier Thayer and Jay A. Carlson and Jonathan C. Herzog and John D. Ramsdell and Brian T. Sniffen},+    title = {Trust management in strand spaces: A rely-guarantee method},+    booktitle = {In Proc. of the European Symposium on Programming (ESOP ’04), LNCS},+    year = 2004,+    pages = {325--339},+    publisher = {Springer-Verlag} }
doc/cpsa.mk view
@@ -19,6 +19,10 @@ %_shapes.txt:	%.txt 	cpsashapes $(SHAPESFLAGS) -o $@ $< +# Extract shape analysis sentences+%_logic.text:	%.txt+	cpsalogic $(LOGICFLAGS) -o $@ $<+ # Annotate shapes %_annotations.txt:	%_shapes.txt 	cpsaannotations $(ANNOTATIONSFLAGS) -o $@ $<
doc/cpsadesign.pdf view

binary file changed (205637 → 212210 bytes)

doc/cpsadesign.tex view
@@ -15,7 +15,8 @@ \makeindex  \title{CPSA Design}-\author{John D.~Ramsdell\qquad Joshua D.~Guttman\\ The MITRE Corporation}+\author{John D.~Ramsdell\qquad Joshua D.~Guttman\\+  The MITRE Corporation\\ CPSA Version \version}  \begin{document} \maketitle@@ -25,12 +26,12 @@  \chapter{Introduction} -The Cryptographic Protocol Shapes Analyzer ({\cpsa}) enumerates all-essentially different executions possible for a cryptographic-protocol.  We call them the \emph{shapes} of the protocol.  Naturally-occurring protocols have only finitely many, indeed very few shapes.-Authentication and secrecy properties are easy to determine from them,-as are attacks and anomalies.+The Cryptographic Protocol Shapes Analyzer ({\cpsa}) attempts to+enumerate all essentially different executions possible for a+cryptographic protocol.  We call them the \emph{shapes} of the+protocol.  Naturally occurring protocols have only finitely many,+indeed very few shapes.  Authentication and secrecy properties are+easy to determine from them, as are attacks and anomalies.  The shapes analysis is performed within a pure Dolev-Yao model.  The {\cpsa} program reads a sequence of problem descriptions, and prints@@ -38,24 +39,29 @@ {\cpsa} is given some initial behavior, and it descovers what shapes are compatible with it.  Normally, the initial behavior is from the point of view of one participant.  The analysis reveals what the other-participants must have done, given the participant's view.  The search-is complete, i.e.\ every shape can in fact be found in a finite-number of steps.+participants must have done, given the participant's view. +Ideally, if there is a finite number of shapes associated with a+problem statement, {\cpsa} will find them given enough resources.  In+other words, the search is complete, i.e.\ every shape can in fact be+found in a finite number of steps.  The {\cpsa}+Theory~\cite{cpsatheory10} contains our latest attempt at showing the+search algorithm is complete.+ A {\cpsa} release includes two other documents, The {\cpsa}-Specification and The {\cpsa} Primer.  The specification describes the-{\cpsa} algorithm in a form that is closely related to its-implementation.  Algorithm correctness proofs are given in the-specification formalism.+Specification~\cite{cpsaspec09} and the {\cpsa}+Primer~\cite{cpsaprimer09}.  The specification describes the {\cpsa}+algorithm in a form that is closely related to its implementation. -There are many design decisions that are not reflected in The {\cpsa}-Specification.  Including these decisions in the specification would-clutter the document and unnecessarily complicate proofs.  The purpose-of this document is to describe the key omitted design decisions.  It-assumes the specification has been thoroughly read.  Definitions are-not reproduced, so the specification should be accessible when reading-this document.  The {\cpsa} Primer provides an overview of {\cpsa},-and may be worth reading before this document is approached.+There are many design decisions that are not reflected in the+specification.  Including these decisions in the specification would+clutter the document.  The purpose of this document is to describe the+key omitted design decisions and provide a link between the+specification and the source code.  It assumes the specification has+been thoroughly read.  Definitions are not reproduced, so the+specification should be accessible when reading this document.  The+{\cpsa} Primer provides an overview of {\cpsa}, and may be worth+reading before this document is approached.  \section{Notation}\label{sec:notation} @@ -63,8 +69,7 @@ Everything was specified in the design formalism.  After the split, the description of protocols and preskeletons diverged by omitting details in the design formalism in what is used for the specification-formalism.  Appendix~A in The {\cpsa} Specification relates the two-formalisms.+formalism.  The key difference between the two formalisms is the design formalism more directly models the Haskell data structures used in the {\cpsa}@@ -73,34 +78,29 @@ reduction systems in the specification translate to term reduction systems in the design. -Zero-based indexing\index{zero-based indexing}\index{indexing,-  zero-based} is used though out this document and in the source code-it describes.  Within the document, a finite sequence is a function-from an initial segment of the natural numbers.  Angle brackets are-used for sequence construction and~$\append$ is used for sequence-concatenation.  Thus $$\seq{3,2}\append\seq{99} = \{0\mapsto 3,-1\mapsto 2, 2\mapsto 99\}.$$ The length of a sequence~$S$ is $|S|$.-The phrase ``for~$x\in S$'' is shorthand for ``for~$x$ in the range-of~$S$''.  The mapping of sequence~$S$ by function~$f$ is~$f\circ S$.-Some sets are represented by sequences with no duplicates, and~$f(S)$-is used for~$f\circ S$ after duplicates have been eliminated.+Unlike the specification, zero-based indexing\index{zero-based+  indexing}\index{indexing, zero-based} is used though out this+document and in the source code it describes.  In what follows, a+finite sequence is a function from an initial segment of the natural+numbers.  The length of a sequence~$f$ is~$|f|$, and+sequence~$f=\seq{f(0),\ldots,f(n-1)}$ for $n=|f|$.  Alternatively,+$\seq{x_0,x_1,\ldots,x_{n-1}} =x_0\cons x_1\cons\ldots\cons+x_{n-1}\cons\seq{}$.  If~$S$ is a set, then~$S^\ast$ is the set of+finite sequences of~$S$, and~$S^+$ is the non-empty finite sequences+of~$S$.  The concatenation of sequences~$f$ and~$f'$ is~$f\append f'$.+The prefix of sequence~$f$ of length~$n$ is~$\prefix{f}{n}$. -You might wonder why lowercase $k$ is used for skeletons rather than-blackboard bold $\mathbb{A}$.  The notation used in the design-document is motivated by the code, and~$k$ with and without decoration-somehow became associated with preskeletons, probably because $p$,-$r$, $t$, and $s$, were already in use.  Many other notational-conventions are directly inspired by the code.+Those familiar with literature on strand spaces might wonder why+lowercase $k$ is used for skeletons rather than blackboard bold+$\mathbb{A}$.  The notation used in the design document is motivated+by the code, and~$k$ with and without decoration somehow became+associated with preskeletons, probably because $p$, $r$, $t$, and $s$,+were already in use.  Many other notational conventions are directly+inspired by the code.  In this document, lowercase Latin letters usually stand for terms, and uppercase Latin letters stand for sequences or sets of terms. -\section{Document Status}--This version of the design describes the {\cpsa} implementation that-assumes the unification problem for the message algebra has one most-general unifier.  The Basic Crypto Algebra has this property.- \chapter{Messages}\label{cha:messages}  The formalism used in the design and the specification for message@@ -112,10 +112,7 @@ Table~\ref{tab:bca} presents a slightly modified signature for the Basic Crypto Algebra.  It specifies a syntax for operations that follows mathematical tradition, such as writing $K_A$ for-$\cn{pubk}(A)$.  Tag constants are quoted strings.  The sort of all-messages is \dom{mesg}, the sort symbol used by the {\cpsa} program.-The sort~$\top$ is used in the specification so that the carrier set-of all messages is~$\alg{A}_\top$, instead of $\alg{A}_{\dom{mesg}}$.+$\cn{pubk}(A)$.  Tag constants are quoted strings.  \begin{table} \begin{center}@@ -146,6 +143,11 @@ comma is right associative.  Pairing was once called concatenation, hence the use of the symbol \texttt{cat} for pairing. +In the actual implementation, binary operations for \cn{pubk} and+\cn{privk} have been added.  The first argument is a name and the+second argument is a tag.  This extension was added so as to model key+usage, such as associating a signing and encryption key with a name.+ In the S-expression syntax used by the program, the simplest term is a variable, which syntactically is a \textsc{symbol} as described in Appendix~\ref{cha:bca syntax reference}.  Internally, each variable@@ -204,7 +206,7 @@ \subsection{Equations}\label{sec:equations}  An algebra reports answers to unification and matching problems by-returning an order-sorted substitution or an error indicator.  A+returning a sequence of order-sorted substitutions.  A different data structure is used for each problem, in this document indicated by using~$\sigma$ for answers to the unification problem of $\sigma(t_0)\equiv\sigma(t_1)$, and using~$\sigma_E$ for answers to the@@ -217,19 +219,13 @@ \fn{unify}\colon \mathcal{T}_\top(X)\times\mathcal{T}_\top(X)\times (X\rightarrow\mathcal{T}_\top(X))\rightarrow-(X\rightarrow\mathcal{T}_\top(X))^?\\+(X\rightarrow\mathcal{T}_\top(X))^\ast\\ \fn{match}\colon \mathcal{T}_\top(X)\times\mathcal{T}_\top(Y)\times (X\rightarrow\mathcal{T}_\top(Y))\rightarrow-(X\rightarrow\mathcal{T}_\top(Y))^?+(X\rightarrow\mathcal{T}_\top(Y))^\ast \end{array}$$ -For type~$T$, we write $T^?$ to describe the lifted type for~$T$ that-includes an error indicator.  In this formalism, sequences of length-less than two are used for the lifted type, and the error indicator is-the empty sequence.  In Haskell, the lifted type is-\index{maybe type}\texttt{Maybe~$T$}.- An answer to the matching problem is called an \index{environment}\emph{environment}.  An environment differs from a substitution produced as an answer to a unification problem in that it@@ -323,14 +319,13 @@ additional sorts and operations are in the {\cpsa} Signature in Table~\ref{tab:strands}.  The signature uses the sort $s~\dom{list}$ for sequences of terms of sort~$s$, and the sort $s~\dom{set}$ for-injective sequences of terms of sort~$s$.  The sorts used in the-signature are in Table~\ref{tab:sorts}.+injective sequences of terms of sort~$s$.  \begin{table} \begin{center}-Additional sort symbols: \dom{evt}, \dom{role},-\dom{maplet}, \dom{instance}, \\-\dom{node}, \dom{ordering}, and \dom{preskel} \\[1ex]+Additional sort symbols: \dom{atom}, \dom{evt}, \dom{role}, \dom{maplet},\\+\dom{instance}, \dom{node}, \dom{ordering}, and \dom{preskel} \\[1ex]+Subsorts: for each base sort $s, s < \dom{atom} < \dom{mesg}$\\[1ex] $\begin{array}{rl} \outbnd\colon\dom{mesg}\rightarrow\dom{evt}\hspace{2\arraycolsep} \inbnd\colon\dom{mesg}\rightarrow\dom{evt}&@@ -346,24 +341,9 @@ \dom{instance}\dom{list}\times \dom{ordering}\dom{set}\times\dom{atom}\dom{set}\times \dom{atom}\dom{set}\rightarrow\dom{preskel}$\\[1ex]-\end{center}-\caption{{\cpsa} Signature}\label{tab:strands}-\end{table}--Some of the terms over a {\cpsa} signature are not-\index{well-formed}well-formed, and omitted from interpretation.  The-text describing a term of a sort includes the conditions for it being-well-formed.--In what follows, the external syntax for protocols is presented, and-later, its translation into terms over a {\cpsa} signature.  For-preskeletons, the internal representation is presented first, followed-by its external syntax.--\begin{table}-\begin{center} \begin{tabular}{rl} \dom{mesg}& the sort of all messages (implementation of $\top$)\\+\dom{atom}& the sort of all base sorted messages\\ \dom{evt}& a transmission or reception event\\ \dom{trace}& a sequence of events used in a role\\ \dom{role}& a trace, a non-originating set, and a uniquely-originating@@ -376,17 +356,37 @@ \dom{ordering}&a causal ordering between a pair of nodes\\ \dom{preskel}& a preskeleton \end{tabular}-\caption{Protocol and Preskeleton Sorts}\label{tab:sorts} \end{center}+\caption{{\cpsa} Signature}\label{tab:strands} \end{table} +\begin{defn}[{\cpsa} Algebra]\label{def:cpsa algebra}+\index{CPSA@{\cpsa} algebra} Algebra~$\alg{A}(X)$ is a \emph{{\cpsa}+  algebra} if it is the order-sorted quotient term algebra generated+by variable set~$X$, and~$X$ has the following property.  For each+sort~$s$, $X_s$ is empty when~$s$ is \dom{atom}, \dom{evt},+\dom{role}, \dom{maplet}, \dom{instance}, \dom{node}, \dom{ordering},+and \dom{preskel}.+\end{defn}++Some of the terms over a {\cpsa} signature are not+\index{well-formed}well-formed, and omitted from interpretation.  The+text describing a term of a sort includes the conditions for it being+well-formed.++In what follows, the external syntax for protocols is presented, and+later, its translation into terms over a {\cpsa} signature.  For+preskeletons, the internal representation is presented first, followed+by its external syntax.+ \section{Protocols}  A protocol defines the patterns of allowed behavior for-non-adversarial participants, called the \emph{regular} participants.-The behavior of each regular participant is an instance of a protocol-template, called a role.  Figure~\ref{fig:ns roles} displays the roles-that make up the Needham-Schroeder protocol.+non-adversarial participants, called the \index{regular+  participant}\emph{regular} participants.  The behavior of each+regular participant is an instance of a protocol template, called a+role.  Figure~\ref{fig:ns roles} displays the roles that make up the+Needham-Schroeder protocol.  \begin{figure} \begin{center}@@ -464,10 +464,11 @@ that the same variable may occur in two roles.  In the external syntax, two roles may share the same identifier. -Associated with each protocol is an implicit set of roles.  For each-term~$t$ in its algebra, there is a \label{def:listener+Associated with each protocol is an implicit role.  For some+variable~$x$ of sort \dom{mesg}, that does not occur in any role in+the protocol, there is a \label{def:listener   role}\index{listener role}\index{role!listener}\emph{listener role}-of the form~$\fn{lsn}(t) = \cn{r}(\seq{\inbnd t,\outbnd t}, \seq{},+of the form~$\fn{lsn} = \cn{r}(\seq{\inbnd x,\outbnd x}, \seq{}, \seq{})$.  A listener role is used to assert that a term is not a secret.  In the implementation, the only difference between a listener role and non-listener roles is its name is the empty string, a fact@@ -476,7 +477,7 @@ \section{Preskeletons}  The other key {\cpsa} data structure is a preskeleton---see the~\cn{k}-operator in Table~\ref{tab:strands}.  A preskeleton is used to encode+operation in Table~\ref{tab:strands}.  A preskeleton is used to encode classes of protocol executions, including its shapes, the answers produced by {\cpsa}.  One component of a preskeleton is its protocol, and one component is a set of strands.  There are more components, but@@ -661,6 +662,39 @@  See the {\cpsa} Primer for more examples of {\cpsa} external syntax. +\section{Source Code}\label{sec:source code}++Protocols, roles, and preskeletons have additional fields not+documented here.  For example, each role and preskeleton keeps track+of the variable set used to generate its message algebra, and the+variable generator used to create fresh variables.  There is a name+associated with each protocol and role.  Preskeletons have addition+fields associated with generalization, as discussed in+Section~\ref{sec:generalization}.++\section{Specification}\label{sec:specification}++There is a direct relationship between the protocols and roles in this+specification, and protocols and roles as members of a {\cpsa} algebra+(Definition~\ref{def:cpsa algebra}).  The relationship between+preskeletons in the two documents requires explanation.  There are two+significant differences.++In this document and in the code, a strand is represented by the+instance $\cn{i}(r,h,E)$, but in the specification, a strand is+represented by a trace and a role.  These two representations are+mathematically equivalent, as the trace of a strand can be computed+from $r$,~$h$, and~$E$.  The code adds the trace to the fields of an+instance.++The second significant difference is that the precedes relation is+represented by a list of ordered pairs in this document, but in the+specification, the precedes relation is always asymmetric and+transitive.  In the code, the transitive reduction is performed on the+precedes relation, and the output always contains the fewest number of+ordered pairs possible without changing the transitive closure of the+precedes relation.+ \chapter{Reductions}\label{cha:reductions}  This chapter describes the implementation-oriented refinements made to@@ -707,9 +741,9 @@ \end{array} $$ -The substitution is permitted as long as it preserves the nodes at-which each uniquely originating term originates.  In other words, the-substitution is permitted only if for each uniquely originating+The substitution specifies a homomorphism as long as it preserves the+nodes at which each uniquely originating term originates.  In other+words, its a homomorphism only if for each uniquely originating term~$t$ in~$k$, $\orig(k,t)\subseteq\orig(k', \sigma(t))$, where $k'=\ops{S}_\sigma(k)$.  The implicit homomorphism is $(\idphi,\sigma)$, where~$\idphi$ is the identity strand map for~$k$.@@ -748,6 +782,20 @@ $(\phi_{s,s'},\idsigma)$, where~$\idsigma$ is the identity substitution.  Note that $\phi_{s,s'}\circ\phi'_s=\idsigma$. +\subsection{Order Enrichment}++The function~$\ops{O}$ performs order enrichment by adding a node+orderings between the node at which a uniquely originating atom+originates and the nodes at which it is gained.  A message is+\emph{gained}\index{gained} by a trace if it is carried by some event+and the first event in which it is carried is inbound.  Let $\gain(k,+t)$ be the set of nodes in~$k$ at which~$t$ is gained.+$$ \ops{O}(\cn{k}(P, I, O, N, U))=+\cn{k}(P, I, \fn{nub}(O\append O'), N, U)$$+where $O'=\{\cn{o}(n_0,n_1)\mid t\in U, n_0\in\orig(k,t),+n_1\in\gain(k,t)\}$.  Order Enrichment specifies a homomorphism that+is an embedding.+ \subsection{Transitive Reduction}  The function~$\ops{R}$ performs a transitive reduction on a preskeleton's@@ -832,14 +880,60 @@  When the subject in unrealized, the test node is selected as follows. The strands are considered in reverse order, and the first unrealized-node in one of the strands is used as the test node.  The program-happens to try atoms for critical messages before it tries-encryptions, but the overall results should be independent of the-algorithms used to select test nodes and critical messages, an assertion-that requires justification.  The encryptions considered as critical-messages are obtained using the \emph{encryptions} function in the-algebra interface.+node in one of the strands is used as the test node.  By default, the+program tries encryptions for critical messages before it tries atoms.+The encryptions considered as critical messages are obtained using the+\emph{encryptions} function in the algebra interface. +\enlargethispage{\baselineskip}+The search order can be modified by using command-line arguments or+the \texttt{herald} form.  The option \texttt{--check-nonces} cause+{\cpsa} to try atoms before encryptions.  Option+\texttt{--try-old-strands} tries the strands in order.  Option+\texttt{--reverse-nodes} tries nodes later in the strand first.++\chapter{Haskell Modules}\label{cha:haskell modules}++An overview of the modules that make up a \texttt{cpsa} program+follows.++\begin{description}+\item[CPSA.Lib.Utilities:]+Contains generic list functions and a function that determines if a+graph has a cycle.+\item[CPSA.Lib.SExpr:]+A data structure for S-expressions, the ones that are called+proper lists.+\item[CPSA.Lib.Pretty:]+A simple pretty printer.+\item[CPSA.Lib.Printer:]+A CPSA specific pretty printer using S-expressions.+\item[CPSA.Lib.Notation:]+A CPSA specific pretty printer using infix notation.+\item[CPSA.Lib.Algebra:]+Defines the interface to CPSA algebras.+\item[CPSA.Lib.CPSA:] Exports the types and functions used to+  construct an implementation of an algebra.+\item[CPSA.Basic.Algebra:]+Basic Crypto Algebra implementation.+\item[CPSA.Lib.Entry:]+Provides a common entry point for programs based on the CPSA library.+\item[CPSA.Lib.Protocol:]+Protocol data structures.+\item[CPSA.Lib.Strand:]+Instance and preskeleton data structures and support functions.+\item[CPSA.Lib.Cohort:]+Computes the cohort associated with a skeleton or its generalization.+\item[CPSA.Lib.Reduction:]+Term reduction for the CPSA solver.+\item[CPSA.Lib.Expand:]+Expands macros using definitions in the input.+\item[CPSA.Lib.Loader:]+Loads protocols and preskeletons from S-expressions.+\item[CPSA.Lib.Displayer:]+Displays protocols and preskeletons as S-expressions.+\end{description}+ \chapter{Visualization}\label{cha:viz}  This section describes the Causally Intuitive Preskeleton Layout@@ -929,7 +1023,7 @@ message algebra in Table~\ref{tab:bca} using the method described in~\cite[Section~4]{GoguenMeseguer92}.  The order-sorted message signature is reproduced in Table~\ref{tab:order-sorted} in a form that-uses prefix notation for every term formed using an operator.  In the+uses prefix notation for every term formed using an operation.  In the related many-sorted signature in Table~\ref{tab:many-sorted}, the inclusion function\index{inclusion function} symbols are \cn{text}, \cn{data}, \cn{name}, \cn{skey}, and \cn{akey}.  Section~4 of the
doc/cpsadiagrams.mp view
@@ -58,9 +58,9 @@   strand.a(3, origin, delta, btex $\mathstrut\mathit{resp}$ etex, node);    % Messages-  inbnd.a(1, dir_width, btex $\enc{N_1, A}{K_B}$ etex);-  outbnd.a(2, dir_width, btex $\enc{N_1, N_2}{K_A}$ etex);-  inbnd.a(3, dir_width, btex $\enc{N_2}{K_B}$ etex);+  rinbnd.a(1, dir_width, btex $\enc{N_1, A}{K_B}$ etex);+  routbnd.a(2, dir_width, btex $\enc{N_1, N_2}{K_A}$ etex);+  rinbnd.a(3, dir_width, btex $\enc{N_2}{K_B}$ etex); endfig;  % Intended run
doc/cpsaprimer.pdf view

binary file changed (192091 → 195714 bytes)

doc/cpsaprimer.tex view
@@ -11,7 +11,8 @@ \makeindex  \title{CPSA Primer}-\author{John D.~Ramsdell\qquad Joshua D.~Guttman\\ The MITRE Corporation}+\author{John D.~Ramsdell\qquad Joshua D.~Guttman\\+  The MITRE Corporation\\ CPSA Version \version}  \begin{document} \maketitle@@ -1081,6 +1082,24 @@ (comment "Nothing left to do") \end{verbatim} +\section{Macros}\label{sec:macros}++After reading the input, {\cpsa} expands macros before in analyzing+the results. A macro definition is a top-level form.++\begin{quote}\scshape+(\texttt{\textup{defmacro}} (name arg${}^\ast$) body)+\end{quote}++The {\cpsa} program expands all calls to macros in non-macro defining+S-expressions using the macros that have been defined previously. A+macro definition can be used to expand a call if the first element of+a list matches the name of the macro, and the length of the remaining+elements in the list matches the length of the macro's argument+list. When two macros definitions are applicable, the last definition+takes precedence. The {\cpsa} program omits macro definitions from its+output.+ \section{Advice}\label{sec:advice}  This section contains advice derived from using {\cpsa}.  When@@ -1156,6 +1175,37 @@ that {\cpsa} has the chance to abort the run in a fashion that generates graphable output.  Of course, sending us input that causes erroneous behavior will help us improve {\cpsa}.++\section{Formula Extraction}\label{sec:formulas}++The \texttt{cpsalogic} program extracts a formula in the language of+order-sorted first-order logic for each problem and its shapes from a+{\cpsa} run. The formula is called a shape analysis sentence. The+formula is modeled by all realized skeletons when {\cpsa} finds all+the shapes for the problem.  The details of formula extraction are+presented in Appendix~B of The {\cpsa}+Specification~\cite{cpsaspec09}.++\section{Annotations}\label{sec:annotations}++The \texttt{cpsaannotations} program uses protocol annotations to+annotate shapes and generate protocol soundness obligations for use+with the rely-guarantee method of trust+management~\cite{guttmanEtAl04}.  The language of formulas is+order-sorted first-order logic extended with a modal says operator.+Formula terms may include function symbols that are not part of a+protocol's message signature.  The syntax of a formula is specified in+the {\cpsa} Overview~\cite{cpsaoverview09}.++\section{Parameter Analysis}\label{sec:parameters}++The parameters of a role are the atoms that are not acquired by the+role's trace, but must be available before a complete execution of the+trace is possible. The \texttt{cpsaparameters} program computes sets+of sets of parameters consistent with the role. If the expected+parameter set is not a member, a specification error is indicated.+The details of parameter analysis are presented in Appendix~A of The+{\cpsa} Specification~\cite{cpsaspec09}.  \section*{Acknowledgement}
doc/cpsaspec.pdf view

binary file changed (348303 → 319553 bytes)

doc/cpsaspec.tex view
@@ -1,2678 +1,2233 @@-\documentclass[12pt]{article}-\usepackage{amssymb}-\usepackage{amsmath}-\usepackage{amsthm}-\usepackage{url}-\usepackage{graphicx}-\usepackage{makeidx}-\usepackage[matrix,arrow,curve]{xy}-% Include this for a hyperlinked version of the document-% \usepackage{hyperref}--\theoremstyle{definition}-\newtheorem{defn}{Definition}[section]-\newtheorem{thm}{Theorem}[section]-\newtheorem{lem}[thm]{Lemma}-\newtheorem{cor}{Corollary}-\input{macros}--% This environment is used for comments about this draft.-\newenvironment{note}{\itshape\par\noindent}{}--\makeindex--\title{The CPSA Specification:\\-A Reduction System for Searching for Shapes in Cryptographic Protocols}-\author{John D.~Ramsdell\quad Joshua D.~Guttman\quad Paul D.~Rowe\\-The MITRE Corporation}--\begin{document}-\maketitle-\cpsacopying--\begin{note}-This is a draft and many of the theorems lack proofs. The focus of-our theoretical efforts has shifted to the {\cpsa} Theory document.-As a result, some of the content is out-of-date.  The draft has an-index and a table of contents at its end.  Hopefully, the final paper-will support an abstract of the following form.-\end{note}--\begin{abstract}-We describe a term reduction system that enumerates all essentially-different executions possible for a cryptographic protocol.  We call-them the \emph{shapes} of the protocol.  Naturally occurring protocols-have only finitely many, indeed very few shapes.  Authentication and-secrecy properties are easy to determine from them, as are attacks and-anomalies.  Our Cryptographic Protocols Shapes Analyzer ({\cpsa})-program is a direct implementation of the reduction system described-within, and the form of the reduction system is partially determined-by the implementation.--The reduction system is a purely syntactic description of an abstract-version of the algorithm published previously.  Order-sorted term-algebras are used for message algebras, and allow us to extend the-algorithm to algebras with an associative-commutative operation.-During the process of refining the description of the algorithm, we-found a significant simplification of the algorithm and that-elaborating some abstractions required great care.--This paper describes the reduction system and shows it possesses-desired correctness properties.  In particular, its search is-\emph{complete} meaning when analyzing a protocol starting with-some initial behavior, every shape can be found in a finite number of-steps.-\end{abstract}--\begin{note}-Background material should be here.-\end{note}--Initial attempts at implementing the Cryptographic Protocols Shapes-Analyzer ({\cpsa}) algorithm in~\cite{DoghmiGuttmanThayer07} revealed-that the strand space framework required extensions and modifications-to specify the design and implementation of a {\cpsa} program.  The-first step was to capture the essence of a strand space algebra in the-order-sorted algebra framework.  The second step was to choose data-structures, and the third step was to specify operations on the data-structures that produce the desired results.--When using strand space theory, one normally hypothesizes the-existence of a single global strand space.  This is a very reasonable-assumption for theoretical analysis, but from the point view of an-implementer, it turns out that it is better to assume there are many-local strand spaces and the design specification task is to describe-the relations between these local spaces.  Our reformulation of strand-space notation provides an implementation oriented way of describing-the concept of a local strand space, and a direct link between from-algorithm specification to the data structures used in the-implementation.--In this specification, each reduction step in the search algorithm-relates a term to a set of terms.  The correctness properties of the-algorithm justify a reduction step by placing restrictions on the-relations relative to their respective local strand spaces.  The fact-that an efficient implementation is available is due in part to the-fact the reduction system is confluent, thus greatly reducing the-search space.--\begin{note}-The sections that follow should described here.-\end{note}--In what follows, a finite sequence is a function from an initial-segment of the natural numbers.  The length of a sequence~$f$-is~$|f|$, $f_0\append f_1$ is the concatenation of sequences~$f_0$-and~$f_1$, and sequence~$f=\seq{f(0),\ldots,f(n-1)}$ for $n=|f|$.-If~$S$ is a set, then~$S^\ast$ is the set of finite sequences of~$S$,-and~$S^+$ is the non-empty finite sequences of~$S$.  \index{sequence}--Section~\ref{sec:skeletons} will define the terms ``skeleton'' and-``pruned skeleton''.  Starting in Section~\ref{sec:auth tests}, all-skeletons are pruned, so ``skeleton'' is used for pruned skeletons.--\section{Overview}\label{sec:overview}--An implementation-oriented view of strand spaces and bundles-\cite{ThayerEtal99} follows.  In this paper, a run of a protocol is-viewed as an exchange of messages by a finite set of local sessions of-the protocol.  Consider the class of $\Sigma,\Gamma$-algebras,-algebras over signature~$\Sigma$ that satisfy-equations~$\Gamma$~\cite[Chapter~3]{BaaderNipkow98}.  A message is an-element of~$\alg{M}_{\Sigma,\Gamma}(X)$, a free-$\Sigma,\Gamma$-algebra generated by set~$X$.--Each local session is called a \emph{strand}, and is an element of the-strand set~$\Theta$.  The behavior of a participant, its \emph{trace},-is a sequence of messaging events.  An \emph{event} is either a-message transmission or a reception.  Outbound message-$t\in\alg{M}_{\Sigma,\Gamma}(X)$ is written as~$\outbnd t$, and-inbound message~$t$ is written as~$\inbnd t$.  A \emph{strand space}-over algebra~$\alg{M}_{\Sigma,\Gamma}(X)$ is the strand set~$\Theta$-together with a trace mapping $\fn{tr}\colon\Theta\to-(\pm\alg{M}_{\Sigma,\Gamma}(X))^+$.  In a strand space, the elements-of the generator set~$X$ denote atomic message elements, such as keys-and text data, and not composite messages, such as encryptions and-pairs.  Later in this paper, strand sets~$\Theta$ will be initial-segments of the natural numbers, so a trace mapping will be a-sequence.--Message events occur at nodes in a strand space.  For each strand~$s$,-there is a node for every message in~$\fn{tr}(s)$.  The \emph{nodes}-of strand space $(\Theta,\fn{tr})$ are $\{(s,p)\mid s\in\Theta, 0\leq-p < |\fn{tr}(s)|\}$, and the event at a node is-$\fn{evt}(s,p)=\fn{tr}(s)(p)$.  The relation~$\Rightarrow$ defined by-$\{(s,p-1)\Rightarrow(s,p)\mid s\in\Theta, 0<p<|\fn{tr}(s)|\}$ is-called the \emph{strand succession relation}.--A \emph{bundle} in strand space $(\Theta,\fn{tr})$ is a finite-directed acyclic graph $\bundle(\Theta,\fn{tr},\to)$, where the-vertices are the nodes of $(\Theta,\fn{tr})$, and an edge represents-communication~($\rightarrow$) or strand succession~($\Rightarrow$).-For communication, if $n_0\rightarrow n_1$, then there is a-message~$t$ such that~$\fn{evt}(n_0)=\outbnd t$-and~$\fn{evt}(n_1)=\inbnd t$.  For each reception node~$n_1$, there is-a unique transmission node~$n_0$ with $n_0\rightarrow n_1$.--In a run of a protocol, the behavior of each strand is constrained by-a role in a protocol.  Adversarial strands are constrained by-roles as are non-adversarial strands.-A role is a sequence of message transmission-and reception terms that serves as a template for its strands.  Let-$\alg{A}_{\Sigma,\Gamma}(Y)$ be a $\Sigma,\Gamma$-term algebra-generated by variable set~$Y$.  A \emph{role} is a trace in-$(\pm\alg{A}_{\Sigma,\Gamma}(Y))^+$.  A \emph{protocol} is a set of-roles.--A strand space $(\Theta,\fn{tr})$ \emph{respects protocol}~$P$ if-there is a role mapping $\fn{rl}\colon\Theta\to P$ with the following-properties.  For each strand~$s$, $|\fn{tr}(s)|\leq|\fn{rl}(s)|$, and-there is a $\Sigma$-homomorphism-$\sigma\colon\alg{A}_{\Sigma,\Gamma}(Y)\rightarrow\alg{M}_{\Sigma,\Gamma}(X)$-such that $\sigma(\fn{rl}(s)(p))=\fn{tr}(s)(p)$ for all $0\leq-p<|\fn{tr}(s)|$.  A bundle $\bundle(\Theta,\fn{tr},\to)$ is a-\emph{run of protocol}~$P$ if $(\Theta,\fn{tr})$ respects-protocol~$P$.--In what follows, $\alg{M}_{\Sigma,\Gamma}(X)$ is replaced by term algebra-$\alg{A}_{\Sigma,\Gamma}(Z)$, where $|Z|=|X|$, so that the two-algebras are isomorphic.--Now, on to the refinement of the definitions in this section.  The-next section adds structure to message algebras using a sort system.-Later on, Definition~\ref{def:role} adds information to a role-and Definition~\ref{def:bundle} refines the notion of a run of a-protocol using the additional information.--\section{Messages}\label{sec:messages}--The {\cpsa} program implements a message algebra as an order-sorted term-algebra~\cite{GoguenMeseguer92}.  The signature of one of the-implemented algebras is given in Figure~\ref{fig:bcs}.-Sort~\dom{mesg} is the sort of all messages, the elements of the-algebras in the previous section.--The use of order-sorted algebras is a partial solution to the-following problem.  When a strand receives the-pair~$\cn{pair}(t_0,t_1)$, it can extract both~$t_0$, and~$t_1$.  When-a strand receives the encryption~$\cn{enc}(t_0,t_1)$, it can-extract~$t_0$ if it has the decryption key associated with~$t_1$.  And-if a strand receives the asymmetric key $\cn{invk}(t)$, it can never-extract~$t$.  How does the {\cpsa} program distinguish these cases?-It classifies a term by its sort and the position at which it occurs-within another term.  The sort system used to classify terms is-presented first.--Following~\cite{GoguenMeseguer92}, the set of messages used by {\cpsa}-is specified by an order-sorted signature $(S, \leq, \Sigma)$, where-$(S,\leq)$ is a partially ordered set of sort symbols, and~$\Sigma$ is-an $S^\ast\times S$-sorted family $\{\Sigma_{w,s}\mid w\in S^\ast,-s\in S\}$ of operation (or function) symbols.  The operations satisfy-the following monotonicity condition,-$f\in\Sigma_{w,s}\cap\Sigma_{w',s'}$ and $w\leq w'$ imply $s\leq s'$,-where $w\leq w'$ iff $|w|=|w'|$ and $w(i)\leq w'(i)$ for $i<|w|$.  A-variable set~$X$,\index{variable set} is an $S$-sorted-family~$X=\{X_s\mid s\in S\}$ of disjoint sets of symbols.  No symbol-is both a variable and an operation.  When $S$ and $\leq$ are clear,-we write~$\Sigma$ for $(S,\leq,\Sigma)$.--\begin{defn}[Regular Signature]\index{regular signature}-An order-sorted signature~$\Sigma$ is \emph{regular} iff given-$f\in\Sigma_{w',s'}$ and given $w''\leq w'$ in~$S^\ast$, there is a-least $(w,s)\in S^\ast\times S$ such that $w''\leq w$ and-$f\in\Sigma_{w,s}$.-\end{defn}--\begin{defn}[Order-Sorted Algebra]-Let~$(S,\leq,\Sigma)$ be an order-sorted signature.  Then an-$(S,\leq,\Sigma)$-\emph{algebra}~\alg{A} is a family $\{\alg{A}_s\mid-s\in S\}$ of sets called the \emph{carriers} of~\alg{A}, together with-a function $\alg{A}_f:\alg{A}_w\to\alg{A}_s$ for each-$f\in\Sigma_{w,s}$ where $\alg{A}_w=\alg{A}_{w(0)}\times\cdots\times-\alg{A}_{w(n-1)}$, where $n=|w|$.  Moreover,-\begin{enumerate}-\item $s\leq s'$ in~$S$ implies $\alg{A}_s\subseteq\alg{A}_{s'}$ and-\item $f\in\Sigma_{w,s}\cap\Sigma_{w',s'}$ and $w\leq-  w'$ imply $\alg{A}_f:\alg{A}_{w}\to\alg{A}_{s}$ equals-  $\alg{A}_f:\alg{A}_{w'}\to\alg{A}_{s'}$ on $\alg{A}_{w}$.-\end{enumerate}-\end{defn}--\begin{defn}[Order-Sorted Terms]-The order-sorted $\Sigma$-terms $\terms_\Sigma(X)$ generated by-variable set~$X$ is the least family $\{\terms_{\Sigma,s}(X)\mid-s\in S\}$ such that-\begin{enumerate}-\item $\Sigma_{\seq{},s}\subseteq\terms_{\Sigma,s}(X)$-and $X_s\subseteq\terms_{\Sigma,s}(X)$ for $s\in S$;-\item $\terms_{\Sigma,s'}(X)\subseteq\terms_{\Sigma,s}(X)$-  if $s'\leq s$;-\item if $f\in\Sigma_{w,s}$ and $t_i\in\terms_{\Sigma,w(i)}(X)$-  for $i<|w|$, then $f(t_0,\ldots,t_{|w|-1})\in-  \terms_{\Sigma,s}(X)$.-\end{enumerate}-\end{defn}--In~\cite{GoguenMeseguer92}, it is proved that $\terms_\Sigma(X)$-is an order-sorted algebra and when~$\Sigma$ is regular, each term has-a least sort.--An \emph{equation} is a triple $(X,t,t')$, written $t\approx t'$,-where~$X$ is a variable set and $t,t'$ are in $\terms_\Sigma(X)$ and-have the same least sort.  See~\cite{GoguenMeseguer92} on how to relax-the sort restriction.  The review of order-sorted algebras ends here.--\begin{defn}[Encryption Signature]-A regular order-sorted signature is an \emph{encryption signature} if-it contains a distinguished sort symbol~$\top$, the sort of all-messages, and a binary encryption operation $\cn{enc}$ defined so that-the least sort of every term of the form $\cn{enc}(t_0,t_1)$-is~$\top$.-\end{defn}--\begin{defn}[Strand Space Signature]-A \emph{strand space signature}~$(\Sigma, B)$ is an encryption-signature~$\Sigma$, and a non-empty subset~$B$ of sort symbols-in~$\Sigma$ such that $s\in B$ implies $s<\top$.  Each member of~$B$-is called a \emph{base sort}.  Every operation in~$\Sigma$ with a base-sorted result must have base sorted arguments.-\end{defn}--\begin{defn}[Strand Space Equations]-Equations in~$\Gamma$ for strand space signature $(\Sigma,B)$ are-\emph{strand space equations} if the least sort of the terms that-define each equation in~$\Gamma$ is a base sort in~$B$.-\end{defn}--The unification type\index{unification type} of~$\Gamma$-w.r.t.\ signature~$\Sigma$ is \emph{unitary}\index{unitary unification-  type} if every problem has a minimal complete set of unifiers that-has at most one element~\cite[Chapter~8,-  Section~3.1]{RobinsonVoronkov01}.--\begin{defn}[Strand Space Algebra]\label{def:algebra}-Given strand space signature~$(\Sigma,B)$ and strand space-equations~$\Gamma$, a \emph{strand space-  algebra}~$\alg{A}_{\Sigma,B,\Gamma}(X)$ is the quotient of-$\terms_\Sigma(X)$ by the equivalence relation on $\terms_\Sigma(X)$-derived from the equations in~$\Gamma$, where the unification type-of~$\Gamma$ w.r.t.\ signature~$\Sigma$ is unitary.-\end{defn}--\begin{figure}-\begin{center}-Base sort symbols: \dom{name}, \dom{text}, \dom{data}, \dom{skey},-\dom{akey}\\-Non-base sort symbol: \dom{mesg} (implementation of $\top$) \\[1ex]-Subsorts: \dom{name}, \dom{text}, \dom{data}, \dom{akey},-$\dom{skey}<\dom{mesg}$\\[1ex]-\begin{tabular}{@{}ll}-$\cn{enc}\colon\dom{mesg}\times\dom{mesg}\rightarrow\dom{mesg}$-&Encryption\\-$\cn{pair}\colon\dom{mesg}\times\dom{mesg}\rightarrow\dom{mesg}$-&Pairing\\-$C_i\colon\dom{mesg}$& Tag constants ($i\in\nat$)\\-$\cn{pubk}\colon\dom{name}\rightarrow\dom{akey}$-&Public key of name\\-$\cn{invk}\colon\dom{akey}\rightarrow\dom{akey}$-&Inverse of asymmetric key\\-$\cn{ltk}\colon\dom{name}\times\dom{name}\rightarrow\dom{skey}$-& Long term shared key-\end{tabular}\\[1ex]-Equation: $\cn{invk}(\cn{invk}(x))\approx x$ for $x\colon\dom{akey}$-\end{center}-\caption{Basic Crypto Signature and Equation}\label{fig:bcs}-\end{figure}--\begin{figure}-\begin{center}-\includegraphics{carriers-0.mps}\\-Carrier set of sort \dom{mesg}\\-$X_\top$: variables of sort \dom{mesg}-\caption{Basic Crypto Carrier Sets}-\label{fig:bc carrier sets}-\end{center}-\end{figure}--In the remainder, the strand space signature and equations are fixed,-and its algebras are written as~$\alg{A}(X)$ and as~$\alg{A}$ when the-variable set~$X$ is available from the context, and the term algebras-as $\terms(X)$ and~$\terms$ respectively.  Relation $\equiv$ is the-equivalence relation on~$\terms_\top$ derived from the equations-in~$\Gamma$, and the equivalence class $[t]$ is $\{t'\mid t\equiv-t'\}$.  We assume each equivalence class has a canonical-representative.  At times we conflate a term with the equivalence-class of which it is a member to simplify the presentation.  Given a-sort~$s$, $t\colon s$ asserts that $[t]\in\alg{A}_s$, and $t\colon S$-asserts that for some~$s\in S$,~$t\colon s$.  Term~$t$ is a-\index{message}\emph{message} if $[t]\in\alg{A}_\top$.  Message~$t$ is-an \index{atom}\emph{atom} iff~$t\colon B$.  The message-$\cn{enc}(t_0,t_1)$ is written $\enc{t_0}{t_1}$.--In the Basic Crypto algebra, sort \dom{mesg} implements sort~$\top$,-and all of its other sorts are base sorts.  A term of the form-$\cn{invk}(t)$ is an atom.  Figure~\ref{fig:bc carrier sets} shows the-classification of terms in the Basic Crypto algebra.  In text, we use-comma as a right associative binary operation for pairing and $K_a$-for $\cn{pubk}(a)$, as in the caption of Figure~\ref{fig:term tree}.--\begin{thm}[Encryption Freely Generated]\label{thm:encryption}-Suppose $t,t_0,t_1\in\terms_\top$ and $\enc{t_0}{t_1}\equiv t$.  Then-there exists $t'_0,t'_1$ such that $t=\enc{t'_0}{t'_1}$, $t_0\equiv-t'_0$, and~$t_1\equiv t'_1$.-\end{thm}-\begin{proof}-Consider $\terms^0_\top(X)\subseteq \terms_\top(X)$, where-$\terms^0_\top(X)=\Sigma_{\seq{},\top}\cup X_\top\cup\bigcup_{s\in-  B}\terms_s(X)$.  Observe that the encryption operation does not-occur in $\terms^0_\top(X)$ and that $\terms^0_\top(X)$ freely-generates $\terms_\top(X)$. Thus $\alg{A}^0_\top(X)=\{[t]\mid t\in-\terms^0_\top(X)\}$ freely generates $\alg{A}_\top(X)$.  No equation-applies to messages in $\alg{A}_\top(X)\setminus\alg{A}^0_\top(X)$ and-so induction on term formation gives the result.-\end{proof}--Figure~\ref{fig:bc carrier sets} shows the carrier sets for the Basic-Crypto Algebra.--\begin{defn}[Position]\label{defn:position}-A \emph{position}~$p$ is a finite sequence of natural numbers.  The-term in~$t$ that \emph{occurs at}~$p$, written~$t\termat p$, is:-$$\begin{array}{l}-t\termat\seq{}=t;\\-f(t_0,\ldots,t_{|w|-1})\termat\seq{i}\append p=-t_i\termat p\mbox{ if }f\in\Sigma_{w,s}\mbox{ and }i<|w|.-\end{array}$$-A term~$t$ \emph{occurs in} $t'\in\terms_\top(X)$ if $t=t'\termat p$-for some~$p$.  A message~$t$ \emph{occurs in} $t'\in\alg{A}_\top(X)$-if the canonical representative of~$t$ occurs in the canonical-representative of~$t'$.-\end{defn}--Some positions within a message are distinguished.  A position~$p$-\emph{traverses a key edge} in~$t$ if $t\termat p_0=\enc{t_0}{t_1}$-and $p=p_0\append\seq{1}\append p_1$.  A position~$p$ \emph{traverses-  an atom edge} in~$t$ if $t\termat p_0=f(t_0,\ldots,t_{|w|-1})$ is an-atom and $p=p_0\append\seq{i}\append p_1$, where $f\in\Sigma_{w,s}$-and $i<|w|$.  A position is a \emph{carried position}\index{carried-  position} in~$t$ if it traverses no key or atom edge in~$t$.  In-Figure~\ref{fig:term tree}, variable~$x$ occurs at two carried-positions, but~$a$ occurs at no carried positions.--\begin{figure}-\begin{center}-\includegraphics{termtree-0.mps}-\end{center}-\vspace{-2ex}-\caption{Tree for $\enc{x}{K_a},\enc{\enc{x}{K_a}}{K_b}$}\label{fig:term tree}-\end{figure}--The concept of an accessible term is used in Definition~\ref{def:used}.--\begin{defn}[Accessible]\label{def:accessible}-Message~$t_0$ is \emph{accessible in}~$t_1$, written~$t_0\ll t_1$,-if~$t_0$ occurs at a position in~$t_1$ that traverses no atom edge.-\end{defn}--A carried term is one that can be extracted from a message reception-given the right set of decryption keys.--\begin{defn}[Carries]\label{def:carries}-Message~$t_0$ \emph{carries}~$t_1$, written~$t_1\sqsubseteq t_0$,-if~$t_1$ occurs at a carried position in~$t_0$.-\end{defn}--Carried positions respect equality modulo the equations.--\begin{defn}[Carried Positions]-\label{def:carried positions}-\index{carried positions}-Given a term~$t$, the set of positions at which~$t'$ carries~$t$ is-$\fn{carpos}(t,t')$, where-$$\fn{carpos}(t,t')=\left\{-\begin{array}{ll}-\{\seq{}\}&\mbox{if $t'\equiv t$, else}\\-\multicolumn{2}{l}{\{\seq{0}\append p \mid-p\in\fn{carpos}(t,t_0)\}}\\-& \mbox{if $t'=\enc{t_0}{t_1}$, else}\\-\multicolumn{2}{l}{\{\seq{i}\append p \mid-p\in\fn{carpos}(t,t_i),i<n\}} \\-& \mbox{if $t'=f(t_0,\ldots,t_{n-1})$ and}\\-&\mbox{$t'$ is not an atom, else}\\-\{\}&\mbox{otherwise.}-\end{array}\right.$$-\end{defn}-Note that $\fn{carpos}(x,\cn{invk}(\cn{invk}(x)))=\{\seq{}\}$, not-$\{\seq{}, \seq{0,0}\}$, and~$t'$ carries~$t$ iff $\fn{carpos}(t,t')$-is non-empty.--\begin{thm}\label{thm:carpos}-For all $t_0,t_1,t'_0,t'_1\in\terms_\top(X)$, $t_0\equiv t_1$ and-$t'_0\equiv t'_1$ implies $\fn{carpos}(t_0,t'_0)=-\fn{carpos}(t_1,t'_1)$.-\end{thm}--\begin{proof}-When $t'_0$ and $t'_1$ are atoms, the result is obvious.  Otherwise,-Theorem~\ref{thm:encryption} applies.-\end{proof}--The key insight discovered while implementing strand space algebras is-that ordinary order-sorted algebras with restricted signatures,-coupled with the \fn{carpos} function, captures the essence of strand-space algebras required to implement the {\cpsa} algorithm.-Section~\ref{sec:cow} will explain why the details of the \fn{carpos}-function are important, and why an implementation of the carries-relation does not suffice.--\begin{defn}[Strand Space with Asymmetric Encryption]-A strand space algebra $\alg{A}_{\Sigma,B,\Gamma}(X)$ with asymmetric-encryption has a signature with a distinguished base sort-symbol~$\cn{akey}$, an-operation~$\cn{invk}\colon\cn{akey}\to\cn{akey}$, and~$\Gamma$-contains the equation $\cn{invk}(\cn{invk}(x))\approx x$ for-$x\colon\dom{akey}$.-\end{defn}--\begin{defn}[Inverse Key]-For a strand space with asymmetric encryption, the decryption key of-encryption~$\enc{t_0}{t_1}$ is~$\fn{inv}(t_1)$, where-$$\fn{inv}(t) =\left\{-\begin{array}{ll}-\cn{invk}(t)&\mbox{if $t\colon\dom{akey}$;}\\-\mbox{undefined}&\mbox{if $t$ is a variable of sort $\top$;}\\-t&\mbox{otherwise.}-\end{array}\right.$$-\end{defn}--\index{substitutions} Both unification and matching are used to solve-equations.  First, a few more definitions from~\cite{GoguenMeseguer92}-and~\cite{RobinsonVoronkov01}.  Given two $S$-sorted variable sets~$X$-and~$Y$, an \emph{order-sorted substitution} is an $S$-sorted-map~$\sigma\colon X\rightarrow\alg{A}(Y)$ such that $\sigma(x)\neq x$-for only finite many elements of~$X$.  For a substitution~$\sigma$,-the \index{domain of substitution}\emph{domain} is the set of-variables $\fn{Dom}(\sigma)=\{x\mid \sigma(x)\neq x\}$ and the-\index{range of substitution}\emph{range} is the set of terms-$\fn{Ran}(\sigma)=\{\sigma(x)\mid x\in\fn{Dom}(\sigma)\}$.-Substitution~$\sigma_0$ is \index{more general substitution}\emph{more-  general than}~$\sigma_1$, written~$\sigma_0\unlhd\sigma_1$, if there-exists a substitution~$\sigma_2$ such that-$\sigma_1(x)\equiv\sigma_2(\sigma_0(x))$ for $x\in X$, the variable-set that generates the term algebra.  It is possible to have-$\sigma_0\unlhd\sigma_1$ and $\sigma_1\unlhd\sigma_0$.  In this case,-$\sigma_1=\sigma_2\circ\sigma_0$ and $\sigma_0=\sigma_2'\circ-\sigma_0$ where $\sigma_2$ and~$\sigma_2'$ are renamings.  That is,-$Dom(\sigma_2)=Ran(\sigma_2)$ and likewise for~$\sigma_2'$.  In this-case we say that $\sigma_0$ and $\sigma_1$ are renamings of each-other.  Given an $S$-sorted map~$\varphi\colon-X\rightarrow\alg{A}(Y)$, the unique order-sorted-$\Sigma$-homomorphism\index{homomorphism!order-sorted}-$\varphi^\ast\colon\alg{A}(X)\rightarrow\alg{A}(Y)$ induced-by~$\varphi$ is also denoted~$\varphi$.--The algorithms used to solve unification and matching problems-typically solve many equations at once.  To facilitate this-requirement, algebras provide functions with the following signatures.-\index{unify}\index{match}-$$\begin{array}{l}-\fn{unify}\colon-\mathcal{T}_\top(X)\times\mathcal{T}_\top(X)\times-(X\rightarrow\mathcal{T}_\top(X))\rightarrow-(X\rightarrow\mathcal{T}_\top(X))^\ast\\-\fn{match}\colon-\mathcal{T}_\top(X)\times\mathcal{T}_\top(Y)\times-(X\rightarrow\mathcal{T}_\top(Y))\rightarrow-(X\rightarrow\mathcal{T}_\top(Y))^\ast-\end{array}$$--Suppose $\sigma_0$ has the property that $\sigma_0(t_i)\equiv-\sigma_0(t_i')$ for~$i < n$.  Then $\sigma_1(t_i)\equiv \sigma_1(t_i')$-for~$i \leq n$ if $\sigma_1\in\fn{unify}(t_n,t'_n,\sigma_0)$.  The-$\fn{unify}$ function has this property:-$$\fn{unify}(t_0,t_1,\sigma_0)=\{\comp{\sigma_1}{\sigma_0}\mid-\sigma_1\in\fn{unify}(\sigma_0(t_0),\sigma_0(t_1),\idsigma)\},$$-where~$\idsigma$ is the identity substitution.  Furthermore, it must-produce a minimal complete set of unifiers.--\begin{lem}[Order of Unification]\label{lem:unification}-Suppose that the underlying message algebra has single most general unifiers-for any two unifiable terms.  Suppose also that-$\fn{unify}(t_0,t_1,\idsigma)=\{\sigma_0\}$ and that-$\fn{unify}(s_0,s_1,\idsigma)=\{\sigma_1\}$.  Then-$\fn{unify}(s_0,s_1,\sigma_0)\cong \fn{unify}(t_0,t_1,\sigma_1)$.-That is, when one side exists so does the other, and the two-substitutions will be renamings of each other.-\end{lem}--A proof of this result can be found for example in~\cite{BaaderNipkow98}.-By a simple induction, given any system of equations,-$E=\{t_1\eqq t_1',\ldots,t_n\eqq t_n'\}$, we may solve them in-any order and we will end up with the same substitution (up to-renaming).--This justifies more general definitions that will be used later.-Let $A_0$ be a set of terms which you would like to jointly unify.-That is, $A_0$ represents the equations $\{t_i\eqq t_j\mid t_i,t_j\in A_0\}$.-Then we may define-$\fn{Unif}(A_0,\sigma)=\fn{unify}(t_{n-1},t_n,\fn{unify}(\dots ,\fn{unify}(t_0,t_1,\sigma)\dots)).$-By Lemma~\ref{lem:unification} this definition does not depend on the order-of the terms $t_0,\dots,t_n$.  The result will be the same up to renaming-for any ordering of the terms.-It then follows by further induction that-$\fn{Unif}(A_1,\fn{Unif}(A_0,\sigma))\cong \fn{Unif}(A_0,\fn{Unif}(A_1,\sigma))$.-This justifies the more general definition-$$U(A_0,\dots,A_n;\sigma)=\fn{Unif}(A_n,\fn{Unif}(\dots ,\fn{Unif}(A_0,\sigma)\dots)).$$-Again we could have defined it in terms of any order of the-sets $A_0,\dots,A_n$.  The result might be a different substitution-but it would be a renaming of the one defined.--\iffalse-When solving a system of equations $E=\{t_1\eqq t_1',\ldots,t_n\eqq-t_n'\}$, we rely on the fact that the order is which the equations are-solved is irrelevant in the following sense.  Let $\mcsu(E)$ be a-minimal complete set of unifiers that solves~$E$,-i.e.\ $\sigma\in\mcsu(E)$ and $t\eqq t'\in E$ implies $\sigma(t)\equiv-\sigma(t')$.  Let $E=E_0\uplus E_1$ be a partition of~$E$, and-let~$S=\{\sigma_1\circ\sigma_0\mid\sigma_0\in\mcsu(E_0)\land-\sigma_1\in\mcsu(\sigma_0(E_1))\}$.  Then~$S$ is a complete set of-unifiers that solve~$E$.-\fi--\subsection*{Discussion}--The message algebra that appears in strand space-papers~\cite{ThayerEtal99,GuttmanThayer02} was not implemented because-there is no syntactic method that can be used to determine if an-encryption denotes symmetric or asymmetric encryption.  The signature-in Figure~\ref{fig:bcs} resolves this problem.--The OSA conjecture of this paper is that the results in every strand-space paper would remain unchanged if it used algebras from-Definition~\ref{def:algebra} as long as unification in the algebra-produces at most one most general unifier.  Notice there is no-prohibition on constants being atoms in the definition of a strand-space algebra in this paper, in contrast with the algebras defined in-other papers.--Some strand space papers defined the word occurs to mean carried by.-This document uses it to assert a message is within another message.--\section{Data Structures}\label{sec:data structures}--The data structures used in the implementation are modeled as elements-in an order-sorted term algebra.  The signature for the algebra is the-extension of a strand space signature shown in-Table~\ref{tab:strands}.  In this specification, it is assumed the-strand space signature uses the sort symbol \dom{mesg} to implement-sort~$\top$.--\begin{table}-\begin{center}-Additional sort symbols: \dom{atom}, \dom{evt}, \dom{role}, \dom{maplet},\\-\dom{instance}, \dom{node}, \dom{ordering}, and \dom{preskel} \\[1ex]-Subsorts: for each $s\in B, s\leq\dom{atom} < \dom{mesg}$\\[1ex]-$\begin{array}{rl}-\outbnd\colon\dom{mesg}\rightarrow\dom{evt}\hspace{2\arraycolsep}-\inbnd\colon\dom{mesg}\rightarrow\dom{evt}&-\cn{r}\colon\dom{evt}\dom{list}\times\dom{atom}\dom{set}\times-\dom{atom}\dom{set}\rightarrow\dom{role}\\-\cn{m}\colon\dom{mesg}\times\dom{mesg}\rightarrow\dom{maplet}&-\cn{i}\colon\dom{role}\times\dom{nat}\times\dom{maplet}\dom{set}-\rightarrow\dom{instance}\\-\cn{n}\colon\dom{nat}\times\dom{nat}\rightarrow\dom{node}-&\cn{o}\colon\dom{node}\times\dom{node}\rightarrow\dom{ordering}-\end{array}$\\-$\cn{k}\colon\dom{role}\dom{set}\times-\dom{instance}\dom{list}\times-\dom{ordering}\dom{set}\times\dom{atom}\dom{set}\times-\dom{atom}\dom{set}\rightarrow\dom{preskel}$\\[1ex]-\begin{tabular}{rl}-\dom{mesg}& the sort of all messages (implementation of $\top$)\\-\dom{atom}& the sort of all base sorted messages\\-\dom{evt}& a transmission or reception event\\-\dom{trace}& a sequence of events used in a role\\-\dom{role}& a trace, a non-originating set, and a uniquely-originating-set\\-\dom{protocol}& a set of roles\\-\dom{nat}& a natural number\\-\dom{maplet}& a map from a role variable to a preskeleton term\\-\dom{instance}& a strand's trace and inheritance as instantiated from a role\\-\dom{node}& a pair of numbers, a strand identifier and a strand position\\-\dom{ordering}&a causal ordering between a pair of nodes\\-\dom{preskel}& a preskeleton-\end{tabular}-\end{center}-\caption{{\cpsa} Signature}\label{tab:strands}-\end{table}--Every element of the sort \dom{atom} is intended to be an element of-some base sort.  Furthermore, elements of the other sorts added by a-{\cpsa} signature correctly model an implementation when there are no-variables of those sorts.  As a result, the algebras that model an-implementation are {\cpsa} algebras.--\begin{defn}[{\cpsa} Algebra]\label{def:cpsa algebra}-\index{CPSA@{\cpsa} algebra} Consider the class of-$\Sigma,\Gamma$-algebras, algebras over {\cpsa} signature~$\Sigma$-that satisfy equations~$\Gamma$.  Algebra~$\alg{C}(X)$ is a-\emph{{\cpsa} algebra} if it is a free $\Sigma,\Gamma$-algebra-generated by variable set~$X$, and the variable set~$X$ has the-following property.  For sort~$s$, $X_s$ is empty when~$s$ is-\dom{atom}, \dom{evt}, \dom{role}, \dom{maplet}, \dom{instance},-\dom{node}, \dom{ordering}, and \dom{preskel}.-\end{defn}--Section~\ref{sec:protocols} on protocols defines events (\dom{evt}),-traces (\dom{env} \dom{list}), and roles (\dom{role}).-Section~\ref{sec:executions} on executions defines instances-(\dom{instance}) and role substitutions (\dom{maplet} \dom{set}).-Section~\ref{sec:skeletons} on skeletons defines, nodes (\dom{node}),-node orderings (\dom{ordering} \dom{set}), and preskeletons-(\dom{preskel}).--\section{Algorithms as Term Reduction Systems}\label{sec:algorithms}--Algorithms in this paper are specified as abstract-reduction systems~\cite[Chapter~2]{BaaderNipkow98}.  A reduction-system is a pair $(A,\to)$, where reduction~$\to$ is a binary relation-$\mathord{\to}\subseteq A\times A$.  Element $x\in A$ is a-\emph{normal form} if there is no~$y$ such that $x\to y$.  The-transitive closure of~$\to$ is~$\to^+$.  The reflexive transitive-closure of~$\to$ is~$\to^\ast$.  A reduction is confluent if-$x\to^\ast y_0$ and $x\to^\ast y_1$ implies there is a~$z$ such that-$y_0\to^\ast z$ and $y_1\to^\ast z$.  A reduction is terminating if-there are no infinite descending chains.  A reduction is convergent if-it is confluent and terminating.--Let $\alg{K}$ be $\alg{A}_{\dom{preskel}}(X)$.  Algorithms are-specified as reduction systems of the form $(\alg{K},\to)$, which are-then used to specify a related setwise reduction system of the form-$(\pow{\alg{K}},\mathord\twoheadrightarrow)$.  Setwise reduction-systems are the ones with the interesting normal forms and confluence-properties.  In a setwise reduction system, reduction rewrites one-element of a set to a set of elements.--\begin{defn}[Setwise Reduction System]-The \emph{setwise reduction system} of binary relation-$\rightsquigarrow\subseteq\alg{K}\times\pow{\alg{K}}$ is a reduction-system $(\pow{\alg{K}},\twoheadrightarrow)$, where for each-$K_0\in\pow{\alg{K}}$, $K_0\twoheadrightarrow K_1$ if for some $k_0\in-K_0$, $k_0\rightsquigarrow K_2$, $K_1=K_2\cup (K_0\setminus\{k_0\})$,-and $K_1\neq K_0$.-\end{defn}--The {\cpsa} algorithm will be specified as a setwise term reduction-system, where the initial problem is given a singleton-in~$\pow{\alg{K}}$, and the answers computed by an implementation of-the algorithm are a normal form of the setwise reduction-relation~$\twoheadrightarrow_k$ defined in Section~\ref{sec:skeleton-  reduction}.--In what follows the relation $k\rightsquigarrow K$ is defined in terms-of $\to\subseteq\alg{K}\times\alg{K}$ by specifying-$\{k\}\twoheadrightarrow K$ using~$\to$, so the $\rightsquigarrow$-relation is not explicitly defined.--We regard sets of preskeletons as factored by isomorphism, where each-set has at most one representative of the equivalence class of-isomorphic preskeletons.  The definition of isomorphic preskeletons-is given in Definition~\ref{def:homomorphism}.--\section{Protocols}\label{sec:protocols}--A protocol defines the patterns of allowed behavior for each-participant in an execution of the protocol.  Protocol participants-send and receive messages.--\begin{defn}[Event]-An \emph{event} is either a message transmission or a reception.-Formally, an event is a pair~$(d,t)$ with $t\in\alg{A}_{\top}$ and~$d$-one of the symbols~$\outbnd$ or~$\inbnd$.  A positive-message~$\outbnd t$ is \index{outbound}\emph{outbound}, and a negative-message~$\inbnd t$ is \index{inbound}\emph{inbound.}-\end{defn}--In a {\cpsa} algebra, an event is a term of sort \dom{evt}.--\begin{defn}[Trace]-A \emph{trace} is a non-empty sequence of events, an-element of $(\pm\alg{A}_{\top})^+$-\end{defn}--In a {\cpsa} algebra, a trace is a term of sort \dom{evt} \dom{list}.--\begin{defn}[Originates]\index{originates}-A message \emph{originates} in a trace if it is carried by some-event and the first event in which it is carried is outbound.-\end{defn}--\begin{defn}[Gained]\index{gained}-A message is \emph{gained} in a trace if it is carried by some-event and the first event in which it is carried is outbound.-\end{defn}--\begin{defn}[Acquired]\index{acquired}-A message is \emph{acquired} by a trace if it first occurs in an-inbound message and is also carried by that message.-\end{defn}--The next definition describes syntactic constraints on-``uniquely-originating'' and ``non-originating'' atoms.  The meaning-of these adjectives is not revealed until Definition~\ref{def:bundle}.--\begin{defn}[Role]\label{def:role}-A \emph{role}~$r$ consists of a trace~$\fn{rtrace}(r)$, a set of-non-originating atoms~$\fn{rnon}(r)$, and a set of uniquely-originating atoms~$\fn{runique}(r)$.  The variable set~$\fn{rvar}(r)$-of the role is the set of variables that occur in~$\fn{rtrace}(r)$.-The following properties hold.-\begin{enumerate}-\item Each uniquely originating atom originates in the trace.-\item Each non-originating atom is not carried by any event in the-  trace, and each variable that occurs in the atom occurs in the-  trace.-\item Every non-base sorted variable is acquired by the trace.\index{acquired}-\end{enumerate}-\end{defn}--In a {\cpsa} algebra, a role is a term of the form~$\cn{r}(C,N,U)$,-where-$$\begin{array}{r@{}c@{}l}-\fn{rtrace}(\cn{r}(C,N,U))&{}={}&C,\\-\fn{rnon}(\cn{r}(C,N,U))&{}={}&N,\\-\fn{runique}(\cn{r}(C,N,U))&{}={}&U.-\end{array}$$--\begin{defn}[Protocol]-A \emph{protocol} is a set of roles with pairwise disjoint variable sets.-\end{defn}--\subsection*{Discussion}--The refinement of strand space protocols is mostly just a change in-representation for the same information.  The change is motivated by-the way protocols are used.  In this refinement, a protocol is defined-without reference to the concept of a strand, a node, or a strand-space.--In~\cite{DoghmiGuttmanThayer07}, a protocol is a triple-$(\Pi,\fn{strand\_non},\fn{strand\_unique})$, where~$\Pi$ is a finite-set of strands, \fn{strand\_non} and \fn{strand\_unique} map a strand-to a set of atoms, and the mappings have properties analogous to the-ones in the Definition~\ref{def:role}, the definition of a role.  The-set of roles is $\{r\mid s\in\Pi, \fn{rtrace}(r)=\fn{tr}(s),-\fn{runique}(r)=\fn{strand\_unique}(s), \fn{rnon}(r)=-\fn{strand\_non}(s)\}$.--In~\cite{DoghmiGuttmanThayer07}, non-originating messages were assumed-to be keys of the form~$K$ or~$K^{-1}$, thereby excluding long term-shared symmetric keys of the form $\cn{ltk}(A,B)$.  The definition of-role allows symmetric keys to be assumed to be non-originating.--\section{Executions}\label{sec:executions}--Executions of a protocol are formalized by a bundle, which is-described in this section.  A key difference in this approach to-formalizing strand spaces is that the parameters used to instantiate a-strand's trace from a role are preserved, so as to support role-origination assumptions.--\begin{defn}[Instance]-An \emph{instance}~$i$ consists of a role $\fn{role}(i)$, a positive-number $\fn{height}(i)$, and an order-sorted substitution-$\fn{subst}(i)$.  Let~$r$,~$h$, and~$\sigma$ be the role, height, and-substitution for a given instance~$i$.  Let $\prefix{C}{h}$ be the prefix of-sequence~$C$ of length~$h$.  The following properties hold.-\begin{enumerate}-\item The height of an instance cannot exceed the length of it's-  role's trace.-\item $\fn{Dom}(\sigma)$ is the set of variables that occur in-  $\prefix{\fn{rtrace}(r)}{h}$.-\item No variable in an instance's role may occur in-  $\fn{Ran}(\sigma)$.-\end{enumerate}-\end{defn}--In a {\cpsa} algebra, an instance is a term of the form~$\cn{i}(r,h,M)$-where-$$\begin{array}{r@{}c@{}l}-\fn{role}(\cn{i}(r,h,M))&{}={}&r,\\-\fn{height}(\cn{i}(r,h,M))&{}={}&h,\\-\fn{subst}(\cn{i}(r,h,M))&{}={}&\sigma-\end{array}$$-and $\sigma(x)=y$ for each $\cn{m}(x,y)\in M$.--\begin{defn}[Trace of Instance]-The trace of an instance~$i$, $\fn{trace}(i)$, is a sequence of-length $\fn{height}(i)$ such that for $\sigma=\fn{subst}(i)$ and all-$j<\fn{height}(i)$,-$\fn{trace}(i)(j)=\sigma(\fn{rtrace}(\fn{role}(i))(j))$.-\end{defn}--For every instance~$i$, the definitions imply that the set of-variables that occur in $\fn{trace}(i)$ is a subset of the set of-variables that occur in $\fn{Ran}(\fn{subst}(i))$.  A Diffie-Hellman-algebra provides an example in which the subset relation is proper.--\begin{defn}[Instance Origination Assumptions]-Let $\sigma=\fn{subst}(i)$ for an instance~$i$, $r=\fn{role}(i)$, and-$h=\fn{height}(i)$.  Instance~$i$ inherits the non-origination-assumption~$\sigma(t)$ if~$t\in\fn{rnon}(r)$, and the variables in~$t$-are in $\fn{Dom}(\sigma)$.  Instance~$i$ inherits the unique-origination assumption~$\sigma(t)$ if~$t\in\fn{runique}(r)$, and $t$-originates in $\prefix{\fn{rtrace}(r)}{h}$.-\end{defn}--\begin{defn}[Strand Space~\protect{\cite[Definition~2.2]{ThayerEtal99}}]-A \emph{strand space} over algebra~$\alg{A}_{\top}$ is a set~$\Theta$-together with a trace mapping $\fn{tr}\colon\Theta\to-(\pm\alg{A}_{\top})^+$.-\end{defn}--In this document, a strand set~$\Theta$ is an initial segment of the-natural numbers, so a trace mapping is a sequence.  Thus a strand-space is the trace sequence $\fn{tr}:((\pm\alg{A}_{\top})^+)^+$, and-its strand set is the domain of $\fn{tr}$.--A finite sequence of instances~$I$ is a \emph{protocol respecting-  strand space}.  The strand space of~$I$ is $\fn{tr}=\fn{trace}\circ-I$.  By construction, the trace of each strand is an instance of a-role.--The variable set $\fn{var}(I)$ is the set of variables that occur in-the range of the substitution of its instances.  In what follows,-definitions are simplified by assuming the variable set associated-with an instance sequence is disjoint from the set of variables that-occur in its roles.--\begin{defn}[Strand Space Nodes]-The set of \emph{nodes} of~$I$ is $\fn{nodes}(I)=\{(s,p)\mid s<|I|,-p<\fn{height}(I(s))\}$.  The event at a given node is-$\fn{evt}(I,(s,p))=\fn{trace}(I(s))(p)$.  A node is \emph{transmitting}-if its event is outbound, otherwise it is \emph{receiving}.-The message at a node is written $\fn{msg}(I,n)$.-\end{defn}--\begin{defn}[Strand Succession]-The \emph{strand succession relation}~$\Rightarrow$ is-$\{(s,p)\Rightarrow(s,p+1)\mid s<|I|, p<\fn{height}(I(s))-1\}$.-\end{defn}--\begin{defn}[Bundle]\label{def:bundle}-A \emph{protocol respecting bundle} $\bundle(I,\to)$ is a directed-acyclic graph, where the vertices are the nodes of~$I$, and an edge-represents communication~($\rightarrow$) or strand-succession~($\Rightarrow$).  For communication, $n_0\rightarrow n_1$-only if there is a message~$t$ such that~$\fn{evt}(I,n_0)=\outbnd t$-and~$\fn{evt}(I,n_1)=\inbnd t$.  For each reception node~$n_1$, there-is a unique transmission node~$n_0$ with $n_0\rightarrow n_1$.-Finally, each inherited uniquely originating atom originates on its-trace and on no other, and no event in a trace carries an inherited-non-originating atom.-\end{defn}--Notice that no non-base sorted variables may occur in the trace of an-instance in a bundle.--\begin{defn}[Causal Order]-Each acyclic graph has a transitive asymmetric relation~$\prec$ on its-vertices.  The relation specifies the causal ordering of nodes in a-bundle.  Relation~$R$ on set~$S$ is \index{asymmetric-  relation}\emph{asymmetric} iff $x\mathbin{R}y$ implies not-$y\mathbin{R}x$ for all distinct $x,y \in S$.-\end{defn}--\begin{defn}[Unique Origination]-An atom uniquely originates in a execution if it originates on exactly-one trace.-\end{defn}--\begin{defn}[Non-Originating]-An atom is non-originating in an execution if the atom originates in-no trace, but each of its variables occurs in some trace.-\end{defn}--\subsection*{Discussion}--Strand space papers use the word positive to describe an outbound-message or a transmitting node, and the word negative to describe an-inbound message or a receiving node.  The adjectives used in this-paper were selected because they are mnemonic.--\section{Skeletons}\label{sec:skeletons}--Strands in executions represent both adversarial and non-adversarial-behaviors.  A strand that represents adversarial behavior is called a-\index{penetrator strand}\emph{penetrator} strand.  The roles-available to a penetrator are determined by the message signature.-For the Basic Crypto Signature in Figure~\ref{fig:bcs}, the traces of-the roles are in Figure~\ref{fig:pen}.  Penetrator roles make no-origination assumptions.--\begin{figure}-$$\begin{array}{l}-\fn{base}(t)=\seq{\outbnd t},\mbox{ where $t$ is an atom}\\-\fn{tag}(t)=\seq{\outbnd t},\mbox{ where $t$ is a tag}\\-\fn{cat}(t_0,t_1)=\seq{\inbnd t_0,\inbnd t_1, \outbnd(t_0,-  t_1)}\\-\fn{sep}(t_0,t_1)=\seq{\inbnd(t_0, t_1),\outbnd-    t_0,\outbnd t_1}\\-\fn{enc}(t_0,t_1)=\seq{\inbnd t_0,\inbnd t_1,-\outbnd\enc{t_0}{t_1}}\\-\fn{dec}(t_0,t_1)=\seq{\inbnd\enc{t_0}{t_1},-\inbnd t_2,\outbnd t_0},\mbox{ where $t_2=\fn{inv}(t_1)$}-\end{array}$$-\caption{Penetrator Traces}\label{fig:pen}-\end{figure}--A non-adversarial strand is called \index{regular strand}-\emph{regular}.  A typical protocol contains a small finite-set of roles used by regular strand.  In addition, a regular strand-may be an instance of a listener role.  For a given message~$t$, a-listener's trace is~$\seq{\inbnd t,\outbnd t}$.  A listener strand is-used to assert that a message is not a secret and is available from-the penetrator.\index{listener strand}--The {\cpsa} program uses a skeleton to represent the regular behavior-that might make up part of an execution.--\begin{defn}[Preskeleton]-A \emph{preskeleton}~$k$ consists of instance sequence-$\fn{insts}(k)$, a transitive asymmetric node ordering~$\kprec{k}$, a-set of uniquely originating atoms $\fn{unique}(k)$, and a set of-non-originating atoms $\fn{non}(k)$.  The following properties hold.-\begin{enumerate}-\item The relation~$\kprec{k}$ includes strand succession~($\Rightarrow$).-\item Each atom in $\fn{unique}(k)$ is carried in the trace of some-  instance in $\fn{insts}(k)$.-\item Every inherited unique origination assumption is in-  $\fn{unique}(k)$, each inherited atom originates on the-  inheriting strand, and the origination position of the inherited-  atom is the same as the origination position of the inherited atom-  in the strand's trace.-\item Each atom in $\fn{non}(k)$ is not carried by an event in the-  trace of some instance in $\fn{insts}(k)$, and each of-  variable that occurs in the atom occurs in some trace.-\item Every inherited non-origination assumption is in $\fn{non}(k)$.-\end{enumerate}-\end{defn}--The set $\alg{K}(X)$ is the set of preskeletons~$k$ such that-$\fn{var}(\fn{insts}(k))\subseteq X$, written~$\alg{K}$ when the-variable set~$X$ is available from the context.  To simplify notation,-let $\fn{ht}(k,s)=\fn{height}(\fn{inst}(k)(s))$.--In a {\cpsa} algebra, a preskeleton is a term of the-form~$\cn{k}(P,I,O,N,U)$ where-$$\begin{array}{r@{}c@{}l}-\fn{insts}(\cn{k}(P,I,O,N,U))&{}={}&I,\\-\fn{non}(\cn{k}(P,I,O,N,U))&{}={}&N,\\-\fn{unique}(\cn{k}(P,I,O,N,U))&{}={}&U.-\end{array}$$-The implementation of a preskeleton keeps track of its protocol as a-set of roles, $P$, but we ignore the protocol here as well as the fact-in a well formed preskeleton, the role of every instance is an element-of~$P$.  The implementation of a preskeleton node ordering is not so-obvious.  For preskeleton~$k$, only a subset of~$\kprec{k}$ is-explicit: $\cn{o}(n_0,n_1)\in O$ if $n_0\kprec{k}n_1$,~$n_0$ and~$n_1$-are on different strands,~$n_0$ is transmitting, and~$n_1$ is-receiving.--To ease the task of isomorphism testing (Section~\ref{sec:preskeleton-  reduction}) and generalization by weakening-(Section~\ref{generalization}), the implementations normalizes a-preskeleton by performing the transitive reduction on~$O$.  The-transitive reduction of a relation is the minimal relation such that-both have the same transitive closure.--\begin{defn}[Hulled Preskeleton]-A preskeleton~$k$ is a \emph{hulled preskeleton} if each atom in-$\fn{unique}(k)$ originates in at most one trace.-\end{defn}--Let $\orig(k,t)$ be the set of nodes at which~$t$ originates in~$k$,-and~$\gain(k,t)$ be the set of nodes at which~$t$ is gained-in~$k$.\index{gained}--\begin{defn}[Skeleton]-A preskeleton~$k$ is a \emph{skeleton} if each atom in-$\fn{unique}(k)$ originates in at most one trace, and the node of-origination precedes each node that gains the atom, i.e.\@ for-every~$t\in\fn{unique}(k)$, $n_0\in\orig(k,t)$ and $n_1\in\gain(k,t)$-implies~$n_0\kprec{k}n_1$.-\end{defn}--\begin{defn}[Preskeleton Homomorphism]\label{def:homomorphism}-\index{homomorphism!preskeleton}-There is a \emph{preskeleton homomorphism} from~$k_0$ to~$k_1$,-written~$k_0\homomorphism{\phi,\sigma}k_1$, if~$\phi$ and~$\sigma$ are-structure-preserving maps with the following properties:-\begin{enumerate}-\item $\phi$ maps strands of~$k_0$ into those of~$k_1$, and nodes as-$\phi((s,p))=(\phi(s),p)$;-\item $\sigma$ is a $\Sigma$-homo\-morph\-ism;-\item $n\in\fn{nodes}(k_0)$ implies $\sigma(\fn{evt}(\fn{insts}(k_0),n))\equiv-  \fn{evt}(\fn{insts}(k_1),\phi(n))$;-\item $n_0\kprec{k_0}n_1$ implies $\phi(n_0)\kprec{k_1}\phi(n_1)$;-\item $\sigma(\fn{non}(k_0)) \subseteq \fn{non}(k_1)$;-\item $\sigma(\fn{unique}(k_0)) \subseteq \fn{unique}(k_1)$;-\item\label{enu:orig} $t\in \fn{unique}(k_0)$ implies-  $\phi(\orig(k_0,t))\subseteq\orig(k_1,\sigma(t))$.-\end{enumerate}-A homomorphism is \index{homomorphism!strandwise injective}\emph{strandwise-  injective} if its strand map is injective.  Two preskeletons are-isomorphic if they are related by strandwise injective homomorphism in-both directions.-\end{defn}--Condition~\ref{enu:orig} ensures that if $t\in unique(k_0)$ originates-at $(s,p)$ then when we apply $\sigma$ to the strand $s$, $\sigma(t)$-neither originates nor is gained at $(\phi(s),j)$ for $j<p$-($\sigma(t)$ can never originate or be gained later).  In other words,-$\sigma$ alone will either satisfy or violate the last clause.--\begin{defn}[Homomorphism Composition]\label{def:composition}-Let $k_0\homomorphism{\psi_0}k_1\homomorphism{\psi_1}k_2$ where-$\psi_0 = (\phi_0,\sigma_0)$ and $\psi_1=(\phi_1,\sigma_1).$  Then the-composition  of $\psi_0$ and $\psi_1$ is defined as-$\psi_1\circ\psi_0 = (\phi_1\circ\phi_0,\sigma_1\circ\sigma_0)$-where $k_0\homomorphism{\psi_1\circ\psi_0}k_2$.-\end{defn}--Since homomorphisms may arbitrarily add some structure such as adding terms-to $unique$ and $non$, it is possible to have-$k_0\homomorphism{\phi,\sigma}k_1$ and $k_0\homomorphism{\phi,\sigma}k_2$-with $k_1\ne k_2$.-For example $k_1$ and $k_2$ could be identical except that $non(k_1)\subsetneq-non(k_2)$.  We would like to be able to talk about the image of $k_0$-under $(\phi,\sigma)$.--\begin{defn}[Image of Homomorphism]\label{def:image}-Preskeleton $k_1$ is the \emph{image of $k_0$ under $\psi=(\phi,\sigma)$}-written $\psi(k_0)=k_1$ iff-\begin{enumerate}-\item $k_0\homomorphism{\phi,\sigma}k_1$-\item $\kprec{k_1}=\phi(\kprec{k_0})^*$-\item $\fn{unique}(k_1)=\sigma(\fn{unique}(k_0))$-\item $\fn{non}(k_1)=\sigma(\fn{non}(k_0))$-\item $\fn{ht}(k_1,\phi(s))=\max \{\fn{ht}(k_0, s')\mid \phi(s')=\phi(s)\}$- for $s<|\fn{inst}(k_0)|$-\item $\phi$ is surjective-\end{enumerate}-\end{defn}--This definition guarantees that the image does not contain extra strands or-nodes, and that it only contains ordering relations and origination assumptions-necessary for $\psi$ to be a homomorphism.  Whenever there is a skeleton $k_1$-such that $k_0\homomorphism{\psi}k_1$, then $\psi(k_0)$ is well-defined, and-we can view $\psi(k_0)$ as being included into $k_1$.  That is,-$k_0\homomorphism{\psi}\psi(k_0)\homomorphism{\idphi,\idsigma}k_1$.--Given $(\idphi,\sigma)$, it is still possible for $(\idphi,\sigma)(k_0)$ not-to exist because $\sigma$ may violate the last clause of-Definition~\ref{def:homomorphism}.  However, if there is some $\phi$-for which $(\phi,\sigma)(k_0)$ is well-defined, then $(\idphi,\sigma)(k_0)$-is also well-defined.--\begin{lem}\label{lem:decompose}-If $k_0\homomorphism{\phi,\sigma}k_1$, then there is a preskeleton $k$ such-that $k_0\homomorphism{\phi_{id},\sigma}k\homomorphism{\phi,\sigma_{id}}k_1$.-\end{lem}--\begin{proof}-Let $k=(\idphi,\sigma)(k_0)$.  Then the-homomorphism $k\homomorphism{\phi,\sigma_{id}}k_1$ is well-defined which the-reader can easily check by verifying each of the seven clauses of-Definition~\ref{def:homomorphism}.-\end{proof}--\begin{cor}\label{cor:commute}-If $k_0\homomorphism{\phi,\sigma_{id}}k_1\homomorphism{\phi_{id},\sigma}k_2,$-then there is a preskeleton $k$ such that-$k_0\homomorphism{\phi_{id},\sigma}k\homomorphism{\phi,\sigma_{id}}k_2$.-\end{cor}--\begin{proof}-We can compose the two homomorphisms to see that-$k_0\homomorphism{\phi,\sigma}k_2$.  We then apply the previous lemma to find $k$.-\end{proof}--\begin{note}-The following definition is frivolous as it is not used anywhere.-We're just trying out definitions to explore links to category theory.-\end{note}--\begin{defn}[{\cpsa} Category]\label{def:cpsa category}-\index{CPSA@{\cpsa} category}-Let $\alg{C}(X)$ be a {\cpsa} algebra-generated by~$X$ (see Definition~\ref{def:cpsa algebra}), and-$\alg{K}(X)$ be  a free-algebra defined by the carrier set for sort \dom{preskel}-in~$\alg{C}(X)$.  In a {\cpsa} category-\begin{enumerate}-\item $\alg{K}(X)$ is an object, for each variable set~$X$,-\item the set of arrows is $(\nat\to\nat)\times-(\alg{A}_\top(X)\to\alg{A}_\top(Y))$, where the second component is a-  homomorphism of the message algebra,-\item Definition~\ref{def:homomorphism} defines the domain and the-  codomain of each arrow,-\item component function composition defines arrow composition, and-\item component identity functions define the arrow identity.-\end{enumerate}-\end{defn}--\begin{defn}[Pruned Skeleton]-A skeleton~$k$ has a set of \emph{redundant strands}~$S$ if there is a-substitution~$\sigma$ that is a variable renaming, a strand-mapping~$\phi$ such that $s\in S$ implies there is some $s'\notin S$-such that $\phi(s)=\phi(s')$ and the height of~$s$ is no greater than-the height of~$s'$, a skeleton~$k'$ such that-$k\homomorphism{\phi,\sigma}k'$ where $k'=(\phi,\sigma)(k)$, and a-homomorphism $k'\homomorphism{\phi',\sigma'}k$ such that-$\sigma\circ\sigma'=\idsigma$ and $\phi\circ\phi'=\idphi$.  A-skeleton~$k$ is \emph{pruned} if it contains no redundant strands.-\end{defn}--\begin{note}-Suggestion from Carolyn Talcott:  Define pruned skeleton as the result-of deleting redundant set of strands.  Then prove that we can use-homomorphisms with the right properties to perform this `deletion'.-\end{note}--The concept of an execution skeleton is introduced to relate a skeleton-that contains only regular strands with its executions.  An execution-skeleton may include penetrator strands.--\begin{defn}[Used]\label{def:used}-Message~$t_0$ is \emph{used in}~$t_1$-if~$t_0$ or $\fn{inv}(t_0)$ is accessible in $t_1$ and~$t_0$ is not-carried by~$t_1$.-\end{defn}-The accessibility of a term is defined in-Definition~\ref{def:accessible}.--\begin{defn}[Execution Skeleton]\label{def:execution skeleton}-The \emph{execution skeleton}~$k$ of bundle~{\bundle}-over instances~$I$ has the following properties.-\begin{enumerate}-\item $\fn{insts}(k)=I$.-\item $\kprec{k} = \prec$.-\item $\fn{unique}(k)$ is the set of atoms that originate uniquely-  in~{\bundle}.-\item $\fn{non}(k)$ is the set of atoms used in the traces of~$I$.-\end{enumerate}-\end{defn}--\begin{defn}[Skeleton Compatible Executions]-A bundle~{\bundle} is \emph{compatible} with skeleton~$k$ if-there is a homomorphism from~$k$ to the execution skeleton-of~{\bundle}.-\end{defn}--\begin{defn}[Realized Skeleton]-A bundle~{\bundle} \emph{realizes} skeleton~$k$ if~$\bundle$ is-compatible with~$k$, and the structure preserving map $(\phi,\sigma)$-has the property that~$\sigma$ is a bijection,~$\phi$ is a-bijection between the strands in~$k$ and the regular strands in the-bundle's execution skeleton, and~$\phi$ preserves the height of the-strands it maps.-\end{defn}--A bundle models a realized skeleton if it realizes it.  A-bundle~{\bundle} models a preskeleton~$k_0$ if there is a realized-skeleton~$k_1$ such that $k_0\homomorphism{\phi,\sigma} k_1$-and~{\bundle} models~$k_1$.--\subsection*{Discussion}--In the refinement of strand space theory, there is no global strand-space on which all analysis is based.  Instead, each skeleton and-execution defines its own strand space, and homomorphisms establish-relations between them.  The definition of a protocol depends on no-strand space.--The definitions in this section are the obvious refinements that-result from using finite ordered strand spaces.  In the {\cpsa}-program, pruned skeletons are used for skeletons in the implementation-of the {\cpsa} algorithm in~\cite{DoghmiGuttmanThayer07}.-In~\cite{DoghmiGuttmanThayer07}, skeletons were not required to-respect origination, but that was just an oversight.--\section{Reductions on Preskeletons}\label{sec:preskeleton reduction}--This section describes the algorithm used to transform a preskeleton-into a skeleton as a setwise term reduction system-$(\alg{K},\twoheadrightarrow)$.  Recall that the relation-$k\rightsquigarrow K$ in Section~\ref{sec:algorithms} is defined in-terms of $\to\subseteq\alg{K}\times\alg{K}$ by specifying-$\{k\}\twoheadrightarrow K$ using~$\to$.--If a preskeleton $k$ is not a skeleton, then it is either because-some $t\in unique(k)$ actually originates at more than one node,-or because for some $t\in unique(k)$, there is a node $n_1\in\gain(k,t)$,-and a node $n_0\in\orig(k,t)$ such that $n_0\nprec_k n_1$.-These obstructions are resolved via identifying strands and-enriching node orderings respectively.  We show that we can always-resolve the first obstruction before resolving the second obstruction.-Moreover, if the first obstruction is resolvable, then there is a-canonical resolution (although there may be non-canonical choices-to reach it).  We call this canonical resolution a pre-hull.  Then-if the second obstruction is also resolvable, it also has a canonical-resolution.  This canonical resolution is a skeleton which we call-a hull.  We begin by giving the definitions of pre-hull and of hull.--\begin{defn}-Given a preskeleton $k$, a \emph{pre-hull} of $k$ is a hulled preskeleton-$k_0$ together with a homomorphism $k\homomorphism{\psi_0}k_0$ such that-for any homomorphism $k\homomorphism{\psi_1}k_1$ to a hulled preskeleton,-there is a unique homomorphism $k_0\homomorphism{\psi}k_1$ such that-$\psi_1=\psi\circ\psi_0$--$$\xymatrix@C=3em{-k\ar@{|->}[r]^{\psi_0} \ar@{|->}[rd]_{\psi_1} &-k_0 \ar@{|->}[d]^{\psi}\\-&k_1}$$-\end{defn}--A preskeleton $k$ may not have a pre-hull, but if it does, then the definition-implies that it is unique up to isomorphism.  Also, every hulled preskeleton-is its own pre-hull where $\psi_0$ is the identity homomorphism.--\begin{defn}-Given a preskeleton $k$, a \emph{hull} of $k$ is a skeleton-$k_0$ together with a homomorphism $k\homomorphism{\psi_0}k_0$ such that-for any homomorphism $k\homomorphism{\psi_1}k_1$ to a skeleton,-there is a unique homomorphism $k_0\homomorphism{\psi}k_1$ such that-$\psi_1=\psi\circ\psi_0$--$$\xymatrix@C=3em{-k\ar@{|->}[r]^{\psi_0} \ar@{|->}[rd]_{\psi_1} &-k_0 \ar@{|->}[d]^{\psi}\\-&k_1}$$-\end{defn}--Just like pre-hulls, a preskeleton may not have a hull, but if it does, then-it is unique up to isomorphism.  Also, every skeleton is its own hull-where $\psi_0$ is the identity homomorphism.--We next show how to take advantage of unification in the-$\Sigma$-algebra to provide a sort of unification of strands.  Before unifying-two strands, we will unify their traces.--\begin{defn}[Trace Unification]\label{def:trace-unification}-Let $k$ be a preskeleton which contains strands~$s$ and~$s'$.  We-say that substitution $\sigma$ \emph{unifies the messages of~$s$-and~$s'$} iff $\sigma(evt(k,(s,p))) \equiv \sigma(evt(k,(s',p)))$-for every $p < height(s)$.  We say that homomorphism-$k\homomorphism{\phi,\sigma}k_0$ \emph{unifies the traces of~$s$-and~$s'$} iff $\sigma$ unifies the messages of~$s$ and~$s'$.-We say that the traces of $s$ and $s'$ are-\emph{unifiable} if there is a $(\phi,\sigma)$ which unifies them.-\end{defn}--Thus, if $(\phi,\sigma)$ unifies the traces of~$s$ and~$s'$,-not only does $\sigma$ unify the messages-but also $t\in \fn{unique}(k_0)$ implies-$\phi(\orig(k_0,t))\subseteq\orig(k_1,\sigma(t))$ by Clause 7 in the-definition of a homomorphism (Definition~\ref{def:homomorphism}).-In fact, as we already saw, it is generally possible for $\sigma$-to unify the messages, without respecting Clause 7. In this case,-$\sigma$ unifies the messages of~$s$ and~$s'$, but the traces-of~$s$ and~$s'$ are not unifiable.  By pairing-$\sigma$ with $\phi$, trace unification only allows homomorphisms-with substitutions $\sigma$ which do not violate Clause 7.--By recalling the discussion which follows Definition~\ref{def:image},-we can see that if $(\phi,\sigma)$ unifies the traces of~$s$ and~$s'$,-then so does $(\idphi,\sigma)$.  Furthermore, if $(\idphi,\sigma)$ unifies-the traces of~$s$ and~$s'$, then so does $(\idphi,\sigma')$ where-$\sigma'$ unifies the messages of~$s$ and~$s'$, and-$\sigma'\unlhd\sigma$.  We can view this another way.  Let $\sigma$-be the most general unifier of the messages of~$s$ and~$s'$.  If $(\idphi,\sigma)$-does not unify the traces, then the traces are not unifiable.--\begin{defn}[Substitution Reduction]-Preskeleton~$k_0$ reduces to preskeleton~$k_1$ by the-substitution~$\sigma$, written~$k_0\reduction{\ops{S}_\sigma}k_1$, iff-$k_1=\psi(k_0)$ where $\psi=(\idphi,\sigma)$.-\end{defn}--The next lemma states that if $k$ is a skeleton in which the traces of-two strands~$s$ and~$s'$ are unifiable, then there is a kind of most-general trace unifier.  Since this most general trace unifier will-turn out to always have the form $(\idphi,\sigma)$, we can use the-corresponding $\ops{S}_{\sigma}$ as a way of implementing this trace-unification.--\begin{lem}\label{lem:substitution}-Let $k$ be a preskeleton which contains strands $s$ and $s'$.  Suppose the-traces of $s$ and $s'$ are unifiable.  Then there is a preskeleton $k_0$ and-a homomorphism $k\homomorphism{\psi_0}k_0$ which unifies the traces-of $s$ and $s'$ such that for every-homomorphism $k\homomorphism{\psi_1}k_1$ which-unifies the traces of $s$ and $s'$, there is a unique homomorphism-$k_0\homomorphism{\psi}k_1$ so that $\psi_1=\psi\circ\psi_0$.--$$\xymatrix@C=3em{-k\ar@{|->}[r]^{\psi_0} \ar@{|->}[rd]_{\psi_1} &-k_0 \ar@{|->}[d]^{\psi}\\-&k_1}$$-\end{lem}--\begin{proof}-Since the traces of $s$ and $s'$ are unifiable by some $(\hat{\phi},\hat{\sigma})$,-we know that $(\idphi,\hat{\sigma})$ also unifies the traces.  Furthermore,-there is a most general unifier $\sigma_0$ which unifies the messages-of~$s$ and~$s'$.  Since-$\sigma_0\unlhd\hat{\sigma}$ we know that $(\idphi,\sigma_0)$ also unifies-the traces.  Let $\psi_0=(\idphi,\sigma_0)$ and let $k_0=\psi_0(k).$-We show that this is the preskeleton and homomorphism we want.--The homomorphism $\psi_0$ unifies the traces of $s$ and $s'$ by construction.-Now let $k\homomorphism{\psi_1}k_1$ with $\psi_1=(\phi_1,\sigma_1)$,-be a homomorphism which unifies the traces of~$s$ and~$s'$.   Since-$\sigma_0$ is the most general unifier of the messages of~$s$ and~$s'$,-there is a unique-$\sigma$ such that $\sigma_1=\sigma\circ\sigma_0$.  Then by letting-$\psi=(\phi_1,\sigma)$ we see that $\psi\circ\psi_0 = (\phi_1,\sigma)-\circ (\phi_{id},\sigma_0) = (\phi_1,\sigma\circ\sigma_0) =-(\phi_1,\sigma_1) = \psi_1$.  It is clear that $\phi_1$ is the unique-node map that will work, and we already noted that $\sigma$ must also-be unique.-\end{proof}--We can find the $k_0$ of Lemma~\ref{lem:substitution} (when it exists)-by finding the most general $\sigma_0$ which-simultaneously unifies the corresponding messages in the traces of~$s$-and~$s'$ and applying the reduction $\ops{S}_{\sigma_0}$ to $k$.  This-reduction will fail if the traces of~$s$ and~$s'$ are not unifiable, and-it will succeed otherwise.  Furthermore, Lemma~\ref{lem:substitution}-guarantees that there is at most a single $k_0$ such that-$k\reduction{\ops{S}_{\sigma_0}}k_0$ where $\sigma_0$ is the most general-unifier of the messages of strands~$s$ and~$s'$.--\begin{defn}[Strand Unification]\label{def:strand-unification}-Let $k$ be a preskeleton with strands $s$ and $s'$.- We say that a homomorphism $\psi=(\phi,\sigma)$ \emph{unifies-the strands} $s$ and $s'$ iff $\phi(s)=\phi(s')$.-We say the strands $s$ and $s'$ are \emph{unifiable}-if there is a homomorphism which unifies them.-\end{defn}--Note that if $\psi$ unifies two strands, then $\psi$ unifies their traces,-but the converse is not true in general.  Thus, unification of two strands-can be broken into two steps.  First we unify their traces, then we unify-the strands in a very simple way.  We already saw that the first step can-be performed in a most general way, as codified by Lemma~\ref{lem:substitution}.-We now want to provide a similar notion for the second step.--Suppose the trace of strand~$s$ is a prefix of the trace of-strand~$s'$ in preskeleton~$k_0$.  In other words, $(\idphi,\idsigma)$-unifies the traces of~$s$ and~$s'$.  This would be the case, for example,-if $k_0$ was the result of unifying the traces of~$s$ and~$s'$ in some-other preskeleton.-In that case, there is a-$\psi$ which unifies the strands~$s$ and~$s'$, namely-$\psi=(\phi_{s,s'},\idsigma)$ where-$$\begin{array}{r@{}c@{}l}-\phi_{s,s'}(j)&{}={}&\left\{-\begin{array}{ll}-\phi_s(s')&\mbox{if $j=s$}\\-\phi_s(j)&\mbox{otherwise}-\end{array}\right.\\-\phi_s(j)&{}={}&\left\{-\begin{array}{ll}-j-1&\mbox{if $j>s$}\\-j&\mbox{otherwise.}-\end{array}\right.-\end{array}-$$--\begin{defn}[Compression Reduction]-Preskeleton~$k_0$ reduces to preskeleton~$k_1$ by compressing the-strand~$s$ into~$s'$, written $k_0\reduction{\ops{C}_{s,s'}}k_1$,-iff $\psi(k_0)=k_1$, with $\psi=(\phi_{s,s'},\idsigma)$.-\end{defn}--The compression reduction $\ops{C}_{s,s'}$ can only be performed on-$k_0$ if $(\idphi,\idsigma)$ unifies the traces of~$s$ and~$s'$, because-otherwise $(\phi_{s,s'},\idsigma)(k_0)$ is not well-defined.  We generally-use this reduction when unifying strands after having unified their-traces.  This reduction is used to implement a kind of most general-unification of two strands once their traces have been unified.--\begin{lem}\label{lem:compression}-Let $k$ be a preskeleton in which $(\idphi,\idsigma)$ unifies the traces-of two strands $s$ and $s'$, and suppose-the strands~$s$ and~$s'$ are unifiable.  Then-there is a preskeleton $k_0$ and a homomorphism $k\homomorphism{\psi_0}k_0$-which unifies the strands $s$ and $s'$ such that for every-homomorphism $k\homomorphism{\psi_0}k_0$ which unifies the-strands $s$ and $s'$, there is a unique homomorphism-$k_0\homomorphism{\psi}k_1$ so that $\psi_1=\psi\circ\psi_0$.--$$\xymatrix@C=3em{-k\ar@{|->}[r]^{\psi_0} \ar@{|->}[rd]_{\psi_1} &-k_0 \ar@{|->}[d]^{\psi}\\-&k_1}$$-\end{lem}--\begin{proof}-Let $\psi_0=(\phi_{s,s'},\sigma_{id})$, and $\psi_0(k)=k_0$. We will-show that this is the preskeleton and homomorphism we want.--By the definition of $\phi_{s,s'}$ we see that $\psi_0$ unifies the-strands $s$ and $s'$.  Let $k\homomorphism{\psi_1}k_1$ with-$\psi_1=(\phi_1,\sigma_1)$ be any homomorphism-which unifies the strands $s$ and $s'$. We-let $\psi=(\phi,\sigma_1)$ where $\phi$ is a node map we still need to define.-Since $\phi_{s,s'}$ maps onto the strands of $k_0$, $\phi$ is completely-determined by where it sends $\phi_{s,s'}(j)$.  But in order for-$\psi_1=\psi\circ\psi_0$ we are forced to define-$\phi(\phi_{s,s'}(j))=\phi_1(j)$.  We can do this because $\phi_{s,s'}$-does not identify any strands except for $s$ and $s'$, and because $\phi_1$-also identifies $s$ and $s'$.  Using this $\phi$, it is clear that-$\psi_1=\psi\circ\psi_0$.  To see that $\psi$ is unique, we note that we-had no choice for either the substitution $\sigma_1$ or the node map-$\phi$.-\end{proof}--We can find the $k_0$ of Lemma~\ref{lem:compression} (when it exists)-by applying $\ops{C}_{s,s'}$ to $k$.  This reduction will fail if-the strands~$s$ and~$s'$ are not unifiable or if the trace of~$s$ is-not a prefix of the trace of~$s'$, and it will succeed otherwise.-Moreover, Lemma~\ref{lem:compression} guarantees that there is at most-a single $k_0$ such that $k\reduction{\ops{C}_{s,s'}}k_0$.--The substitution and compression reductions are used to unify two-strands in two separate steps.  When two strands are unifiable, then-their traces are also unifiable.  We may thus use Lemma~\ref{lem:substitution}-to unify their traces in a most general way.  This will cause the trace-of one of the strands to be a prefix of the other, thereby enabling-compression.  The resulting preskeleton is the most general one which-unifies the two strands, as we show in the following lemma.--\begin{lem}\label{lem:hulling}-Let $k$ be a preskeleton containing strands $s$ and $s'$-which are unifiable.-Then there is a preskeleton $k_0$ and a homomorphism-$k\homomorphism{\psi_0}k_0$ which unifies $s$ and $s'$ such that-for every homomorphism $k\homomorphism{\psi_1}k_1$ which unifies-$s$ and $s'$, there is a unique homomorphism-$k_0\homomorphism{\psi}k_1$ so that $\psi_1=\psi\circ\psi_0$.--$$\xymatrix@C=3em{-k\ar@{|->}[r]^{\psi_0} \ar@{|->}[rd]_{\psi_1} &-k_0 \ar@{|->}[d]^{\psi}\\-&k_1}$$-\end{lem}--\begin{proof}-Since the strands $s$ and $s'$ are unifiable, their traces are also-unifiable.  Thus, by Lemma~\ref{lem:substitution}, we can find a-preskeleton $k_0'$ and a homomorphism $k\homomorphism{\psi_0'}k_0'$-so that any homomorphism from $k$ which unifies the traces of $s$ and $s'$-factors through $\psi_0'$.  The preskeleton $k_0'$ now satisfies-the hypotheses of Lemma~\ref{lem:compression}, so we can find a-preskeleton $k_0''$ and a homomorphism-$k_0'\homomorphism{\psi_0''}k_0''$ so that any homomorphism from-$k_0'$ which unifies $s$ and $s'$ factors through $\psi_0''$.-Let $\psi_0=\psi_0''\circ\psi_0'=(\phi_{s,s'},\sigma)$ where-$\sigma$ is the mgu of the traces of $s$ and $s'$, and let $k_0=k_0''$.-It remains to show that this $\psi_0$ and $k_0$ have the desired-properties.--First, it is clear that $\psi_0$ unifies $s$ and $s'$.  Now let-$k\homomorphism{\psi_1}k_1$ be an arbitrary homomorphism which unifies-$s$ and $s'$.  By Lemma~\ref{lem:substitution}, $\psi_1$ factors uniquely-through $\psi_0'$ as $\psi'\circ\psi_0'$.  Moreover, $\psi'$ is a-homomorphism from $k_0'$ which unifies $s$ and $s'$, thus by-Lemma~\ref{lem:compression}, $\psi'$ factors uniquely through-$\psi_0''$ as $\psi'=\psi''\circ\psi_0''$.  Thus $\psi_1$ factors-uniquely through $\psi_0=\psi_0''\circ\psi_0'$ as desired.--$$\xymatrix@C=3em{-k\ar@{|->}[r]^{\psi_0'} \ar@{|->}[rrdd]_{\psi_1} &-k_0' \ar@{|->}[rdd]^{\psi'} \ar@{|->}[r]^{\psi_0''} &-k_0 \ar@{|->}[dd]^{\psi}\\-& &\\-& &k_1}$$-\end{proof}--We thus now have a canonical way of unifying two strands when they-are unifiable.--\begin{lem}\label{lem:unify-commute}-Let $k$ be a preskeleton containing strands $s_0,s_0',s_1,s_1'$-(not necessarily all distinct) such that the pairs of strands-$(s_0,s_0')$ and $(s_1,s_1')$ are simultaneously unifiable.  Let-$k_0$ be the result of first unifying $s_0$~and~$s_0'$ and then-$s_1$~and~$s_1'$ according to Lemma~\ref{lem:hulling}.  Let-$k_1$ be the result of first unifying $s_1$~and~$s_1'$ and then-$s_0$~and~$s_0'$ also according to Lemma~\ref{lem:hulling}.-Then $k_0$ and $k_1$ are isomorphic.-\end{lem}--\begin{proof}-We can repeatedly apply Lemma~\ref{lem:hulling} to obtain the-following diagram.--$$-\xymatrix@C=3em{-& k\ar@{|->}[ld]_{\psi_0'}-	 \ar@{|->}[rd]^{\psi_1'} &\\-k_0'\ar@{|->}[d]_{\psi_0} %\ar@{|->}[rrd]-& &-k_1'\ar@{|->}[d]^{\psi_1} %\ar@{|->}[lld]-\\-k_0\ar@{|->}[rr]^{\psi_2} & & k_1\ar@{|->}[ll]^{\psi_2'}-}$$--The preskeleton $k_0'$ is the result of unifying strands $s_0$~and~$s_0'$-of $k$ in a most general way, and $k_0$ is the result of unifying-strands $\psi_0'(s_1)$~and~$\psi_0'(s_1')$ of $k_0'$ in a most general-way.  Similarly, $k_1'$ is the result of unifying strands $s_1$~and~$s_1'$-of $k$ in a most general way, and $k_1$ is the result of unifying-strands $\psi_1'(s_0)$~and~$\psi_1'(s_0')$ of $k_1'$ in a most general way.--We can infer the homomorphism $k_0\homomorphism{\psi_2}k_1$ and-$k_1\homomorphism{\psi_2'}k_0$ from Lemma~\ref{lem:hulling}-as the unique homomorphisms which make the diagram commute.  By the-uniqueness of these arrows we can infer that $\psi_2\circ\psi_2'=id_{k_1}$-and that $\psi_2'\circ\psi_2=id_{k_0}$.  Thus $\psi_2$~and~$\psi_2'$ are-isomorphisms and they are inverses of each other.  Thus $k_0$ and $k_1$-are isomorphic.-\end{proof}--Lemma~\ref{lem:unify-commute} implies that if we want to simultaneously-unify several sets of strands which are simultaneously unifiable,-any order of pairwise strand unification-will result in a skeleton which is isomorphic to the result of every-other order.  However, given a preskeleton $k$ which is not a hulled-preskeleton, we do not want to unify \emph{every} pair of strands-which are unifiable.  We only want to unify those pairs of strands-which demonstrate that for some $t\in unique(k)$, $\orig(k,t)$ has-more than one node.  For this purpose we use another reduction-which is built out of~$\ops{S}_{\sigma}$ and~$\ops{C}_{s,s'}$.--Recall that the relation $k\rightsquigarrow K$ in-Section~\ref{sec:algorithms} is defined in terms of-$\to\subseteq\alg{K}\times\alg{K}$ by specifying-$\{k\}\twoheadrightarrow K$ using~$\to$.--\begin{defn}[Hulling Reduction]\label{def:hulling}-Preskeleton $k_0$ reduces to preskeleton $k_1$ by hulling strands~$s$-and~$s'$, written $k_0\reduction{\ops{H}_{s,s'}}k_1$, iff there is-some $t\in unique(k_0)$ and there are distinct strands~$s$ and~$s'$-such that $\{(s,p),(s',p')\}\subseteq\orig(k_0,t)$, and the-strands~$s$ and~$s'$ are unifiable, and $k_1$ is the preskeleton-guaranteed by Lemma~\ref{lem:hulling}.  For the setwise hulling-relation, $\{k_0\}\setreduction{\ops{H}_{s,s'}}\{k_1\mid-k_0\reduction{\ops{H}_{s,s'}}k_1\}$, when $k_0$ has a message in-$\fn{unique}(k_0)$ that originates on both~$s$ and~$s'$.-\end{defn}--This hulling reduction $\ops{H}_{s,s'}$ implements the-``most general strand unifier" $\psi_0$ from Lemma~\ref{lem:hulling}-when it exists, but it is only applicable when-$s$~and~$s'$ originate the same $t\in unique(k)$.-By the proof of Lemma~\ref{lem:hulling},-$k_0\reduction{\ops{H}_{s,s'}}k_1$, iff there is a (unique) preskeleton $k$ such-that $k_0\reduction{\ops{S}_{\sigma}}k\reduction{\ops{C}_{s,s'}}k_1$,-where $\sigma$ is the most general unifier of the messages of~$s$-and~$s'$.--Given a preskeleton $k$ which is not a hulled preskeleton,-it is possible that simultaneously unifying-all pairs of strands $s$~and~$s'$ which both originate some-$t\in unique(k)$ will not produce a hulled preskeleton.  The unification-process may introduce more points of origination of terms which are-meant to be uniquely originating.  However, the next lemma shows that-repeatedly resolving these obstructions will yield a pre-hull.--\begin{lem}\label{lem:prehull-exist}-Suppose that there is a homomorphism from $k$ into a hulled-preskeleton.  Then $k$ has a pre-hull.-\end{lem}--\begin{proof}-If $k$ is not a hulled preskeleton, then it has (possibly several)-pairs of strands $s$~and~$s'$ which each originate the same term-$t\in unique(k)$.  All of these pairs are simultaneously unifiable-since the homomorphism from $k$ into a hulled preskeleton which is-assumed to exist performs that unification.  Therefore by-Lemmas~\ref{lem:hulling} and~\ref{lem:unify-commute}, we may-unify these pairs $s$~and~$s'$ in any order in a most general way-to find a homomorphism $k\homomorphism{\psi_0}k_0$ which simultaneously-unifies all the pairs $s$~and~$s'$, such that for any homomorphism-$k\homomorphism{\psi_1}k_1$ which unifies these pairs there is a unique-$k_0\homomorphism{\psi}k_1$ such that $\psi_1=\psi\circ\psi_0$.--By the properties of $\psi_0$ and $k_0$, if $k_0$ is a hulled-preskeleton it is the pre-hull of $k$.  If not, then $k_0$-again satisfies the hypothesis of this lemma, so we can repeat the-process of the above paragraph.  Since each iteration reduces the-number of strands, this process will eventually terminate.  By-the properties of the resulting preskeleton at each step, it will-terminate with the pre-hull.-\end{proof}--\begin{lem}\label{lem:prehull-compute}-If a preskeleton $k$ has a pre-hull, then repeated applications-of $\ops{H}_{s,s'}$ will terminate in the pre-hull of $k$.-\end{lem}--\begin{proof}-For every pair of strands $s$~and~$s'$ which are eventually unified-in the pre-hull, there is a sequence of hulling reductions which-causes $s$~and~$s'$ to originate the same term which should-be uniquely originating.  Furthermore, by Lemma~\ref{lem:unify-commute}-this obstruction is introduced by the end of every reordering of such-a sequence, although it may be introduced earlier.  Thus, we may apply-the hulling reductions in any order, and we will eventually unify the-same sets of strands.  Again by Lemma~\ref{lem:unify-commute},-the preskeletons resulting from each order of hulling reductions will-all be isomorphic.  Since Lemma~\ref{lem:prehull-exist} shows that-at least one such order results in the pre-hull, every order will-result in the pre-hull.-\end{proof}--\begin{defn}[Order Enrichment]-Suppose hulled preskeleton~$k_0$ is not a skeleton.  Hulled-preskeleton~$k_0$ reduces to skeleton~$k_1$ by order enrichment, written-$k_0\reduction{\ops{O}}k_1$, iff~$k_1$ is the result of adding node-orderings implied by origination.  That is,-\begin{enumerate}-\item $\kprec{k_1}= (\kprec{k_0}\cup\{n_0,n_1\mid n_0\in\orig(k_0,t)\land-n_1\in\gain(k_0,t)\})^\ast$,-\item $\fn{ht}(k_1,s)=-\fn{ht}(k_0,s)$ for $s<|\fn{inst}(k_0)|$,-\item $\fn{unique}(k_1)=\fn{unique}(k_0)$, and-\item $\fn{non}(k_1)=\fn{non}(k_0)$.-\end{enumerate}-There is a homomorphism from~$k_0$ to~$k_1$ that is an embedding.  For-the setwise order enrichment reduction,-$\{k_0\}\setreduction{\ops{O}}\{k_1\mid k_0\reduction{\ops{O}}k_1\}$-when $k_0$ is a hulled preskeleton that is not a skeleton.-\end{defn}--\begin{lem}\label{lem:order-enrichment}-Suppose $k$ is a preskeleton such that every $t$ in $unique(k)$ originates-in $k$ at most once.  Suppose also that there is a homomorphism from-$k$ to a skeleton.  Then there is a skeleton $k_0$ and a homomorphism-$k\homomorphism{\psi_0}k_0$ such that for every homomorphism-$k\homomorphism{\psi_1}k_1$ to a skeleton $k_1$, there is a unique-homomorphism $k_0\homomorphism{\psi}k_1$ so that $\psi_1=\psi\circ\psi_0$.--$$\xymatrix@C=3em{-k\ar@{|->}[r]^{\psi_0} \ar@{|->}[rd]_{\psi_1} &-k_0 \ar@{|->}[d]^{\psi}\\-&k_1}$$-\end{lem}--\begin{proof}-Let $k_0$ be obtained from $k$ by adding edges to the node-ordering relation.  That is, $n_0\kprec{k_0}n_1$ is the transitive-closure of pairs such that-either $n_0\kprec{k}n_1$ or for some $t\in unique(k)$, $t$ originates-at $n_0$ and $n_1\in\gain(k,t)$.  Let $\psi_0$ be the obvious-embedding of $k$ into $k_0$.  We must show that $k_0$ is-a skeleton.  It will be sufficient to check that we did not introduce-any cycles into the node ordering.  But, in fact, if $\kprec{k_0}$-had a cycle, then so would the--First, we chose $k_0$ to be a skeleton.  Now let $k\homomorphism{\psi_1}k_1$-be an arbitrary homomorphism to a skeleton $k_1$.  Then we can also-apply $\psi_1$ to $k_0$, but we must be careful to check that it remains-a homomorphism.  Only clause 4 of Definition~\ref{def:homomorphism} could-potentially fail.  However, assume-\end{proof}--\begin{note}-Our current understanding of pruning is this.  We have an example that-shows that pruning one strand at a time does not remove all redundant-strands.  We are searching for efficient ways to perform multiple-strand pruning in one step, but haven't found one yet.--We also do not know if single strand pruning is confluent.-\end{note}--\begin{defn}[Pruning]\label{def:pruning}-Suppose skeleton~$k_0$ has a redundant strand~$s$.  Then there exists-a distinct strand~$s'$ that describes more specific behavior.-Skeleton~$k_0$ reduces to skeleton~$k_1$ by pruning, written-$k_0\reduction{\ops{P}_s}k_1$, iff there is a substitution~$\sigma$-such that $\sigma(\fn{evt}(k_0,(s,p)))\equiv \fn{evt}(k_0,(s',p))$ for-all $p<h$, where~$h$ is the height of strand~$s$ in~$k_0$, no variable-in $\fn{Dom}(\sigma)$ occurs in the trace of any strand other-than~$s$, $t\in\fn{unique}(k_0)$ implies-$\sigma(t)\in\fn{unique}(k_0)$, $t\in\fn{non}(k_0)$ implies-$\sigma(t)\in\fn{non}(k_0)$, there is a~$k$ such that-$k_0\reduction{\ops{S}_\sigma}k\reduction{\ops{C}_{s,s'}}k_1$, and if-$(s,p)\kprec{k_0}(s'',p'')$ then $(s',p')\kprec{k_0}(s'',p'')$, and if-$(s'',p'')\kprec{k_0}(s,p)$ then $(s'',p'')\kprec{k_0}(s',p')$.  For-the setwise pruning reduction,-$\{k_0\}\setreduction{\ops{P}_s}\{k_1\mid-k_0\reduction{\ops{P}_s}k_1\}$, when there is a $k_1$ such that-$k_0\reduction{\ops{P}_s}k_1$.-\end{defn}--\begin{lem}[Pruning]\label{lem:pruning}-Let~$k$ be a skeleton with redundant strand~$s$.  For every pruned-skeleton~$k_1$ such that $k\homomorphism{\psi_1}k_1$, there is a-skeleton~$k_0$ and homomorphisms~$\psi_0$ and~$\psi$ with-$k\reduction{\ops{P}_s}k_0$, $k\homomorphism{\psi_0}k_0$,-$\psi_1=\psi\circ\psi_0$, and $\psi_0=(\phi_{s,s'},\sigma)$, where-strand~$s'$ and substitution~$\sigma$ are as specified in-Definition~\ref{def:pruning}.-\end{lem}--\begin{proof}-Pruning operations commute.  Suppose~$k$ has two redundant-strands,~$s$ and~$s'$.  If~$s$ describes more specific behavior and-is used to justify pruning~$s'$, then the strand that justifies the-pruning of~$s$ can serve the same purpose.-\begin{note}-The proof is not complete.  Something more needs to be added here.-\end{note}-\end{proof}--Notice that a setwise hulling reduction may produce the empty set, but-a setwise order enrichment and pruning reduction never does.--Let reduction $\twoheadrightarrow=-\bigcup_{s,s'}\setreduction{\ops{H}_{s,s'}}\cup\setreduction{\ops{O}}\cup-\bigcup_s\setreduction{\ops{P}_s}$.--\begin{thm}-The reduction $\twoheadrightarrow$ is convergent.-\end{thm}--\begin{proof}-The reduction $\twoheadrightarrow$ is confluent by-Lemmas~\ref{lem:hulling} and~\ref{lem:pruning}.  It's convergent-because the number of hulling and pruning steps is bounded by the-number of strands in a preskeleton.-\end{proof}--\begin{defn}[Preskeleton Reduction System]-Preskeleton~$k_0$ reduces to pruned skeleton~$k_1$,-written~$k_0\reduction{\fn{skel}}k_1$, if-$\{k_0\}\twoheadrightarrow^\ast K$, $k_1\in K$, and~$K$ is a normal-form of~$\twoheadrightarrow$.-\end{defn}--It is easy to show $k_0\reduction{\fn{skel}}k_1$ implies~$k_0\mapsto-k_1$.  Furthermore, the structure-preserving map that demonstrates the-homomorphism is easy to derive.  For each pruned skeleton~$k$,-$k\reduction{\fn{skel}}k$.--\begin{thm}[Preskeleton Reduction System Correct]\label{thm:prsc}-Let~$k$ be a preskeleton.  For every pruned skeleton~$k_1$ such that-$k\homomorphism{\psi_1}k_1$, there is a pruned skeleton~$k_0$ and-homomorphisms~$\psi_0$ and~$\psi$ with $k\reduction{\fn{skel}}k_0$,-$k\homomorphism{\psi_0}k_0$, and $\psi_1=\psi\circ\psi_0$.--$$\xymatrix@C=3em{-k\ar@{|->}[r]^{\psi_0} \ar@{|->}[rd]_{\psi_1} &-k_0 \ar@{|->}[d]^{\psi}\\-&k_1}$$-\end{thm}--\begin{note}-Old stuff.-\end{note}--\begin{lem}[Hulling]-Suppose $k\mapsto k'$ with~$k$ a preskeleton and~$k'$ a hulled-preskeleton.  There exists a set of homomorphisms~$\Psi$ and a set of-hulled preskeletons~$K$, such that for every hulled preskeleton~$k_1$ and-every homomorphism~$k\homomorphism{\psi_1}k_1$, for-some~$\psi_0\in\Psi$, $k_0\in K$, and~$\psi$,-$\psi_1=\psi\circ\psi_0$,~$\psi$ is unique to within isomorphism,-and~$k_0$ is isomorphic to some~$k_2$ with-$k\to^\ast k_2$, where reduction $\to=\bigcup_{s,s'}\reduction{\ops{H}_{s,s'}}$.-\end{lem}--\begin{thm}-Suppose $k\mapsto k'$ with~$k$ a preskeleton and~$k'$ a pruned-skeleton.  There exists a set of homomorphisms~$\Psi$ and a set of-pruned skeletons~$K$, such that for every pruned skeleton~$k_1$ and-every homomorphism~$k\homomorphism{\psi_1}k_1$, for-some~$\psi_0\in\Psi$, $k_0\in K$, and~$\psi$,-$\psi_1=\psi\circ\psi_0$,~$\psi$ is unique to within isomorphism,-and~$k_0$ is isomorphic to some~$k_2$ with-$k\reduction{\fn{skel}}k_2$.--$$\xymatrix@C=3em{-k\ar@{|->}[r]^{\psi_0} \ar@{|->}[rd]_{\psi_1} &-k_0 \ar@{|->}[d]^{\psi}\\-&k_1}$$-\end{thm}--\section{Penetrator Derivable}\label{penetrator}--For each algebra, the powers of the adversary are defined by a set of-roles.  For the Basic Crypto Signature in Figure~\ref{fig:bcs}, the-traces of the penetrator roles are in Figure~\ref{fig:pen}.-Penetrator roles make no origination assumptions.--The context in which penetrator strands appear determine the messages-the adversary can derive.  The context includes previously sent-messages and atoms it is forbidden to originate.  An atom that is-assumed to be non-originating must be avoided as is a uniquely-originating atom that is assumed to originate on a regular strand.--The ternary relation \der{t}{T_p}{T_a} states that message~$t$ is-penetrator derivable from previously sent messages~$T_p$ while-avoiding atoms~$T_a$.  The relation is defined by a set of inference-rules.  Most of the rules are justified by a penetrator role that when-instantiated, derives a message in the conclusion of the rule.--The first rule states that no additional penetrator behavior is required-to derive~$t$ if it has been previously sent.-$$\infer{t\in{T_p}}{\der{t}{T_p}{T_a}}$$--A uniquely originating atom need not be avoided if it has been sent.-\begin{equation}\label{eqn:avoid}-\infer{\der{t}{T_p}{T_a}}%-{\der{t}{\{t_0\}\cup T_p}{\{t_0\}\cup T_a}}-\end{equation}--There are two decomposition steps available to the penetrator.-\begin{equation}\label{eqn:sep}-\infer{\der{t}{\{t_0,t_1\}\cup T_p}{T_a}}%-{\der{t}{\{(t_0,t_1)\}\cup T_p}{T_a}}\quad-[\mbox{by $\fn{sep}(t_0,t_1)$}]-\end{equation}-\begin{equation}\label{eqn:dec}-\infer{\der{\fn{inv}(t_1)}{T_p}{T_a}\qquad-\der{t}{\{t_0,\enc{t_0}{t_1}\}\cup T_p}{T_a}}%-{\der{t}{\{\enc{t_0}{t_1}\}\cup T_p}{T_a}}\quad-[\mbox{by $\fn{dec}(t_0,t_1)$}]-\end{equation}--There are two constructive steps.-$$\infer{\der{t_0}{T_p}{T_a}\qquad\der{t_1}{T_p}{T_a}}%-{\der{(t_0,t_1)}{T_p}{T_a}}\quad-[\mbox{by $\fn{cat}(t_0,t_1)$}]$$-$$\infer{\der{t_0}{T_p}{T_a}\qquad\der{t_1}{T_p}{T_a}}%-{\der{\enc{t_0}{t_1}}{T_p}{T_a}}\quad-[\mbox{by $\fn{enc}(t_0,t_1)$}]$$--There are three rules for indivisible messages.-$$\der{C_i}{T_p}{T_a}\quad-[\mbox{by $\fn{tag}(C_i)$}]$$-$$\infer{t\notin T_a\qquad\mbox{$t$ an atom}}%-{\der{t}{T_p}{T_a}}\quad-[\mbox{by $\fn{base}(t)$}]$$-A non-base sorted variable is derivable in a bundle that instantiates-it with any message other than an element of $X_\top$.-$$\infer{t\in X_\top}{\der{t}{T_p}{T_a}}$$--\begin{defn}[Outbound predecessors]-The \emph{outbound predecessors} of skeleton~$k$ at~$n$ is-$\fn{outpred}(k,n)=\{\fn{msg}(k,n_0)\mid n_0 \kprec{k} n, n_0\mbox{~is-  transmitting}\}$.-\end{defn}--\begin{defn}[Avoidance Set]\label{def:avoid}-The \emph{avoidance set} of skeleton~$k$ is-$\fn{avoid}(k)=\fn{non}(k)\cup\{t\mid-t\in\fn{unique}(k)\land|\orig(k,t)|=1\}$.-\end{defn}--An atom in $\fn{avoid}(k)$ is not available to the penetrator, except-if it is exposed by a messages transmission.  Clearly, only uniquely-originating atoms can be exposed.--\begin{defn}[Derivable Before]\label{def:der}-A message~$t$ is \emph{derivable before} reception node~$n$ in-skeleton~$k$, written $\fn{der}(k,n,t)$, if $\der{t}{T_p}{T_a}$ where-$T_p=\fn{outpred}(k,n)$ and $T_a=\fn{avoid}(k)$.-\end{defn}--\begin{defn}[Realized Node]-A reception node~$n$ is \emph{realized} in skeleton~$k$ if-$\fn{msg}(k,n)$ is derivable before~$n$ in~$k$.-\end{defn}--Notice that one can read off penetrator behavior from the proof tree-used to demonstrate that $\fn{msg}(k,n)$ is derivable before~$n$-in~$k$.  For example, if a decryption step is required by the proof,-an instance of the penetrator's decryption role is indicated.  In a-bundle, for a non-base sorted variable, there is a substitution that-maps the variable to a message that is not a non-base sorted variable.-The substitution determines the penetrator behavior associated with-the variable.--\begin{thm}[Realized Skeleton]-A skeleton is realized if and only if all of its reception nodes are-realized.-\end{thm}--\begin{proof}-Given a skeleton~$k$ in which all of its reception nodes are realized,-the combination of the regular behavior in the skeleton, the-penetrator behavior specified by the proof trees used to demonstrate-each node is realized, and a substitution for non-base sorted-variables determines a bundle.  The skeleton of the bundle may have-more non-originating atoms than is in $\fn{non}(k)$, however since the-extra non-originating atoms are derivable by the bundle that-realizes~$k$, the proof trees for those atoms specify any additional-penetrator behavior required.--\begin{note}-I haven't figure out how to do the ``only if'' part of this proof yet.-\end{note}-\end{proof}--\subsection{Implementation}\label{sec:derivable implementation}--The derivable before a node predicate is implemented using auxiliary-functions.--\begin{defn}[Buildable]-Message~$t$ is \emph{buildable} from previously sent messages~$T_p$-while avoiding~$T_a$, written $\fn{bld}(t,T_p,T_a)$, if-\der{t}{T_p}{T_a} without the use of Inference Rules \ref{eqn:avoid},-\ref{eqn:sep}, and~\ref{eqn:dec}.-\end{defn}--Consider the following reduction system based on Inference Rules-\ref{eqn:avoid}, \ref{eqn:sep}, and~\ref{eqn:dec}.-$$\begin{array}{r@{}c@{}ll}-\dctx{\{t\}\cup T_p}{T_a}&{}\to{}&\dctx{T_p}{T_a}\setminus\{t\}-&\mbox{if $t$ is an atom or in $X_{\top}$}\\-\dctx{\{(t_0,t_1)\}\cup T_p}{T_a}&{}\to{}&\dctx{\{t_0,t_1\}\cup T_p}{T_a}\\-\dctx{\{\enc{t_0}{t_1}\}\cup-T_p}{T_a}&{}\to{}&\dctx{\{t_0,\enc{t_0}{t_1}\}\cup T_p}{T_a}-&\mbox{if $t_0\notin T_p$ and}\\-&&&\fn{bld}(\fn{inv}(t_1),T_p,T_a)-\end{array}$$--\begin{defn}[Decompose]-Previously sent messages~$T_p$ and avoidance set~$T_a$-\emph{decompose} to $T'_p,T'_a$, written-$\fn{decompose}(T_p,T_a)=(T'_p,T'_a)$, if-$\dctx{T_p}{T_a}\to^\ast\dctx{T'_p}{T'_a}$-and $(T'_p,T'_a)$ is a normal form of reduction~$\to$.-\end{defn}--The penetrator derivable predicate $\der{t}{T_p}{T_a}$ is implemented as-\begin{center}-\begin{tabular}{l}-$\der{t}{T_p}{T_a}={}$\\-\quad\textbf{let} $T'_p, T'_a=\fn{decompose}(T_p,T_a)$ \textbf{in}\\-\quad$\fn{bld}(t,T'_p,T'_a)$-\end{tabular}-\end{center}--The decomposition at a node function is-\begin{center}-\begin{tabular}{l}-$\fn{dcmp}(k,n)={}$\\-\quad$\fn{decompose}(\fn{outpred}(k,n),\fn{avoid}(k))$-\end{tabular}-\end{center}--The derivable before a node predicate is implemented as-\begin{center}-\begin{tabular}{l}-$\fn{der}(k,n,t)={}$\\-\quad\textbf{let} $T_p, T_a=\fn{dcmp}(k,n)$ \textbf{in}\\-\quad$\fn{bld}(t,T_p,T_a)$-\end{tabular}-\end{center}--\subsection*{Discussion}--\begin{note}-Add discussion.-\end{note}--\section{Carried Only Within}\label{sec:cow}--A set of encryptions~$T_e$ protects critical message~$t$ in-message~$t'$ if~$t$ is carried by~$t'$ only within a member of~$T_e$.-The definition of the carried only within ({\cow}) relation to follow makes-this concept precise.  The concept is used when solving authentication-tests (Section~\ref{sec:auth tests}).--The question of the protection of a critical message is posed within-the context of a given pruned skeleton~$k$.  The message algebra is-$\alg{A}_\top(X)$, where~$X$ is the finite variable-set~$\fn{vars}(k)$.  Thus all substitutions in this section are finite-maps.--\begin{defn}[Ancestors]-Let $t'=t\termat p$.  The \emph{ancestors} of~$t'$ in~$t$ at~$p$ is-the set $\fn{anc}(t,p)=\{t\termat p'\mid \mbox{$p'$ a proper prefix-  of~$p$}\}$.-\end{defn}--\begin{defn}[Carried Only Within]\label{def:cow}-Message~$t$ is \emph{carried only within} set~$T_e$ in~$t'$, written-$t\nncow{T_e}t'$, if for all carried positions~$p$ of~$t$ in~$t'$,-there exists an ancestor~$t_a\in\fn{anc}(t',p)$ and $t_e\in T_e$ such-that~$t_a\equiv t_e$.  The negation, $\neg(t\nncow{T_e}t')$ is written-$t\ncow{T_e}t'$.-\end{defn}--Definition~\ref{def:carried positions} defines $\fn{carpos}(t,t')$, the-set of positions at which~$t'$ carries~$t$.--The details of a reduction on skeletons called a augmentation will be-described in Section~\ref{augmentations}.  In simplified form, for-an augmentation, given~$t$,~$T_e$, and~$t'$, one must find all most-general unifiers~$\sigma$ such that~$\sigma(t)$ is carried only within-set~$\sigma(T_e)$ in~$\sigma(t')$.--A carried only within solution cannot be directly computed using-Definition~\ref{def:cow}.  Given terms~$t_a$ and~$t_e$, the-$\fn{unify}$ function specified at the end of-Section~\ref{sec:messages} finds substitutions~$\sigma$ such-$\sigma(t_a)\equiv \sigma(t_e)$, however, the carried positions-$\fn{carpos}(\sigma(t),\sigma(t'))$, are used before the $\fn{unify}$-function computes the substitution~$\sigma$.  Figure~\ref{fig:cows}-displays the iterative procedure that breaks the cyclic dependencies.-Each step of the iteration improves an approximation of a solution to-the problem.  The correctness of this function is the subject a paper-in preparation.--\begin{figure}-\begin{center}-\begin{tabular}{l}-$\fn{cows}(t,T,t') ={}$\\-\quad $\fn{cows}_0(t,T,t',\idsigma)$-\quad --- $\idsigma$ is the identity-subst \\-\\-$\fn{cows}_0(t,T,t',\sigma) ={}$\\-\quad \textbf{if} $\sigma(t)$ is {\cow} $\sigma(T)$ at-$\sigma(t')$ \textbf{then}\\-\qquad $\{\sigma\}$\\-\quad \textbf{else}\\-\qquad\textbf{let}-$S=\fn{fold}(t,T,t',\sigma)$-\textbf{in}\\-\qquad$\bigcup_{\sigma'\in S}-\fn{cows}_0(t, T, t',\sigma')$\\-\\-$\fn{fold}(t,T,t',\sigma)={}$\\-$\quad\{\sigma'\circ\sigma\mid\sigma'\in-\fn{fold}_0(\sigma(T),\sigma(t'),\{\idsigma\},-\fn{carpos}(\sigma(t),\sigma(t')))$\\-\\-$\fn{fold}_0(T,t',S,\{\})=S$\\-$\fn{fold}_0(T,t',S,\seq{p}\append P)={}$\\-\quad $\fn{fold}_0(T,t',\fn{solve}(\fn{anc}(t',p),T,S),P)$\\-\\-$\fn{solve}(T,T',S)={}$\\-\quad$\{\sigma'\mid t\in T, t'\in T',-\sigma\in S, \sigma'\in\fn{unify}(t,t',\sigma)\}$-\end{tabular}-\end{center}-\caption{The \fn{cows} Function}\label{fig:cows}-\end{figure}--\section{Authentication Tests}\label{sec:auth tests}--In what follows, we assume all skeletons are pruned, and use the word-``skeleton'' to mean pruned skeleton.--\begin{defn}[Protectors]-Let \fn{deriv} be a boolean valued function that determines if a-message is derivable.  The encryptions that protect~$t_c$ in~$t$ is-$\fn{protectors}(\fn{deriv},t_c, t) = \fn{prot}(t)$ where-$$\fn{prot}(t) =\left\{-\begin{array}{ll}-\mbox{undefined}&\mbox{if $t\equiv t_c$, else}\\-\{\}&\mbox{if $t=\enc{t_0}{t_1}$ and $t_c$ is not carried by~$t_0$, else}\\-\{\enc{t_0}{t_1}\}&-\mbox{if $t=\enc{t_0}{t_1}$ and $\lnot\fn{deriv}(\fn{inv}(t_1))$, else}\\-\fn{prot}(t_0)&\mbox{if $t=\enc{t_0}{t_1}$, else}\\-\bigcup_{i<n}\fn{prot}(t_i)&\mbox{if $t=f(t_0,\ldots,t_{n-1})$ and~$t$-  is not an atom, else}\\-\{\}&\mbox{otherwise.}-\end{array}\right.$$-\end{defn}--\begin{defn}[Escape Set]-The escape set for message~$t_c$ at~$n$ in skeleton~$k$ is the set of-encryptions $\fn{esc}(k,n,t_c)$ where-$$\fn{esc}(k,n,t_c)=\{t_e\mid t_e\in\fn{protectors}(\lambda-t\mathpunct.\fn{der}(k,n,t),t_c,t_o), t_o\in\fn{outpred}(k,n)\}$$-and~$\fn{der}(k,n,t)$ is true when $t$ is derivable before~$n$ in~$k$-(See Definition~\ref{def:der}).-\end{defn}--The $\fn{der}$ function is implemented as-$\fn{der}(k,n,t)=\fn{bld}(t,T_p,T_a)$ where-$(T_p,T_a)=\fn{dcmp}(k,n)$, so that~$T_p$ and~$T_a$ need not be-recomputed.--\begin{defn}[Critical Position]-Position~$p$ is a \emph{critical position} of $t=\fn{msg}(k,n)$ if-\begin{enumerate}-\item $p$ is a carried position in~$t$,-\item either $t\termat p\in\fn{unique}(k)$ and $t\termat p$ originates-  in~$k$, or $t\termat p=\enc{t_0}{t_1}$ and~$t_1$ is not derivable-  before~$n$ in~$k$,-\item $\fn{esc}(k,n,t\termat p)$ is defined, and-\item $\fn{anc}(t,p)\cap \fn{esc}(k,n,t\termat p)=\emptyset$.-\end{enumerate}-\end{defn}--The message at a critical position is called a \emph{critical-  message}.  It is a \emph{critical nonce} if the message is an atom,-otherwise it is a \emph{critical encryption}.  Observe that every-critical message at a node in a skeleton is not derivable at the node.--\begin{thm}-A reception node is unrealized iff it has a critical position.-\end{thm}--\begin{defn}[Critical Position Solved]\label{def:critical position solved}-Suppose~$p$ is a critical position at~$n_0$ in~$k_0$ and-$k_0\homomorphism{\phi,\sigma}k_1$.  Let~$t_0=\fn{msg}(k,n)\termat p$,-$t_1=\sigma(t_0)$,-$T=\sigma(\fn{esc}(k_0,n_0,t_0))$, $n_1=\phi(n_0)$,-and~$t=\fn{msg}(k_1,n_1)$.  Critical position~$p$ is solved in~$k_1$-after~$k_0$ at~$n_0$ if:-\begin{enumerate}-\item $\fn{anc}(t,p)\cap T\neq\emptyset$, or-\item for some~$t_p\in\fn{outpred}(k_1,n_1)$, $t_1$ is not carried-  only within~$T$ in~$t_p$, or-\item the decryption key of a member of~$T$ is derivable-  before~$n_1$ in~$k_1$, or-\item $t_1$ is an encryption and its encryption key is derivable-  before~$n_1$ in~$k_1$.-\end{enumerate}-\end{defn}--\begin{defn}[Contraction]\label{def:contraction}-Let~$p$ be a critical position at~$n$ in~$k$, $t=\fn{msg}(k,n)$, and-$T_e= \fn{esc}(k,n,t\termat p)$.  Suppose there is a-substitution~$\sigma$ such that for some~$t_a\in\fn{anc}(t,p)$,-$t_e\in T_e$, $\sigma(t_a)=\sigma(t_e)$.-Skeleton~$k_1$ is a \emph{contraction} if-$k\reduction{\ops{S}_\sigma}k_0\reduction{\fn{skel}}k_1$.-\end{defn}--{\cpsa} computes a set of substitutions for each critical position, and-then removes some substitutions to form a complete set of most-general unifiers.  Only most general unifiers are used for-contractions.--The function~$\ops{A}_{i,n}$ augments a preskeleton with a new strand.-It appends the instance~$i$ to the sequence of instances, adds node-orderings, and adds atoms as specified by the role of the instance.-The function orders the last node in the strand before some node~$n$-in the preskeleton.--\begin{defn}[Augmentation]\label{def:augmentation}-Skeleton~$k_0$ reduces to preskeleton~$k_1$ by the augmentation~$i,n$,-written $k_0\reduction{\ops{A}_{i,n}}k_1$ if-\begin{enumerate}-\item $\fn{insts}(k_1)=\fn{insts}(k_0)\append\seq{i}$;-\item $\kprec{k_1}=(\mathord{\kprec{k_0}}\cup\mathord{\Rightarrow_{k_1}}\cup-\mathord{\{(n_0, n)\}})^\ast$, where $n_0=(|\fn{insts}(k_0)|,-\fn{height}(i)-1))$;-\item $\fn{unique}(k_1)$ is $\fn{unique}(k_0)$ and the inherited-  uniquely originating atoms in~$i$;-\item $\fn{non}(k_1)$ is $\fn{non}(k_0)$ and the inherited-  non-originating atoms in~$i$.-\end{enumerate}-\end{defn}--\begin{defn}[Regular Augmentation]-Let~$t_c$ be a critical message at~$n$ in~$k$, and~$i$ be an instance-of a regular, non-listener role.  Skeleton~$k_2$ is a \emph{regular-  augmentation} if-$k\reduction{\ops{S}_\sigma}k_0\reduction{\ops{A}_{i,n}}k_1-\reduction{\fn{skel}}k_2$ for some substitution~$\sigma$ and~$t_c$ is-solved in~$k_2$ after~$k_0$ at~$n$.-\end{defn}--The details of regular augmentation is the subject of the next section.--\begin{defn}[Listener Augmentation]-Let~$t_c$ be a critical message at~$n$ in~$k$, and-$T=\fn{esc}(k,n,t_c)$.  For each $\enc{t_0}{t_1}\in T$,-skeleton~$k_1$ is a \emph{listener augmentation} if-$k\reduction{\ops{A}_{i,n}}k_0\reduction{\fn{skel}}k_1$ and~$i$ is a-listener for $\fn{inv}(t_1)$.  If $t_c=\enc{t_0}{t_1}$, then-skeleton~$k_1$ is a \emph{listener augmentation} if-$k\reduction{\ops{A}_{i,n}}k_0\reduction{\fn{skel}}k_1$ and~$i$ is a-listener for $t_1$.-\end{defn}--\begin{defn}[Cohort Member]-For unrealized node~$n$ in a skeleton~$k_0$, and a position~$p$ at~$n$, $k_0\reduction{n,p}k_1$ asserts that $k_1$ is a-member of the cohort of~$k_0$, where~$k_1$ is derived using-contraction, regular augmentation, or listener augmentation, and~$p$-is solved in~$k_1$ after~$k_0$ at~$n$.  For the setwise cohort member-reduction, $\{k_0\}\setreduction{n,t}\{k_1\mid k_0\reduction{n,p}k_1\}$,-when~$n$ is unrealized in~$k_0$, and~$p$ is a critical position at~$n$.-\end{defn}--\begin{thm}[Cohort Correct]-Let node~$n$ be unrealized in skeleton~$k$, and~$p$ be a critical-position at~$n$.  For every realized skeleton~$k_1$ such that-$k\homomorphism{\psi_1}k_1$, there is a~$k_0$,~$\psi_0$, and~$\psi$-with $k\reduction{n,p}k_0$, $k\homomorphism{\psi_0}k_0$, and-$\psi_1=\psi\circ\psi_0$.--$$\xymatrix@C=3em{-k\ar@{|->}[r]^{\psi_0} \ar@{|->}[rd]_{\psi_1} &-k_0 \ar@{|->}[d]^{\psi}\\-&k_1}$$-\end{thm}--\begin{thm}[Cohort]-Reduction $\setreduction{\fn{co}}=\bigcup_{n,t}\setreduction{n,p}$ is-confluent.-\end{thm}--\begin{thm}[Critical Message Solved]-If $k_0\reduction{n_0,p_0}k_1 \reduction{n_1,p_1}\ldots-\reduction{n_{\ell-1},p_{\ell-1}}k_\ell$ is a sequence of cohort member-reductions, then for positive~$\ell$,~$p_0$ is solved in~$k_\ell$-after~$k_0$ at~$n_0$.-\end{thm}--\section{Finding Regular Augmentations}\label{augmentations}--Let~$t_c$ be the critical message that demonstrates~$n$ is a test node-in skeleton~$k$.  For each substitution-instance pair~$(\sigma,i)$-that satisfies some properties, there is a potential regular-augmentation with~$\comp{\reduction{\fn{skel}}}%-{\comp{\reduction{\ops{A}_{i,n}}}{\reduction{\ops{S}_\sigma}}}$.-When successful, the message~$t$ in the last node of the added strand-is outbound, carries~$\sigma(t_c)$, but~$\sigma(t_c)$ is not carried-only within escape set~$\sigma(T_e)$ in~$t$.  Moreover, for every-other message~$t$ in the strand,~$\sigma(t_c)$ is carried only within-escape set~$\sigma(T_e)$ in~$t$.  The last node in the strand is-called a \emph{transforming node}, as this node no longer protects the-critical message, but nodes that precede it do.--When generating a candidate substitution-instance pair~$(\sigma,i)$-for augmentation, $\fn{trace}(i)$ must contain a member of~$T_t$, the-set of \emph{target messages}.  The critical message~$t_c$ is a member along-with each ancestor of the critical message~$t_c$ on every path to a place-at which~$t_c$ is carried in every member of the escape set~$T_e$,-with the exception of the members of~$T_e$.  That is,-$T_t=\{t_c\}\cup\{t_t\mid t_e\in T_e,p\in\fn{carpos}(t_c, t_e),-t_t\in\fn{anc}(t_e,p)\}\setminus T_e$.--To find all candidate substitution-instance pairs, each role in the-protocol is considered.  For each role~$r$, a substitution~$\sigma_r$-is created.  The domain of~$\sigma_r$, $\fn{Dom}(\sigma_r)$, is the-variables that occur in the role's trace.  The substitution~$\sigma_r$-is a bijection, and each variable in $\fn{Ran}(\sigma_r)$ is chosen in-a way that ensures it does not occur in the skeleton~$k$ or in any of-its roles.--Consider each outbound message~$t_{n-1}$ in $\fn{rtrace}(r)=\seq{\pm-  t_0,\ldots,+t_{n-1},\ldots}$.  Let substitutions~$S$ be a complete-set of most general unifiers~$\sigma'$ such that for every message~$t$-that is carried by $t_{n-1}$ and message~$t_t\in T_t$,-$\sigma'(t)\equiv\sigma'(t_t)$, and $\sigma_r\unlhd\sigma'$.  This-operation inserts the critical message into the trace-$\sigma_r\circ\fn{rtrace}(r)$.--\begin{figure}-\begin{center}-\begin{tabular}{l}-$\fn{cowt}(t,T,C,S) ={}$\\-$\quad\bigcup_{\sigma\in S}\fn{cowt}_0(t,T,C,\sigma)$\\-\\-$\fn{cowt}_0(t,T,C,\sigma) ={}$\\-\quad \textbf{if} $\all{t}\pm t\in C\to\sigma(t)$ is {\cow} $\sigma(T)$ at-$\sigma(t')$ \textbf{then}\\-\qquad $\{\sigma\}$\\-\quad \textbf{else}\\-\qquad$\fn{cowt}(t,T,C,\fn{foldn}(t, T, C, \{\sigma\}))$\\-\\-$\fn{foldn}(t,T,\seq{},S)=S$\\-$\fn{foldn}(t,T,\seq{\pm t'}\append C,S)={}$\\-$\quad\fn{foldn}(t,T,C,\bigcup_{\sigma\in S}\fn{fold}(t,T,t',\sigma))$-\end{tabular}-\end{center}-\caption{The $\fn{cowt}$ Function}\label{fig:cowt}-\end{figure}--The next step is to explore ways to extend the substitution~$\sigma'$-so that for events in $\sigma'\circ\fn{rtrace}(r)$ that-precede~$t_{n-1}$, the critical message is carried only within the-escape set.  The function \fn{cowt}, presented in-Figure~\ref{fig:cowt}, performs the explorations, producing the-substitutions $S'=\fn{cowt}(t_c,T_e,\prefix{\fn{rtrace}(r)}{n-1},S)$.-Function $\fn{fold}$ is defined in Figure~\ref{fig:cows}.--The final step is to remove substitutions $\sigma\in S'$ such that-$\sigma(t_c)$ is carried only within $\sigma(T_e)$-in~$\sigma(t_{n-1})$ and produce a complete set of most general-unifiers~$S''$ by removing less general unifiers.  For each-$\sigma'\in S''$,-there is a potential regular augmentation constructed from-$(\sigma,i)$, where $\fn{role}(i)=r$, $\fn{height}(i)=n$,-$\fn{subst}(i)=\sigma$, and~$\sigma$ is~$\sigma'$ stripped of-mappings to messages with variables that do not occur in-$\sigma'\circ\prefix{\fn{rtrace}(r)}{n}$.--\begin{note}-For target terms to be the reasonable set for insertion of the-critical message, one must require that variables of sort message are-acquired.  This fact needs to be explained and noted as another reason-for the acquired variable constraint.-\end{note}--\subsection{Regular Augmentation and Hulling}--Consider regular augmentation-$k\reduction{\ops{S}_\sigma}k_0\reduction{\ops{A}_{i,n}}k_1-\reduction{\fn{skel}}k_2$, where $k_1$ is not a hulled preskeleton.-Let~$k_3$ be the result of one hulling step.  It is crucial that-$k\longmapsto k_2$, but it need not be the case that $k_1\longmapsto-k_3$.  The reason is that a point of origination on the augmenting-strand may move during hulling, but that's okay since the augmenting-strand is not in the image of a homomorphism from~$k$.  An-implementation must be careful not to check the preservation of-origination points in this particular case.--\section{Generalization}\label{generalization}--Each problem statement for {\cpsa} is expressed as a preskeleton.  If-the preskeleton cannot be transformed into a single skeleton using the-Preskeleton Reduction System, an error is signaled.  Otherwise, the-first skeleton is designated as the \index{point-of-view-  skeleton}point-of-view skeleton.  For each skeleton generated from a-point-of-view skeleton via contraction, augmentation, and-generalization, there is a homomorphism from the point-of-view-skeleton.  Simplifying the implementation is the motivation for-restricting the algorithm to problem statements that are expressed by-a single skeleton.--\begin{defn}[Generalize]-A skeleton~$k_0$ \emph{generalizes}-skeleton~$k_1$, written $k_1\reduction{<}_k k_0$, if-both~$k_0$ and~$k_1$ are realized,~$k_0$ and~$k_1$ are not isomorphic,-there is a homomorphism from a point-of-view skeleton~$k$ to~$k_0$, and-a strandwise injective homomorphism $k_0\mapsto k_1$.-\end{defn}--\begin{note}-Recent experiments show that pruning must not be performed when-generalizing.-\end{note}--If skeletons are allowed to be isomorphic, we-write~$k_1\reduction{\leq}_k k_0$, and note that $\reduction{\leq}_k$-defines a partial ordering.  Therefore, there are maximal elements in-the partial ordering.  A shape associated with a preskeleton-is a maximally generalized realized skeleton derived from the-preskeleton.--\begin{defn}[Shape]-Let~$k_0$ be a preskeleton such that $k_0\reduction{\fn{skel}}k$-and~$k$ is unique, and let~$k_1$ be a realized skeleton such that-$k\mapsto k_1$.  Skeleton~$k_2$ is a \emph{shape} of~$k_0$ if-$k_1\reduction{\leq}_k k_2$, and~$k_2$ is maximal among skeletons that-generalize~$k_1$.-\end{defn}--There are four generalization reductions used to transform a realized-skeleton into its shapes: deletion, weakening, forgetting, and-separation.--\begin{defn}[Deletion]-Skeleton~$k_0$ \emph{generalizes by deletion} skeleton~$k_1$, written-$k_1\reduction{\ops{D}_n}_k k_0$, if $k_1\reduction{<}_k k_0$,-$k_2\reduction{\fn{skel}}k_0$, and~$k_2$ is the result of deleting-node~$n$ in~$k_1$ and all of the nodes that follow it in its strand.-\end{defn}--\begin{defn}[Weakening]-Skeleton~$k_0$ \emph{generalizes by weakening} skeleton~$k_1$, written-$k_1\reduction{\ops{W}_{n,n'}}_k k_0$, if $k_1\reduction{<}_k k_0$,-$k_2\reduction{\fn{skel}}k_0$, and~$k_2$ is~$k_1$ except-$\kprec{k_2}=(\kprec{k_1}\setminus\{(n,n')\})^\ast$.-\end{defn}--\begin{defn}[Forgetting]-Skeleton~$k_0$ \emph{generalizes by origination assumption forgetting}-skeleton~$k_1$, written $k_1\reduction{\ops{F}_t}_k k_0$, if-$k_1\reduction{<}_k k_0$, $k_2\reduction{\fn{skel}}k_0$, and~$k_2$-is~$k_1$ except $\fn{unique}(k_2)=\fn{unique}(k_1)\setminus\{t\}$ and-$\fn{non}(k_2)=\fn{non}(k_1)\setminus\{t\}$.-\end{defn}--Sometimes a more general skeleton can be found by replacing some-occurrences of one variable by a fresh variable.  For variable-separation, the location of an occurrence of a variable is defined-using a skeleton's instance sequence.--\begin{defn}[Location]-Message~$t$ is at \emph{location} $(s,x,p)$ in~$k$ if-$t=\fn{subst}(I(s))(x)\termat p$ and $I=\fn{insts}(k)$.-\end{defn}--\begin{defn}[Separation]-Skeleton~$k_0$ \emph{generalizes by variable separation}-skeleton~$k_1$, written $k_1\reduction{\ops{V}_t}_k k_0$, if-$k_1\reduction{<}_k k_0$, $k_2\reduction{\fn{skel}}k_0$, and~$k_2$-is~$k_1$ except ~$t$ is a variable that occurs in multiple locations-in~$k_1$, and~$k_2$ is the result of replacing~$t$ with a variable~$t_0$-of the same sort at a subset of~$t$'s locations, where~$t_0$ occurs-nowhere in~$k_1$.-\end{defn}--When separating a non-originating term, both the term and its clone-are non-originating.  When separating a uniquely originating term,-either the term or its clone is uniquely originating.--\begin{note}-What happens when separating~$t$ in~$k$ into~$t$ and~$t_0$, and-$\cn{ltk}(t,t)\in\fn{non}(k)$?  Should a skeleton~$k_0$ with-$\cn{ltk}(t,t_0)\in\fn{non}(k_0)$ be a candidate separation?-Currently, only skeletons~$k_1$ with $\cn{ltk}(t,t)\in\fn{non}(k_1)$-and $\cn{ltk}(t_0,t_0)\in\fn{non}(k_1)$ are considered.-\end{note}--\begin{defn}[Generalization]-The reduction~$\reduction{\fn{gen}}_k-=\bigcup_n\reduction{\ops{D}_n}_k\cup-\bigcup_{n,n'}\reduction{\ops{W}_{n,n'}}_k\cup-\bigcup_t\reduction{\ops{F}_t}_k\cup \bigcup_t\reduction{\ops{V}_t}_k$-is the \emph{generalization} relation.  For the setwise generalization-reduction, $\{k_0\}\setreduction{\fn{gen}}_k\{k_1\}$ when-$k_0\reduction{\fn{gen}}_k k_1$.-\end{defn}--\begin{note}-The fact that each generalization reduction replaces a singleton with-just a singleton requires explanation.  We're not sure it's justified,-and harbor serious doubts.  It is justified if we can prove the-conjecture that the cohort reduction relation produces every shape,-and generalization just identifies which realized skeletons are-shapes.  However, one member of the test suite provides a counter-example to the conjecture.  Barring a bug in {\cpsa}, the conjecture-must be false.-\end{note}--\begin{thm}[Generalization]-The relation~$\setreduction{\fn{gen}}_k$ is terminating.-\end{thm}--\subsection*{Discussion}-In~\cite{DoghmiGuttmanThayer07}, the shapes of a point-of-view-skeleton are said to be minimal, in the partial ordering induced by-injective homomorphism, among all realized homomorphic images of the-point-of-view skeleton.  Minimal corresponds to maximally generalized.-The need for origination assumption forgetting was not known-when~\cite{DoghmiGuttmanThayer07} was written.  Generalization by-variable separation uses non-carried positions, and in particular,-positions that traverse an atom edge.  Algebras in previous strand-space papers have no concept of a position that traverses an atom-edge, and therefore cannot be used to specify generalization by-variable separation.--\section{Collapsing}\label{collapsing}--Let reduction $\setreduction{\fn{cg}}_k=(\setreduction{\fn{co}}\cup-\setreduction{\fn{gen}}_k)^+$, the transitive closure of the cohort-and generalization setwise reduction relations.  The normal forms of-this relation are sets of shapes, however, shapes may be missing from-each set.  The missing shapes are found by collapsing other shapes.--\begin{defn}[Collapsing]-Let $k_0$ and $k_1$ be two skeletons such that there are two-strands,~$s$ and~$s'$, and a substitution~$\sigma$ with-$\sigma(\fn{evt}(k_0,(s,p)))= \sigma(\fn{evt}(k_0,(s',p)))$ for all-$p<h$, where~$h$ is the height of strand~$s$ in~$k_0$.  Then~$k_0$-\emph{collapses} to~$k_1$, written $k_0\reduction{\fn{clp}}k_1$, if-$k_0\reduction{\ops{S}_\sigma}k\reduction{\ops{C}_{s,s'}}k'-\reduction{\fn{skel}}k_1$.-\end{defn}--\begin{defn}[Setwise Collapsing]-For the collapsing relation $\setreduction{\fn{clp}}_k\subseteq-\pow{\alg{K}}\times\pow{\alg{K}}$,-$K_0\setreduction{\fn{clp}}_k K_1$ if~$K_0$ is a normal form of-$\setreduction{\fn{cg}}_k$, for some $k_0\in K_0$, $k_0-\reduction{\fn{clp}}k$, $\{k\}\cup K_0\setreduction{\fn{cg}}_k K_1$,-and $K_0\neq K_1$.-\end{defn}--Notice that a setwise cohort reduction may produce the empty set, but-a setwise generalization and collapsing reduction never does.--\section{Skeleton Reduction System}\label{sec:skeleton reduction}--Let reduction-$\twoheadrightarrow_k=\setreduction{\fn{cg}}_k\cup-(\setreduction{\fn{clp}}_k)^+$.-\begin{thm}-The reduction~$\twoheadrightarrow_k$ is confluent.-\end{thm}--\begin{thm}[Soundness]-Let~$k_0$ be a preskeleton such that $k_0\reduction{\fn{skel}}k$-and~$k$ is unique and unrealized.  Skeleton~$k_1$ is a shape of~$k_0$-if $\{k\}\twoheadrightarrow_k K$, $k_1\in K$, and~$K$ is a normal-form.-\end{thm}--\begin{thm}[Completeness]-Let~$k_0$ be a preskeleton such that $k_0\reduction{\fn{skel}}k$-and~$k$ is unique and unrealized.  If $\{k\}\twoheadrightarrow_k K$,-and~$K$ is a normal form, then~$k_1$ is a shape of~$k_0$ only if-$k_1\in K$.-\end{thm}-\appendix--\section{Programs Specified by a Role's Trace}\label{sec:traces}--The behavior associated with a role's trace is possible as long as some-messages are available initially.  The required initial messages are-specified by a pair of ternary relations, $\flow{T_0}{C}{T_1}$ and-$\flow{T_0}{\pm t}{T_1}$.  The relation $\flow{T_0}{C}{T_1}$ asserts-that messages in~$T_1$ are available after a run of~$C$ given the-messages in~$T_0$ are available initially.  The relation is defined-using the $\flow{T_0}{\pm t}{T_1}$ relation.--$$\flow{T}{\seq{}}{T}\qquad-\infer{\flow{T_0}{\pm t}{T}\quad\flow{T}{C}{T_1}}%-{\flow{T_0}{\seq{\pm t}\append C}{T_1}}$$--The $\flow{T_0}{\pm t}{T_1}$ relation is defined using the-$\flow{T_0}{C}{T_1}$ relation.  An outbound message can be formed if-it is available initially-$$\infer{t\in T}{\flow{T}{+t}{T}}$$-or if it can be formed by construction.-$$\infer{\flow{T}{\seq{+t_0,\ldots,+t_{n-1}}}{T}}%-{\flow{T}{+f(t_0,\ldots,t_{n-1})}{T}}\quad-\left[\begin{array}{l}-f\in\Sigma_{w,s}\land n=|w|\land {}\\-\mbox{$f(t_0,\ldots,t_{n-1})$ not an atom}-\end{array}\right]$$--An inbound message makes atoms, acquired variables, and-encryptions available.-$$\flow{T}{-t}{T\cup\{t\}}\quad [\mbox{$t$ an atom or a variable}]$$-When the decryption key is available, the contents of the encryption-is also available.  Furthermore, the encryption can be sent in future-messages without access to its encryption key.-$$\infer{\flow{T_0}{+\fn{inv}(t_1)}{T_0}\quad-  \flow{T_0}{-t_0}{T_1}}{\relax-  \flow{T_0}{-\enc{t_0}{t_1}}{T_1\cup\{\enc{t_0}{t_1}\}}}$$ A received-encryption that can be sent ensures the encyption agrees with-currently available terms and makes nothing new available.-$$\infer{\flow{T}{+\enc{t_0}{t_1}}{T}}{\relax-  \flow{T}{-\enc{t_0}{t_1}}{T}}$$--Consider an operation $f\in\Sigma_{w,s}$ other than the encryption-operation.  The order in which messages that occur in a message-constructed using~$f$ are made available may determine if the-decryption key of an encryption is available.  Let~$\pi_n$ be a-permutation on the domain of a sequence of length~$n$.-$$\infer{\flow{T_0}{\seq{-t_0,\ldots,-t_{n-1}}\circ\pi_n}{T_1}}%-{\flow{T_0}{-f(t_0,\ldots,t_{n-1})}{T_1}}\quad-\left[\begin{array}{l}-f\in\Sigma_{w,s}\land n=|w|\land f\neq\cn{enc}\land {}\\-\mbox{$f(t_0,\ldots,t_{n-1})$ not an atom}-\end{array}\right]$$--\begin{defn}[Trace Parameters]-The set of atoms~$T_0$ are \emph{parameters} of trace~$C$ if-$\flow{T_0}{C}{T_1}$ for some~$T_1$, and~$T_0$ is minimal, that is for-all~$T'_0$ such that $\flow{T'_0}{C}{T_1}$, $T'_0\not\subset T_0$.-\end{defn}--The role $\seq{\outbnd\enc{a,n}{K_b},\inbnd\enc{n}{K_a}}$ has-two sets of parameters, $\{a,n,K_b,K^{-1}_a\}$-and $\{a,n,K_b,K_a\}$.  A program that implements the role using the-second set is useless, so it will be ignored.  The intended program-for the role follows.-$$\begin{array}{ll}-\cn{proc}(a,n,K_b,K^{-1}_a)\\-\quad \cn{send}(\enc{a,n}{K_b});\\-\quad x_0\gets \cn{recv}();\\-\quad x_1\gets \cn{decrypt}(x_0,K^{-1}_a);\quad\mbox{--- may fail}\\-\quad x_1 \neq n \to \cn{fail};\\-\cn{end}-\end{array}$$--Let $T_0=\{a,n,K_b,K^{-1}_a\}$ and $T_1=T_0\cup\{\enc{n}{K_a}\}$.  The-derivation tree that specifies the intended program has the following-outline.-$$\begin{array}{l}-\mbox{\ldots~construct outbound message}  \\-\flow{T_0}{\outbnd\enc{a,n}{K_b}}{T_0}\\-\mbox{\ldots~decode inbound message}  \\-\flow{T_0}{\inbnd\enc{n}{K_a}}{T_1} \\-\mbox{\ldots~compose trace}  \\-\flow{T_0}{\seq{\outbnd\enc{a,n}{K_b},\inbnd\enc{n}{K_a}}}{T_1}-\end{array}$$--The decoding of the inbound message is specified by this derivation.-$$\infer{\flow{T_0}{\outbnd K^{-1}_a}{T_0}\qquad-\infer{\flow{T_0}{\outbnd n}{T_0}}{\flow{T_0}{\inbnd n}{T_0}}}-{\flow{T_0}{\inbnd\enc{n}{K_a}}{T_1}}$$--\section*{Acknowledgment}--Carolyn Talcott and Leonard Monk provided valuable feedback on drafts-of this document.--\bibliography{cpsa}-\bibliographystyle{plain}--\printindex--\tableofcontents+\documentclass[12pt]{report}+\usepackage{amssymb}+\usepackage{amsmath}+\usepackage{amsthm}+\usepackage{url}+\usepackage[matrix,arrow,curve]{xy}+\usepackage{makeidx}+% Include this for a hyperlinked version of the document+% \usepackage{hyperref}+\theoremstyle{definition}+\newtheorem{defn}{Definition}[chapter]+\newtheorem{thm}{Theorem}[chapter]+\newtheorem{lem}[thm]{Lemma}+\newtheorem{cor}[thm]{Corollary}+\newtheorem{conj}[thm]{Conjecture}+\newtheorem{prop}[thm]{Proposition}+\input{macros}++\hyphenation{pro-to-skel-e-ton}+\hyphenation{pro-to-role}++% This environment is used for comments about this draft.+\newenvironment{note}{\itshape\par}{}++\newcommand{\inv}[1]{\ensuremath{\cn{inv}(#1)}}+\newcommand{\gen}{\ensuremath{\cn{g}}}+\newcommand{\expr}[2]{\ensuremath{{#1}^{#2}}}+\newcommand{\bca}{\textsc{bca}}+\newcommand{\alga}{\alg{A}}+\newcommand{\tr}{\ensuremath{\mathfrak C}}+\newcommand{\base}{\ensuremath{\mathfrak B}}+\newcommand{\ints}{\ensuremath{\mathbb Z}}+\newcommand{\solve}[1]{\stackrel{#1}{\longtwoheadrightarrow}}+\newcommand{\outpred}{\fn{outpred}}+\newcommand{\avoid}{\fn{avoid}}+\newcommand{\dcmp}{\fn{dcmp}}+\newcommand{\carpos}{\fn{carpos}}+\newcommand{\esc}{\fn{esc}}+\newcommand{\aug}{\fn{aug}}+\newcommand{\crit}{\fn{crit}}+\newcommand{\critpos}{\fn{critp}}+\newcommand{\anc}{\fn{anc}}+\newcommand{\mcow}{\fn{cow}}+\newcommand{\mncow}{\fn{ncow}}+\newcommand{\sdom}{\fn{Dom}}+\newcommand{\sran}{\fn{Ran}}+\newcommand{\svars}{\fn{Vars}}+\newcommand{\evt}{\fn{evt}}+\newcommand{\msg}{\fn{msg}}+\newcommand{\role}{\mathsf{r}}+\newcommand{\skel}{\mathsf{k}}+\newcommand{\rl}{\fn{rl}}+\newcommand{\nodes}{\fn{nodes}}+\newcommand{\lsn}{\fn{lsn}}+\newcommand{\init}{\fn{init}}+\newcommand{\resp}{\fn{resp}}+\newcommand{\form}{\mathcal{F}}+\newcommand{\sent}{\mathcal{S}}++\makeindex++\title{The CPSA Specification:\\+A Reduction System for Searching for Shapes in Cryptographic Protocols}+\author{John D.~Ramsdell\qquad Joshua D.~Guttman\\+  \quad Moses D.~Liskov\qquad Paul D.~Rowe\\+  The MITRE Corporation\\ CPSA Version \version}++\begin{document}+\maketitle+\cpsacopying++\tableofcontents++\begin{abstract}+We describe a term reduction system that enumerates all essentially+different executions possible for a cryptographic protocol.  We call+them the \emph{shapes} of the protocol.  Naturally occurring protocols+have only finitely many, indeed very few shapes.  Authentication and+secrecy properties are easy to determine from them, as are attacks and+anomalies.  Our Cryptographic Protocols Shapes Analyzer ({\cpsa})+program is a direct implementation of the reduction system described+within, and the form of the reduction system is partially determined+by the implementation.+\end{abstract}++\chapter{Introduction}++The Cryptographic Protocol Shapes Analyzer ({\cpsa}) attempts to+enumerate all essentially different executions possible for a+cryptographic protocol.  We call them the \emph{shapes} of the+protocol.  Naturally occurring protocols have only finitely many,+indeed very few shapes.  Authentication and secrecy properties are+easy to determine from them, as are attacks and anomalies.++The shapes analysis is performed within a pure Dolev-Yao model.  The+{\cpsa} program reads a sequence of problem descriptions, and prints+the steps it used to solve each problem.  For each input problem,+{\cpsa} is given some initial behavior, and it descovers what shapes+are compatible with it.  Normally, the initial behavior is from the+point of view of one participant.  The analysis reveals what the other+participants must have done, given the participant's view.++This document specifies the {\cpsa} program using a term reduction+system.  Chapter~\ref{chp:order-sorted mesg algs} describes message+algebras as order-sorted quotient term algebras.+Chapter~\ref{chp:strand spaces and bundles} presents an+implementation-oriented view of strand spaces.+Chapter~\ref{chp:adversary model} details the model of the adversary.+The formal definition of a partial run of a protocol is called a+skeleton, and is introduced in Chapter~\ref{chp:skeletons}.++The term reduction systems used to specify the algorithm is presented+in Chapter~\ref{chp:algorithms}, and the primitive reduction rules are+in Chapter~\ref{chp:prim preskel ops}.  The rules used to transform+terms called preskeletons into skeletons are in+Chapter~\ref{chp:preskeleton reduction}.++The algorithm used to model adversarial behavior is in+Chapter~\ref{chp:penetrator derivable}.  The algorithms used to infer+what else must have happened given a partial description of a run of+a protocol as skeleton is in Chapters~\ref{chp:cow} and~\ref{chp:auth+  tests}.  Chapters~\ref{chp:generalization} and~\ref{chp:collapsing}+find most general descriptions of {\cpsa} answers---the shapes.+Finally, Chapter~\ref{chp:skeleton reduction} assembles reduction+rules into one system that specifies the {\cpsa} program.++Appendix~\ref{chp:traces} details the sense in which a protocol role+can be viewed as an abstraction of a program.+Appendix~\ref{chp:logic} describes a formula in the language of+order-sorted first-order logic for each problem and its shapes found+by {\cpsa}.  The formula is called a shape analysis sentence.  The+formula is modeled by all skeletons that describe full runs of a+protocol when {\cpsa} finds all the shapes for the problem.++Ideally, if there is a finite number of shapes associated with a+problem statement, {\cpsa} will find them given enough resources.  In+other words, the search is complete, i.e.\ every shape can in fact be+found in a finite number of steps.  The {\cpsa}+Theory~\cite{cpsatheory10} contains our latest attempt at showing the+search algorithm is complete.++A {\cpsa} release includes two other documents, the {\cpsa}+Design~\cite{cpsadesign09} and the {\cpsa} Primer~\cite{cpsaprimer09}.+The design document describes details of the {\cpsa}+implementation that would clutter this one.  It should be read by+anyone interesting in reading and modifying the source code.  The+{\cpsa} Primer provides an overview of {\cpsa}, and may be worth+reading before this document is approached.++\section{Notation}\label{sec:notation}++A finite sequence\index{sequence} is a function from an initial+segment of the whole numbers.  The length of a sequence~$f$ is~$|f|$,+and sequence~$f=\seq{f(1),\ldots,f(n)}$ for $n=|f|$.  Alternatively,+$\seq{x_1,x_2,\ldots,x_n} =x_1\cons x_2\cons\ldots\cons+x_n\cons\seq{}$.  If~$S$ is a set, then~$S^\ast$ is the set of finite+sequences of~$S$, and~$S^+$ is the non-empty finite sequences of~$S$.+The concatenation of sequences~$f_0$ and~$f_1$ is~$f_0\append f_1$.+The prefix of sequence~$f$ of length~$n$ is~$\prefix{f}{n}$.++\chapter{Order-Sorted Message Algebras}\label{chp:order-sorted mesg algs}++{\cpsa} models a message by an equivalence class of terms over a+signature. A sort system is used to classify messages.  {\cpsa}+depends on the sort system to allow it to treat a variable that+represents an asymmetric key differently from a variable that+represents an arbitrary message.  In particular, {\cpsa} uses+order-sorted quotient term algebras~\cite{GoguenMeseguer92} for+message algebras.  This formalism enables the use of well-known+algorithms for unification and matching in the presences of equations+and sorts~\cite[Chapter~8]{RobinsonVoronkov01}.++This paper makes no attempt to provide a general introduction to+order-sorted quotient term algebras.  We use a message algebra called+the Basic Crypto Algebra (\bca), which is the main algebra used by+{\cpsa}.++\begin{figure}+\begin{center}+Sorts: \dom{name}, \dom{text}, \dom{data}, \dom{skey}, \dom{akey} $<$ \dom{mesg}\\[1ex]+Base sorts: \dom{name}, \dom{text}, \dom{data}, \dom{skey}, \dom{akey}\\+Carried positions: $\bullet$ denotes a carried position.\\[1ex]+\begin{tabular}{@{}ll}+$\enc{\bullet}{(\cdot)}\colon\dom{mesg}\times\dom{mesg}\rightarrow\dom{mesg}+$&Encryption\\+$(\bullet,\bullet)\colon\dom{mesg}\times\dom{mesg}\rightarrow\dom{mesg}$+&Pairing\\+``\ldots''$\colon{}\dom{mesg}$& Tag constants\\+$K_{(\cdot)}\colon\dom{name}\rightarrow\dom{akey}$+&Public key of name\\+$(\cdot)^{-1}\colon\dom{akey}\rightarrow\dom{akey}$+&Inverse of key\\+$\cn{ltk}(\cdot,\cdot)\colon\dom{name}\times\dom{name}\rightarrow\dom{skey}$+& Long term key+\end{tabular}\\[1ex]+Equation: $(x^{-1})^{-1} \approx x$ for $x\colon\dom{akey}$+\end{center}+\caption{Basic Crypto Signature and Equation}\label{fig:bcs}+\end{figure}++There are six {\bca} sorts: $\dom{mesg}$, \index{sorts}the sort of+all messages, $\dom{skey}$, the sort of symmetric keys,+$\dom{akey}$, the sort of asymmetric keys, $\dom{name}$, the sort of+participant names, and $\dom{text}$ and $\dom{data}$ for ordinary+values.  Sort $\dom{mesg}$ is sometimes written as~$\top$ and the+other sorts are called \index{base sorts}\emph{base sorts}.+All base sorts are subsorts of $\dom{mesg}$.  The function+symbols, or \index{operations}\emph{operations}, used to form terms+are given by the signature in Figure~\ref{fig:bcs}.++Each variable~$x$ used to form a term has a unique sort~$s$, written+$x\colon s$.  Variable set~$X$\index{variable set} is an indexed set+of sets of variables, $X_s=\{x\mid x\colon s\}$.  For {\bca},+$X_{\dom{mesg}}$, $X_{\dom{skey}}$, $X_{\dom{akey}}$,+$X_{\dom{name}}$, $X_{\dom{text}}$, and $X_{\dom{data}}$ partition+the set of variables in~$X$.  By abuse of notation, at times, we+write~$X$ for the set of variables in~$X$.++\begin{figure}+$$\begin{array}{r@{{}={}}l}+\alga_{\dom{skey}}&\{\{x\}\mid x \in X_{\dom{skey}}\} \cup \{\{\cn{ltk}(a,b)\}\mid a \in X_{\dom{name}}, b \in X_{\dom{name}}\}\\+\alga_{\dom{akey}}&\begin{array}[t]{@{}l}+\{\{x^{-2n}\mid n\in\nat\}\mid x\in X_{\dom{akey}}\}\\+\quad{}\cup\{\{x^{-2n-1}\mid n\in\nat\}\mid x\in X_{\dom{akey}}\}\\+\quad{}\cup\{\{K_x^{-2n}\mid n\in\nat\}\mid x\in X_{\dom{name}}\}\\+\quad{}\cup\{\{K_x^{-2n-1}\mid n\in\nat\}\mid x\in X_{\dom{name}}\}\\+\end{array}\\+\alga_{\dom{name}}&\{\{x\}\mid x \in X_{\dom{name}}\}\\+\alga_{\dom{text}}&\{\{x\}\mid x \in X_{\dom{text}}\}\\+\alga_{\dom{data}}&\{\{x\}\mid x \in X_{\dom{data}}\}\\+\base&\alga_{\dom{skey}} \cup \alga_{\dom{akey}} \cup \alga_{\dom{name}} \cup \alga_{\dom{text}} \cup \alga_{\dom{data}}\\+\alga^0&\base\cup \{\{x\}\mid x\in X_{\dom{mesg}}\} \cup+\{\{x\}\mid x \hbox{ is a tag constant }\}\\+\alga^{n+1}&\alga^n+\begin{array}[t]{@{}l}+{}\cup\{\{(t_0,t_1)\mid t_0\in T_0, t_1\in T_1\}\mid+ T_0\in\alga^n,T_1\in\alga^n\}\\+{}\cup\{\{\enc{t_0}{t_1}\mid t_0\in T_0, t_1\in T_1\}\mid+ T_0\in\alga^n,T_1\in\alga^n\}+\end{array}\\+\alga = \alga_{\dom{mesg}}&\bigcup_{n\in\nat}\alga^n+\end{array}$$+\caption{{\bca} Messages~$\alga$ and Atoms~$\base$}\label{fig:algebra}+\end{figure}++The Basic Crypto Quotient Term Algebra~$\alga$ generated by variable+set~$X$ is displayed in Figure~\ref{fig:algebra}.  The union of the+messages in~$\alga$ is set of terms generated by~$X$, and~$\alga$+partitions the set of terms into a set of equivalence classes induced+by the equations.  Terms~$t_0$ and~$t_1$ are equivalent, written+$t_0\equiv t_1$, iff $t_0\in T\land t_1\in T$ for some $T\in\alga$.+The canonical representative of a message is the $t$ in $\{t'\mid+t'\equiv t\}$ with the fewest occurrences of the $(\cdot)^{-1}$+operation.++Keys, names, data, and texts in the algebra are called+\index{atoms}\emph{atoms} and are members of~$\base$.  We write+$t\colon B$ iff $\{t'\mid t'\equiv t\}\in\base$.  Note that encryption+is defined with an encryption key of sort $\dom{mesg}$.  When the+encryption key is of sort $\dom{akey}$ this is meant to model+asymmetric encryption: otherwise, this models symmetric encryption.+Note that even complex messages such as encryptions can be used as+encryption keys in the symmetric sense.++To find the decryption key associated with an encryption, one must+exclude the case in which the key is a variable of sort \dom{mesg},+as there is no way to determine if the encryption operation denotes+symmetric or asymmetric encryption.  Therefore, the decryption+key\index{inverse key} associated with encryption key~$t$+is~$\fn{inv}(t)$.++$$\fn{inv}(t) =\left\{+\begin{array}{ll}+\cn{invk}(t)&\mbox{if $t\colon\dom{akey}$;}\\+\mbox{undefined}&\mbox{if $t$ is a variable of sort $\dom{mesg}$;}\\+t&\mbox{otherwise.}+\end{array}\right.$$++An important property possessed by the algebra is that for all $T\in\alga$,+if there are any encryptions in $T$ then all members of $T$ are encryptions.+As a result, a message can be identified as representing an encryption+and if it is, decomposed into its plaintext and its decryption key.+This property is a consequence of the fact that equations relate+atoms, not arbitrary messages.  A similar property holds for pairs.++We write $\alga_X$ when it is important to identify the variable+set~$X$ that generates the algebra.  Given two variable sets~$X$+and~$Y$, a \index{substitution}\emph{substitution} is an order-sorted+map~$\sigma\colon X\rightarrow\alga_Y$ such that $\sigma(x)\neq x$ for+only finitely many elements of~$X$.  For a substitution~$\sigma$, the+\index{domain}\index{domain}\emph{domain} is the set of variables+$\sdom(\sigma)=\{x\mid \sigma(x)\neq x\}$ and the+\index{range}\emph{range} is the set $\sran(\sigma)=\{\sigma(x)\mid+x\in\sdom(\sigma)\}$.  Substitution~$\sigma_0$ is \index{more general+  substitution}\emph{more general than}~$\sigma_1$,+written~$\sigma_0\unlhd\sigma_1$, if there exists a+substitution~$\sigma_2$ such that+$\all{x}\sigma_1(x)\equiv\sigma_2(\sigma_0(x))$.  Given a+substitution~$\sigma\colon X\rightarrow\alga_Y$, the unique+homomorphism\index{homomorphism!algebra} $\sigma^\ast\colon+\alga_X\rightarrow\alga_Y$ induced by~$\sigma$ is also+denoted~$\sigma$.++A \index{position}\emph{position}~$p$ is a finite sequence of whole+numbers.  The term in~$t$ that \emph{occurs at}~$p$, written~$t\termat+p$, is:+$$\begin{array}{l}+t\termat\seq{}=t;\\+(t_1,t_2)\termat i\cons p=t_i\termat p\mbox{ for $i\in\{1,2\}$};\\+\enc{t_1}{t_2}\termat i\cons p=t_i\termat p\mbox{ for+  $i\in\{1,2\}$};\\+t^{-1}\termat 1\cons p=t\termat p.+\end{array}$$+A term~$t$ \index{occurs in}\emph{occurs in} term~$t'$ if $t=t'\termat+p$ for some~$p$.  A message~$T$ \emph{occurs in} message~$T'$ if the+canonical representative of~$T$ occurs in the canonical representative+of~$T'$.++A carried term is one that can be extracted from a message reception+assuming plaintext is extractable from encryptions.  The positions at+which term $t$ is carried in $t'$ is $\carpos(t,t')$\index{carried+  positions}\index{carpos@\carpos}\label{def:carried positions},+where+$$\carpos(t,t')=\left\{+\begin{array}{ll}+\{\seq{}\}&\mbox{if $t'\equiv t$, else}\\+\multicolumn{2}{l}{\{1\cons p \mid+p\in\carpos(t,t_1)\}}\\+& \mbox{if $t'=\enc{t_1}{t_2}$, else}\\+\multicolumn{2}{l}{\{i\cons p \mid+i\in\{1,2\}, p\in\carpos(t,t_i)\}} \\+& \mbox{if $t'=(t_1,t_2)$ else}\\+\emptyset&\mbox{otherwise.}+\end{array}\right.$$++Term~$t$ \index{carries}\emph{carries}~$t'$ if $\carpos(t',t)$ is not+empty, and $t'\sqsubseteq t$ when~$t'$ is carried by~$t$.  Note that+for all terms $t_0,t_1,t'_0,t'_1$, if $t_0\equiv t_1$ and $t'_0\equiv+t'_1$, then $\carpos(t_0,t'_0)= \carpos(t_1,t'_1)$.  We write $t'+\sqsubseteq_p t$ when $p \in \carpos(t',t)$ and $t \termat p \equiv+t'$.++In what follows, we will often conflate a term with the message of+which it is a member, and use lowercase letters to denote both.++\chapter{Strand Spaces and Bundles}\label{chp:strand spaces and bundles}++When using strand space theory, one normally hypothesizes the+existence of a single global strand space.  This is a very reasonable+assumption for theoretical analysis, but from the point view of an+implementer, it turns out that it is better to assume there are many+local strand spaces and the design specification task is to describe+the relations between these local spaces.  Our reformulation of strand+space notation provides an implementation oriented way of describing+the concept of a local strand space, and a direct link between from+algorithm specification to the data structures used in the+implementation.++A run of a protocol is viewed as an exchange of messages by a finite+set of local sessions of the protocol.  Each local session is called a+\index{strand}\emph{strand}.  The behavior of a strand, its+\index{trace}\emph{trace}, is a sequence of messaging events.  An+\index{event}\emph{event} is either a message transmission or a+reception.  Outbound message $t\in\alga_X$ is written as~$\outbnd t$,+and inbound message~$t$ is written as~$\inbnd t$.  The set of traces+over $\alga_X$ is $\tr_X=(\pm\alga_X)^+$.  A message+\index{originates}\emph{originates} in a trace if it is carried by+some event and the first event in which it is carried is outbound.  A+message is \index{gained}\emph{gained} by a trace if it is carried by+some event and the first event in which it is carried is inbound.  A+message is \index{acquired}\emph{acquired} by a trace if it first+occurs in a reception event and is also carried by that event.++Abstractly, a strand space is a multiset of traces, but since we wish+to name each element, a \index{strand space}\emph{strand+  space}~$\Theta_X$ over algebra~$\alga_X$ is defined to be a sequence+of traces in $\tr_X$.  A strand~$s$ is a member of the domain of+$\Theta_X$, and its trace is $\Theta_X(s)$.  In a strand space, the+elements of the generator set~$X$ denote atomic message elements, such+as keys, and not composite messages, such as encryptions and pairs.+Therefore, the sort of every variable in~$X$ is a base sort.++Message events occur at nodes in a strand space.  For each strand~$s$,+there is a node for every event in~$\Theta(s)$.  The+\index{nodes}\emph{nodes} of strand space $\Theta$ are $\{(s,i)\mid+s\in\sdom(\Theta), 1\leq i\leq |\Theta(s)|\}$, the event at a node is+\index{evt@\evt}$\evt_\Theta(s,i)=\Theta(s)(i)$, and the message at a+node is \index{msg@\msg}$\msg_\Theta(s,i) = m$ such that+$\evt_\Theta(s,i) = \pm m$.  Just as a position names a subterm within+another term, a strand names a trace within a strand space, and a node+names an event in a strand space.  The relation~$\Rightarrow$ defined+by $\{(s,i)\Rightarrow(s,i+1)\mid s\in\sdom(\Theta), 1\leq+i<|\Theta(s)|\}$ is called the \index{strand succession}\emph{strand+  succession relation}.++A \index{bundle}\emph{bundle} in strand space $\Theta$ is a finite+directed acyclic graph $\Upsilon(\Theta,\to)$, where the vertices are+the nodes of $\Theta$, and an edge represents+communication~($\rightarrow$) or strand succession~($\Rightarrow$).+For \index{communication}communication, if $n_0\rightarrow n_1$, then+there is a message~$t$ such that~$\evt_\Theta(n_0)=\outbnd t$+and~$\evt_\Theta(n_1)=\inbnd t$.  For each reception node~$n_1$, there+is a unique transmission node~$n_0$ with $n_0\rightarrow n_1$.++Each acyclic graph has a transitive asymmetric relation~$\prec$ on its+vertices.  The relation specifies the causal ordering of nodes in a+bundle.  Relation~$R$ on set~$S$ is \emph{asymmetric} iff+$x\mathbin{R}y$ implies not $y\mathbin{R}x$ for all distinct $x,y \in+S$.++An atom \index{uniquely originates}\emph{uniquely originates} in a+bundle if it originates in the trace of exactly one strand.  An atom+is \index{non-originating}\emph{non-originating} in a bundle if it+originates on no strand, but each of its variables occurs in some+strand's trace.++In a run of a protocol, the behavior of each strand is constrained by+a role in a protocol.  Adversarial strands are constrained by roles as+are non-adversarial strands.  A protorole over $\alga_Y$ is+$\role_Y(C,N,U)$, where $C\in\tr_Y$, $N\subseteq\base_Y$, and+$U\subseteq\base_Y$.  The trace of the role is~$C$, its+non-origination assumptions are~$N$, and its unique origination+assumptions are~$U$.  A protorole is a \index{role}\emph{role} if (1)+$t\in N$ implies $t$ is not carried in $C$, and all variables in $N$+occur in $C$, (2) $t\in U$ implies $t$ originates in $C$, and (3) if+variable~$x$ occurs in $C$ then $x$ is an atom or it is acquired in+$C$.  A \index{protocol}\emph{protocol} is a set of roles.  Let+\index{Vars@\svars}$\svars(P)$ be the set of variables that occur in+the traces of the roles in protocol~$P$.++A bundle~$\Upsilon(\Theta_X,\to)$ is a \index{run of+  protocol}\emph{run of protocol} $P$ if there is a role mapping+$\rl\colon\Theta_X\to P$ that satisfies properties for each+$s\in\sdom(\Theta_X)$.  Assuming $\rl(s)=\role_Y(C,N,U)$ and $X$ and+$Y$ share no variables, and let $h=|\Theta_X(s)|$, the properties are+(1) $h\leq|C|$, (2) there is a+homomorphism~$\sigma\colon\alga_Y\to\alga_X$ such that+$\comp{\sigma}{\prefix{C}{h}}=\Theta_X(s)$, (3) $\sdom(\sigma)$ is the+set of variables that occur in~$\prefix{C}{h}$, (4) if the variables+in $t\in N$ occur in $\sdom(\sigma)$, then $\sigma(t)$ is+non-originating in $\Upsilon(\Theta_X,\to)$, and (5) if $t\in U$+originates at index~$i$ in~$C$, and $i\leq h$, then $\sigma(t)$+uniquely originates in $\Upsilon(\Theta_X,\to)$ at node $(s,i)$.+Origination assumptions in bundles specified by roles are called+\index{inherited origination assumptions}\emph{inherited origination+  assumptions}.++\chapter{Adversary Model}\label{chp:adversary model}++A fixed set of penetrator roles encodes the adversary model associated+with a message algebra.  For the Basic Crypto Algebra, there are eight+roles.  Each role makes no origination assumptions, and the trace of+each role is given in Figure~\ref{fig:pen}.  The first line of the+figure specifies many traces, one for each base sort, and a trace for+each tag.++\begin{figure}+$$\begin{array}{lll}+\mbox{Create}(z\colon B)&+\seq{\outbnd z}&\seq{\outbnd\mbox{``\ldots''}}\\+\mbox{Pair}(x,y\colon\top)&+\seq{\inbnd x,\inbnd y,\outbnd(x, y)}&+\seq{\inbnd(x, y),\outbnd x,\outbnd y}\\+\mbox{Encrypt}(x,y\colon\top)&+\seq{\inbnd x,\inbnd y,\outbnd\enc{x}{y}}&+\seq{\inbnd\enc{x}{y},\inbnd \fn{inv}(y),\outbnd x}+\end{array}$$+\caption{Basic Crypto Algebra Penetrator Role Traces}\label{fig:pen}+\end{figure}++A strand exhibits non-adversarial behavior when its role is not a+penetrator role.  A non-adversarial strand is called a \index{regular+  strand}\emph{regular} strand as is its role.++The penetrator cannot use a non-originating atom to encrypt or decrypt+a message, because every key it uses must be carried in a message.+Consider a uniquely originating atom that originates on a regular+strand.  The penetrator cannot make the atom using a create role,+because the atom would originate at more than one node.  Therefore,+the penetrator can use a uniquely originating atom to encrypt or+decrypt a message only if it is transmitted by a regular strand+unprotected by encryption.++\chapter{Skeletons}\label{chp:skeletons}++The details of penetrator behavior are abstracted away when performing+protocol analysis.  The abstracted description of a bundle is called a+realized skeleton, which is defined using a protoskeleton.  A+\emph{protoskeleton} over $\alga_X$ is+$\skel_X(\rl,P,\Theta_X,\prec,N,U)$, where $\rl\colon\Theta_X\to P$ is+a role map, the sets~$X$ and $\svars(P)$ are disjoint,+$\Theta_X$ is a sequence of traces in $\tr_X$, $\prec$ is a relation+on the nodes in $\Theta_X$, $N\subseteq\base_X$ are its+non-origination assumptions, and $U\subseteq\base_X$ are its unique+origination assumptions.  Unlike a strand space, the sort of a+variable in~$X$ need not be a base sort.++Assume the strands in bundle $\Upsilon(\Theta_X,\to)$ have been+permuted so that regular strands precede penetrator strands in+sequence~$\Theta_X$, and $\rl$ demonstrates the bundle is a run of+protocol~$P$.  Let~$P'$ be~$P$ without penetrator roles.  Skeleton+$\skel_X(\rl',P',\Theta'_X,\prec,N,U)$ \index{realized+  skeleton}\index{skeleton!realized}\emph{realizes} the bundle if+$\rl'$ and $\Theta'_X$ are the truncations of $\rl$ and $\Theta_X$+respectively that omit penetrator strands from their domains, $\prec$+is the transitive asymmetric relation associated with the bundle+without penetrator nodes, $N$ is the set of non-originating atoms with+variables that occur in $\Theta'_X$, and $U$ is the set of atoms that+uniquely originate and are carried by some regular node.++A protoskeleton $\skel_X(\rl,P,\Theta_X,\prec,N,U)$ is a+\index{preskeleton}\emph{preskeleton} if the following properties hold.+\begin{enumerate}+\item Sequence $\rl$ demonstrates that the strands in $\sdom(\Theta_X)$+  satisfy the conditions for being a part of a run of protocol~$P$.+\item Relation $\prec$ is transitive, asymmetric, and includes the+  strand succession relation $(\Rightarrow)$.+\item Each atom in $N$ is carried at no node, and each variable+  in the atom occurs at some node.+\item Each atom in $U$ is carried at some node.+\item $N$ includes the non-originating atoms inherited from roles via+  the role map.+\item $U$ includes the uniquely originating atoms inherited from roles via+  the role map.+\end{enumerate}++\begin{sloppypar}+Let $\orig_k(t)$ be the set of nodes at which~$t$ originates in+preskeleton~$k$, and~$\gain_k(t)$ be the set of nodes at which~$t$ is+gained in~$k$.  Preskeleton $\skel_X(\rl,P,\Theta_X,\prec,N,U)$ is a+\index{skeleton}\emph{skeleton} if each atom in $U$ originates on at+most one strand, and the node of origination precedes each node that+gains the atom, i.e.\@ for every~$t\in U$, $n_0\in\orig_k(t)$ and+$n_1\in\gain_k(t)$ implies~$n_0\prec n_1$.+\end{sloppypar}++Let $k_0=\skel_X(rl_0,P,\Theta_0,\prec_0,N_0,U_0)$ and+$k_1=\skel_Y(rl_1,P,\Theta_1,\prec_1,N_1,U_1)$ be preskeletons.  There+is a \index{preskeleton+  homomorphism}\index{homomorphism!preskeleton}\emph{preskeleton+  homomorphism} from~$k_0$ to~$k_1$ if~$\phi$ and~$\sigma$ are maps+with the following properties:+\begin{enumerate}+\item $\phi$ maps strands of~$k_0$ into those of~$k_1$, and nodes as+  $\phi((s,p))=(\phi(s),p)$, that is $\phi$ is in+  $\sdom(\Theta_0)\to\sdom(\Theta_1)$;+\item $\sigma\colon\alga_X\to\alga_Y$ is a message algebra homomorphism;+\item $n\in\nodes(\Theta_0)$ implies+  $\sigma(\evt_{\Theta_0}(n))=\evt_{\Theta_1}(\phi(n))$;+\item $n_0\prec_0+n_1$ implies $\phi(n_0)\prec_1\phi(n_1)$;+\item $\sigma(N_0)\subseteq N_1$;+\item $\sigma(U_0)\subseteq U_1$;+\item $t\in U_0$ implies+  $\phi(\orig_{k_0}(t))\subseteq\orig_{k_1}(\sigma(t))$.+\end{enumerate}++A homomorphism is \index{strandwise injective+  homomorphism}\index{homomorphism!strandwise+  injective}\emph{strandwise injective} if its strand map is+injective.  Two preskeletons are isomorphic if they are related by+\index{isomorphic preskeletons}\index{preskeletons!isomorphic}+\label{def:isomorphic preskeletons}+strandwise injective homomorphism in both directions.  A homomorphism+is \index{nodewise isomorphic+  homomorphism}\index{homomorphism!nodewise isomorphic}\emph{nodewise+  isomorphic} if the strand map~$\phi$ implies a bijection on nodes,+and $n_0\prec_1 n_1$ implies $\phi^{-1}(n_0)\prec_0\phi^{-1}(n_1)$.  A+skeleton is \index{realized+  skeleton}\index{skeleton!realized}\emph{realized} if there is a+nodewise isomorphic homomorphism from it to a skeleton that realizes a+bundle, and message component of the homomorphism is injective.++Our formalism requires that every protocol include a listener+role\index{listener role} of the form:+$\lsn(x\colon\top)=\role(\seq{\inbnd x,\outbnd+  x},\emptyset,\emptyset)$.  Instances of this role are sometimes used+to make penetrator derived messages visible in skeletons.  We say+skeleton~$k$ \emph{realizes modulo listeners} bundle+$\Upsilon(\Theta,\to) $ if~$k$ realizes $\Upsilon(\Theta',\to')$ and+\hbox{$\Upsilon(\Theta,\to)$} is the result of removing full length+listener strands, and adjusting the communication ordering $\to$+appropriately.++The set of bundles denoted by preskeleton~$k$, $\sembrack{k}$, is:+$$\sembrack{k_0} = \{\Upsilon\mid+\mbox{$k_0\homomorphism{\phi,\sigma}k_1$ and $k_1$ realizes modulo+  listeners $\Upsilon$}\}$$ A {\cpsa} algorithm is \emph{complete} if+when given a preskeleton~$k_0$, either the algorithm diverges, or else it+terminates and produces a finite set of realized skeletons~$K$, such+that $\sembrack{k_0}=\bigcup_{k_1\in K}\sembrack{k_1}$.+\label{def:preskeleton denotation}++Let~$\longrightarrow$ be an irreflexive reduction relation on+preskeletons.  The relation~$\longrightarrow$ is \emph{semantics+  preserving} if $\sembrack{k_0}=\bigcup_{k_1\in\{k_1\mid+  k_0\longrightarrow k_1\}}\sembrack{k_1}$.++\section{Blanchet's Simple Example Protocol}\label{sec:blanchet's+  simple example protocol}++The following protocol is a simplified version of the Denning-Sacco+key distribution protocol~\cite{DenningSacco81} due to Bruno Blanchet.+$$\begin{array}{r@{{}:{}}l}+A\to B&\enc{\enc{s}{a^{-1}}}{b}\\+B\to A&\enc{d}{s}+\end{array}$$+Symmetric key~$s$ is freshly generated, asymmetric keys $a^{-1}$ and+$b^{-1}$ are uncompromised, and the goal of the protocol is to keep+data~$d$ secret.  The protocol was constructed with a known flaw for+expository purposes.++This {\cpsa} description of the protocol has an initiator and a+responder role.+$$\begin{array}{r@{{}={}}l}+\init(a,b\colon A,s\colon S, d\colon T)&+\role(\seq{\outbnd\enc{\enc{s}{a^{-1}}}{b},\inbnd\enc{d}{s}},+\emptyset,\emptyset)\\+\resp(a,b\colon A,s\colon S, d\colon T)&+\role(\seq{\inbnd\enc{\enc{s}{a^{-1}}}{b},\outbnd\enc{d}{s}},+\emptyset,\emptyset)+\end{array}$$+where we use~$A$ for sort \dom{akey}, $S$ for sort \dom{skey}, and+$T$ for sort \dom{text} to save space.  The algebra for the initiator+role is generated from $X$, where $X_A=\{a,b\}$, $X_S=\{s\}$,+$X_T=\{d\}$, $X_{\dom{data}}=\emptyset$, $X_{\dom{name}}=\emptyset$,+and $X_\top=\emptyset$.++An interesting point of view for analysis is to see if the+authentication goals of the initiator are met.  To do so, we assume+there was full length run of an initiator strand, and let {\cpsa}+determine what else must have happened.  Let variable set $Y=a,b\colon+A,s\colon S, d\colon T$.  The point-of-view skeleton is:+$$\begin{array}{r@{}ll}+\skel_Y(+&\seq{\init(a_0,b_0,s_0,d_0)},+&\mbox{Role map}\\+&\{\init(a_0,b_0,s_0,d_0),\resp(a_1,b_1,s_1,d_1)\},+&\mbox{Protocol}\\+&\seq{\seq{\outbnd\enc{\enc{s}{a^{-1}}}{b},\inbnd\enc{d}{s}}},+&\mbox{Strands}\\+&\emptyset,+&\mbox{Node orderings}\\+&\{a^{-1},b^{-1}\},+&\mbox{Non-origination}\\+&\{s\})+&\mbox{Unique origination}+\end{array}$$+where the variable set that generates the algebra for the initiator+and responder roles have been renamed so as to avoid conflicts with+the variable set~$Y$ used by the skeleton.++The skeleton produced by {\cpsa} for this problem follows.  Notice+that the two strands agree on the key~$b$ used in the outermost+encryption of their first message, and indication that the+authentication goals of the initiator are met.  See+Figure~\ref{fig:blanchet's protocol} to see the structure of the shape.+$$\begin{array}{r@{}ll}+\skel_Y(+&\seq{\init(a_0,b_0,s_0,d_0),\resp(a_1,b_1,s_1,d_1)},+&\mbox{Role map}\\+&\{\init(a_0,b_0,s_0,d_0),\resp(a_1,b_1,s_1,d_1)\},+&\mbox{Protocol}\\+&\langle\begin{array}[t]{@{}l}+\seq{\outbnd\enc{\enc{s}{a^{-1}}}{b},\inbnd\enc{d}{s}},\\+\seq{\inbnd\enc{\enc{s}{a^{-1}}}{b},\outbnd\enc{d}{s}}\rangle,+\end{array}+&\mbox{Strands}\\+&\{(1,1)\prec(2,1),(2,2)\prec(1,2)\},+&\mbox{Node orderings}\\+&\{a^{-1},b^{-1}\},+&\mbox{Non-origination}\\+&\{s\})+&\mbox{Unique origination}+\end{array}$$+The homomorphism from the point-of-view skeleton to the shape is+$$(\seq{1},\{a\mapsto a, b\mapsto b, s\mapsto s, d\mapsto d\}).$$++\begin{figure}+\begin{center}+\begin{tabular}{c@{\qquad}c}+$\xymatrix{+\txt{\strut init}&\txt{\strut resp}\\+\bullet\ar@{=>}[d]\ar[r]&\bullet\ar@{=>}[d]\\+\bullet&\bullet\ar[l]}$+&+$\xymatrix{+\txt{\strut resp}&\txt{\strut init}\\+\bullet\ar@{=>}[d]&\bullet\ar@{-->}[l]\\+\bullet&}$+\end{tabular}+\end{center}+\caption{Shapes for Blanchet's Protocol}\label{fig:blanchet's protocol}+\end{figure}++An analysis of the authentication goals for the responder shows the+flaw built into the protocol.  To do the analysis, assume there was a+full length run of a responder strand, and let {\cpsa} determine what+else must have happened.  In this case, the point-of-view skeleton is:+$$\begin{array}{r@{}ll}+\skel_Y(+&\seq{\resp(a_0,b_0,s_0,d_0)},+&\mbox{Role map}\\+&\{\init(a_0,b_0,s_0,d_0),\resp(a_1,b_1,s_1,d_1)\},+&\mbox{Protocol}\\+&\seq{\seq{\inbnd\enc{\enc{s}{a^{-1}}}{b},\outbnd\enc{d}{s}}},+&\mbox{Strands}\\+&\emptyset,+&\mbox{Node orderings}\\+&\{a^{-1},b^{-1}\},+&\mbox{Non-origination}\\+&\{s\})+&\mbox{Unique origination}+\end{array}$$++The shape generated by {\cpsa} follows.  An early indication of a+problem is the variable set for the shape has three asymmetric keys.+Let variable set $Z=a,b,b'\colon A,s\colon S, d\colon T$.  The shape+is:+$$\begin{array}{r@{}ll}+\skel_Z(+&\seq{\resp(a_0,b_0,s_0,d_0),\init(a_1,b_1,s_1,d_1)},+&\mbox{Role map}\\+&\{\init(a_0,b_0,s_0,d_0),\resp(a_1,b_1,s_1,d_1)\},+&\mbox{Protocol}\\+&\langle\begin{array}[t]{@{}l}+\seq{\inbnd\enc{\enc{s}{a^{-1}}}{b},\outbnd\enc{d}{s}},\\+\seq{\outbnd\enc{\enc{s}{a^{-1}}}{b'}}\rangle,+\end{array}+&\begin{array}[t]{@{}l}+\mbox{Strands}\\+\mbox{\emph{Note key is $b'$ not $b$!}}+\end{array}\\+&\{(2,1)\prec(1,1)\},+&\mbox{Node orderings}\\+&\{a^{-1},b^{-1}\},+&\mbox{Non-origination}\\+&\{s\})+&\mbox{Unique origination}+\end{array}$$++Notice that the two strands do not agree on the key used in the outermost+encryption of their first message---an authentication failure.  To see+that the authentication failure leads to the failure to protect the+secrecy of data~$d$, the protocol is analyzed using the following+point-of-view:+$$\begin{array}{r@{}ll}+\skel_Y(+&\seq{\resp(a_0,b_0,s_0,d_0),\lsn(x)},+&\mbox{Role map}\\+&\{\init(a_0,b_0,s_0,d_0),\resp(a_1,b_1,s_1,d_1),\lsn(x)\},+&\mbox{Protocol}\\+&\seq{+\seq{\inbnd\enc{\enc{s}{a^{-1}}}{b},\outbnd\enc{d}{s}},+\seq{\inbnd d,\outbnd d}},+&\mbox{Strands}\\+&\{(1,2)\prec(2,1),+&\mbox{Node orderings}\\+&\{a^{-1},b^{-1}\},+&\mbox{Non-origination}\\+&\{s,d\})+&\mbox{Unique origination}+\end{array}$$++{\cpsa} finds a shape that shows how data~$d$ is revealed to the adversary.++\section{Dolev-Yao Example 1.3}++The intended run of the protocol in the Dolev-Yao Example 1.3 is:+$$\begin{array}{r@{{}:{}}l}+A\to B&\enc{\enc{m}{b},a}{b}\\+B\to A&\enc{\enc{m}{a},b}{a}+\end{array}$$+assuming text~$m$ is freshly generated, and asymmetric keys $a^{-1}$+and $b^{-1}$ are uncompromised.++The {\cpsa} description of the protocol also has an initiator and a+responder role.+$$\begin{array}{r@{{}={}}l}+\init(a,b\colon A, m\colon T)&+\role(\seq{\outbnd\enc{\enc{m}{b},a}{b},\inbnd\enc{\enc{m}{a},b}{a}},+\emptyset,\emptyset)\\+\resp(a,b\colon A, m\colon\top)&+\role(\seq{\inbnd\enc{\enc{m}{b},a}{b},\outbnd\enc{\enc{m}{a},b}{a}},+\emptyset,\emptyset)\\+\end{array}$$++An interesting point of view for analysis is to see if~$m$ is kept+secret after the initiator sends its message.  Let variable set+$Z=a,b\colon A, m\colon T$.  The initial scenario preskeleton is:+$$\begin{array}{r@{}ll}+\skel_Z(+&\seq{\init(a_0,b_0,m_0),\lsn(x)},+&\mbox{Role map}\\+&\{\init(a_0,b_0,m_0),\resp(a_1,b_1,m_1),\lsn(x)\},+&\mbox{Protocol}\\+&\seq{\seq{\outbnd\enc{\enc{m}{b},a}{b}},\seq{\inbnd m}},+&\mbox{Strands}\\+&\emptyset,+&\mbox{Node orderings}\\+&\{a^{-1},b^{-1}\},+&\mbox{Non-origination}\\+&\{m\})+&\mbox{Unique origination}+\end{array}$$+where the variable set that generates the algebra for the initiator+role has been renamed so as to avoid conflicts with the variable set~$Z$+used by the preskeleton.++\begin{figure}+$$\xymatrix{+\txt{\strut init}&\txt{\strut }&\txt{\strut resp}&\txt{\strut resp}\\+\bullet\ar[rrr]&&&\bullet\ar@{=>}[d]\\+&&\bullet\ar@{=>}[d]&\bullet\ar@{-->}[l]\\+&\bullet\ar@{=>}[d]&\bullet\ar@{-->}[l]&\\+&\bullet&&}$$+\caption{Dolev-Yao Example 1.3 Shape}\label{fig:dy shape}+\end{figure}++{\cpsa} determines $m$ is not kept secret by producing the shape in+Figure~\ref{fig:dy shape}.  The added strands in the shape are+instances of responder roles.  The strands in the shape are:+$$\begin{array}{l}+\seq{\outbnd\enc{\enc{m}{b},a}{b}}\\+\seq{\inbnd m}\\+\seq{\inbnd\enc{\enc{m}{b},a'}{b},\outbnd\enc{\enc{m}{a'},b}{a'}}\\+\seq{\inbnd\enc{\enc{\enc{m}{b}, a}{b},a''}{b},+\outbnd\enc{\enc{\enc{m}{b},a}{a''},b}{a''}}+\end{array}$$+The non-origination and unique origination assumptions are as they are+in the initial scenario preskeleton.  An interesting exercise left for+the reader is to produce a bundle that is realized by the shape.++\section{Exercise}++Consider the following roles.+$$\begin{array}{r@{{}={}}l}+\init(a,b\colon A)&\role(\seq{\outbnd(a,b),\inbnd(b,a)},+\emptyset,\emptyset)\\+\resp(a,b\colon A)&\role(\seq{\inbnd(a,b),\outbnd(b,a)},+\emptyset,\emptyset)+\end{array}$$+Let $X=x,y\colon A$ and+$\begin{array}[t]{@{}r@{}l}+k=\skel_X(+&\seq{\init(a,b),\resp(a,b),\resp(a,b)},\\+&\{\init(a,b),\resp(a,b)\},\\+&\seq{\begin{array}[t]{@{}l}+\seq{\outbnd(x,y),\inbnd(y,x)},\\+\seq{\inbnd(x,y),\outbnd(y,x)},\\+\seq{\inbnd(x,y),\outbnd(y,x)}},+\end{array}\\+&\mbox{Node ordering in Figure~\ref{fig:exercise}},\\+&\emptyset,\\+&\emptyset)+\end{array}$++\begin{figure}+$$\xymatrix{+\txt{\strut init}&\txt{\strut resp}&\txt{\strut resp}\\+\bullet\ar@{=>}[d]\ar@/^/[rr]\ar[r]&\bullet\ar@{=>}[d]&\bullet\ar@{=>}[d]\\+\bullet&\bullet\ar[l]&\bullet\ar@/^/[ll]}$$+\caption{Exercise Skeleton}\label{fig:exercise}+\end{figure}++What is $\sembrack{k}$?++One member is shown in Figure~\ref{fig:bundle}.++\begin{figure}+$$\begin{array}{ll}+\mbox{init}&\seq{\outbnd(x,y),\inbnd(y,x)}\\+\mbox{resp}&\seq{\inbnd(x,y),\outbnd(y,x)}\\+\mbox{resp}&\seq{\inbnd(x,y),\outbnd(y,x)}\\+\mbox{pair}&\seq{\inbnd(y,x),\inbnd(y,x),\outbnd((y,x),(y,x))}\\+\mbox{sep}&\seq{\inbnd((y,x),(y,x)),\outbnd(y,x)}+\end{array}$$++$$\xymatrix{+\txt{\strut init}&\txt{\strut resp}&\txt{\strut resp}&\txt{\strut pair}&\txt{\strut sep}\\+\bullet\ar@{=>}[dddd]\ar@/^/[rr]\ar[r]&\bullet\ar@{=>}[d]&\bullet\ar@{=>}[d]&&\\+&\bullet\ar@/_/[rrd]&\bullet\ar[r]&\bullet\ar@{=>}[d]&\\+&&&\bullet\ar@{=>}[d]&\\+&&&\bullet\ar[r]&\bullet\ar@{=>}[d]\\+\bullet&&&&\bullet\ar[llll]}$$+\caption{A Bundle Realized by the Example Skeleton}\label{fig:bundle}+\end{figure}++\chapter{Algorithms as Reduction Systems}\label{chp:algorithms}++Algorithms in this paper are specified as abstract reduction+systems~\cite[Chapter~2]{BaaderNipkow98}.  A reduction system is a+pair $(A,\to)$, where reduction~$\to$ is a binary relation+$\mathord{\to}\subseteq A\times A$.  Element $x\in A$ is a+\index{normal form}\emph{normal form} if there is no~$y$ such that+$x\to y$.  The transitive closure of~$\to$ is~$\to^+$.  The reflexive+transitive closure of~$\to$ is~$\to^\ast$.  A reduction is confluent+if $x\to^\ast y_0$ and $x\to^\ast y_1$ implies there is a~$z$ such+that $y_0\to^\ast z$ and $y_1\to^\ast z$.  A reduction is terminating+if there are no infinite descending chains.  A reduction is convergent+if it is confluent and terminating.++Let $\alg{K}$ be the set of preskeletons.  Algorithms are specified as+reduction systems of the form $(\alg{K},\to)$, which are then used to+specify a related setwise reduction system of the form+$(\pow{\alg{K}},\mathord\twoheadrightarrow)$.  Setwise reduction+systems are the ones with the interesting normal forms and confluence+properties.  In a setwise reduction system, reduction rewrites one+element of a set to a set of elements.++\begin{defn}[Setwise Reduction System]+The \emph{setwise reduction system}\index{setwise reduction system} of+binary relation $\rightsquigarrow\subseteq\alg{K}\times\pow{\alg{K}}$+is a reduction system $(\pow{\alg{K}},\twoheadrightarrow)$, where for+each $K_0\in\pow{\alg{K}}$, $K_0\twoheadrightarrow K_1$ if for some+$k_0\in K_0$, $k_0\rightsquigarrow K_2$, $K_1=K_2\cup+(K_0\setminus\{k_0\})$, and $K_1\neq K_0$.+\end{defn}++The {\cpsa} algorithm will be specified as a setwise term reduction+system, where the initial problem is given a singleton+in~$\pow{\alg{K}}$, and the answers computed by an implementation of+the algorithm are a normal form of the setwise reduction+relation~$\twoheadrightarrow_k$ defined in Chapter~\ref{chp:skeleton+  reduction}.++In what follows the relation $k\rightsquigarrow K$ is defined in terms+of $\to\subseteq\alg{K}\times\alg{K}$ by specifying+$\{k\}\twoheadrightarrow K$ using~$\to$, so the $\rightsquigarrow$+relation is not explicitly defined.++We regard sets of preskeletons as factored by isomorphism, where each+set has at most one representative of the equivalence class of+isomorphic preskeletons.  The definition of isomorphic preskeletons+is given on Page~\pageref{def:isomorphic preskeletons}.++The {\cpsa} Design~\cite{cpsadesign09} describes an extension of a+message algebra signature that models the data structures used in the+{\cpsa} program.  The terms over the extended signature include ones+that model preskeletons.  Sets of terms of sort preskeleton are the+domain of our setwise reduction systems.++\chapter{Primitive Preskeleton Operators}\label{chp:prim preskel ops}++The are four primitive operators\index{operators} on preskeletons used+by {\cpsa} to solve authentication tests.  Each operator is a partial+map from preskeletons to preskeletons.++\begin{defn}[Substitution Operator]\label{def:substitution operator}+For order-sorted substitution~$\sigma\colon X\to\alg{A}_Y$,+the operator~$\ops{S}_\sigma$ is:+$$\begin{array}{l}+\ops{S}_\sigma(\skel_X(\rl,P,\Theta_X,\prec,N,U)) = {}\\+\quad\skel_Y(\rl,P,+s\mapsto \comp\sigma{\Theta_X(s)},\prec,\sigma(N), \sigma(U))+\end{array}$$+\end{defn}++For $k'=\ops{S}_\sigma(k)$, there is a homomorphism from~$k$ to~$k'$+only if for all $t\in U_k$,+$\orig_k(t)\subseteq\orig_{k'}(\sigma(t))$.  The structure preserving+maps associated with the homomorphism are~$\idphi$ and~$\sigma$.++\begin{defn}[Compression Operator]\label{def:compression operator}+For distinct strands~$s$ and~$s'$, operator~$\ops{C}_{s,s'}$+compresses strand~$s$ into~$s'$.+$$\begin{array}{l}+\ops{C}_{s,s'}(\skel_X(\rl,P,\Theta_X,\prec,N,U)) = {}\\+\quad \skel_X(\comp\rl{\phi'_s},P,+\comp{\Theta_X}{\phi'_s},\prec',N,U)+\end{array}$$+where+$$\begin{array}{r@{}c@{}l}+\phi'_s(j)&{}={}&\left\{+\begin{array}{ll}+j+1&\mbox{if $j\geq s$}\\+j&\mbox{otherwise,}+\end{array}\right.+\end{array}$$+relation $\prec'$ is the transitive closure of $\phi_{s,s'}(\prec)$, and+$$\begin{array}{r@{}c@{}l}+\phi_{s,s'}(j)&{}={}&\left\{+\begin{array}{ll}+\phi_s(s')&\mbox{if $j=s$}\\+\phi_s(j)&\mbox{otherwise}+\end{array}\right.\\+\phi_s(j)&{}={}&\left\{+\begin{array}{ll}+j-1&\mbox{if $j>s$}\\+j&\mbox{otherwise.}+\end{array}\right.+\end{array}$$+\end{defn}++The compression operator is only used when $\Theta_X(s)$ is a prefix+of $\Theta_X(s')$, and when there is a homomorphism from~$k$ to+$\ops{C}_{s,s'}(k)$.  The structure preserving maps associated with+the homomorphism are~$\phi_{s,s'}$ and~$\idsigma$.  Note that the+compression operator is defined only when relation~$\prec'$ is+asymmetric, and that $\comp{\phi_{s,s'}}{\phi'_s}=\idphi$.++\begin{defn}[Ordering Enrichment Operator]\label{def:order enrichment operator}+Operator~$\ops{O}$ applied to~$k$ enriches~$\kprec{k}$ by adding all+elements implied by unique origination.  That is $\ops{O}(k)=+\skel_X(\rl,P,\Theta_X,\prec',N,U))$, where+$k=\skel_X(\rl,P,\Theta_X,\prec,N,U)$ and $\prec'=+(\prec\cup\{(n_0,n_1)\mid n_0\in\orig(k,t)\land+n_1\in\gain(k,t)\})^\ast$.+\end{defn}++The ordering enrichment operator is total and idempotent.  The+structure preserving maps associated with the operator's homomorphism+are~$\idphi$ and~$\idsigma$, i.e.\ the homomorphism is an embedding.++\begin{defn}[Augmentation Operator]\label{def:augmentation operator}+For node~$n$, role~$r$, and trace~$C$, operator~$\ops{A}_{n,r,C}$ is:+$$\begin{array}{l}+\ops{A}_{n,r,C}(\skel_X(\rl,P,\Theta_X,\prec,N,U)) = {}\\+\quad\skel_{X'}(\rl\append r,P,+\Theta_X(s)\append C,\prec',N',U')+\end{array}$$+where $X'$ is $X$ extended to include the variables in~$C$,+$\prec'$ is the minimal extension of $\prec$ such that+$(|\Theta_X|+1,|C|)\prec' n$, $N'$ is $N$ extended with+non-origination assumptions inherited from~$r$ by~$C$, and likewise+for~$U'$.+\end{defn}++The structure preserving maps associated with the augmentation+operator's homomorphism are~$\idphi$ and~$\idsigma$, i.e.\ the+homomorphism is an embedding.++\chapter{Reductions on Preskeletons}\label{chp:preskeleton reduction}++This chapter describes the algorithm used to transform a preskeleton+into a skeleton as a setwise term reduction system+$(\alg{K},\twoheadrightarrow)$.  Recall that the relation+$k\rightsquigarrow K$ in Chapter~\ref{chp:algorithms} is defined in+terms of $\to\subseteq\alg{K}\times\alg{K}$ by specifying+$\{k\}\twoheadrightarrow K$ using~$\to$.  Additionally, when+$k=\skel(\rl,P,\Theta,\prec,N,U)$, $U_k$ is used to name~$U$, and so+forth for other components of~$\skel$.++If a preskeleton $k$ is not a skeleton, then it is either because some+$t\in U_k$ actually originates at more than one node, or because for+some $t\in U_k$, there is a node $n_1\in\gain_k(t)$, and a node+$n_0\in\orig_k(t)$ such that $n_0\nprec_k n_1$.  These obstructions+are resolved via identifying strands and enriching node orderings+respectively.  A \index{hulled+  preskeleton}\index{preskeleton!hulled}\emph{hulled preskeleton} is a+preskeleton in which every uniquely originating atom originates at+most once, but it may lack some node orderings needed to be a+skeleton.++Skeletons may contain redundant strands.  After converting+preskeletons to skeletons, a preskeleton reduction system may remove+redundant strands using a process called \index{pruning}pruning.  A+skeleton without any redundant strands is called a \index{pruned+  skeleton}\index{skeleton!pruned}\emph{pruned skeleton}.++\begin{defn}[Hulling Reduction]\label{def:hulling}+Preskeleton $k_0$ reduces to preskeleton $k_1$ by hulling strands~$s$+and~$s'$, written $k_0\reduction{\ops{H}_{s,s'}}k_1$, iff there is+some $t\in U_{k_0}$ and distinct~$s$ and~$s'$ such that+$\{(s,i),(s',i')\}\subseteq\orig_{k_0}(t)$, a most general+unifier~$\sigma$ such that $\sigma(\Theta_{k_0}(s)(j))\equiv+\sigma(\Theta_{k_0}(s')(j))$ for all $1\leq j\leq|\Theta_{k_0}(s)|$,+and $k_0\reduction{\ops{S}_\sigma}k\reduction{\ops{C}_{s,s'}}k_1$+for some~$k$.  For the setwise hulling relation,+$\{k_0\}\setreduction{\ops{H}_{s,s'}}\{k_1\mid+k_0\reduction{\ops{H}_{s,s'}}k_1\}$, when $k_0$ has a message in+$U_{k_0}$ that originates on both~$s$ and~$s'$.+\end{defn}++Note that for+$k_0\reduction{\ops{S}_\sigma}k\reduction{\ops{C}_{s,s'}}k_1$, there+is a homomorphism from~$k_0$ to~$k_1$ when there is one from~$k_0$+to~$k$, i.e.\ when $\ops{S}_\sigma$ ensures that points of origination+are preserved.++\begin{defn}[Order Enrichment]+Suppose hulled preskeleton~$k_0$ is not a skeleton.  Hulled+preskeleton~$k_0$ reduces to skeleton~$k_1$ by order enrichment, written+$k_0\reduction{\ops{O}}k_1$, iff~$k_1$ is the result of adding node+orderings implied by origination.  That is,+$\kprec{k_1}= (\kprec{k_0}\cup\{(n_0,n_1)\mid n_0\in\orig(k_0,t)\land+n_1\in\gain(k_0,t)\})^\ast$.+There is a homomorphism from~$k_0$ to~$k_1$ that is an embedding.  For+the setwise order enrichment reduction,+$\{k_0\}\setreduction{\ops{O}}\{k_1\mid k_0\reduction{\ops{O}}k_1\}$+when $k_0$ is a hulled preskeleton that is not a skeleton.+\end{defn}++The pruning operator~$\ops{P}_s$ removes a \index{redundant+  strands}redundant strand.  When a strand~$s$ is redundant, there is+another strand~$s'$ that describes more specific behavior.+Skeleton~$k_0$ has a redundant strand~$s$ if there is a skeleton~$k_1$+such that+$k_0\reduction{\ops{S}_\sigma}k\reduction{\ops{C}_{s,s'}}k_1$,+$k_0\homomorphism{\phi,\sigma}k_1$, and+$k_1\homomorphism{\phi',\sigma'}k_0$, where+$\comp{\phi}{\phi'}=\idphi$ and $\comp{\sigma}{\sigma'}=\idsigma$.+In particular $\phi=\phi_{s,s'}$ and $\phi'=\phi'_s$+with~$\phi_{s,s'}$ and~$\phi'_s$ as in Definition~\ref{def:compression+  operator}.  The bidirectional homomorphism requirement leads to the+following definition.++\begin{defn}[Pruning]\label{def:pruning}+Suppose skeleton~$k_0$ has a redundant strand~$s$.  Then there exists+a distinct strand~$s'$ that describes more specific behavior.+Skeleton~$k_0$ reduces to skeleton~$k_1$ by pruning, written+$k_0\reduction{\ops{P}_s}k_1$, iff there is a most general+unifier~$\sigma$ such that $\sigma(\Theta_{k_0}(s)(j))\equiv+\Theta_{k_0}(s')(j)$ for all $1\leq j\leq|\Theta_{k_0}(s)|$, no+variable in $\sdom(\sigma)$ occurs in the trace of any strand other+than~$s$, $\sigma$ is a renaming, $t\in U_{k_0}$ implies $\sigma(t)\in+U_{k_0}$, $t\in N_{k_0}$ implies $\sigma(t)\in N_{k_0}$, there is+a~$k$ such that+$k_0\reduction{\ops{S}_\sigma}k\reduction{\ops{C}_{s,s'}}k_1$, there+is a homomorphism from~$k_0$ to~$k_1$, and if+$(s,p)\kprec{k_0}(s'',p'')$ then $(s',p')\kprec{k_0}(s'',p'')$, and if+$(s'',p'')\kprec{k_0}(s,p)$ then $(s'',p'')\kprec{k_0}(s',p')$.  For+the setwise pruning reduction,+$\{k_0\}\setreduction{\ops{P}_s}\{k_1\mid+k_0\reduction{\ops{P}_s}k_1\}$, when there is a $k_1$ such that+$k_0\reduction{\ops{P}_s}k_1$.+\end{defn}++There is one additional constraint on pruning recently identified.  In+Chapter~\ref{chp:generalization} on generalization, a parameter to its+reduction system is the point-of-view skeleton.  The point-of-view+skeleton defines the problem to be solved by {\cpsa}.  A+generalization step is valid only when there is a homomorphism from+the point-of-view skeleton and the result of generalization.  To+support generalization, {\cpsa} computes and stores the strand mapping+part of a homomorphism from the point-of-view skeleton to every+preskeleton derived from it.++The addition constraint on pruning is this: no strand is considered+redundant if it is in the image of the skeleton's strand map from its+point-of-view skeleton.  Our notation for reductions that include+pruning does not record the dependency of the relation on the+point-of-view skeleton, but the notation in the chapter on generalization+shows how it might be done.++\section{Reduction Systems}++Notice that a setwise hulling reduction may produce the empty set, but+a setwise order enrichment and pruning reduction never does.++There are two preskeleton reduction systems, one with pruning, and one+without.  For the one without, let reduction $\twoheadrightarrow=+\bigcup_{s,s'}\setreduction{\ops{H}_{s,s'}}\cup\setreduction{\ops{O}}$.++\begin{defn}[Preskeleton Reduction System]+Preskeleton~$k_0$ reduces to skeleton~$k_1$,+written~$k_0\reduction{\fn{skel}}k_1$\index{skel@\fn{skel}}, if+$\{k_0\}\twoheadrightarrow^\ast K$, $k_1\in K$, and~$K$ is a normal+form of~$\twoheadrightarrow$.+\end{defn}++For each skeleton~$k$, $k\reduction{\fn{skel}}k$.++When using pruning, let reduction $\twoheadrightarrow=+\bigcup_{s,s'}\setreduction{\ops{H}_{s,s'}}\cup\setreduction{\ops{O}}\cup+\bigcup_s\setreduction{\ops{P}_s}$.++\begin{defn}[Preskeleton Reduction System with Pruning]+Preskeleton~$k_0$ reduces to pruned skeleton~$k_1$,+written~$k_0\reduction{\fn{pskel}}k_1$\index{pskel@\fn{pskel}}, if+$\{k_0\}\twoheadrightarrow^\ast K$, $k_1\in K$, and~$K$ is a normal+form of~$\twoheadrightarrow$.+\end{defn}++For each pruned skeleton~$k$, $k\reduction{\fn{pskel}}k$.++\chapter{Penetrator Derivable}\label{chp:penetrator derivable}++For each algebra, the powers of the adversary are defined by a set of+roles.  For the Basic Crypto Signature in Figure~\ref{fig:bcs}, the+traces of the penetrator roles are in Figure~\ref{fig:pen traces}.+Penetrator roles make no origination assumptions.++\begin{figure}+$$\begin{array}{l}+\fn{base}(t)=\seq{\outbnd t},\mbox{ where $t$ is an atom}\\+\fn{tag}(t)=\seq{\outbnd t},\mbox{ where $t$ is a tag}\\+\fn{cat}(t_0,t_1)=\seq{\inbnd t_0,\inbnd t_1, \outbnd(t_0,+  t_1)}\\+\fn{sep}(t_0,t_1)=\seq{\inbnd(t_0, t_1),\outbnd+    t_0,\outbnd t_1}\\+\fn{enc}(t_0,t_1)=\seq{\inbnd t_0,\inbnd t_1,+\outbnd\enc{t_0}{t_1}}\\+\fn{dec}(t_0,t_1)=\seq{\inbnd\enc{t_0}{t_1},+\inbnd t_2,\outbnd t_0},\mbox{ where $t_2=\fn{inv}(t_1)$}+\end{array}$$+\caption{Penetrator Traces}\label{fig:pen traces}+\end{figure}++The context in which penetrator strands appear determine the messages+the adversary can derive.  The context includes previously sent+messages and atoms it is forbidden to originate.  An atom that is+assumed to be non-originating must be avoided as is a uniquely+originating atom that is assumed to originate on a regular strand.++The ternary relation \der{t}{T_p}{T_a} states that message~$t$ is+penetrator derivable from previously sent messages~$T_p$ while+avoiding atoms~$T_a$.  The relation is defined by a set of inference+rules.  Most of the rules are justified by a penetrator role that when+instantiated, derives a message in the conclusion of the rule.++The first rule states that no additional penetrator behavior is required+to derive~$t$ if it has been previously sent.+$$\infer{t\in{T_p}}{\der{t}{T_p}{T_a}}$$++A uniquely originating atom need not be avoided if it has been sent.+\begin{equation}\label{eqn:avoid}+\infer{\der{t}{T_p}{T_a}}%+{\der{t}{\{t_0\}\cup T_p}{\{t_0\}\cup T_a}}+\end{equation}++There are two decomposition steps available to the penetrator.+\begin{equation}\label{eqn:sep}+\infer{\der{t}{\{t_0,t_1\}\cup T_p}{T_a}}%+{\der{t}{\{(t_0,t_1)\}\cup T_p}{T_a}}\quad+[\mbox{by $\fn{sep}(t_0,t_1)$}]+\end{equation}+\begin{equation}\label{eqn:dec}+\infer{\der{\fn{inv}(t_1)}{T_p}{T_a}\qquad+\der{t}{\{t_0,\enc{t_0}{t_1}\}\cup T_p}{T_a}}%+{\der{t}{\{\enc{t_0}{t_1}\}\cup T_p}{T_a}}\quad+[\mbox{by $\fn{dec}(t_0,t_1)$}]+\end{equation}++There are two constructive steps.+$$\infer{\der{t_0}{T_p}{T_a}\qquad\der{t_1}{T_p}{T_a}}%+{\der{(t_0,t_1)}{T_p}{T_a}}\quad+[\mbox{by $\fn{cat}(t_0,t_1)$}]$$+$$\infer{\der{t_0}{T_p}{T_a}\qquad\der{t_1}{T_p}{T_a}}%+{\der{\enc{t_0}{t_1}}{T_p}{T_a}}\quad+[\mbox{by $\fn{enc}(t_0,t_1)$}]$$++There are three rules for indivisible messages.+$$\der{C_i}{T_p}{T_a}\quad+[\mbox{by $\fn{tag}(C_i)$}]$$+$$\infer{t\notin T_a\qquad\mbox{$t$ an atom}}%+{\der{t}{T_p}{T_a}}\quad+[\mbox{by $\fn{base}(t)$}]$$+A non-base sorted variable is derivable in a bundle that instantiates+it with any message other than an element of $X_\top$.+$$\infer{t\in X_\top}{\der{t}{T_p}{T_a}}$$++\begin{defn}[Outbound predecessors]+The \index{outbound predecessors}\emph{outbound predecessors} of+skeleton~$k$ at~$n$ is $\outpred(k,n)=\{\msg_k(n_0)\mid n_0 \kprec{k}+n, n_0\mbox{~is transmitting}\}$.+\end{defn}++\begin{defn}[Avoidance Set]\label{def:avoid}+The \index{avoidance set}\emph{avoidance set} of skeleton~$k$ is+$\avoid(k)=N_k\cup\{t\mid t\in U_k\land|\orig_k(t)|=1\}$.+\end{defn}++An atom in $\avoid(k)$ is not available to the penetrator, except+if it is exposed by a messages transmission.  Clearly, only uniquely+originating atoms can be exposed.++\begin{defn}[Derivable Before]\label{def:der}+A message~$t$ is \index{derivable before}\emph{derivable before}+reception node~$n$ in skeleton~$k$, written $\fn{der}(k,n,t)$, if+$\der{t}{T_p}{T_a}$ where $T_p=\outpred(k,n)$ and $T_a=\avoid(k)$.+\end{defn}++\begin{defn}[Realized Node]+A reception node~$n$ is \emph{realized} in skeleton~$k$ if+$\msg_k(n)$ is derivable before~$n$ in~$k$.+\end{defn}++Notice that one can read off penetrator behavior from the proof tree+used to demonstrate that $\msg_k(n)$ is derivable before~$n$+in~$k$.  For example, if a decryption step is required by the proof,+an instance of the penetrator's decryption role is indicated.  In a+bundle, for a non-base sorted variable, there is a substitution that+maps the variable to a message that is not a non-base sorted variable.+The substitution determines the penetrator behavior associated with+the variable.++\begin{conj}[Realized Skeleton]+A skeleton is realized if and only if all of its reception nodes are+realized.+\end{conj}++\begin{proof}[Partial Proof]+Given a skeleton~$k$ in which all of its reception nodes are realized,+the combination of the regular behavior in the skeleton, the+penetrator behavior specified by the proof trees used to demonstrate+each node is realized, and a substitution for non-base sorted+variables determines a bundle.  The skeleton of the bundle may have+more non-originating atoms than is in $N_k$, however since the+extra non-originating atoms are derivable by the bundle that+realizes~$k$, the proof trees for those atoms specify any additional+penetrator behavior required.++The ``only if'' part of this proof has yet to be completed.+\end{proof}++\section{Implementation}\label{sec:derivable implementation}++The derivable before a node predicate is implemented using auxiliary+functions.++\begin{defn}[Buildable]+Message~$t$ is \index{buildable}\emph{buildable} from previously sent+messages~$T_p$ while avoiding~$T_a$, written $\fn{bld}(t,T_p,T_a)$, if+\der{t}{T_p}{T_a} without the use of Inference Rules \ref{eqn:avoid},+\ref{eqn:sep}, and~\ref{eqn:dec}.+\end{defn}++Consider the following reduction system based on Inference Rules+\ref{eqn:avoid}, \ref{eqn:sep}, and~\ref{eqn:dec}.+$$\begin{array}{r@{}c@{}ll}+\dctx{\{t\}\cup T_p}{T_a}&{}\to{}&\dctx{T_p}{T_a}\setminus\{t\}+&\mbox{if $t$ is an atom or in $X_{\top}$}\\+\dctx{\{(t_0,t_1)\}\cup T_p}{T_a}&{}\to{}&\dctx{\{t_0,t_1\}\cup T_p}{T_a}\\+\dctx{\{\enc{t_0}{t_1}\}\cup+T_p}{T_a}&{}\to{}&\dctx{\{t_0,\enc{t_0}{t_1}\}\cup T_p}{T_a}+&\mbox{if $t_0\notin T_p$ and}\\+&&&\fn{bld}(\fn{inv}(t_1),T_p,T_a)+\end{array}$$++\begin{defn}[Decompose]+Previously sent messages~$T_p$ and avoidance set~$T_a$+\emph{decompose} to $T'_p,T'_a$, written+$\fn{decompose}(T_p,T_a)=(T'_p,T'_a)$, if+$\dctx{T_p}{T_a}\to^\ast\dctx{T'_p}{T'_a}$+and $(T'_p,T'_a)$ is a normal form of reduction~$\to$.+\end{defn}++The penetrator derivable predicate $\der{t}{T_p}{T_a}$ is implemented as+\begin{center}+\begin{tabular}{l}+$\der{t}{T_p}{T_a}={}$\\+\quad\textbf{let} $T'_p, T'_a=\fn{decompose}(T_p,T_a)$ \textbf{in}\\+\quad$\fn{bld}(t,T'_p,T'_a)$+\end{tabular}+\end{center}++The decomposition at a node function is+\begin{center}+\begin{tabular}{l}+$\fn{dcmp}(k,n)={}$\\+\quad$\fn{decompose}(\outpred(k,n),\avoid(k))$+\end{tabular}+\end{center}++The derivable before a node predicate is implemented as+\begin{center}+\begin{tabular}{l}+$\fn{der}(k,n,t)={}$\\+\quad\textbf{let} $T_p, T_a=\fn{dcmp}(k,n)$ \textbf{in}\\+\quad$\fn{bld}(t,T_p,T_a)$+\end{tabular}+\end{center}++\chapter{Carried Only Within}\label{chp:cow}++A set of encryptions~$T_e$ protects critical message~$t$ in+message~$t'$ if~$t$ is carried by~$t'$ only within a member of~$T_e$.+The definition of the carried only within ({\cow}) relation to follow makes+this concept precise.  The concept is used when solving authentication+tests (Chapter~\ref{chp:auth tests}).++\begin{defn}[Ancestors]+Let $t'=t\termat p$.  The \index{ancestors}\emph{ancestors} of~$t'$+in~$t$ at~$p$ is the set $\fn{anc}(t,p)=\{t\termat p'\mid \mbox{$p'$ a+  proper prefix of~$p$}\}$.+\end{defn}++\begin{defn}[Carried Only Within]\label{def:cow}+Message~$t$ is \index{carried only within}\emph{carried only within}+set~$T_e$ in~$t'$ if for all \index{carried positions}carried+positions~$p$ of~$t$ in~$t'$, there exists an+ancestor~$t_a\in\fn{anc}(t',p)$ and $t_e\in T_e$ such that~$t_a\equiv+t_e$.+\end{defn}++The function defines $\fn{carpos}(t,t')$ is defined on+Page~\pageref{def:carried positions}, the set of positions at+which~$t'$ carries~$t$.  The interface to each algebra exports+\index{unify}$\fn{unify}_0$, where+$$\fn{unify}_0(t,t',\sigma)=\{\sigma'\circ\sigma\mid+\sigma'\in\fn{unify}(\sigma(t),\sigma(t'))\}.$$++The details of a reduction on skeletons called a augmentation will be+described in Section~\ref{sec:augmentation}.  In simplified form, for+an augmentation, given~$t$,~$T_e$, and~$t'$, one must find all most+general unifiers~$\sigma$ such that~$\sigma(t)$ is carried only within+set~$\sigma(T_e)$ in~$\sigma(t')$.++\begin{figure}+\begin{center}+\begin{tabular}{l}+$\fn{cows}(t,T,t') ={}$\\+\quad $\fn{cows}_0(t,T,t',\idsigma)$+\quad --- $\idsigma$ is the identity+subst \\+\\+$\fn{cows}_0(t,T,t',\sigma) ={}$\\+\quad \textbf{if} $\sigma(t)$ is {\cow} $\sigma(T)$ at+$\sigma(t')$ \textbf{then}\\+\qquad $\{\sigma\}$\\+\quad \textbf{else}\\+\qquad\textbf{let}+$S=\fn{fold}(t,T,t',\sigma)$+\textbf{in}\\+\qquad$\bigcup_{\sigma'\in S}+\fn{cows}_0(t, T, t',\sigma')$\\+\\+$\fn{fold}(t,T,t',\sigma)={}$\\+$\quad\{\sigma'\circ\sigma\mid\sigma'\in+\fn{fold}_0(\sigma(T),\sigma(t'),\{\idsigma\},+\fn{carpos}(\sigma(t),\sigma(t')))$\\+\\+$\fn{fold}_0(T,t',S,\{\})=S$\\+$\fn{fold}_0(T,t',S,\seq{p}\append P)={}$\\+\quad $\fn{fold}_0(T,t',\fn{solve}(\fn{anc}(t',p),T,S),P)$\\+\\+$\fn{solve}(T,T',S)={}$\\+\quad$\{\sigma'\mid t\in T, t'\in T',+\sigma\in S, \sigma'\in\fn{unify}_0(t,t',\sigma)\}$+\end{tabular}+\end{center}+\caption{The \fn{cows} Function}\label{fig:cows}\index{cows@\fn{cows}}+\end{figure}++A carried only within solution cannot be directly computed using+Definition~\ref{def:cow}.  Given terms~$t_a$ and~$t_e$, the+$\fn{unify}_0$ function finds substitutions~$\sigma$ such+$\sigma(t_a)\equiv \sigma(t_e)$, however, the carried positions+$\fn{carpos}(\sigma(t),\sigma(t'))$, are used before the+$\fn{unify}_0$ function computes the substitution~$\sigma$.+Figure~\ref{fig:cows} displays the iterative procedure that breaks the+cyclic dependencies.  Each step of the iteration improves an+approximation of a solution to the problem.  The correctness of this+function is shown in~\cite{algimpl}, although for a version of the+algorithm with the alternate definition for the function~$\fn{fold}$ in+Figure~\ref{fig:fold}.++\begin{figure}+\begin{center}+\begin{tabular}{l}+$\fn{fold}(t,T,t',\sigma)={}$\\+$\quad\fn{fold}_0(t,T,t',\sigma,\{\idsigma\},\fn{carpos}(\sigma(t), \sigma(t')))$\\+\\+$\fn{fold}_0(t,T,t',\sigma,S,\{\})=\{\sigma' \circ \sigma | \sigma' \in S\}$\\+$\fn{fold}_0(t,T,t',\sigma,S,\seq{p} \append P)={}$\\+\quad+$\fn{fold}_0(t,T,t',\sigma,\fn{solve}(\fn{anc}(\sigma(t'),p),\sigma(T),S),P)$\\+\end{tabular}+\end{center}+\caption{The Alternate \fn{fold} Function}\label{fig:fold}+\end{figure}++\chapter{Solving Authentication Tests}\label{chp:auth tests}++\begin{defn}[Protectors]+Let \fn{deriv} be a boolean valued function that determines if a+message is derivable.  The encryptions that+\index{protectors}protect~$t_c$ in~$t$ is+$\fn{protectors}(\fn{deriv},t_c, t) = \fn{prot}(t)$ where+$$\fn{prot}(t) =\left\{+\begin{array}{ll}+\mbox{undefined}&\mbox{if $t\equiv t_c$, else}\\+\{\}&\mbox{if $t=\enc{t_0}{t_1}$ and $t_c$ is not carried by~$t_0$, else}\\+\{\enc{t_0}{t_1}\}&+\mbox{if $t=\enc{t_0}{t_1}$ and $\lnot\fn{deriv}(\fn{inv}(t_1))$, else}\\+\fn{prot}(t_0)&\mbox{if $t=\enc{t_0}{t_1}$, else}\\+\bigcup_{i<n}\fn{prot}(t_i)&\mbox{if $t=f(t_0,\ldots,t_{n-1})$ and~$t$+  is not an atom, else}\\+\{\}&\mbox{otherwise.}+\end{array}\right.$$+\end{defn}++\begin{defn}[Escape Set]+The \index{escape set}\emph{escape set} for message~$t_c$ at~$n$ in+skeleton~$k$ is the set of encryptions $\fn{esc}(k,n,t_c)$ where+$$\fn{esc}(k,n,t_c)=\{t_e\mid t_e\in\fn{protectors}(\lambda+t\mathpunct.\fn{der}(k,n,t),t_c,t_o), t_o\in\outpred(k,n)\}$$+and~$\fn{der}(k,n,t)$ is true when $t$ is derivable before~$n$ in~$k$+(See Definition~\ref{def:der}).+\end{defn}++The $\fn{der}$ function is implemented as+$\fn{der}(k,n,t)=\fn{bld}(t,T_p,T_a)$ where+$(T_p,T_a)=\fn{dcmp}(k,n)$, so that~$T_p$ and~$T_a$ need not be+recomputed.++\begin{defn}[Critical Position]+Position~$p$ is a \index{critical position}\emph{critical position} of+$t=\msg_k(n)$ if+\begin{enumerate}+\item $p$ is a carried position in~$t$,+\item either $t\termat p\in U_k$ or $t\termat p=\enc{t_0}{t_1}$+  and~$t_1$ is not derivable before~$n$ in~$k$,+\item $\fn{esc}(k,n,t\termat p)$ is defined, and+\item $\fn{anc}(t,p)\cap \fn{esc}(k,n,t\termat p)=\emptyset$.+\end{enumerate}+\end{defn}++The message at a critical position is called an \emph{authentication+  test}.  It is a \index{nonce test}\emph{nonce test} if the message+is an atom, otherwise it is a \index{encryption test}\emph{encryption+  test}.  Observe that every critical message at a node in a skeleton+is not derivable at the node.++\begin{conj}+A reception node is unrealized iff it has a critical position.+\end{conj}++\begin{defn}[Target Messages]+Let $T_e$ be a set of messages, and~$t_c$ be a message.  The set of+\index{target messages}\emph{target messages} is+$$\fn{targ}(t_c,T_e)=\{t_c\}\cup\{t_t\mid t_e\in T_e,p\in\fn{carpos}(t_c, t_e),+t_t\in\fn{anc}(t_e,p)\}\setminus T_e.$$+\end{defn}++\begin{defn}[Critical Position Solved]\label{def:critical position solved}+Suppose~$p$ is a critical position at~$n_0$ in~$k_0$ and+$k_0\homomorphism{\phi,\sigma}k_1$.  Let~$t_0=\msg_k(n)\termat p$,+$t_1=\sigma(t_0)$, $T_0=\fn{esc}(k_0,n_0,t_0)$, $T_1=\sigma(T_0)$,+$n_1=\phi(n_0)$, and~$t=\msg_{k_1}(n_1)$.  Critical position~$p$ is+\index{solved critical position}\emph{solved} in~$k_1$ after~$k_0$+at~$n_0$ if:+\begin{enumerate}+\item $\fn{anc}(t,p)\cap T_1\neq\emptyset$, or+\item for some~$t_p\in\outpred(k_1,n_1)$, $t_1$ is not carried+  only within~$T_1$ in~$t_p$, or+\item+  $\fn{targ}(t_1,T_1)\setminus\sigma(\fn{targ}(t_0,T_0))\neq\emptyset$+  and there are variables in $k$'s protocol that are not atoms, or+\item the decryption key of a member of~$T_1$ is derivable+  before~$n_1$ in~$k_1$, or+\item $t_1$ is an encryption and its encryption key is derivable+  before~$n_1$ in~$k_1$.+\end{enumerate}+\end{defn}++\section{Test Solving Steps}++A step used to solve a test is a contraction+(Definition~\ref{def:contraction}), a regular augmentation+(Definition~\ref{def:regular augmentation}), a displacement+(Definition~\ref{def:displacement}), or a listener augmentation+(Definition~\ref{def:listener augmentation}).++\begin{defn}[Contraction]\label{def:contraction}+Let~$p$ be a critical position+at~$n$ in~$k$, $t=\msg_k(n)$, and $T_e= \fn{esc}(k,n,t\termat p)$.+Suppose there is a substitution~$\sigma$ such that for+some~$t_a\in\fn{anc}(t,p)$, $t_e\in T_e$, $\sigma(t_a)=\sigma(t_e)$.+Skeleton~$k_1$ is a \index{contraction}\emph{contraction} if+$k\reduction{\ops{S}_\sigma}k_0\reduction{\fn{pskel}}k_1$.+\end{defn}++{\cpsa} computes a set of substitutions for each critical position, and+then removes some substitutions to form a complete set of most+general unifiers.  Only most general unifiers are used for+contractions.++\begin{defn}[Regular Augmentation]\label{def:regular augmentation}+Suppose substitution~$\sigma$, non-listener role~$r$, and trace~$C$+are selected as described in Section~\ref{sec:augmentation}.+Skeleton~$k_2$ is a \index{regular augmentation}\emph{regular+  augmentation} if+$k\reduction{\ops{S}_\sigma}k_0\reduction{\ops{A}_{n,r,C}}k_1+\reduction{\fn{pskel}}k_2$.+\end{defn}++\begin{defn}[Displacement]\label{def:displacement}+Let substitution~$\sigma$, non-listener role~$r$, and trace~$C$ be+selected as described in Section~\ref{sec:augmentation}, and there be+a preskeleton~$k_1$ such that+$k\reduction{\ops{S}_\sigma}k_0\reduction{\ops{A}_{n,r,C}}k_1$.+Similar to a hulling reduction (Definition~\ref{def:hulling}), suppose+there are strands~$s$ and~$s'$, where one of them is the newly created+strand, and a most general unifier~$\sigma'$ such that+$\sigma'(\Theta_{k_1}(s)(j))\equiv \sigma'(\Theta_{k_1}(s')(j))$ for+$1\leq j\leq|\Theta_{k_1}(s)|$.  Skeleton~$k_4$ is a+\index{displacement}\emph{displacement} if+$k_1\reduction{\ops{S}_{\sigma'}}k_2\reduction{\ops{C}_{s,s'}}k_3+\reduction{\fn{pskel}}k_4$.+\end{defn}++\begin{defn}[Listener Augmentation]\label{def:listener augmentation}+Let~$p$ be a critical position at~$n$ in~$k$, $t_c=\msg_k(n)\termat+p$, and $T_e= \fn{esc}(k,n,t_c)$.  For each $\enc{t_0}{t_1}\in T_e$,+skeleton~$k_1$ is a \index{listener augmentation}\emph{listener+  augmentation} if+$k\reduction{\ops{A}_{n,\lsn,C}}k_0\reduction{\fn{pskel}}k_1$ and~$C$+listens for $\fn{inv}(t_1)$,+i.e.\ $C=\seq{\inbnd\fn{inv}(t_1),\outbnd\fn{inv}(t_1)}$.  If+$t_c=\enc{t_0}{t_1}$, then skeleton~$k_1$ is a \emph{listener+  augmentation} if+$k\reduction{\ops{A}_{n,\lsn,C}}k_0\reduction{\fn{pskel}}k_1$ and+$C=\seq{\inbnd t_1,\outbnd t_1}$.+\end{defn}++\begin{defn}[Cohort Member]\label{def:cohort member}+For unrealized node~$n$ in a skeleton~$k_0$, and a position~$p$+at~$n$, $k_0\reduction{n,p}k_1$ asserts that $k_1$ is a member of the+\index{cohort}cohort of~$k_0$, where~$k_1$ is derived using+contraction, regular augmentation, displacement, or listener+augmentation, and~$p$ is solved in~$k_1$ after~$k_0$ at~$n$.  For the+setwise cohort member reduction, $\{k_0\}\setreduction{n,p}\{k_1\mid+k_0\reduction{n,p}k_1\}$, when~$n$ is unrealized in~$k_0$, and~$p$ is+a critical position at~$n$.+\end{defn}++\begin{conj}[Critical Message Solved]+If $k_0\reduction{n_0,p_0}k_1 \reduction{n_1,p_1}\ldots+\reduction{n_{\ell-1},p_{\ell-1}}k_\ell$ is a sequence of cohort member+reductions, then for positive~$\ell$,~$p_0$ is solved in~$k_\ell$+after~$k_0$ at~$n_0$.+\end{conj}++\section{Augmentation}\label{sec:augmentation}++Let~$t_c$ be the critical message that demonstrates~$n$ is a test node+in skeleton~$k$.  For each triple~$(\sigma,r,C)$ that satisfies some+properties, there is a potential regular augmentation+with~$\comp{\reduction{\fn{pskel}}}%+{\comp{\reduction{\ops{A}_{n,r,C}}}{\reduction{\ops{S}_\sigma}}}$.+When successful, the message~$t$ in the last event of the added strand+is outbound, carries~$\sigma(t_c)$, but~$\sigma(t_c)$ is not carried+only within escape set~$\sigma(T_e)$ in~$t$, where+$T_e=\fn{esc}(k,n,t_c)$, the escape set.  Moreover, for every other+message~$t$ in the strand,~$\sigma(t_c)$ is carried only within escape+set~$\sigma(T_e)$ in~$t$.  The last event in the strand is called a+\index{transforming event}\emph{transforming event}, as this event no+longer protects the critical message, but events that precede it do.++{\cpsa} computes the parameters for a set of augmentation steps as+follows.  Suppose skeleton~$k=\skel_X(\_,P,\_,\_,\_,\_)$.  First,+compute the target messages, $T_t=\fn{targ}(t_c, T_e)$.  Next, for+each non-listener role $\role(C_r,N_r,U_r)\in P$ and each index~$h$ where+$C_r(h)=\outbnd t$, a transmission, do the following.++\begin{description}+\item[Create fresh variables:] Let~$\sigma_r$ be a sort preserving+  variable renaming, where the domain is the variables that occur in+  $\prefix{C_r}h$, and every variable in the range does not occur+  in~$X$ or in~$P$.++\item[Insert critical message:] For each message~$t'$ carried by~$t$,+  and each~$t_t\in \fn{targ}(t_c, T_e)$, consider most general+  unifiers~$\sigma'$ where, $\sigma'(t')=\sigma'(t_t)$ and+  $\sigma_r\unlhd\sigma'$.  (In other words,+  $\sigma'=\sigma_0\circ\sigma_r$ for some $\sigma_0$.)++\item[Ensure previous events do not transform:] For each $\sigma'$,+  find most general unifiers~$\sigma$ such that for $1\leq i<h$,+  $\sigma(t_c)$ is carried only within $\sigma(T_e)$ at $\sigma(C(i))$+  and $\sigma'\unlhd\sigma$.  The function \fn{cowt}, presented in+  Figure~\ref{fig:cowt}, performs the explorations, producing the+  substitutions $S'=\fn{cowt}(t_c,T_e,\prefix{C_r}{h},S)$.  Function+  $\fn{fold}$ is defined in Figure~\ref{fig:cows}.  Let $S_{r,h}$ be+  the set~$S'$ with non-most general unifiers removed.+\item[Ensure last event transforms:] For each $\sigma\in S_{r,h}$, if+  $\sigma(t_c)$ is not carried only with $\sigma(T_e)$ at+  $\sigma(C(h))$, try augmenting with parameters $n$, $r$,+  $\sigma\circ\prefix{C}{h}$, and~$\sigma$.+\end{description}++\begin{figure}+\begin{center}+\begin{tabular}{l}+$\fn{cowt}(t,T,C,S) ={}$\\+$\quad\bigcup_{\sigma\in S}\fn{cowt}_0(t,T,C,\sigma)$\\+\\+$\fn{cowt}_0(t,T,C,\sigma) ={}$\\+\quad \textbf{if} $\all{t}\pm t\in C\to\sigma(t)$ is {\cow} $\sigma(T)$ at+$\sigma(t')$ \textbf{then}\\+\qquad $\{\sigma\}$\\+\quad \textbf{else}\\+\qquad$\fn{cowt}(t,T,C,\fn{foldn}(t, T, C, \{\sigma\}))$\\+\\+$\fn{foldn}(t,T,\seq{},S)=S$\\+$\fn{foldn}(t,T,\seq{\pm t'}\append C,S)={}$\\+$\quad\fn{foldn}(t,T,C,\bigcup_{\sigma\in S}\fn{fold}(t,T,t',\sigma))$+\end{tabular}+\end{center}+\caption{The $\fn{cowt}$ Function}\label{fig:cowt}+\end{figure}++\begin{note}+For target terms to be the reasonable set for insertion of the+critical message, one must require that variables of sort message are+acquired.  This fact needs to be explained and noted as another reason+for the acquired variable constraint.+\end{note}++\chapter{Generalization}\label{chp:generalization}++Each problem statement for {\cpsa} is expressed as a preskeleton.  If+the preskeleton cannot be transformed into a single skeleton using the+Preskeleton Reduction System, an error is signaled.  Otherwise, the+first skeleton is designated as the \index{point-of-view+  skeleton}\index{skeleton!point-of-view}point-of-view skeleton.  For+each skeleton generated from a point-of-view skeleton via contraction,+augmentation, and generalization, there is a homomorphism from the+point-of-view skeleton.  Simplifying the implementation is the+motivation for restricting the algorithm to problem statements that+are expressed by a single skeleton.++\begin{defn}[Generalize]+A skeleton~$k_0$ \emph{generalizes}+skeleton~$k_1$, written $k_1\reduction{<}_k k_0$, if+both~$k_0$ and~$k_1$ are realized,~$k_0$ and~$k_1$ are not isomorphic,+there is a homomorphism from a point-of-view skeleton~$k$ to~$k_0$, and+a strandwise injective homomorphism $k_0\mapsto k_1$.+\end{defn}++If skeletons are allowed to be isomorphic, we+write~$k_1\reduction{\leq}_k k_0$, and note that $\reduction{\leq}_k$+defines a partial ordering.  Therefore, there are maximal elements in+the partial ordering.  A shape associated with a preskeleton+is a maximally generalized realized skeleton derived from the+preskeleton.++We write $k=\fn{pov}(k_0)$\index{pov@\fn{pov}} if there is a+unique~$k$ such that $k_0\reduction{\fn{skel}}k$ and there is a+homomorphism from~$k_0$ to~$k$.++\begin{defn}[Shape]+Let~$k_0$ be a preskeleton such that $k=\fn{pov}(k_0)$,+and let~$k_1$ be a realized skeleton such that+$k\mapsto k_1$.  Skeleton~$k_2$ is a \index{shape}\emph{shape} of~$k_0$ if+$k_1\reduction{\leq}_k k_2$, and~$k_2$ is maximal among skeletons that+generalize~$k_1$.+\end{defn}++There are four generalization reductions used to transform a realized+skeleton into its shapes: deletion, weakening, forgetting, and+separation.++\begin{defn}[Deletion]+Skeleton~$k_0$ \index{deletion}\emph{generalizes by deletion}+skeleton~$k_1$, written $k_1\reduction{\ops{D}_n}_k k_0$, if+$k_1\reduction{<}_k k_0$, $k_2\reduction{\fn{skel}}k_0$, and~$k_2$ is+the result of deleting node~$n$ in~$k_1$ and all of the nodes that+follow it in its strand.+\end{defn}++\begin{defn}[Weakening]+Skeleton~$k_0$ \index{weakening}\emph{generalizes by weakening}+skeleton~$k_1$, written $k_1\reduction{\ops{W}_{n,n'}}_k k_0$, if+$k_1\reduction{<}_k k_0$, $k_2\reduction{\fn{skel}}k_0$, and~$k_2$+is~$k_1$ except $\kprec{k_2}=(\kprec{k_1}\setminus\{(n,n')\})^\ast$.+\end{defn}++\begin{defn}[Forgetting]+Skeleton~$k_0$ \index{forgetting}\emph{generalizes by origination+  assumption forgetting} skeleton~$k_1$, written+$k_1\reduction{\ops{F}_t}_k k_0$, if $k_1\reduction{<}_k k_0$,+$k_2\reduction{\fn{skel}}k_0$, and~$k_2$ is~$k_1$ except+$U_{k_2}=U_{k_1}\setminus\{t\}$ and $N_{k_2}=N_{k_1}\setminus\{t\}$.+\end{defn}++Sometimes a more general skeleton can be found by replacing some+occurrences of one variable by a fresh variable.  For variable+separation, the location of an occurrence of a variable is defined+using a skeleton's instance sequence.++\begin{defn}[Location]+Message~$t$ is at \emph{location} $(s,i,p)$ in~$k$ if+$\pm t=\Theta_k(s)(i)\termat p$.+\end{defn}++\begin{defn}[Variable Separation]+Skeleton~$k_0$ \index{variable separation}\emph{generalizes by+  variable separation} skeleton~$k_1$, written+$k_1\reduction{\ops{V}_t}_k k_0$, if $k_1\reduction{<}_k k_0$,+$k_2\reduction{\fn{skel}}k_0$, and~$k_2$ is~$k_1$ except ~$t$ is a+variable that occurs in multiple locations in~$k_1$, and~$k_2$ is the+result of replacing~$t$ with a variable~$t_0$ of the same sort at a+subset of~$t$'s locations, where~$t_0$ occurs nowhere in~$k_1$.+\end{defn}++When separating a non-originating term, both the term and its clone+are non-originating.  When separating a uniquely originating term,+either the term or its clone is uniquely originating.++\begin{note}+What happens when separating~$t$ in~$k$ into~$t$ and~$t_0$, and+$\cn{ltk}(t,t)\in N_k$?  Should a skeleton~$k_0$ with+$\cn{ltk}(t,t_0)\in N_{k_0}$ be a candidate separation?+Currently, only skeletons~$k_1$ with $\cn{ltk}(t,t)\in N_{k_1}$+and $\cn{ltk}(t_0,t_0)\in N_{k_1}$ are considered.+\end{note}++\begin{defn}[Generalization]+The reduction~$\reduction{\fn{gen}}_k+=\bigcup_n\reduction{\ops{D}_n}_k\cup+\bigcup_{n,n'}\reduction{\ops{W}_{n,n'}}_k\cup+\bigcup_t\reduction{\ops{F}_t}_k\cup \bigcup_t\reduction{\ops{V}_t}_k$+is the \emph{generalization} relation.  For the setwise generalization+reduction, $\{k_0\}\setreduction{\fn{gen}}_k\{k_1\}$ when+$k_0\reduction{\fn{gen}}_k k_1$.+\end{defn}++\begin{note}+The fact that each generalization reduction replaces a singleton with+just a singleton requires explanation.  We're not sure it's justified,+and harbor serious doubts.  It is justified if we can prove the+conjecture that the cohort reduction relation produces every shape,+and generalization just identifies which realized skeletons are+shapes.  However, one member of the test suite provides a counter+example to the conjecture.  Barring a bug in {\cpsa}, the conjecture+must be false.+\end{note}++\begin{conj}[Generalization]+The relation~$\setreduction{\fn{gen}}_k$ is terminating.+\end{conj}++\section*{Discussion}+In~\cite{DoghmiGuttmanThayer07}, the shapes of a point-of-view+skeleton are said to be minimal, in the partial ordering induced by+injective homomorphism, among all realized homomorphic images of the+point-of-view skeleton.  Minimal corresponds to maximally generalized.+The need for origination assumption forgetting was not known+when~\cite{DoghmiGuttmanThayer07} was written.  Generalization by+variable separation uses non-carried positions, and in particular,+positions that traverse an atom edge.  Algebras in previous strand+space papers have no concept of a position that traverses an atom+edge, and therefore cannot be used to specify generalization by+variable separation.++\chapter{Collapsing}\label{chp:collapsing}++Let reduction $\setreduction{\fn{cg}}_k=(\setreduction{\fn{co}}\cup+\setreduction{\fn{gen}}_k)^+$, the transitive closure of the cohort+and generalization setwise reduction relations.  The normal forms of+this relation are sets of shapes, however, shapes may be missing from+each set.  This occurs when {\cpsa} is run in a mode that omits+displacements when solving authentication tests, which is sometimes+done for performance reasons.  The missing shapes are found by+collapsing other shapes.++\begin{defn}[Collapsing]+Let $k_0$ and $k_1$ be two skeletons such that there are two+strands,~$s$ and~$s'$, and a most general unifier~$\sigma$ such that+$\sigma(\Theta_{k_0}(s)(j))\equiv \sigma(\Theta_{k_0}(s')(j))$ for all+$1\leq j\leq|\Theta_{k_0}(s)|$.  Then~$k_0$ \emph{collapses} to~$k_1$,+written $k_0\reduction{\fn{clp}}k_1$, if+$k_0\reduction{\ops{S}_\sigma}k\reduction{\ops{C}_{s,s'}}k'+\reduction{\fn{skel}}k_1$.+\end{defn}++\begin{defn}[Setwise Collapsing]+For the collapsing relation $\setreduction{\fn{clp}}_k\subseteq+\pow{\alg{K}}\times\pow{\alg{K}}$,+$K_0\setreduction{\fn{clp}}_k K_1$ if~$K_0$ is a normal form of+$\setreduction{\fn{cg}}_k$, for some $k_0\in K_0$, $k_0+\reduction{\fn{clp}}k$, $\{k\}\cup K_0\setreduction{\fn{cg}}_k K_1$,+and $K_0\neq K_1$.+\end{defn}++Notice that a setwise cohort reduction may produce the empty set, but+a setwise generalization and collapsing reduction never does.++\chapter{Skeleton Reduction System}\label{chp:skeleton reduction}++Let reduction+$\twoheadrightarrow_k=\setreduction{\fn{cg}}_k\cup+(\setreduction{\fn{clp}}_k)^+$.  This reduction system specifies the+{\cpsa} program.++\begin{conj}+The reduction~$\twoheadrightarrow_k$ is confluent.+\end{conj}++\begin{conj}[Soundness]\label{cnj:soundness}+Let~$k_0$ be a preskeleton and~$k$ be an unrealized skeleton such that+$k=\fn{pov}(k_0)$.  Skeleton~$k_1$ is a shape of~$k_0$ if+$\{k\}\twoheadrightarrow_k K$, $k_1\in K$, and~$K$ is a normal form.+\end{conj}++The set of bundles denoted by preskeleton~$k$, $\sembrack{k}$ is+defined on Page~\pageref{def:preskeleton denotation}.++\begin{conj}[Completeness]\label{cnj:completeness}+Let~$k_0$ be a preskeleton and~$k$ be an unrealized skeleton such that+$k=\fn{pov}(k_0)$.  For all~$K$ such that $\{k\}\twoheadrightarrow_k+K$, $\sembrack{k_0}=\bigcup_{k_1\in K}\sembrack{k_1}$.+\end{conj}++\chapter*{Acknowledgement}++Carolyn Talcott and Leonard Monk provided valuable feedback on drafts+of this document.++\appendix++\chapter{Programs Specified by a Role}\label{chp:traces}++Given the definitions in Chapter~\ref{chp:strand spaces and bundles},+a role can be viewed as an abstraction of a program, and a strand as+an abstraction of a run of a program.  But what program is specified+by a role?++Consider a role that contains the event $\inbnd\enc{t_0}{t_1}$.  If+the program has the decryption key~$\fn{inv}(t_1)$ before the message+is received, the program could decrypt the message and extract~$t_0$.+Alternatively, if the program has $\enc{t_0}{t_1}$, or has~$t_0$ and+the encryption key~$t_1$, it might check to see if the received+message is the same as the expected message, and abort the run if not.++Here is an example of when the second behavior is desired.  In+{\cpsa}, encryption can be used to represent hashing.  The hash of~$t$,+$\#t$, expands to $\enc{\mbox{``hash''},t}{h}$, where~$h$ is an+asymmetric key known to all, but no one knows~$h^{-1}$.  The tag+``hash'' is added to the encryption so as to ensure a hash is never+confused with other uses of encryption.++A role does not specify a valid program if the only possible way of+interpreting the event~$\inbnd\#t$ is by using~$h^{-1}$ to decrypt+$\enc{\mbox{``hash''},t}{h}$.  The remainder of this section describes+how this class of specification errors is detected for the Basic Crypto+Algebra.++The behaviors associated with a trace depend on the set of messages+available initially.  The behaviors are specified by a data flow+relation, $\flow{T_0}{C}{T_1}$.  For trace~$C$, the relation+$\flow{T_0}{C}{T_1}$ asserts that when messages~$T_0$ are available+initially, there is a behavior of~$C$ that produces messages~$T_1$.++A derivation tree used to demonstrate $\flow{T_0}{C}{T_1}$ shows the steps+that enable the flow of data.  The tree can be linearized, and thus+specifies a sequential program that implements the role.++The data flow relation is defined with the aid of a data flow relation+for a sequence of events, $\flow{T_0}{C}{T_1}$.++$$\flow{T}{\seq{}}{T}\qquad+\infer{\flow{T_0}{\seq{\pm t}}{T}\quad\flow{T}{C}{T_1}}%+{\flow{T_0}{\seq{\pm t}\append C}{T_1}}$$++The $\flow{T_0}{\seq{\pm t}}{T_1}$ relation is defined using the+$\flow{T_0}{C}{T_1}$ relation.  An outbound message can be formed if+it is available initially+$$\infer{t\in T}{\flow{T}{\seq{+t}}{T}}$$+or if it can be formed by construction.+$$\infer{\flow{T}{\seq{+t_1,\ldots,+t_{n}}}{T}}%+{\flow{T}{\seq{+f(t_1,\ldots,t_{n})}}{T}}\quad+\left[\begin{array}{l}+f(t_1,\ldots,t_{n})\\+\mbox{not an atom}+\end{array}\right]$$++An inbound message makes atoms and acquired variables available.+$$\flow{T}{\seq{-t}}{T\cup\{t\}}\quad [\mbox{$t$ an atom or a variable}]$$+When the decryption key is available, the contents of the encryption+are also available.  Furthermore, the encryption can be sent in future+messages without access to its encryption key.+$$\infer{\flow{T_0}{\seq{+\fn{inv}(t_1)}}{T_0}\quad+  \flow{T_0}{\seq{-t_0}}{T_1}}{\relax+  \flow{T_0}{\seq{-\enc{t_0}{t_1}}}{T_1\cup\{\enc{t_0}{t_1}\}}}$$ A received+encryption that can be sent ensures the encryption agrees with+currently available terms and makes nothing new available.+$$\infer{\flow{T}{\seq{+\enc{t_0}{t_1}}}{T}}{\relax+  \flow{T}{\seq{-\enc{t_0}{t_1}}}{T}}$$++Consider an operation $f$ other than the encryption operation.  The+order in which messages that occur in a message constructed using~$f$+are made available may determine if the decryption key of an+encryption is available.  All possible orderings must be explored.+Let~$\pi_n$ be a permutation on the domain of a sequence of+length~$n$.+$$\infer{\flow{T_0}{\seq{-t_1,\ldots,-t_{n}}\circ\pi_n}{T_1}}%+{\flow{T_0}{\seq{-f(t_1,\ldots,t_{n})}}{T_1}}+\left[\begin{array}{l}+f(t_1,\ldots,t_{n})\\+\mbox{not an atom}+\end{array}\right]$$++The data flow relation is used to find initial sets of atoms that are+compatible with some behavior of a trace that produces messages.++\begin{defn}[Trace Parameters]+The set of atoms~$T_0$ are \index{parameters}\emph{parameters} of+trace~$C$ if $\flow{T_0}{C}{T_1}$ for some~$T_1$, and~$T_0$ is+minimal, that is for all~$T'_0$ such that $\flow{T'_0}{C}{T_1}$,+$T'_0\not\subset T_0$.+\end{defn}++The role $\seq{\outbnd\enc{a,n}{K_b},\inbnd\enc{n}{K_a}}$ has two sets+of parameters, $\{a,n,K_b,K^{-1}_a\}$ and $\{a,n,K_b,K_a\}$.  See+Figure~\ref{fig:ambigrole} for two examples of programs that implement+the role, using distinct parameter sets.++\begin{figure}+\begin{center}+\begin{tabular}{l@{\hspace{8mm}}l}+$\cn{proc}(a,n,K_b,K^{-1}_a)$ & $\cn{proc}(a,n,K_b,K_a)$\\+$\quad \cn{send}(\enc{a,n}{K_b});$ & $\quad \cn{send}(\enc{a,n}{K_b});$\\+$\quad x_0\gets \cn{recv}();$ & $\quad x_0\gets \cn{recv}();$\\+$\quad x_1\gets \cn{decrypt}(x_0,K^{-1}_a);$ & $\quad x_1\gets \enc{n}{K_a};$\\+$\quad x_1 \neq n \to \cn{fail};$ & $\quad x_0 \neq x_1 \to \cn{fail};$ \hspace{8mm}\\+$\cn{end}$ & $\cn{end}$+\end{tabular}+\end{center}+\label{fig:ambigrole}+\caption{Two programs that implement the role $\seq{\outbnd\enc{a,n}{K_b},\inbnd\enc{n}{K_a}}$.}+\end{figure}++The {\cpsa} distribution contains a program that computes the set of+parameters of a role.  It was used to find an error in a role's use of+hashing as described at the beginning of this section.  The role in+question is the verifier role that is part of an attestation+protocol~\cite{CokerEtAl11}.  In an earlier version of the role,+every set of parameters included the decryption key of the encryption+used as a hash.  The role was so complicated that inspection did not+reveal the error.++Note that this section is specific to the basic crypto algebra in the+sense that all non-atomic operations are assumed to be constructable,+and encryption has the specific de-construction recipe shown.  Although+carried positions were not mentioned in this section, the inference system+specifies the same concept.  In fact, in future work we hope to show that+the inference system is all one needs to define, and that which positions+are carried, which are protected, and which sorts are atoms can be defined+in terms of the inferences available.++\chapter{Shape Analysis and First-Order Logic}\label{chp:logic}++For each point-of-view skeleton and its shapes found by {\cpsa}, there+is a formula in the language of order-sorted first-order logic called+a \index{shape analysis sentence}\emph{shape analysis sentence,} often+shortened to a shape sentence.  The sentence has a special form,+$\all{X}\Psi\rightarrow\bigvee_i\some{Y_i}\Delta_i\wedge\Phi_i$,+where~$\Psi$ and~$\Phi_i$ are conjunctions of atomic formulas and~$X$+and~$Y_i$ are variable sets.  This fragment of first-order logic is+called coherent logic.  Formula~$\Psi$ describes the point-of-view+skeleton~$k$.  For each homomorphism to a shape,+$k\homomorphism{\delta_i}k_i$, formula~$\Delta_i$ describes the+structure preserving maps~$\delta_i$, and the shape~$k_i$ is+described by~$\Phi_i$.++Models of a shape sentence are skeletons.  If {\cpsa} finds all of the+shapes and the homomorphisms associated with a point-of-view skeleton,+the analysis' shape sentence is modeled by all realized skeletons.+Shape sentences are closely related to security+goals~\cite{guttman09}, and motivated by that work.++\section{Shape Formulas}++The signature for terms extends the one used for the underlying+message algebra with a sort $\dom{nat}$, the sort of natural numbers,+and two new operations, constant $\cn{zero}\colon\dom{nat}$, and the+successor function $\cn{succ}\colon\dom{nat}\to\dom{nat}$.  The text+uses the usual numerals for natural numbers.++Shape formulas make use of protocol specific predicates and protocol+independent predicates.  For each role $r=\role_Y(C,N,U)$ in+protocol~$P$, there are protocol specific binary predicates+$P[r,h,x]\colon\dom{nat}\times S$ for every $1\leq h\leq|C|$+and~$x\colon S$ that occurs in~$C|_h$.  The protocol independent unary+predicates are $\cn{non}\colon\dom{mesg}$ and+$\cn{uniq}\colon\dom{mesg}$.  The protocol independent predicate of+arity four is $\cn{precedes}\colon+\dom{nat}\times\dom{nat}\times\dom{nat}\times\dom{nat}$.  The+predicate \cn{false} has arity zero and, of course, equality is+binary.++We define~$\form(k)=(Y,\Phi)$, where~$\Phi$ is $k$'s skeleton formula,+and~$Y$ is the formula's variable set.  Let+$k=\skel_X(\rl,P,\Theta,\prec,N,U)$.  The variable set~$Y$ is~$X$+augmented with a variable~$z_s\colon\dom{nat}$ for each strand+$s\in\sdom(\Theta)$.  The formula~$\Phi$ is a conjunction of atomic+formulas composed as follows.++\begin{itemize}+\item For each $s\in\sdom(\Theta)$, let $r=\rl(s)=\role_Y(C,N,U)$,+  $\comp{\sigma}{C|_h}=\Theta(s)$, and $h=|\Theta(s)|$.  For each+  variable $x\in\sdom(\sigma)$ and term $t=\sigma(x)$, assert+  $P[r,h,x](z_s,t)$.  Note $\sigma\colon\alga_Y\to\alga_X$ is the+  homomorphism described near the end of Chapter~\ref{chp:strand+    spaces and bundles}.+\item For each $(s,i)\prec(s',i')$, assert+  $\cn{precedes}(z_s,i,z_{s'},i')$.+\item For each $t\in N$, assert $\cn{non}(t)$.+\item For each $t\in U$, assert $\cn{uniq}(t)$.+\end{itemize}++In the code that extracts a shape analysis sentence, the+$\cn{procedes}$ predicate is not asserted for strand succession, and+only for communication when the it is in the transitive reduction of+the~$\prec$ relation.  The missing relations must be asserted as axioms+for proper handling of a shape sentence.++Given a set of homomorphisms $k\homomorphism{\delta_i}k_i$, its shape+sentence is+\begin{equation}+\sent(k\homomorphism{\delta_i}k_i)=\all{X}\Psi\rightarrow+\bigvee_i\some{Y_i}\Delta_i\wedge\Phi_i,\label{eq:shape sentence}+\end{equation}+where $\form(k)=(X,\Psi)$.  The same procedure produces~$Y_i$+and~$\Phi_i$ for shape~$k_i$ with one proviso---the variables in+$Y_i$ that also occur in~$X$ must be renamed to avoid trouble while+encoding the structure preserving maps~$\delta_i$.++\begin{figure}+$$\begin{array}{l}+\all{a_0,b_0\colon A, s_0\colon S, d_0\colon T, z_0\colon N}\\+\quad\init_{2,a}(z_0,a_0)\wedge+\init_{2,b}(z_0,b_0)\wedge+\init_{2,s}(z_0,s_0)\wedge+\init_{2,d}(z_0,d_0)\wedge{}\\+\quad\cn{non}(a_0^{-1})\wedge+\cn{non}(b_0^{-1})\wedge+\cn{uniq}(s_0)\\+\quad\rightarrow\\+\quad\some{a_1,b_1\colon A, s_1\colon S, d_1\colon T, z_1,z_2\colon+  N}\\+\qquad z_0=z_1\wedge a_0=a_1\wedge b_0=b_1\wedge s_0=s_1\wedge d_0=d_1\wedge{}\\+\qquad\init_{2,a}(z_1,a_1)\wedge+\init_{2,b}(z_1,b_1)\wedge+\init_{2,s}(z_1,s_1)\wedge+\init_{2,d}(z_1,d_1)\wedge{}\\+\qquad\resp_{2,a}(z_1,a_1)\wedge+\resp_{2,b}(z_1,b_1)\wedge+\resp_{2,s}(z_1,s_1)\wedge+\resp_{2,d}(z_1,d_1)\wedge{}\\+\qquad\cn{precedes}(z_1,1,z_2,1)\wedge+\cn{precedes}(z_2,2,z_1,2)\wedge{}\\+\qquad\cn{non}(a_1^{-1})\wedge+\cn{non}(b_1^{-1})\wedge+\cn{uniq}(s_1)+\end{array}$$+\caption{A Shape Analysis Sentence for Blanchet's+  Protocol}\label{fig:blanchet's shape analysis sentence}+\end{figure}++The structure preserving maps~$\delta_i=(\phi_i,\sigma_i)$ are encoded+in~$\Delta_i$ by a conjunction of equalities.  Map~$\sigma_i$ is coded+as equalities between a message algebra variable in the domain+of~$\sigma_i$ and the term it maps to.  Map~$\phi_i$ is coded as+equalities between strand variables in~$\Psi$ and strand variables+in~$\Phi_i$.  Let~$Z$ be the sequence of strand variables freshly+generated for~$k$, and~$Z_i$ be the ones generated for~$k_i$.  The+strand mapping part of~$\Delta_i$ is+$\bigwedge_{j\in\sdom(\Theta)}Z(j)=Z_i(\phi_i(j))$.++The shape analysis sentence for the first analysis of Blanchet's+Simple Example Protocol in Section~\ref{sec:blanchet's simple example+  protocol} is displayed in Figure~\ref{fig:blanchet's shape analysis+  sentence}.  The sort \dom{nat} is abbreviated as~$N$, and the+strand progress predicate $P[r,h,x](z,t)$ is written $r_{h,x}(z,t)$+with the protocol left implicit.++\section{Models of Shape Formulas}++The universe for a model of a shape formula is+$\alg{D}=\nat\cup\alga_X$.  When skeleton~$k$ and variable assignment+$\alpha:Z\to \alg{D}$ model formula~$\Psi$, we write+$k,\alpha\models\Psi$.++For each protocol specific predicate $P[r,h,x]$, $k,\alpha\models+P[r,h,x](y,z)$ iff $\alpha(y)\in\nat$, $\alpha(z)\in\alga$, and with+$\alpha(y)=s$,++\begin{enumerate}+\item $s\in\sdom(\Theta)$,+\item $h\in\sdom(\Theta(s))$, and+\item $\alpha(z)=\sigma(x)$, where $\rl(s)=\role(C,N,U)$,+$\comp{\sigma}{C|_\ell}=\Theta(s)$, and $\ell=|\Theta(s)|$.+\end{enumerate}++In a model, $\rl(s)$ need not be~$r$.  The events that make up a+strand's trace is all that matters.  The protocol specific predicate+$P[r,h,x]$ is called a \index{strand progress predicate}\emph{strand+  progress predicate}, because it asserts a strand is associated with+an instance of role~$r$ of height at least~$h$.++Modeling the protocol independent predicates is straightforward.+\begin{itemize}+\item $k,\alpha\models\cn{non}(y)$ iff $\alpha(y)\in N$.+\item $k,\alpha\models\cn{uniq}(y)$ iff $\alpha(y)\in U$.+\item $k,\alpha\models y=z$ iff $\alpha(y)=\alpha(z)$.+\item $k,\alpha\models\cn{precedes}(w,x,y,z)$ iff+$(\alpha(w),\alpha(x))\prec(\alpha(y),\alpha(z))$.+\item $k,\alpha\not\models\cn{false}$.+\end{itemize}++\begin{conj}+Let $\form(k)=(X,\Psi)$ and $\Phi=\some{X}\Psi$.+Skeleton~$k'$ models~$\Phi$ if there is a homomorphism from~$k$ to+$k'$, i.e.\ $k'\models\Phi$ iff $\some{\delta}k\homomorphism{\delta}k'$.+\end{conj}++This conjecture is essentially a restatement of the first of the two+main results from~\cite{guttman09}.++The set of bundles denoted by preskeleton~$k$, $\sembrack{k}$ is+defined on Page~\pageref{def:preskeleton denotation}.++\begin{conj}+Let $k\homomorphism{\delta_i}k_i$ be a complete set of homomorphisms+for shapes $k_i\in K$, and assume $\sembrack{k}=\bigcup_{k'\in+  K}\sembrack{k'}$.  Then the shape analysis+sentence~$\Sigma=\sent(k\homomorphism{\delta_i}k_i)$ is modeled by all+realized skeletons~$k$, i.e.\ $k\models\Sigma$.+\end{conj}++A shape analysis sentence can be translated into the language of+ordinary first-order logic and used with an automated first-order+theorem prover.  If security goal~$\Phi$ can be derived from shape+analysis sentence~$\Sigma$, then $\Phi$ is modeled by all realized+skeletons.++\begin{conj}+Suppose $\Phi$ is a security goal and $\Sigma$ is a shape analysis+sentence modeled by all realized skeletons.  Then $\Sigma\vdash\Phi$+iff $\Phi$ is modeled by all realized skeletons.+\end{conj}++\bibliography{cpsa}+\bibliographystyle{plain}++\printindex  \end{document}
doc/cpsatheory.pdf view

binary file changed (291485 → 292084 bytes)

doc/cpsatheory.tex view
@@ -5,7 +5,8 @@ \usepackage[matrix,arrow,curve]{xy}  \title{CPSA Theory}-\author{Moses D.~Liskov\and John D. Ramsdell\and Paul D.~Rowe}+\author{Moses D.~Liskov\and John D. Ramsdell\and Paul D.~Rowe\\+  The MITRE Corporation\\ CPSA Version \version}  \input{macros} @@ -69,7 +70,8 @@ \maketitle \cpsacopying -\emph{This is a draft and some key theorems lack proofs.}+\emph{This is a draft and there is much that is missing.  We+  expect this document is in for a big change.}  {\cpsa} takes a partial description of a run of a protocol, and attempts to produce a compact description of all possible runs of the@@ -205,7 +207,7 @@  $$\fn{inv}(t) =\left\{ \begin{array}{ll}-\cn{invk}(t)&\mbox{if $t\colon\dom{akey}$;}\\+\cn{invk}(t)&\mbox{if $t\colon\scap{akey}$;}\\ \mbox{undefined}&\mbox{if $t$ is a variable of sort $\top$;}\\ t&\mbox{otherwise.} \end{array}\right.$$@@ -220,13 +222,18 @@ We write $\alga_X$ when it is important to identify the variable set~$X$ that generates the algebra.  Given two variable sets~$X$ and~$Y$, a \emph{substitution} is an order-sorted map~$\sigma\colon-X\rightarrow\alga_Y$ such that $\sigma(x)\neq x$ for only finitely many-elements of~$X$.  For a substitution~$\sigma$, the \emph{domain} is-the set of variables $\sdom(\sigma)=\{x\mid \sigma(x)\neq x\}$ and the-\emph{range} is the set $\sran(\sigma)=\{\sigma(x)\mid-x\in\sdom(\sigma)\}$.  Given a substitution~$\sigma\colon-X\rightarrow\alga_Y$, the unique homomorphism $\sigma^\ast\colon-\alga_X\rightarrow\alga_Y$ induced by~$\sigma$ is also denoted~$\sigma$.+X\rightarrow\alga_Y$ such that $\sigma(x)\neq x$ for only finitely+many elements of~$X$.  For a substitution~$\sigma$, the \emph{domain}+is the set of variables $\sdom(\sigma)=\{x\mid \sigma(x)\neq x\}$ and+the \emph{range} is the set $\sran(\sigma)=\{\sigma(x)\mid+x\in\sdom(\sigma)\}$.  Substitution~$\sigma_0$ is \index{more general+  substitution}\emph{more general than}~$\sigma_1$,+written~$\sigma_0\unlhd\sigma_1$, if there exists a+substitution~$\sigma_2$ such that+$\all{x}\sigma_1(x)\equiv\sigma_2(\sigma_0(x))$.  Given a+substitution~$\sigma\colon X\rightarrow\alga_Y$, the unique+homomorphism $\sigma^\ast\colon \alga_X\rightarrow\alga_Y$ induced+by~$\sigma$ is also denoted~$\sigma$.  In what follows, a finite sequence is a function from an initial segment of the whole numbers.  The length of a sequence~$f$ is~$|f|$,@@ -893,7 +900,7 @@ \item\label{enu:contract} $\anc(t',p) \cap T' \neq \emptyset$, or \item\label{enu:augment} for some $t_p\in\transpred_{k'}(n')$, $\mncow(t' \termat p,T',t_p)$, or-\item[2a.]\label{enu:augment2} +\item[2a.]\label{enu:augment2} $\fn{targ}(t'_c,T') \setminus \sigma(\fn{targ}(t_c,T)) \neq \emptyset$ and there are variables in $k$'s protocol that are not atoms, or@@ -1349,7 +1356,7 @@ \end{defn}  \begin{defn}-Let $k$ be an unrealized skeleton with unrealized node $n$ and critical position $p$.  Let $k'$ be a realized +Let $k$ be an unrealized skeleton with unrealized node $n$ and critical position $p$.  Let $k'$ be a realized skeleton, and let $k \homomorphism{\phi,\sigma} k'$.  Then $(r,i,pp,tt)$ is a {\em solving augmentation candidate} for $(k,k',n,p,\phi,\sigma)$ if $(r,i,pp,tt)$ is an augmentation candidate for $(k,n,p)$, and \begin{enumerate}
doc/cpsauser.html view
@@ -38,7 +38,7 @@ <p>The analyzer is designed to work well with other tools. S-expressions are used for both input and output. The analyzer reads all the problems in its input, writes out the solution to each problem, and then exits. This release-contains six tools. The <a href="#cpsagraph"><tt>cpsagraph</tt></a> program+contains seven tools. The <a href="#cpsagraph"><tt>cpsagraph</tt></a> program provides a visualization of answers using Scalable Vector Graphics (<a href="http://www.w3.org/Graphics/SVG/">SVG</a>). The <a href="#cpsashapes"><tt>cpsashapes</tt></a> program removes intermediate results@@ -47,6 +47,8 @@ href="#cpsafiff"><tt>cpsadiff</tt></a> program compares CPSA output   files S-expression by S-expression, and prints the first skeleton   that differs.+The <a href="#cpsalogic"><tt>cpsalogic</tt></a> program logical+  formula that can be used to ensure security goals are achieved. The <a href="#cpsaannotations"><tt>cpsaannotations</tt></a> program uses protocol annotations to annotate shapes and generate protocol soundness obligations. The@@ -308,7 +310,7 @@ <p>The title is used by <tt>cpsagraph</tt> when generating XHTML.   In the following example, the herald form specifies a strand bound   of 12 in a way that is equivalent to the command line-  option <tt>--bound=12</tt>.</pp>+  option <tt>--bound=12</tt>.</p>  <blockquote>   <pre>(herald "Needham-Schroeder Public-Key Protocol" (bound 12))</pre>@@ -435,6 +437,27 @@   -v       --version      show version number</pre> </blockquote> +<h2 id="cpsalogic">Formula Extraction</h2>++<p>The <tt>cpsalogic</tt> program extracts a formula in the language+  of order-sorted first-order logic for each problem and its shapes+  from a CPSA run. The formula is called a shape analysis+  sentence. The formula is modeled by all realized skeletons when CPSA+  finds all the shapes for the problem.</p>++<h3>Usage</h3>++<blockquote>+  <pre>$ cpsalogic -h+Usage: cpsalogic [OPTIONS] [FILE]+  -o FILE    --output=FILE     output FILE+  -m INT     --margin=INT      set output margin (default 72)+  -a STRING  --algebra=STRING  algebra (default basic)+  -s         --show-algebras   show algebras+  -h         --help            show help message+  -v         --version         show version number</pre>+</blockquote>+ <h2 id="cpsaannotations">Annotations</h2>  <p>The <tt>cpsaannotations</tt> program uses protocol annotations to annotate@@ -461,9 +484,9 @@ the position of the event in the trace that is annotated by the formula. Zero-based indexing is used.</p> -<p>The language of formulas is first-order logic extended with a modal says-operator. Formula terms may include function symbols that are not part of a-protocol's message signature.</p>+<p>The language of formulas is order-sorted first-order logic extended+with a modal says operator. Formula terms may include function symbols+that are not part of a protocol's message signature.</p>  <blockquote>   <pre>ANNOTATION ::= (annotations TERM (INT FORMULA)*)
doc/index.html view
@@ -37,7 +37,7 @@  <p>After running the analysis, you will note files with the extension <tt>.xhtml</tt>. These are XHTML/SVG compound documents that can be viewed by-standards compliant browsers such as Firefox or Safari.</p>+standards compliant browsers such as Firefox, Chrome, or Safari.</p>  <p>New users should study CPSA's analysis of the following protocols in order, Needham-Schroeder (<tt>ns.xhtml</tt>), Woo-Lam (<tt>woolam.xhtml</tt>), Yahalom
doc/macros.tex view
@@ -1,5 +1,5 @@ \newcommand{\cpsa}{\textsc{cpsa}}-\newcommand{\version}{2.2.2}+\newcommand{\version}{2.2.3} \newcommand{\cpsacopying}{\begingroup   \renewcommand{\thefootnote}{}\footnotetext{{\copyright} 2010 The     MITRE Corporation.  Permission to copy without fee all or part of@@ -11,7 +11,7 @@ \newcommand{\pov}{\textsc{pov}} \newcommand{\cow}{\textsc{cow}} \newcommand{\cn}[1]{\ensuremath{\operatorname{\mathsf{#1}}}}-\newcommand{\dom}[1]{\ensuremath{\operatorname{\mathrm{#1}}}}+\newcommand{\dom}[1]{\ensuremath{\operatorname{\mathbf{#1}}}} \newcommand{\fn}[1]{\ensuremath{\operatorname{\mathit{#1}}}} \newcommand{\seq}[1]{\ensuremath{\langle#1\rangle}} \newcommand{\enc}[2]{\ensuremath{\{\!|#1|\!\}_{#2}}}@@ -46,8 +46,6 @@ \newcommand{\alg}[1]{\ensuremath{\mathfrak#1}} \newcommand{\ops}[1]{\ensuremath{\mathbb#1}} \newcommand{\bundle}{\ensuremath{\mathcal{B}}}-\newcommand{\nncow}[1]{\mathbin{\odot^{#1}}}-\newcommand{\ncow}[1]{\mathbin{\dagger^{#1}}} \newcommand{\der}[3]{\ensuremath{\dctx{#2}{#3}\vdash#1}} \newcommand{\dctx}[2]{\ensuremath{#1:#2}} \newcommand{\flow}[3]{\ensuremath{#1,#2\rhd#3}}
src/CPSA/Annotations/Annotations.hs view
@@ -153,7 +153,6 @@ type Pair = (Node, Node)        -- Precedes relation  data Algebra t p g s e c => Preskel t p g s e c = Preskel-    -- Role from which this was instantiated (Nothing for listeners)     { protocol :: Prot t p g s e c,       insts :: [Instance t p g s e c],       traces :: [Trace],@@ -277,13 +276,12 @@ -- Load the node orderings  loadOrderings :: Monad m => Strands -> [SExpr Pos] -> m [Pair]-loadOrderings strands xs =-    foldM f [] xs-    where-      f ns x =-          do-            np <- loadPair strands x-            return (adjoin np ns)+loadOrderings _ [] = return []+loadOrderings strands (x : xs) =+    do+      np <- loadPair strands x+      nps <- loadOrderings strands xs+      return (adjoin np nps)  loadPair :: Monad m => [Int] -> SExpr Pos -> m Pair loadPair heights (L pos [x0, x1]) =
src/CPSA/Basic/Algebra.hs view
@@ -1012,6 +1012,12 @@ displayEnc ctx (F Cat [t0, t1]) t = displayTerm ctx t0 : displayEnc ctx t1 t displayEnc ctx t0 t1 = [displayTerm ctx t0, displayTerm ctx t1] +displayEnv :: Context -> Context -> Env -> [SExpr ()]+displayEnv ctx ctx' (Env r) =+    map (\(x, t) -> L () [displayTerm ctx x, displayTerm ctx' t]) r'+    where+      r' = map (\(x, t) -> (I x, inferSort t)) $ M.assocs r+ -- displaySubst c s displays a substitution s in context c, where some -- variables that occur in s might not be in c.  Enough sort -- inference is performed so as to allow the extension of the context.@@ -1094,6 +1100,7 @@     addToContext = addToContext     displayVars = displayVars     displayTerm = displayTerm+    displayEnv = displayEnv     displaySubst = displaySubst  instance C.Algebra Term Place Gen Subst Env Context
src/CPSA/DiffieHellman/Algebra.hs view
@@ -1641,6 +1641,12 @@ displayEnc ctx (F Cat [t0, t1]) t = displayTerm ctx t0 : displayEnc ctx t1 t displayEnc ctx t0 t1 = [displayTerm ctx t0, displayTerm ctx t1] +displayEnv :: Context -> Context -> Env -> [SExpr ()]+displayEnv ctx ctx' (Env (_, r)) =+    map (\(x, t) -> L () [displayTerm ctx x, displayTerm ctx' t]) r'+    where+      r' = map (\(x, t) -> (I x, inferSort t)) $ M.assocs r+ -- displaySubst c s displays a substitution s in context c, where some -- variables that occur in s might not be in c.  Enough sort -- inference is performed so as to allow the extension of the context.@@ -1725,6 +1731,7 @@     addToContext = addToContext     displayVars = displayVars     displayTerm = displayTerm+    displayEnv = displayEnv     displaySubst = displaySubst  instance C.Algebra Term Place Gen Subst Env Context
src/CPSA/Lib/Algebra.hs view
@@ -1,4 +1,4 @@--- Defines the interface to CPSA algebras+-- Defines the interface to CPSA algebras.  -- Copyright (c) 2009 The MITRE Corporation --@@ -186,6 +186,7 @@     addToContext :: c -> [t] -> c -- Add to context from some terms     displayVars :: c -> [t] -> [SExpr ()]     displayTerm :: c -> t -> SExpr ()+    displayEnv :: c -> c -> e -> [SExpr ()]     -- A substitution display routine is required due to the fact that     -- the sort of some variables in the substitition might not be     -- known.  For the purposes of displaying the substitition, enough
src/CPSA/Lib/CPSA.hs view
@@ -1,5 +1,5 @@--- Types and functions used to construct an implementation of an--- algebra.+-- Exports the types and functions used to construct an implementation+-- of an algebra.  -- Each algebra provides an instance of each type class in the Algebra -- module, and exports its name, and its starting variable generator.@@ -19,8 +19,8 @@  module CPSA.Lib.CPSA (module CPSA.Lib.Utilities,                       module CPSA.Lib.SExpr,-                      module CPSA.Lib.Printer,                       module CPSA.Lib.Pretty,+                      module CPSA.Lib.Printer,                       module CPSA.Lib.Notation,                       module CPSA.Lib.Algebra,                       Event (..), flow) where
src/CPSA/Lib/Cohort.hs view
@@ -132,7 +132,7 @@ -- 2. for some t in outpred(k', phi(v)), t' is not carried only within --    T in t, or ----- 2a. targetterms(t', T) \ sigma(targetterms(t, esc(k, v, t)) /= empty +-- 2a. targetterms(t', T) \ sigma(targetterms(t, esc(k, v, t)) /= empty --    and there are variables in k's protocol that are not atoms, or -- -- 3. the decryption key for an element of T is derivable, or@@ -380,13 +380,15 @@                 Cause t p g s e c -> [Preskel t p g s e c] augmentations displacement k ct pos ek n escape cause =     [ k' | r <- roles (protocol k),-           k' <- roleAugs displacement k ct pos ek n escape cause r ]+           k' <- roleAugs displacement k ct pos ek n escape cause targets r ]+    where+      targets = S.toList (targetTerms ct escape)  roleAugs :: Algebra t p g s e c => Bool -> Preskel t p g s e c ->             t -> p -> Maybe t -> Node -> Set t -> Cause t p g s e c ->-            Role t p g s e c -> [Preskel t p g s e c]-roleAugs displacement k ct pos ek n escape cause role =-    [ k' | (subst', inst) <- transformingNode ct escape role subst,+            [t] -> Role t p g s e c -> [Preskel t p g s e c]+roleAugs displacement k ct pos ek n escape cause targets role =+    [ k' | (subst', inst) <- transformingNode ct escape targets role subst,            (k', n', subst'') <-                augment displacement k n cause role subst' inst,            maybeSolved ct pos ek escape k' n' subst'' ]@@ -406,12 +408,11 @@             [] -> error "Cohort.grow: Internal error"  transformingNode :: Algebra t p g s e c => t -> Set t ->-                    Role t p g s e c -> (g, s) ->+                    [t] -> Role t p g s e c -> (g, s) ->                     [((g, s), Instance t p g s e c)]-transformingNode ct escape role subst =+transformingNode ct escape targets role subst =     loop 1 [] [] (rtrace role)     where-      targets = S.toList (targetTerms ct escape)       -- loop height past acc trace       loop _ _ acc [] = acc       loop ht past acc (In t : c) =@@ -454,11 +455,11 @@ cowt :: Algebra t p g s e c => t -> Set t ->         Trace t p g s e c -> [(g, s)] -> [(g, s)] cowt ct escape c substs =-    nubSubst $ concatMap (cowt0 ct escape c) substs+    nubSnd $ concatMap (cowt0 ct escape c) substs --- Remove gen substs pairs with the same substs.-nubSubst :: Algebra t p g s e c => [(g, s)] -> [(g, s)]-nubSubst substs =+-- Remove pairs with the same second element.+nubSnd :: Eq b => [(a, b)] -> [(a, b)]+nubSnd substs =     L.nubBy (\(_, s) (_, s') -> s == s') substs  -- Handle one substitution at a time.
src/CPSA/Lib/Displayer.hs view
@@ -1,4 +1,4 @@--- Displayer for protocols and preskeletons+-- Displays protocols and preskeletons as S-expressions.  -- Copyright (c) 2009 The MITRE Corporation --
src/CPSA/Lib/Entry.hs view
@@ -1,4 +1,4 @@--- A common entry point for programs based on the CPSA library+-- Provides a common entry point for programs based on the CPSA library.  -- Copyright (c) 2009 The MITRE Corporation --
src/CPSA/Lib/Expand.hs view
@@ -1,4 +1,4 @@--- Expands macros using definitions in the input+-- Expands macros using definitions in the input.  -- Copyright (c) 2009 The MITRE Corporation --
src/CPSA/Lib/Loader.hs view
@@ -1,4 +1,4 @@--- Loader for protocols and preskeletons+-- Loads protocols and preskeletons from S-expressions.  -- Copyright (c) 2009 The MITRE Corporation --
src/CPSA/Lib/Notation.hs view
@@ -1,4 +1,4 @@--- A CPSA specific pretty printer+-- A CPSA specific pretty printer using infix notation.  -- Copyright (c) 2009 The MITRE Corporation --
src/CPSA/Lib/Pretty.hs view
@@ -1,4 +1,4 @@--- A simple pretty printer+-- A simple pretty printer.  -- The alogithm is by Lawrence C. Paulson, who simplified an algorithm -- by Derek C. Oppen.
src/CPSA/Lib/Printer.hs view
@@ -1,4 +1,4 @@--- A CPSA specific pretty printer+-- A CPSA specific pretty printer using S-expressions.  -- Copyright (c) 2009 The MITRE Corporation --
src/CPSA/Lib/Protocol.hs view
@@ -1,4 +1,4 @@--- Protocol data structures+-- Protocol data structures.  -- Copyright (c) 2009 The MITRE Corporation --
src/CPSA/Lib/Reduction.hs view
@@ -124,7 +124,8 @@             else                -- Input was not a skeleton                 do                   let lk = LPreskel k n Nothing-                  wrt p h (commentPreskel lk [] (unrealized k) False "")+                  wrt p h (commentPreskel lk [] (unrealized k) False+                           "Not a skeleton")                   let lk' = LPreskel k' (n + 1) (Just lk)                   mode p h ks (n + optLimit p) (n + 2)                            (hist (gist k', n + 1))  [lk']@@ -298,8 +299,9 @@ commentPreskel :: Algebra t p g s e c => LPreskel t p g s e c ->                   [Int] -> [Node] -> Bool -> String -> SExpr () commentPreskel lk seen unrealized shape msg =-    displayPreskel (content lk) l+    displayPreskel k l     where+      k = content lk       l = L () [S () "label", N () (label lk)] : p       p = maybe s (\p -> L () [S () "parent", N () (label p)] : s) (parent lk)       s | null seen = r@@ -307,5 +309,18 @@       kids = map (N ()) (L.sort (L.nub seen))       r = L () (S () "unrealized" : nodes) : notes       nodes = map displayNode (L.sort unrealized)-      notes = if shape then L () [S () "shape"] : msgs else msgs-      msgs = if null msg then [] else [comment msg]+      notes = if shape then L () [S () "shape"] : spm : msgs else msgs+    -- Structure preserving map (homomorphism)+      spm = L () (S () "maps" : map (amap $ strandMap k) (envMaps k))+      amap strands env = L () [L () strands, L () env]+      strandMap k = map (N ()) (prob k)+      envMaps k =+          case (pov k) of+            Nothing -> []+            Just k' ->+                map (displayEnv (ctx k') (ctx k)) (homomorphism k' k (prob k))+      ctx k = addToContext emptyContext (kvars k)+      msgs = case msg of+               "" -> []+               "Not a skeleton" -> L () [S () "preskeleton"] : [comment msg]+               _ -> [comment msg]
src/CPSA/Lib/Strand.hs view
@@ -1,4 +1,4 @@--- Strand Space data structures+-- Instance and preskeleton data structures and support functions.  -- Copyright (c) 2009 The MITRE Corporation --@@ -816,7 +816,7 @@  -- Preskeleton Reduction System (PRS) --- The PRS reduces a preskeleton to skeleton or fails.  Along the way,+-- The PRS reduces a preskeleton to a list of skeletons.  Along the way, -- it applies the associtated homomorphism to a node and computes a -- substitution.  Thus if skel (k, n, empty) = [(k', n', sigma)], then -- phi,sigma is a homomorphism from k to k', n' = phi(n).@@ -831,14 +831,14 @@ skel :: Algebra t p g s e c => PRS t p g s e c -> Preskel t p g s e c skel (_, k, _, _, _) = k --- returns the preskeleton that results from applying a substitution--- or nothing if fails to preserve the nodes at which each maybe--- uniquely originating term originates, or produces a strand that is--- not an instance of its role.+-- Returns the preskeletons that result from applying a substitution.+-- If validate is True, preskeletons that fail to preserve the nodes+-- at which each maybe uniquely originating term originates are filter+-- out.  ksubst :: Algebra t p g s e c => PRS t p g s e c ->-          (g, s) -> [PRS t p g s e c]-ksubst (k0, k, n, phi, hsubst) (gen, subst) =+          Bool -> (g, s) -> [PRS t p g s e c]+ksubst (k0, k, n, phi, hsubst) validate (gen, subst) =     do       (gen', insts') <- foldMapM (substInst subst) gen (insts k)       let non' = map (substitute subst) (knon k)@@ -847,7 +847,9 @@       let k' = newPreskel gen' (protocol k) insts'                (orderings k) non' unique' operation' (prob k) (pov k)       k' <- wellFormedPreskel k'-      return (k0, k', n, phi, compose subst hsubst)+      case not validate || validateMappingSubst k0 phi subst k' of+        True -> return (k0, k', n, phi, compose subst hsubst)+        False -> fail ""  -- Monad version of mapAccumR foldMapM :: Monad m => (a -> b -> m (a, c)) -> a -> [b] -> m (a, [c])@@ -955,7 +957,7 @@ hullByCompressing prune prs s s' =     do       (s'', s''', subst) <- unifyStrands (skel prs) s s'-      prs <- ksubst prs subst+      prs <- ksubst prs False subst       prs' <- compress prs s'' s'''       hull prune prs' @@ -995,7 +997,7 @@ hullByDeOrigination  prune prs u (s, p) (s', p') =     do       subst <- deOrig (skel prs) u (s, p) ++ deOrig (skel prs) u (s', p')-      prs <- ksubst prs subst+      prs <- ksubst prs False subst       hull prune prs  deOrig :: Algebra t p g s e c => Preskel t p g s e c -> t -> Node -> [(g, s)]@@ -1136,7 +1138,7 @@       case not usePruningUnboundCheck || unboundCheck k s s' env' of         True -> return ()         False -> fail ""-      prs <- ksubst prs (gen', substitution env')+      prs <- ksubst prs True (gen', substitution env')       compress prs s s'  matchTraces :: Algebra t p g s e c => Trace t p g s e c ->@@ -1240,7 +1242,7 @@  homomorphismFilter :: Algebra t p g s e c => PRS t p g s e c ->                       [Ans t p g s e c]-homomorphismFilter prs@ (k0, k, _, phi, subst)+homomorphismFilter prs@(k0, k, _, phi, subst)     | validateMappingSubst k0 phi subst k = [ans prs]     | otherwise = [] @@ -1273,7 +1275,7 @@ contract k n cause subst =     do       prs <- ksubst (k, k { operation = Contracted emptySubst cause },-                     n, strandids k, emptySubst) subst+                     n, strandids k, emptySubst) False subst       prs' <- hull usePruningWhileSolving prs       homomorphismFilter prs' @@ -1323,7 +1325,7 @@     do       let operation' = AddedStrand (rname role) (height inst) cause       prs <- ksubst (k, k { operation = operation' }, n,-                     strandids k, emptySubst) subst+                     strandids k, emptySubst) False subst       aug prs inst  -- Apply the augmentation operator by adding an instance and one@@ -1373,7 +1375,7 @@     do       (s, s', subst) <- unifyStrands k s s'       let op = addedToDisplaced (operation k) s s'-      prs <- ksubst (k0, k { operation = op}, n, phi, hsubst) subst+      prs <- ksubst (k0, k { operation = op}, n, phi, hsubst) False subst       prs <- compress prs s s'       hull usePruningWhileSolving prs @@ -1782,7 +1784,7 @@     do       (s, s', subst) <- unifyStrands k s s'       prs <- ksubst (k, k { operation = Collapsed s s' },-                     (0, 0), strandids k, emptySubst) subst+                     (0, 0), strandids k, emptySubst) False subst       prs <- compress prs s s'       prs <- hull usePruningDuringCollapsing prs       return $ skel prs
src/CPSA/Lib/Utilities.hs view
@@ -1,4 +1,5 @@--- Generic list functions and cycle checking+-- Contains generic list functions and a function that determines if a+-- graph has a cycle.  -- Copyright (c) 2009 The MITRE Corporation --
+ src/CPSA/Logic/Logic.hs view
@@ -0,0 +1,539 @@+-- Converts a solution to a problem into a coherent logic formula++-- Copyright (c) 2011 The MITRE Corporation+--+-- This program is free software: you can redistribute it and/or+-- modify it under the terms of the BSD License as published by the+-- University of California.++module CPSA.Logic.Logic (Prot, Preskel, State, logic) where++import qualified Data.List as L+import CPSA.Lib.CPSA++{--+import System.IO.Unsafe+z :: Show a => a -> b -> b+z x y = unsafePerformIO (print x >> return y)+--}++type State t p g s e c = ([Prot t p g s e c], [Preskel t p g s e c])++logic :: (Algebra t p g s e c, Monad m) => String -> g ->+         State t p g s e c -> Maybe (SExpr Pos) ->+         m (State t p g s e c, Maybe (SExpr ()))+logic _ _ (ps, ks) Nothing =    -- Nothing signifies end-of-file+    displayFormula ps (reverse ks)+logic name gen (ps, []) (Just sexpr) = -- Looking for POV skeleton+    loadPOV name gen ps sexpr+logic name gen (ps, ks) (Just sexpr) = -- Looking for shapes+    loadOtherPreskel name gen ps ks sexpr++loadPOV :: (Algebra t p g s e c, Monad m) => String -> g ->+           [Prot t p g s e c] -> SExpr Pos ->+           m (State t p g s e c, Maybe (SExpr ()))+loadPOV name origin ps (L pos (S _ "defprotocol" : xs)) =+    do+      p <- loadProt name origin pos xs+      return ((p : ps, []), Nothing)+loadPOV _ _ ps (L pos (S _ "defskeleton" : xs)) =+    do+      p <- findProt pos ps xs+      k <- loadPreskel pos p (pgen p) emptyContext xs+      case (isSkeleton k, isShape k) of+        (True, False) -> return ((ps, [k]), Nothing) -- Found POV+        _ -> return ((ps, []), Nothing)              -- Not POV+loadPOV _ _ ps _ = return ((ps, []), Nothing)++loadOtherPreskel :: (Algebra t p g s e c, Monad m) => String -> g ->+                    [Prot t p g s e c] -> [Preskel t p g s e c] ->+                    SExpr Pos -> m (State t p g s e c, Maybe (SExpr ()))+loadOtherPreskel name origin ps ks (L pos (S _ "defprotocol" : xs)) =+    do                     -- Found next protocol.  Print this formula+      p <- loadProt name origin pos xs+      displayFormula (p : ps) (reverse ks)+loadOtherPreskel _ _ ps ks (L pos (S _ "defskeleton" : xs)) =+    do+      p <- findProt pos ps xs+      let g = kgen (last ks)    -- Make sure vars in skeleton are+      let c = kctx (last ks)    -- distinct from the ones in the POV+      k <- loadPreskel pos p g c xs+      case isShape k of+        True -> return ((ps, k : ks), Nothing) -- Found shape+        False -> return ((ps, ks), Nothing) -- Found intermediate skeleton+loadOtherPreskel _ _ ps ks _ = return ((ps, ks), Nothing)++-- Load a protocol++-- The Prot record contains information extraced from protocols for+-- use when processing preskeletons.  A protocol includes a role for+-- all listeners.+data Algebra t p g s e c => Prot t p g s e c = Prot+    { pname :: String,          -- Protocol name+      pgen :: g,                -- Generator for preskeletons+      roles :: [Role t p g s e c] }+    deriving Show++-- The Role record contains information extraced from roles for use+-- when processing preskeletons.+data Algebra t p g s e c => Role t p g s e c = Role+    { rname :: String,          -- Role name+      vars :: [t],+      ctx :: c }+    deriving Show++-- Load a protocol.  On success, returns a Prot record.++loadProt :: (Algebra t p g s e c, Monad m) => String -> g ->+            Pos -> [SExpr Pos] -> m (Prot t p g s e c)+loadProt nom origin pos (S _ name : S _ alg : x : xs)+    | alg /= nom =+        fail (shows pos $ "Expecting terms in algebra " ++ nom)+    | otherwise =+        do+          (gen, rs) <- loadRoles origin (x : xs)+          (gen', r) <- makeListenerRole pos gen+          return (Prot { pname = name, pgen = gen', roles = r : rs })+loadProt _ _ pos _ =+    fail (shows pos "Malformed protocol")++-- A generator is threaded thoughout the protocol loading process so+-- as to ensure no variable occurs in two roles.  It also ensures that+-- every variable that occurs in a preskeleton never occurs in one of+-- its roles.++loadRoles :: (Algebra t p g s e c, Monad m) => g ->+             [SExpr Pos] -> m (g, [Role t p g s e c])+loadRoles origin xs =+    mapAccumLM loadRole origin xs++-- A monad version of map accumulation from the left+mapAccumLM :: Monad m => (a -> b -> m (a, c)) -> a -> [b] -> m (a, [c])+mapAccumLM _ z [] =+    return (z, [])+mapAccumLM f z (x : xs) =+    do+      (z', y) <- f z x+      (z'', ys) <- mapAccumLM f z' xs+      return (z'', y : ys)++loadRole :: (Algebra t p g s e c, Monad m) => g ->+            SExpr Pos -> m (g, Role t p g s e c)+loadRole gen (L _ (S _ "defrole" :+                     S _ name :+	             L _ (S _ "vars" : vars) :+                     L _ (S _ "trace" : _ : _) :+                     _)) =+    do+      (gen, vars) <- loadVars gen vars+      let ctx = addToContext emptyContext vars+      let r = Role { rname = name, vars = vars, ctx = ctx }+      return (gen, r)+loadRole _ x =+    fail (shows (annotation x) "Malformed role")++-- A protocol's listener role++listenerName :: String+listenerName = ""++makeListenerRole :: (Algebra t p g s e c, Monad m) => Pos -> g ->+                    m (g, Role t p g s e c)+makeListenerRole pos gen =+    do+      (gen', t) <- makeVar pos gen "x"+      let vars = [t]+      let ctx = addToContext emptyContext vars+      let r = Role { rname = listenerName, vars = vars, ctx = ctx }+      return (gen', r)++makeVar :: (Algebra t p g s e c, Monad m) => Pos -> g -> String -> m (g, t)+makeVar pos gen name =+    do+      (gen', ts) <- loadVars gen [L pos [S pos name, S pos "mesg"]]+      case ts of+        [t] -> return (gen', t)+        _ -> fail (shows pos "Bad variable generation")++-- Find a protocol++findProt :: (Algebra t p g s e c, Monad m) => Pos ->+            [Prot t p g s e c] -> [SExpr Pos] -> m (Prot t p g s e c)+findProt pos ps (S _ name : _) =+    case L.find (\p -> name == pname p) ps of+      Nothing -> fail (shows pos $ "Protocol " ++ name ++ " unknown")+      Just p -> return p+findProt pos _ _ = fail (shows pos "Malformed skeleton")++-- Load a preskeleton++data Algebra t p g s e c => Instance t p g s e c = Instance+    { pos :: Pos,               -- Instance position+      role :: Role t p g s e c, -- Role from which this was instantiated+      env :: [(t, t)],          -- The environment+      height :: Int,            -- Height of the instance+      strand :: t }             -- Variable associated with the instance+    deriving Show++type Strands = [Int]            -- [Strand height]++type Node = (Int, Int)          -- (Strand, Position)++type Pair = (Node, Node)        -- Precedes relation++data Algebra t p g s e c => Preskel t p g s e c = Preskel+    { protocol :: Prot t p g s e c,+      kgen :: g,                -- Final generator+      kvars :: [t],             -- Variables excluding strand vars+      insts :: [Instance t p g s e c],+      orderings :: [Pair],+      nons :: [t],+      uniqs :: [t],+      isSkeleton :: Bool,+      isShape :: !Bool,         -- Always looked at, so make it strict+      homomorphisms :: [SExpr Pos], -- Loaded later+      kctx :: c }++loadPreskel :: (Algebra t p g s e c, Monad m) => Pos -> Prot t p g s e c ->+               g -> c -> [SExpr Pos] -> m (Preskel t p g s e c)+loadPreskel _ prot gen ctx (S _ _ : L _ (S _ "vars" : vars) : xs) =+    do+      (gen', kvars) <- loadVars gen vars+      (gen'', insts) <- loadInsts prot gen' kvars [] xs+      let strands = map strand insts+      let heights = map height insts+      orderings <- loadOrderings heights (assoc precedesKey xs)+      nons <- loadBaseTerms kvars (assoc nonOrigKey xs)+      uniqs <- loadBaseTerms kvars (assoc uniqOrigKey xs)+      let kctx = addToContext ctx (kvars ++ strands)+      return (Preskel { protocol = prot,+                        kgen = gen'',+                        kvars = kvars,+                        insts = insts,+                        orderings = orderings,+                        nons = nons,+                        uniqs = uniqs,+                        isSkeleton = not $ hasKey preskeletonKey xs,+                        isShape = hasKey shapeKey xs,+                        homomorphisms = assoc mapsKey xs,+                        kctx = kctx })+loadPreskel pos _ _ _ _ = fail (shows pos "Malformed skeleton")++loadInsts :: (Algebra t p g s e c, Monad m) => Prot t p g s e c ->+             g -> [t] -> [Instance t p g s e c] -> [SExpr Pos] ->+             m (g, [Instance t p g s e c])+loadInsts prot gen kvars insts (L pos (S _ "defstrand" : x) : xs) =+    case x of+      S _ role : N _ height : env ->+          do+            (gen', i) <- loadInst pos prot gen kvars role height env+            loadInsts prot gen' kvars (i : insts) xs+      _ ->+          fail (shows pos "Malformed defstrand")+loadInsts prot gen kvars insts (L pos (S _ "deflistener" : x) : xs) =+    case x of+      [term] ->+          do+            (gen', i) <- loadListener pos prot kvars gen term+            loadInsts prot gen' kvars (i : insts) xs+      _ ->+          fail (shows pos "Malformed deflistener")+loadInsts _ gen _ insts _ =+    return (gen, reverse insts)++loadInst :: (Algebra t p g s e c, Monad m) => Pos -> Prot t p g s e c ->+            g -> [t] -> String -> Int -> [SExpr Pos] ->+            m (g, Instance t p g s e c)+loadInst pos prot gen kvars role height env =+    do+      r <- lookupRole pos prot role+      env <- mapM (loadMaplet kvars (vars r)) env+      (gen', t) <- makeVar pos gen "z" -- Make the strand variable+      -- The sort of t will be fixed on output--see function skel.+      return (gen', Instance { pos = pos, role = r,+                               env = env, height = height,+                               strand = t })++lookupRole :: (Algebra t p g s e c, Monad m) => Pos ->+              Prot t p g s e c -> String -> m (Role t p g s e c)+lookupRole pos prot role =+    case L.find (\r -> role == rname r) (roles prot) of+      Nothing ->+          fail (shows pos $ "Role " ++ role ++ " not found in " ++ pname prot)+      Just r -> return r++loadMaplet :: (Algebra t p g s e c, Monad m) =>+              [t] -> [t] -> SExpr Pos -> m (t, t)+loadMaplet kvars vars (L _ [domain, range]) =+    do+      t <- loadTerm vars domain+      t' <- loadTerm kvars range+      return (t, t')+loadMaplet _ _ x = fail (shows (annotation x) "Malformed maplet")++loadListener :: (Algebra t p g s e c, Monad m) => Pos ->+                Prot t p g s e c -> [t] -> g -> SExpr Pos ->+                m (g, Instance t p g s e c)+loadListener pos prot kvars gen x =+    do+      r <- lookupRole pos prot listenerName+      t <- loadTerm kvars x+      (gen', z) <- makeVar pos gen "z" -- Make the strand variable+      return (gen', Instance { pos = pos, role = r,+                               env = [(head $ vars r, t)], height = 2,+                               strand = z })++-- Load the node orderings++loadOrderings :: Monad m => Strands -> [SExpr Pos] -> m [Pair]+loadOrderings _ [] = return []+loadOrderings strands (x : xs) =+    do+      np <- loadPair strands x+      nps <- loadOrderings strands xs+      return (adjoin np nps)++loadPair :: Monad m => [Int] -> SExpr Pos -> m Pair+loadPair heights (L pos [x0, x1]) =+    do+      n0 <- loadNode heights x0+      n1 <- loadNode heights x1+      case sameStrands n0 n1 of  -- Same strand+        True -> fail (shows pos "Malformed pair -- nodes in same strand")+        False -> return (n0, n1)+    where+      sameStrands (s0, _) (s1, _) = s0 == s1+loadPair _ x = fail (shows (annotation x) "Malformed pair")++loadNode :: Monad m => [Int] -> SExpr Pos -> m Node+loadNode heights (L pos [N _ s, N _ p])+    | s < 0 = fail (shows pos "Negative strand in node")+    | p < 0 = fail (shows pos "Negative position in node")+    | otherwise =+        case height heights s of+          Nothing -> fail (shows pos "Bad strand in node")+          Just h | p < h -> return (s, p)+          _ -> fail (shows pos "Bad position in node")+    where+      height [] _ = Nothing+      height (x: xs) s          -- Assume s non-negative+          | s == 0 = Just x+          | otherwise = height xs (s - 1)+loadNode _ x = fail (shows (annotation x) "Malformed node")++loadBaseTerms :: (Algebra t p g s e c, Monad m) => [t] -> [SExpr Pos] -> m [t]+loadBaseTerms _ [] = return []+loadBaseTerms vars (x : xs) =+    do+      t <- loadBaseTerm vars x+      ts <- loadBaseTerms vars xs+      return (adjoin t ts)++loadBaseTerm :: (Algebra t p g s e c, Monad m) => [t] -> SExpr Pos -> m t+loadBaseTerm vars x =+    do+      t <- loadTerm vars x+      case isAtom t of+        True -> return t+        False -> fail (shows (annotation x) "Expecting an atom")++-- Homomorphisms++-- The maps entry in a preskeleton contains a list of homomorphisms.+-- A homomorphism is a list of length two, a strand map as a list of+-- natural numbers, and a substition.++loadMaps :: (Algebra t p g s e c, Monad m) => Preskel t p g s e c ->+            Preskel t p g s e c -> [SExpr Pos] -> m [[SExpr ()]]+loadMaps pov k maps =+    mapM (loadMap pov k) maps++loadMap :: (Algebra t p g s e c, Monad m) => Preskel t p g s e c ->+            Preskel t p g s e c -> SExpr Pos -> m [SExpr ()]+loadMap pov k (L _ [L _ strandMap, L _ algebraMap]) =+    do+      let zs = map strand $ insts pov+      perm <- mapM loadPerm strandMap -- Load the strand map+      let zs' = map strand $ insts k+      let zh = [(t, zs' !! p) | (t, p) <- zip zs perm]+      -- Compute the strand part of the homomorphism+      let eqs = map (displayEq $ kctx k) zh+      -- Load the algebra part of the homomorphism+      ah <- mapM (loadMaplet (kvars k) (kvars pov)) algebraMap+      -- Compute the algebra part of the homomorphism+      let eqa = map (displayEq $ kctx k) ah+      return (eqs ++ eqa)+loadMap _ _ x = fail (shows (annotation x) "Malformed map")++loadPerm :: Monad m => SExpr Pos -> m Int+loadPerm (N _ n) | n >= 0 = return n+loadPerm x = fail (shows (annotation x) "Expecting a natural number")++displayEq :: Algebra t p g s e c => c -> (t, t) -> SExpr ()+displayEq ctx (x, y) =+    L () [S () "equal", displayTerm ctx x, displayTerm ctx y]++-- Association lists++-- Lookup value in alist, appending values with the same key+assoc :: String -> [SExpr a] -> [SExpr a]+assoc key alist =+    concat [ rest | L _ (S _ head : rest) <- alist, key == head ]++keyPred :: String -> SExpr a -> Bool+keyPred key (L _ (S _ head : _)) = key == head+keyPred _ _ = False++hasKey :: String -> [SExpr a] -> Bool+hasKey key alist = any (keyPred key) alist++-- The key used to identify a non-skeleton+preskeletonKey :: String+preskeletonKey = "preskeleton"++-- The key used to identify a shape+shapeKey :: String+shapeKey = "shape"++-- The key used to extract the list of homomorphisms+mapsKey :: String+mapsKey = "maps"++-- The key used in preskeletons for communication orderings+precedesKey :: String+precedesKey = "precedes"++-- The key used in preskeletons for non-originating atoms+nonOrigKey :: String+nonOrigKey = "non-orig"++-- The key used in preskeletons for uniquely originating atoms+uniqOrigKey :: String+uniqOrigKey = "uniq-orig"++-- Formula printing++displayFormula :: (Algebra t p g s e c, Monad m) =>+                  [Prot t p g s e c] -> [Preskel t p g s e c] ->+                  m (State t p g s e c, Maybe (SExpr ()))+displayFormula ps [] =+    return ((ps, []), Nothing)+displayFormula ps (k : ks) =+    do+      sexpr <- form k ks+      return ((ps, []), Just sexpr)++form :: (Algebra t p g s e c, Monad m) => Preskel t p g s e c ->+        [Preskel t p g s e c] -> m (SExpr ())+form k ks =                     -- k is the POV skeleton+    do                          -- ks is the list of shapes+      (vars, conj) <- skel k+      disj <- mapM (shape k) ks+      return $ quantify "forall" vars+                 (imply (conjoin conj) (disjoin disj))++-- Convert one skeleton into a declaration and a conjunction.  The+-- declaration is used as the bound variables in a quantifier.+skel :: (Algebra t p g s e c, Monad m) => Preskel t p g s e c ->+        m ([SExpr ()], [SExpr ()])+skel k =+    do+      let vars = displayVars (kctx k) (kvars k)+      let strands = displayVars (kctx k) (map strand $ insts k)+      return (vars ++ listMap nat strands,+              map (strandForm k) (insts k) +++              map (precedesForm k) (orderings k) +++              map (unary "non" $ kctx k) (nons k) +++              map (unary "uniq" $ kctx k) (uniqs k))++listMap :: ([SExpr ()] -> [SExpr ()]) -> [SExpr ()] -> [SExpr ()]+listMap _ [] = []+listMap f (L () xs : ys) = L () (f xs) : listMap f ys+listMap f (y : ys) = y : listMap f ys++-- Replace "mesg" as the sort in the list with "nat"+nat :: [SExpr ()] -> [SExpr ()]+nat [] = error "Logic.nat: empty list as argument"+nat [_] = [S () "nat"]+nat (v : vs) = v : nat vs++-- Creates the atomic formulas used to describe an instance of a role+strandForm :: Algebra t p g s e c => Preskel t p g s e c ->+              Instance t p g s e c -> SExpr ()+strandForm k inst =+    conjoin $ map f $ env inst+    where+      f (x, t) =+          L () [S () "strand",+                Q () $ pname $ protocol k, -- Name of the protocol+                Q () $ rname $ role inst, -- Name of the role+                N () $ height inst,+                quote $ displayTerm (ctx $ role inst) x,+                displayTerm (kctx k) (strand inst),+                displayTerm (kctx k) t]++quote :: SExpr () -> SExpr ()+quote (S () str) = Q () str+quote x = x++-- Creates the atomic formula used to describe a node ordering relation+precedesForm :: Algebra t p g s e c => Preskel t p g s e c -> Pair -> SExpr ()+precedesForm k ((s, i), (s', i')) =+    L () [S () "precedes",+          displayTerm (kctx k) t,+          N () i,+          displayTerm (kctx k) t',+          N () i']+    where+      t = strand $ insts k !! s+      t' = strand $ insts k !! s'++-- Creates a formula associated with a shape.  It is a disjunction of+-- existentially quantified formulas that describe the homomorphism+-- and the shape as a skeleton.+shape :: (Algebra t p g s e c, Monad m) => Preskel t p g s e c ->+         Preskel t p g s e c -> m (SExpr ())+shape pov k =+    do+      (vars, conj) <- skel k+      case null $ homomorphisms k of+        True -> fail "No homomorphism for shape"+        False ->+            do+              hs <- loadMaps pov k (homomorphisms k)+              let xs = [quantify "exists" vars $ conjoin (h ++ conj) | h <- hs]+              return $ disjoin xs++-- Formula primitives++unary :: Algebra t p g s e c => String -> c -> t -> SExpr ()+unary pred ctx t =+    L () [S () pred, displayTerm ctx t]++quantify :: String -> [SExpr ()] -> SExpr () -> SExpr ()+quantify _ [] form = form+quantify name vars form =+    L () [S () name, L () vars, form]++conjoin :: [SExpr ()] -> SExpr ()+conjoin conjuncts =+    case concatMap f conjuncts of+      [x] -> x+      xs -> L () (S () "and" : xs)+    where+      f (L () (S () "and" : xs)) = xs+      f x = [x]++disjoin :: [SExpr ()] -> SExpr ()+disjoin conjuncts =+    case concatMap f conjuncts of+      [x] -> x+      xs -> L () (S () "or" : xs)+    where+      f (L () (S () "or" : xs)) = xs+      f x = [x]++imply :: SExpr () -> SExpr () -> SExpr ()+imply (L () [S () "and"]) consequence = consequence+imply antecedent consequence =+    L () [S () "implies", antecedent, consequence]
+ src/CPSA/Logic/Main.hs view
@@ -0,0 +1,93 @@+-- Summarize CPSA output as a formula in coherent logic++-- Copyright (c) 2011 The MITRE Corporation+--+-- This program is free software: you can redistribute it and/or+-- modify it under the terms of the BSD License as published by the+-- University of California.++module Main (main) where++import System.IO+import System.IO.Error+import CPSA.Lib.CPSA+import CPSA.Lib.Entry+import CPSA.Logic.Logic+import qualified CPSA.Basic.Algebra+import qualified CPSA.DiffieHellman.Algebra+import qualified CPSA.SimpleDiffieHellman.Algebra++-- Algebra names+algs :: [String]+algs = [CPSA.Basic.Algebra.name, CPSA.DiffieHellman.Algebra.name,+        CPSA.SimpleDiffieHellman.Algebra.name]++main :: IO ()+main =+    do+      let options = algOptions CPSA.Basic.Algebra.name+      let interp = algInterp CPSA.Basic.Algebra.name algs+      (p, (output, alg, margin)) <- start options interp+      h <- outputHandle output+      writeComment h margin cpsaVersion+      writeComment h margin "Coherent logic"+      case () of+        _ | alg == CPSA.Basic.Algebra.name ->+              go (step h alg CPSA.Basic.Algebra.origin margin)+                 p ([], [])+          | alg == CPSA.DiffieHellman.Algebra.name ->+              go (step h alg CPSA.DiffieHellman.Algebra.origin margin)+                 p ([], [])+          | alg == CPSA.SimpleDiffieHellman.Algebra.name ->+              go (step h alg CPSA.SimpleDiffieHellman.Algebra.origin margin)+                 p ([], [])+          | otherwise ->+               abort ("Bad algebra: " ++ alg)+      hClose h++go :: (a -> Maybe (SExpr Pos) -> IO a) -> PosHandle -> a -> IO ()+go f p a =+    loop a+    where+      loop a =+          do+            x <- readSExpr p+            case x of+              Nothing ->+                  do+                    _ <- f a x+                    return ()+              Just _ ->+                  do+                    a <- f a x+                    loop a++step :: Algebra t p g s e c => Handle ->+        String -> g -> Int -> State t p g s e c ->+        Maybe (SExpr Pos) -> IO (State t p g s e c)+step output _ _ margin state@([], []) (Just sexpr@(L _ (S _ cmt : _)))+     | cmt == "herald" || cmt == "comment" =+         do+           writeLnSEexpr output margin sexpr+           return state+step output name origin margin state sexpr =+    do+      x <- try (logic name origin state sexpr)+      case x of+        Right (acc, Nothing) ->+            after output margin acc sexpr+        Right (acc, Just x) ->+            do+              writeLnSEexpr output margin x+              after output margin acc sexpr+        Left err ->+            abort (ioeGetErrorString err)++after :: Algebra t p g s e c => Handle -> Int -> State t p g s e c ->+         Maybe (SExpr Pos) -> IO (State t p g s e c)+after output margin state (Just sexpr@(L _ (S _ "defprotocol" : _))) =+    do+      writeLnSEexpr output margin sexpr+      return state+after _ _ state _ =+    return state
src/CPSA/SimpleDiffieHellman/Algebra.hs view
@@ -1237,6 +1237,12 @@ displayEnc ctx (F Cat [t0, t1]) t = displayTerm ctx t0 : displayEnc ctx t1 t displayEnc ctx t0 t1 = [displayTerm ctx t0, displayTerm ctx t1] +displayEnv :: Context -> Context -> Env -> [SExpr ()]+displayEnv ctx ctx' (Env r) =+    map (\(x, t) -> L () [displayTerm ctx x, displayTerm ctx' t]) r'+    where+      r' = map (\(x, t) -> (I x, inferSort t)) $ M.assocs r+ -- displaySubst c s displays a substitution s in context c, where some -- variables that occur in s might not be in c.  Enough sort -- inference is performed so as to allow the extension of the context.@@ -1321,6 +1327,7 @@     addToContext = addToContext     displayVars = displayVars     displayTerm = displayTerm+    displayEnv = displayEnv     displaySubst = displaySubst  instance C.Algebra Term Place Gen Subst Env Context
tst/Makefile view
@@ -30,6 +30,10 @@ %_shapes.txt:	%.txt 	../dist/build/cpsashapes/cpsashapes $(SHAPESFLAGS) -o $@ $< +# Extract shape analysis sentences+%_logic.text:	%.txt+	../dist/build/cpsalogic/cpsalogic $(LOGICFLAGS) -o $@ $<+ # Annotate shapes %_annotations.txt:	%_shapes.txt 	../dist/build/cpsaannotations/cpsaannotations \
tst/blanchet.tst view
@@ -1,7 +1,7 @@ (herald "Blanchet's Simple Example Protocol"   (comment "There is a flaw in this protocol by design")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol blanchet basic@@ -66,7 +66,8 @@   (label 3)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (s s) (d d)))))  (comment "Nothing left to do") @@ -195,7 +196,8 @@   (label 10)   (parent 9)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (s s) (d d)))))  (comment "Nothing left to do") @@ -216,7 +218,9 @@   (traces ((recv (enc (enc s (privk a)) (pubk b))) (send (enc d s)))     ((recv d) (send d)))   (label 11)-  (unrealized (0 0) (1 0)))+  (unrealized (0 0) (1 0))+  (preskeleton)+  (comment "Not a skeleton"))  (defskeleton blanchet   (vars (d text) (a b name) (s skey))@@ -247,7 +251,8 @@   (label 13)   (parent 12)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((a a) (b b) (s s) (d d)))))  (comment "Nothing left to do") @@ -268,7 +273,9 @@   (traces ((recv (enc (enc s (privk a)) (pubk b))) (send (enc d s)))     ((recv d) (send d)))   (label 14)-  (unrealized (0 0) (1 0)))+  (unrealized (0 0) (1 0))+  (preskeleton)+  (comment "Not a skeleton"))  (defskeleton blanchet   (vars (d text) (a b name) (s skey))@@ -299,7 +306,8 @@   (label 16)   (parent 15)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((a a) (b b) (s s) (d d)))))  (comment "Nothing left to do")
tst/completeness-test.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol completeness-test basic@@ -82,6 +82,7 @@   (seen 4)   (unrealized)   (shape)+  (maps ((0 1) ((b b) (n n) (s s) (a a) (s-0 s-0))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton completeness-test@@ -101,7 +102,8 @@   (label 4)   (parent 2)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((b b) (n n) (s s) (a a) (s-0 s)))))  (comment "Nothing left to do") @@ -168,6 +170,7 @@   (seen 8)   (unrealized)   (shape)+  (maps ((0 1) ((b b) (n n) (s s) (a a) (s-0 s-0))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton completeness-test@@ -187,7 +190,8 @@   (label 8)   (parent 6)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((b b) (n n) (s s) (a a) (s-0 s)))))  (comment "Nothing left to do") @@ -268,6 +272,7 @@   (seen 13)   (unrealized)   (shape)+  (maps ((0 1) ((b b) (n n) (s s) (a a))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton completeness-test@@ -287,7 +292,8 @@   (label 13)   (parent 11)   (unrealized)-  (shape))+  (shape)+  (maps ((1 0) ((b b) (n n) (s s) (a a)))))  (comment "Nothing left to do") @@ -351,6 +357,7 @@   (seen 17)   (unrealized)   (shape)+  (maps ((0 1) ((b b) (n n) (s s) (a a))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton completeness-test@@ -369,6 +376,7 @@   (label 17)   (parent 15)   (unrealized)-  (shape))+  (shape)+  (maps ((0 2) ((b b) (n n) (s s) (a a)))))  (comment "Nothing left to do")
tst/crushing.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol crushing basic@@ -362,6 +362,7 @@   (label 14)   (parent 9)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((k k) (n n) (n1 n2) (n2 n2) (n3 n2)))))  (comment "Nothing left to do")
tst/dass_simple.tst view
@@ -1,6 +1,6 @@ (herald "Distributed Authentication Security Service Protocol Variants") -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol dass-simple basic@@ -137,7 +137,8 @@   (label 5)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (k k) (kp kp) (ta ta) (tb tb)))))  (comment "Nothing left to do") @@ -332,6 +333,7 @@   (seen 14)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (k k) (kp kp) (ta ta) (tb tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton dass+@@ -353,6 +355,7 @@   (label 14)   (parent 12)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (k k) (kp kp) (ta ta) (tb tb)))))  (comment "Nothing left to do")
tst/denning-sacco.tst view
@@ -1,6 +1,6 @@ (herald "Denning-Sacco Protocol") -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol denning-sacco basic@@ -181,6 +181,7 @@   (seen 6)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (ks ks) (k k) (ta ta))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton denning-sacco@@ -210,7 +211,8 @@   (label 6)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a b) (b b) (ks ks) (k k) (ta ta)))))  (defskeleton denning-sacco   (vars (ta text) (a b ks b-0 a-0 name) (k skey))@@ -246,6 +248,7 @@   (seen 8)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (ks ks) (k k) (ta ta))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton denning-sacco@@ -276,7 +279,8 @@   (label 8)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a b-0) (b b) (ks ks) (k k) (ta ta)))))  (defskeleton denning-sacco   (vars (ta text) (a b ks a-0 b-0 name) (k skey))@@ -312,6 +316,7 @@   (seen 10)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (ks ks) (k k) (ta ta))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton denning-sacco@@ -340,7 +345,8 @@   (label 10)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (ks ks) (k k) (ta ta)))))  (defskeleton denning-sacco   (vars (ta text) (a b ks a-0 a-1 name) (k skey))@@ -376,6 +382,7 @@   (seen 12)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (ks ks) (k k) (ta ta))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton denning-sacco@@ -404,6 +411,7 @@   (label 12)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a b) (b b) (ks ks) (k k) (ta ta)))))  (comment "Nothing left to do")
tst/deorig_contract.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol deorig-contract basic@@ -59,6 +59,7 @@     ((recv (enc x1 k)) (recv (enc x2 k)) (send (enc x1 x2 k))))   (label 2)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((k k) (x1 x1) (x2 x2)))))  (comment "Nothing left to do")
tst/deorig_simple.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol deorig-simple basic@@ -43,6 +43,7 @@   (traces ((send (enc x2 k)) (recv x2)) ((recv (enc x2 k)) (send x2)))   (label 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((k k) (x2 x2)))))  (comment "Nothing left to do")
tst/dh_cert.tst view
@@ -1,6 +1,6 @@ (herald "Diffie-Hellman with Certificate" (algebra diffie-hellman)) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol dh-cert diffie-hellman@@ -1155,7 +1155,11 @@   (label 20)   (parent 17)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((ca ca) (a a) (b b) (as-ltv as-ltv) (bs-ltv bs-ltv-0) (x x)+        (gB (exp (gen) bs-ltv)) (gy (exp (gen) y))))))  (defskeleton dh-cert   (vars (ca a b name) (as-ltv bs-ltv expn))@@ -1224,7 +1228,11 @@   (label 22)   (parent 19)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((ca ca) (a a) (b b) (as-ltv as-ltv) (bs-ltv bs-ltv) (x x)+        (gB (gen)) (gy (gen))))))  (comment "Nothing left to do") @@ -1933,7 +1941,11 @@   (label 37)   (parent 32)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((ca ca) (a a) (b b) (bs-ltv bs-ltv) (as-ltv as-ltv-0) (y y)+        (gA (exp (gen) as-ltv)) (gx (exp (gen) x))))))  (defskeleton dh-cert   (vars (ca a b name) (bs-ltv as-ltv expn))@@ -2086,6 +2098,10 @@   (label 41)   (parent 39)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((ca ca) (a a) (b b) (bs-ltv bs-ltv) (as-ltv as-ltv) (y y)+        (gA (gen)) (gx (gen))))))  (comment "Nothing left to do")
tst/dhke.tst view
@@ -1,6 +1,6 @@ (herald "Diffie-Hellman Key Exchange" (algebra diffie-hellman)) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol dhke diffie-hellman@@ -81,7 +81,8 @@   (label 2)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (x x) (y y)))))  (defskeleton dhke   (vars (a b name) (x y expn))@@ -210,7 +211,8 @@   (label 7)   (parent 6)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (x x) (y y)))))  (defskeleton dhke   (vars (a b a-0 name) (x y x-0 expn))@@ -289,7 +291,9 @@     ((send (exp (gen) x)) (recv (exp (gen) y))       (send (enc n (exp (exp (gen) x) y)))) ((recv n) (send n)))   (label 10)-  (unrealized (1 0)))+  (unrealized (1 0))+  (preskeleton)+  (comment "Not a skeleton"))  (defskeleton dh-mim   (vars (n text) (x y expn))@@ -303,7 +307,8 @@   (label 11)   (parent 10)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((n n) (x x) (y y)))))  (comment "Nothing left to do") @@ -379,7 +384,8 @@   (label 14)   (parent 13)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (h (exp (gen) x)) (y y)))))  (defskeleton dhke-with-base-vars   (vars (a b name) (y x expn))@@ -500,7 +506,8 @@   (label 19)   (parent 18)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (g (exp (gen) y)) (x x)))))  (defskeleton dhke-with-base-vars   (vars (a b a-0 name) (h base) (x y expn))@@ -572,7 +579,9 @@   (traces ((send (exp (gen) x)) (recv hy) (send (enc n (exp hy x))))     ((recv hx) (send (exp (gen) y)) (recv (enc n (exp hx y)))))   (label 22)-  (unrealized (1 2)))+  (unrealized (1 2))+  (preskeleton)+  (comment "Not a skeleton"))  (defskeleton dh-mim-with-base-vars   (vars (n text) (hy hx base) (x y expn))@@ -604,7 +613,9 @@   (label 24)   (parent 23)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0 1) ((n n) (x x) (hy (exp (gen) y)) (y y) (hx (exp (gen) x))))))  (defskeleton dh-mim-with-base-vars   (vars (n text) (hy hx base) (x y expn))@@ -748,7 +759,8 @@   (label 32)   (parent 31)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((n n) (x x) (hy (gen)) (y y) (hx (gen))))))  (comment "Nothing left to do") @@ -772,7 +784,9 @@   (traces ((send (exp (gen) x)) (recv hy) (send (enc n (exp hy x))))     ((recv n) (send n)))   (label 33)-  (unrealized (1 0)))+  (unrealized (1 0))+  (preskeleton)+  (comment "Not a skeleton"))  (defskeleton dh-mim-with-base-vars   (vars (n text) (hy base) (x expn))@@ -850,6 +864,7 @@   (label 38)   (parent 36)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((n n) (x x) (hy (gen))))))  (comment "Nothing left to do")
tst/dy.tst view
@@ -1,6 +1,6 @@ (herald "Example 1.3 from 1983 Dolev-Yao Paper") -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol dy basic@@ -38,7 +38,8 @@   (label 1)   (parent 0)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a b) (b b) (m m)))))  (defskeleton dy   (vars (m text) (a b name))@@ -57,7 +58,8 @@   (label 2)   (parent 0)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (m m)))))  (defskeleton dy   (vars (m text) (a b a-0 name))@@ -191,7 +193,8 @@   (label 8)   (parent 5)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (m m)))))  (defskeleton dy   (vars (m text) (a b a-0 name))
tst/encsig.tst view
@@ -1,7 +1,7 @@ (herald "Encrypted Signed Message Example"   (comment "Shows examples of key usage of asymmetric keys")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol mult-keys-enc-sig basic@@ -47,7 +47,8 @@   (label 1)   (parent 0)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2)))))  (comment "Nothing left to do") @@ -118,6 +119,7 @@   (seen 5)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (n2 n2) (n1 n1))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton mult-keys-enc-sig@@ -139,7 +141,8 @@   (label 5)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n2 n2) (n1 n1)))))  (comment "Nothing left to do") @@ -187,7 +190,8 @@   (label 7)   (parent 6)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n2 n2) (n1 n1)))))  (comment "Nothing left to do") @@ -277,7 +281,8 @@   (label 11)   (parent 9)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n2 n2) (n1 n1)))))  (defskeleton mult-keys-enc-sig   (vars (n2 n1 text) (a b name))@@ -302,6 +307,7 @@   (seen 11)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (n2 n2) (n1 n1))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton mult-keys-enc-sig@@ -331,6 +337,7 @@   (seen 14)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (n2 n2) (n1 n1))))   (comment "2 in cohort - 1 not yet seen"))  (defskeleton mult-keys-enc-sig
tst/epmo-key-hash.tst view
@@ -1,7 +1,7 @@ (herald "Electronic Purchase with Money Order Protocol with Key Hashing"   (comment "Annotated with trust management formulas")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol epmo basic@@ -203,7 +203,11 @@   (label 4)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((b b) (c c) (m m) (nb nb) (nc nc) (nm nm) (goods goods)+        (price price)))))  (comment "Nothing left to do") @@ -542,7 +546,9 @@   (label 12)   (parent 11)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0) ((b b) (c c) (m m) (nc nc) (nm nm) (nb nb) (price price)))))  (comment "Nothing left to do") @@ -716,6 +722,10 @@   (label 16)   (parent 15)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((b b) (c c) (m m) (nb nb) (nc nc) (nm nm) (goods goods)+        (price price)))))  (comment "Nothing left to do")
tst/epmo.tst view
@@ -1,7 +1,7 @@ (herald "Electronic Purchase with Money Order Protocol"   (comment "Annotated with trust management formulas")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol epmo basic@@ -202,7 +202,11 @@   (label 4)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((b b) (c c) (m m) (hash hash) (nb nb) (nc nc) (nm nm)+        (goods goods) (price price)))))  (comment "Nothing left to do") @@ -448,7 +452,11 @@   (label 10)   (parent 9)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((b b) (c c) (m m) (hash hash) (nc nc) (nm nm) (nb nb)+        (price price)))))  (comment "Nothing left to do") @@ -620,6 +628,10 @@   (label 14)   (parent 13)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((b b) (c c) (m m) (hash hash) (nb nb) (nc nc) (nm nm)+        (goods goods) (price price)))))  (comment "Nothing left to do")
tst/epmo_acctnum-key-hash.tst view
@@ -3,7 +3,7 @@   (displacement)   (comment "This version includes account numbers in exchanges")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read") (comment "Displacement disabled") @@ -287,7 +287,11 @@   (label 6)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((b b) (m m) (c c) (nm nm) (nc nc) (nb nb) (goods goods)+        (price price)))))  (defskeleton epmo_acctnum   (vars (nm nc nb price acctnum goods nm-0 price-0 text) (m c b name))@@ -830,7 +834,11 @@   (label 19)   (parent 17)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((b b) (m m) (c c) (nm nm) (nb nb) (nc nc) (acctnum acctnum)+        (price price)))))  (defskeleton epmo_acctnum   (vars (nm nb nc acctnum price acctnum-0 goods nm-0 price-0 text)
tst/epmo_acctnum.tst view
@@ -2,7 +2,7 @@   (displacement)   (comment "This version includes account numbers in exchanges")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read") (comment "Displacement disabled") @@ -383,7 +383,11 @@   (label 8)   (parent 5)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((b b) (m m) (c c) (nm nm) (nc nc) (nb nb) (hash hash)+        (goods goods) (price price)))))  (defskeleton epmo_acctnum   (vars (nm nc nb price acctnum goods nm-0 price-0 text)@@ -1224,7 +1228,11 @@   (label 27)   (parent 25)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((b b) (m m) (c c) (nm nm) (nb nb) (nc nc) (hash hash)+        (acctnum acctnum) (price price)))))  (defskeleton epmo_acctnum   (vars (nm nb nc acctnum price acctnum-0 goods nb-0 text)
tst/ffgg.tst view
@@ -1,7 +1,7 @@ (herald "The ffgg Protocol"   (comment "From A Necessarily Parallel Attack by Jon K. Millen")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol ffgg basic@@ -27,7 +27,9 @@     ((send a) (recv (cat b n1 n2)) (send (cat a (enc n1 n2 m (pubk b))))       (recv (cat n1 x (enc x y n1 (pubk b))))) ((recv m) (send m)))   (label 0)-  (unrealized (1 0)))+  (unrealized (1 0))+  (preskeleton)+  (comment "Not a skeleton"))  (defskeleton ffgg   (vars (m n1 n2 x y text) (b a name))@@ -116,6 +118,7 @@   (label 4)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((b b) (m m) (a a) (n1 n1) (n2 n2) (x x) (y y)))))  (comment "Nothing left to do")
tst/fragile_pruning.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol fragile_pruning basic@@ -146,6 +146,7 @@   (label 6)   (parent 5)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((k k) (n n) (n1 new) (n2 new) (n3 new)))))  (comment "Nothing left to do")
tst/isoreject.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol isoreject basic@@ -60,7 +60,8 @@   (label 2)   (parent 0)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (na na) (nb nb) (nc nc)))))  (defskeleton isoreject   (vars (na nb nc text) (a b name))@@ -79,7 +80,8 @@   (label 3)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (na na) (nb nb) (nc nc)))))  (comment "Nothing left to do") @@ -121,7 +123,8 @@   (label 5)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((b b) (a a) (na na) (nb nb) (nc nc)))))  (defskeleton isoreject   (vars (na nb nc text) (b a name))@@ -139,6 +142,7 @@   (label 6)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((b b) (a a) (na na) (nb nb) (nc nc)))))  (comment "Nothing left to do")
tst/kelly1.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol kelly1 basic@@ -143,6 +143,10 @@   (label 3)   (parent 2)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((A A) (C C) (S S) (Ns Ns) (request request) (Check Check)+        (policy policy) (response response)))))  (comment "Nothing left to do")
tst/kerberos.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol kerberos basic@@ -430,7 +430,9 @@   (label 15)   (parent 8)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0) ((a a) (b b) (ks ks) (t t) (t-prime t-prime) (l l) (k k)))))  (defskeleton kerberos   (vars (t t-prime l l-0 text) (a b ks b-0 ks-0 name) (k skey))@@ -518,7 +520,9 @@   (label 18)   (parent 11)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0) ((a a) (b b) (ks ks) (t t) (t-prime t-prime) (l l) (k k)))))  (defskeleton kerberos   (vars (t t-prime l text) (a b ks name) (k skey))@@ -549,6 +553,7 @@   (parent 13)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (ks ks) (t t) (t-prime t-prime) (l l) (k k))))   (comment "1 in cohort - 1 not yet seen"))  (defskeleton kerberos@@ -581,6 +586,7 @@   (seen 15)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (ks ks) (t t) (t-prime t-prime) (l l) (k k))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton kerberos@@ -613,6 +619,7 @@   (seen 23)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (ks ks) (t t) (t-prime t-prime) (l l) (k k))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton kerberos@@ -645,6 +652,7 @@   (seen 18)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (ks ks) (t t) (t-prime t-prime) (l l) (k k))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton kerberos@@ -858,7 +866,9 @@   (label 31)   (parent 27)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0) ((a a) (b b) (ks ks) (t t) (t-prime t-prime) (l l) (k k)))))  (defskeleton kerberos   (vars (t t-prime l text) (a b ks name) (k skey))@@ -882,7 +892,9 @@   (label 32)   (parent 29)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0) ((a a) (b b) (ks ks) (t t) (t-prime t-prime) (l l) (k k)))))  (comment "Nothing left to do") @@ -913,6 +925,7 @@       (send (cat (enc t l k b (ltk a ks)) (enc t l k a (ltk b ks))))))   (label 33)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (ks ks) (t t) (l l) (k k)))))  (comment "Nothing left to do")
tst/missing_contraction.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol missing-contraction basic@@ -36,7 +36,8 @@   (label 1)   (parent 0)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((m m) (a a) (c a) (n n) (b b)))))  (defskeleton missing-contraction   (vars (n text) (a c b name))@@ -52,7 +53,8 @@   (label 2)   (parent 0)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((m n) (a a) (c c) (n n) (b b)))))  (comment "Nothing left to do") @@ -73,7 +75,9 @@   (traces ((send (enc a m (pubk a))))     ((recv (enc a m (pubk c))) (send (enc a m (pubk c)))))   (label 3)-  (unrealized (1 0)))+  (unrealized (1 0))+  (preskeleton)+  (comment "Not a skeleton"))  (defskeleton missing-contraction   (vars (m text) (a c name))@@ -103,7 +107,8 @@   (label 5)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((m m) (a a) (c a)))))  (defskeleton missing-contraction   (vars (m text) (c a b name))@@ -119,7 +124,8 @@   (label 6)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((1 0) ((m m) (a a) (c c)))))  (comment "Nothing left to do") @@ -158,7 +164,8 @@   (label 8)   (parent 7)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((m m) (a a) (b b) (c a) (n n)))))  (defskeleton missing-contraction   (vars (n text) (a b c name))@@ -190,7 +197,8 @@   (label 10)   (parent 9)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((m n) (a a) (b b) (c b) (n n)))))  (defskeleton missing-contraction   (vars (n text) (a b name))
tst/neuman-stubblebine-reauth.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol neuman-stubblebine-reauth basic@@ -1233,7 +1233,11 @@   (label 34)   (parent 17)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb ra-prime) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb)))))  (defskeleton neuman-stubblebine-reauth   (vars (ra tb rb ra-prime rb-prime rb-0 rb-prime-0 text) (a b ks name)@@ -1625,6 +1629,10 @@   (seen 34)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb ra-prime) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -1810,7 +1818,11 @@   (label 49)   (parent 25)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb ra-prime) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb)))))  (defskeleton neuman-stubblebine-reauth   (vars (ra tb rb ra-prime rb-prime rb-0 text) (a b ks name) (k skey))@@ -2211,6 +2223,10 @@   (seen 34)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -2376,6 +2392,10 @@   (seen 49)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb ra-prime) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -3014,6 +3034,10 @@   (seen 44 60)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "2 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -3132,6 +3156,10 @@   (seen 49)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -3553,7 +3581,11 @@   (label 92)   (parent 53)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb ra-prime) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb)))))  (defskeleton neuman-stubblebine-reauth   (vars (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 rb-prime-0 text)@@ -3701,7 +3733,11 @@   (label 96)   (parent 56)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb)))))  (defskeleton neuman-stubblebine-reauth   (vars (ra tb rb ra-prime rb-prime rb-0 rb-prime-0 text) (a b ks name)@@ -3736,7 +3772,11 @@   (label 97)   (parent 58)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb)))))  (defskeleton neuman-stubblebine-reauth   (vars@@ -3900,7 +3940,11 @@   (label 101)   (parent 59)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb)))))  (defskeleton neuman-stubblebine-reauth   (vars (ra tb rb ra-prime rb-prime rb-0 rb-prime-0 ra-prime-0 text)@@ -4066,6 +4110,10 @@   (seen 64 82)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "2 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -4484,6 +4532,10 @@   (seen 92)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb ra-prime) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -4647,6 +4699,10 @@   (seen 96)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -4688,6 +4744,10 @@   (seen 97)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -4869,6 +4929,10 @@   (seen 101)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -5089,7 +5153,11 @@   (label 128)   (parent 81)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb)))))  (defskeleton neuman-stubblebine-reauth   (vars (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 text) (a b ks name)@@ -5309,7 +5377,11 @@   (label 133)   (parent 83)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb ra-prime) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb)))))  (defskeleton neuman-stubblebine-reauth   (vars (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 text) (a b ks name)@@ -5792,6 +5864,10 @@   (seen 92 96)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "2 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -5827,7 +5903,11 @@   (label 145)   (parent 94)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb)))))  (defskeleton neuman-stubblebine-reauth   (vars (ra tb rb ra-prime rb-prime rb-0 ra-prime-0 ra-0 tb-0 text)@@ -6131,6 +6211,10 @@   (seen 101)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -6173,7 +6257,11 @@   (label 153)   (parent 103)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb)))))  (defskeleton neuman-stubblebine-reauth   (vars@@ -6366,6 +6454,10 @@   (seen 128)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb rb) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth@@ -6603,6 +6695,10 @@   (seen 133)   (unrealized)   (shape)+  (maps+    ((0 1)+      ((ra ra) (tb tb) (rb ra-prime) (a a) (b b) (ks ks) (k k)+        (ra-prime ra-prime) (rb-prime rb-prime) (tb-0 tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine-reauth
tst/neuman-stubblebine.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol neuman-stubblebine basic@@ -75,7 +75,8 @@   (label 2)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (ks ks) (ra ra) (rb rb) (k k) (tb tb)))))  (comment "Nothing left to do") @@ -368,6 +369,7 @@   (seen 14)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (ks ks) (ra ra) (rb rb) (k k) (tb tb))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton neuman-stubblebine@@ -393,7 +395,8 @@   (label 14)   (parent 12)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (ks ks) (ra ra) (rb rb) (k k) (tb tb)))))  (comment "Nothing left to do") @@ -446,6 +449,7 @@   (label 16)   (parent 15)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (ks ks) (ra ra) (rb rb) (k k) (tb tb)))))  (comment "Nothing left to do")
tst/no_contraction.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol no-contraction basic@@ -18,7 +18,9 @@   (traces ((recv (enc n (privk a))))     ((send (enc (enc n (privk a-0)) (pubk b)))))   (label 0)-  (unrealized (0 0)))+  (unrealized (0 0))+  (preskeleton)+  (comment "Not a skeleton"))  (defskeleton no-contraction   (vars (n text) (a a-0 b name))@@ -49,6 +51,7 @@   (label 2)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((a a) (n n) (a-0 a) (b b)))))  (comment "Nothing left to do")
tst/non_transforming.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol non_transforming basic@@ -84,7 +84,8 @@   (label 3)   (parent 2)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1 1) ((a d) (b d) (c d) (d d) (B B0) (B0 B0) (B1 B0)))))  (defskeleton non_transforming   (vars (a b c d text) (B0 B1 name))@@ -125,7 +126,8 @@   (label 5)   (parent 2)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1 1) ((a c) (b b) (c c) (d b) (B B1) (B0 B1) (B1 B1)))))  (defskeleton non_transforming   (vars (a c d text) (B0 B1 name))@@ -145,9 +147,9 @@     ((recv (enc c c (pubk B1))) (send (enc c (pubk B1)))))   (label 6)   (parent 2)-  (seen 3)+  (seen 11)   (unrealized (0 1))-  (comment "3 in cohort - 1 not yet seen"))+  (comment "3 in cohort - 2 not yet seen"))  (defskeleton non_transforming   (vars (a b c d text) (B1 name))@@ -171,6 +173,7 @@   (seen 5 9)   (unrealized)   (shape)+  (maps ((0 1 2) ((a a) (b b) (c c) (d d) (B B1) (B0 B1) (B1 B1))))   (comment "2 in cohort - 0 not yet seen"))  (defskeleton non_transforming@@ -216,6 +219,7 @@   (seen 5)   (unrealized)   (shape)+  (maps ((0 1 1) ((a a) (b d) (c a) (d d) (B B0) (B0 B0) (B1 B0))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton non_transforming@@ -236,27 +240,29 @@     ((recv (enc c c (pubk B1))) (send (enc c (pubk B1)))))   (label 10)   (parent 6)-  (seen 3)+  (seen 3 11)   (unrealized)   (shape)-  (comment "2 in cohort - 1 not yet seen"))+  (maps ((0 1 2) ((a a) (b c) (c c) (d d) (B B1) (B0 B1) (B1 B1))))+  (comment "2 in cohort - 0 not yet seen"))  (defskeleton non_transforming-  (vars (d text) (B1 name))-  (defstrand recv 2 (a d) (b d) (B B1))-  (defstrand sender 1 (a d) (b d) (B B1))-  (defstrand breaker 2 (a d) (b d) (B B1))-  (defstrand breaker 2 (a d) (b d) (B B1))+  (vars (d text) (B0 name))+  (defstrand recv 2 (a d) (b d) (B B0))+  (defstrand sender 1 (a d) (b d) (B B0))+  (defstrand breaker 2 (a d) (b d) (B B0))+  (defstrand breaker 2 (a d) (b d) (B B0))   (precedes ((1 0) (2 0)) ((1 0) (3 0)) ((2 1) (0 0)) ((3 1) (0 1)))-  (non-orig (privk B1))+  (non-orig (privk B0))   (uniq-orig d)-  (operation collapsed 2 1)-  (traces ((recv (enc d (pubk B1))) (recv (enc d (pubk B1))))-    ((send (enc d d (pubk B1))))-    ((recv (enc d d (pubk B1))) (send (enc d (pubk B1))))-    ((recv (enc d d (pubk B1))) (send (enc d (pubk B1)))))+  (operation nonce-test (displaced 5 1 sender 1) c (0 1)+    (enc c (pubk B1)) (enc c c (pubk B1)))+  (traces ((recv (enc d (pubk B0))) (recv (enc d (pubk B0))))+    ((send (enc d d (pubk B0))))+    ((recv (enc d d (pubk B0))) (send (enc d (pubk B0))))+    ((recv (enc d d (pubk B0))) (send (enc d (pubk B0)))))   (label 11)-  (parent 10)+  (parent 6)   (seen 3)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))
tst/nonaug-prune.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol nonaug-prune basic@@ -136,7 +136,8 @@   (label 6)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps ((0 0 1) ((n n) (A B) (B B) (k k)))))  (defskeleton nonaug-prune   (vars (n text) (B C name) (k akey))@@ -356,6 +357,7 @@   (seen 6)   (unrealized)   (shape)+  (maps ((0 2 1) ((n n) (A B) (B B) (k k))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton nonaug-prune
tst/ns.tst view
@@ -1,6 +1,6 @@ (herald "Needham-Schroeder Public-Key Protocol Variants") -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol ns basic@@ -61,7 +61,8 @@   (label 2)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2)))))  (comment "Nothing left to do") @@ -126,7 +127,8 @@   (label 5)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0 0) ((a a) (b b) (n1 n1) (n1-0 n1) (n2 n2) (n2-0 n2)))))  (comment "Nothing left to do") @@ -171,7 +173,8 @@   (label 7)   (parent 6)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (n2 n2) (b b) (n1 n1)))))  (comment "Nothing left to do") @@ -237,7 +240,8 @@   (label 10)   (parent 9)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2)))))  (comment "Nothing left to do") @@ -305,7 +309,8 @@   (label 13)   (parent 12)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((b b) (a a) (n2 n2) (n1 n1)))))  (defskeleton ns-role-origs   (vars (n2 n1 n2-0 text) (b a b-0 name))@@ -410,7 +415,8 @@   (label 18)   (parent 17)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n1 n3) (n2 n2) (n3 n3)))))  (comment "Nothing left to do") @@ -438,7 +444,8 @@     ((recv (enc n1 a (pubk b))) (send (enc n1 n2 (pubk a)))))   (label 19)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((n1 n1) (n2 n2) (a a) (b b)))))  (comment "Nothing left to do") @@ -463,7 +470,9 @@   (traces ((recv (enc a n1 (pubk b))) (send (enc n1 n2 b (pubk a))))     ((recv n2) (send n2)))   (label 20)-  (unrealized (1 0)))+  (unrealized (1 0))+  (preskeleton)+  (comment "Not a skeleton"))  (defskeleton nsl-typeless   (vars (n1 mesg) (n2 text) (a b name))@@ -515,6 +524,7 @@   (label 23)   (parent 21)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((a a) (b b) (n2 n2) (n1 a-0)))))  (comment "Nothing left to do")
tst/nsl3.tst view
@@ -1,6 +1,6 @@ (herald "Three Party Needham-Schroeder-Lowe Protocol") -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol nsl3 basic@@ -160,7 +160,11 @@   (label 3)   (parent 2)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((a a) (b b) (c c) (na0 na0) (na1 na1) (nb0 nb0) (nb1 nb1)+        (nc0 nc0) (nc1 nc1)))))  (comment "Nothing left to do") @@ -329,7 +333,11 @@   (label 7)   (parent 6)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((a a) (b b) (c c) (na0 na0) (na1 na1) (nb0 nb0) (nb1 nb1)+        (nc0 nc0) (nc1 nc1)))))  (comment "Nothing left to do") @@ -677,7 +685,11 @@   (label 15)   (parent 13)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((a a) (b b) (c c) (na0 na0) (na1 na1) (nb0 nb0) (nb1 nb1)+        (nc0 nc0) (nc1 nc1)))))  (defskeleton nsl3   (vars (nc0 nc1 nb0 nb1 nc0-0 nc1-0 na0 na1 text) (a b c name))
tst/nsl4cm1.tst view
@@ -1,10673 +1,11967 @@ (herald "Four Party Needham-Schroeder-Lowe Protocol") -(comment "CPSA 2.2.2")-(comment "All input read")--(defprotocol nsl4cm basic-  (defrole init-    (vars (a b c d name) (na nb nc nd text))-    (trace (send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b)))))-  (defrole resp1-    (vars (a b c d name) (na nb nc nd text))-    (trace (recv (enc a c d na (pubk b)))-      (send (enc a b d na nb (pubk c))) (recv (enc nb nc nd (pubk b)))-      (send (enc nc nd (pubk c)))))-  (defrole resp2-    (vars (a b c d name) (na nb nc nd text))-    (trace (recv (enc a b d na nb (pubk c)))-      (send (enc a b c na nb nc (pubk d))) (recv (enc nc nd (pubk c)))-      (send (enc nd (pubk d)))))-  (defrole resp3-    (vars (a b c d name) (na nb nc nd text))-    (trace (recv (enc a b c na nb nc (pubk d)))-      (send (enc b c d na nb nc nd (pubk a)))-      (recv (enc nd (pubk d))))))--(defskeleton nsl4cm-  (vars (na nb nc nd text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b)))))-  (label 0)-  (unrealized (0 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp1 2) na (0 1)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b)))-      (send (enc a b d na nb-0 (pubk c)))))-  (label 1)-  (parent 0)-  (unrealized (0 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp2 2) na (0 1)-    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d)))))-  (label 2)-  (parent 1)-  (unrealized (0 1) (2 0))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))-    ((3 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp1 2) na (2 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b)))-      (send (enc a b d na nb-1 (pubk c)))))-  (label 3)-  (parent 2)-  (seen 4)-  (unrealized (0 1) (2 0))-  (comment "4 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 3 1 resp1 2) na (2 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d)))))-  (label 4)-  (parent 2)-  (unrealized (0 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 3 1 resp1 2) na (2 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d)))))-  (label 5)-  (parent 2)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 4 1 resp1 2) na (2 0)-    (enc a b d na nb-1 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 6)-  (parent 3)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp2 2) na (2 0)-    (enc a b d na nb-1 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d)))))-  (label 7)-  (parent 3)-  (unrealized (0 1) (2 0) (4 0))-  (comment "5 in cohort - 5 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp3 2) na (0 1)-    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b d na nb-0 (pubk c))-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))-  (label 8)-  (parent 4)-  (unrealized (0 1) (3 0))-  (comment "4 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 9)-  (parent 5)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 10)-  (parent 5)-  (seen 20)-  (unrealized (0 1) (3 0))-  (comment "4 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 11)-  (parent 6)-  (seen 5 27)-  (unrealized (0 1) (4 0))-  (comment "6 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 12)-  (parent 6)-  (seen 20 31)-  (unrealized (0 1) (4 0))-  (comment "6 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp1 2) na (4 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a c d na (pubk b)))-      (send (enc a b d na nb-2 (pubk c)))))-  (label 13)-  (parent 7)-  (seen 15)-  (unrealized (0 1) (2 0) (4 0))-  (comment "5 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((4 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 5 1 resp1 2) na (4 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d)))))-  (label 14)-  (parent 7)-  (unrealized (0 1) (4 0))-  (comment "4 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 5 3 resp1 2) na (4 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d)))))-  (label 15)-  (parent 7)-  (seen 37)-  (unrealized (0 1) (2 0))-  (comment "4 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((4 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 1 resp1 2) na (4 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 16)-  (parent 7)-  (seen 34 44)-  (unrealized (0 1) (4 0))-  (comment "5 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 5 3 resp1 2) na (4 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d)))))-  (label 17)-  (parent 7)-  (seen 44)-  (unrealized (0 1) (2 0))-  (comment "5 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nd-0 nb-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (0 1)) ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp1 2) na (3 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d na (pubk b)))-      (send (enc a b d na nb-1 (pubk c)))))-  (label 18)-  (parent 8)-  (seen 21)-  (unrealized (0 1) (3 0))-  (comment "4 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (3 0)) ((2 1) (0 1))-    ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 4 1 resp1 2) na (3 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))-  (label 19)-  (parent 8)-  (seen 21 52)-  (unrealized (0 1) (3 0))-  (comment "3 in cohort - 1 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (3 0)) ((2 1) (0 1))-    ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 4 1 resp1 2) na (3 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 20)-  (parent 8)-  (seen 25 50)-  (unrealized (0 1) (3 0))-  (comment "4 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 4 2 resp2 2) na (3 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 21)-  (parent 8)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 22)-  (parent 9)-  (seen 59)-  (unrealized (0 1) (4 0))-  (comment "6 in cohort - 5 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 23)-  (parent 9)-  (seen 24 63)-  (unrealized (0 1) (4 0))-  (comment "6 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (0 1)) ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (3 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 24)-  (parent 10)-  (seen 50 55)-  (unrealized (0 1) (3 0))-  (comment "5 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 4 2 resp2 2) nb-0 (3 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))-  (label 25)-  (parent 10)-  (seen 65)-  (unrealized (0 1))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 26)-  (parent 11)-  (seen 6 28 29 39 71)-  (unrealized (0 1) (4 0))-  (comment "8 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 1 resp1 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 27)-  (parent 11)-  (seen 5 29 39 71)-  (unrealized (0 1) (4 0))-  (comment "7 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 28)-  (parent 11)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 5 2 resp2 2) nb-1 (4 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 29)-  (parent 11)-  (unrealized (0 1))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 30)-  (parent 12)-  (seen 33 50 80)-  (unrealized (0 1) (4 0))-  (comment "6 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 1 resp1 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 31)-  (parent 12)-  (seen 33 80 82)-  (unrealized (0 1) (4 0))-  (comment "5 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 32)-  (parent 12)-  (seen 33 55 83)-  (unrealized (0 1) (4 0))-  (comment "5 in cohort - 1 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 5 2 resp2 2) nb-1 (4 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))-  (label 33)-  (parent 12)-  (unrealized (0 1))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) na (4 0)-    (enc a b d na nb-2 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 34)-  (parent 13)-  (seen 45 89)-  (unrealized (0 1) (4 0))-  (comment "6 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 6 3 resp1 2) na (4 0)-    (enc a b d na nb-2 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c)))))-  (label 35)-  (parent 13)-  (seen 39 89)-  (unrealized (0 1) (2 0))-  (comment "6 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp2 2) na (4 0)-    (enc a b d na nb-2 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-2 (pubk c))))-    ((recv (enc a b d na nb-2 (pubk c)))-      (send (enc a b c na nb-2 nc-2 (pubk d)))))-  (label 36)-  (parent 13)-  (unrealized (0 1) (2 0) (4 0) (6 0))-  (comment "7 in cohort - 7 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (3 0)) ((2 1) (0 1)) ((3 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (contracted (nb-1 nb-0)) na (4 0)-    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-1 (pubk d)))))-  (label 37)-  (parent 14)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 5 3 resp1 2) na (4 0)-    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d)))))-  (label 38)-  (parent 14)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 5 3 resp1 2) na (4 0)-    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d)))))-  (label 39)-  (parent 14)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp2 2) na (4 0)-    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-2 (pubk d)))))-  (label 40)-  (parent 14)-  (unrealized (0 1) (4 0) (5 0))-  (comment "5 in cohort - 5 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 5 1 resp1 2) na (2 0)-    (enc a b c na nb-1 nc-1 (pubk d)) (enc a b d na nb-1 (pubk c))-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d)))))-  (label 41)-  (parent 15)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 1 resp1 2) na (2 0)-    (enc a b c na nb-1 nc-1 (pubk d)) (enc a b d na nb-1 (pubk c))-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 42)-  (parent 15)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp3 2) na (2 0)-    (enc a b c na nb-1 nc-1 (pubk d)) (enc a b d na nb-1 (pubk c))-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b c na nb-1 nc-1 (pubk d)))-      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a)))))-  (label 43)-  (parent 15)-  (unrealized (0 1) (2 0) (5 0))-  (comment "6 in cohort - 6 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (3 0)) ((2 1) (0 1)) ((3 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (contracted (nb-1 nb-0)) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 44)-  (parent 16)-  (unrealized (0 1))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 45)-  (parent 16)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 46)-  (parent 16)-  (seen 111)-  (unrealized (0 1) (4 0) (5 0))-  (comment "5 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp1 2) nb-1 (2 0)-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c)))))-  (label 47)-  (parent 17)-  (seen 48 131)-  (unrealized (0 1) (2 0))-  (comment "6 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 5 1 resp1 2) nb-1 (2 0)-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d)))))-  (label 48)-  (parent 17)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp3 2) nb-1 (2 0)-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 49)-  (parent 17)-  (seen 121)-  (unrealized (0 1) (2 0) (5 0))-  (comment "6 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((1 1) (3 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 1 resp1 2) na (3 0)-    (enc a b d na nb-1 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 50)-  (parent 18)-  (seen 55 67)-  (unrealized (0 1) (3 0))-  (comment "5 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp2 2) na (3 0)-    (enc a b d na nb-1 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d)))))-  (label 51)-  (parent 18)-  (unrealized (0 1) (3 0) (5 0))-  (comment "6 in cohort - 6 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 5 2 resp2 2) na (3 0)-    (enc a b d na nb-1 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))-  (label 52)-  (parent 18)-  (unrealized (0 1))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((1 1) (3 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp2 2) na (3 0)-    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-1 (pubk d)))))-  (label 53)-  (parent 19)-  (unrealized (0 1) (3 0) (4 0))-  (comment "4 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((1 1) (3 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (3 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 54)-  (parent 20)-  (seen 152)-  (unrealized (0 1) (3 0) (4 0))-  (comment "4 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 4 2 resp2 2) nb-0 (3 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 55)-  (parent 20)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd text) (a b c d name))-  (defstrand init 3 (na nc) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc) (nb nb) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc) (nb nb) (nc nc) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc)-  (operation nonce-test (contracted (nb-0 nb) (nc-0 nc) (nd-0 nd)) nc-    (0 1) (enc a b c nc nb nc (pubk d)) (enc a b d nc nb (pubk c))-    (enc a c d nc (pubk b)) (enc b c d nc nb nc nd (pubk a)))-  (traces-    ((send (enc a c d nc (pubk b)))-      (recv (enc b c d nc nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nb (pubk c))))-    ((recv (enc a b d nc nb (pubk c)))-      (send (enc a b c nc nb nc (pubk d))))-    ((recv (enc a b c nc nb nc (pubk d)))-      (send (enc b c d nc nb nc nd (pubk a)))))-  (label 56)-  (parent 21)-  (seen 149)-  (unrealized)-  (comment "1 in cohort - 0 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)-    (enc a b c nc-0 nb-0 nc-0 (pubk d)) (enc a b d nc-0 nb-0 (pubk c))-    (enc a c d nc-0 (pubk b)) (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 57)-  (parent 21)-  (unrealized (0 1) (4 0))-  (comment "5 in cohort - 5 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 58)-  (parent 22)-  (seen 17 60 163)-  (unrealized (0 1) (4 0))-  (comment "8 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 1 resp1 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 59)-  (parent 22)-  (seen 5 17 62 163)-  (unrealized (0 1) (4 0))-  (comment "7 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 60)-  (parent 22)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 3 resp1 2) nb-1 (4 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 61)-  (parent 22)-  (seen 172)-  (unrealized (0 1))-  (comment "3 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 5 2 resp2 2) nb-1 (4 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 62)-  (parent 22)-  (seen 166 173)-  (unrealized (0 1) (4 0))-  (comment "6 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 1 resp1 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 63)-  (parent 23)-  (seen 50 65 157)-  (unrealized (0 1) (4 0))-  (comment "5 in cohort - 1 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 3 resp1 2) nb-1 (4 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 64)-  (parent 23)-  (seen 25 55)-  (unrealized (0 1) (4 0))-  (comment "4 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 5 2 resp2 2) nb-1 (4 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))-  (label 65)-  (parent 23)-  (unrealized (0 1))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (3 0)-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 66)-  (parent 24)-  (seen 146)-  (unrealized (0 1) (3 0) (5 0))-  (comment "6 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nd-0 nb-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))-    ((3 1) (0 1)) ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 5 2 resp2 2) nb-1 (3 0)-    (enc a b d nb-1 nb-0 (pubk c)) (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c)))))-  (label 67)-  (parent 24)-  (unrealized (0 1))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nc nd text) (a b c d name))-  (defstrand init 3 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc) (nb nc) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc) (nb nc) (nc nc) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc)-  (operation nonce-test (contracted (nb nc) (nc-0 nc) (nd-0 nd)) nc-    (0 1) (enc a b c nc nc nc (pubk d)) (enc a b d nc nc (pubk c))-    (enc a c d nc (pubk b)) (enc b c d nc nc nc nd (pubk a)))-  (traces-    ((send (enc a c d nc (pubk b)))-      (recv (enc b c d nc nc nc nd (pubk a)))-      (send (enc nc nc nd (pubk b))))-    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nc (pubk c))))-    ((recv (enc a b d nc nc (pubk c)))-      (send (enc a b c nc nc nc (pubk d))))-    ((recv (enc a b c nc nc nc (pubk d)))-      (send (enc b c d nc nc nc nd (pubk a)))))-  (label 68)-  (parent 25)-  (seen 156)-  (unrealized)-  (comment "1 in cohort - 0 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)-    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a c d nc-0 (pubk b)) (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 69)-  (parent 25)-  (seen 160)-  (unrealized (0 1) (4 0))-  (comment "5 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (contracted (nb-2 nb-1)) nb-0 (4 0)-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 70)-  (parent 26)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (4 0)-    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 71)-  (parent 26)-  (seen 6 29 39 73)-  (unrealized (0 1) (4 0))-  (comment "9 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))-  (label 72)-  (parent 26)-  (seen 16 199)-  (unrealized (0 1) (4 0) (6 0))-  (comment "8 in cohort - 6 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 73)-  (parent 27)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 74)-  (parent 27)-  (seen 44 207)-  (unrealized (0 1) (4 0) (5 0))-  (comment "6 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))-    ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 75)-  (parent 28)-  (seen 20 211)-  (unrealized (0 1) (5 0))-  (comment "7 in cohort - 5 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))-    ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))-  (label 76)-  (parent 28)-  (seen 20 216)-  (unrealized (0 1) (5 0))-  (comment "7 in cohort - 5 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)-    (enc a b c nc-0 nc-0 nc-0 (pubk d))-    (enc a b c nc-0 nb-0 nc-1 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))-  (label 77)-  (parent 29)-  (seen 173 221)-  (unrealized (0 1) (5 0))-  (comment "7 in cohort - 5 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp3 2) nc-0 (0 1)-    (enc a b c nc-0 nc-0 nc-0 (pubk d))-    (enc a b c nc-0 nb-0 nc-1 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))-  (label 78)-  (parent 29)-  (seen 226)-  (unrealized (0 1) (5 0))-  (comment "7 in cohort - 6 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp3 2) nc-0 (0 1)-    (enc a b c nc-0 nc-0 nc-0 (pubk d))-    (enc a b c nc-0 nb-0 nc-1 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a)))))-  (label 79)-  (parent 29)-  (seen 232)-  (unrealized (0 1) (5 0))-  (comment "7 in cohort - 6 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (4 0)-    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 80)-  (parent 30)-  (seen 33 82)-  (unrealized (0 1) (4 0))-  (comment "5 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-1 (pubk d)))))-  (label 81)-  (parent 30)-  (seen 146 240)-  (unrealized (0 1) (4 0) (6 0))-  (comment "8 in cohort - 6 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 2 resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 82)-  (parent 30)-  (unrealized (0 1))-  (comment "2 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 83)-  (parent 31)-  (seen 33 55 82)-  (unrealized (0 1) (4 0))-  (comment "5 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 84)-  (parent 31)-  (seen 152 250)-  (unrealized (0 1) (4 0) (5 0))-  (comment "6 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 85)-  (parent 32)-  (seen 152 254)-  (unrealized (0 1) (4 0) (5 0))-  (comment "6 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (nc nb nd text) (a b c d name))-  (defstrand init 3 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc) (nb nc) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc) (nb nc) (nc nc) (a a) (b b) (c c) (d d))-  (defstrand resp1 2 (na nc) (nb nb) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc)-  (operation nonce-test (contracted (nb-0 nc) (nc-0 nc) (nd-0 nd)) nc-    (0 1) (enc a b c nc nc nc (pubk d)) (enc a b d nc nc (pubk c))-    (enc a b d nc nb (pubk c)) (enc a c d nc (pubk b))-    (enc b c d nc nc nc nd (pubk a)))-  (traces-    ((send (enc a c d nc (pubk b)))-      (recv (enc b c d nc nc nc nd (pubk a)))-      (send (enc nc nc nd (pubk b))))-    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nc (pubk c))))-    ((recv (enc a b d nc nc (pubk c)))-      (send (enc a b c nc nc nc (pubk d))))-    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nb (pubk c))))-    ((recv (enc a b c nc nc nc (pubk d)))-      (send (enc b c d nc nc nc nd (pubk a)))))-  (label 86)-  (parent 33)-  (seen 68)-  (unrealized)-  (comment "1 in cohort - 0 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)-    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))-    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 87)-  (parent 33)-  (seen 160 258)-  (unrealized (0 1) (5 0))-  (comment "7 in cohort - 5 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)-    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))-    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 88)-  (parent 33)-  (seen 160 213 229 263)-  (unrealized (0 1) (5 0))-  (comment "7 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (contracted (nb-2 nb-0)) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 89)-  (parent 34)-  (unrealized (0 1))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 90)-  (parent 34)-  (seen 111 128 129 268)-  (unrealized (0 1) (4 0) (6 0))-  (comment "7 in cohort - 2 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))-  (label 91)-  (parent 34)-  (seen 99 111)-  (unrealized (0 1) (4 0) (6 0))-  (comment "7 in cohort - 4 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 6 1 resp1 2) nb-1 (2 0)-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))-    (enc a b d nb-1 nb-2 (pubk c)) (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c)))))-  (label 92)-  (parent 35)-  (unrealized (0 1))-  (comment "3 in cohort - 3 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp2 2) nb-1 (2 0)-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))-    (enc a b d nb-1 nb-2 (pubk c)) (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b d nb-1 nb-2 (pubk c)))-      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))-  (label 93)-  (parent 35)-  (seen 17 279)-  (unrealized (0 1) (2 0) (6 0))-  (comment "8 in cohort - 6 not yet seen"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp3 2) nb-1 (2 0)-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))-    (enc a b d nb-1 nb-2 (pubk c)) (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 94)-  (parent 35)-  (seen 121 285)-  (unrealized (0 1) (2 0) (6 0))-  (comment "8 in cohort - 6 not yet seen"))--(comment "Strand bound exceeded--aborting run")--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 nb-3 text)-    (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-3) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))-    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (4 0)) ((7 1) (6 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp1 2) na (6 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-2 (pubk c))))-    ((recv (enc a b d na nb-2 (pubk c)))-      (send (enc a b c na nb-2 nc-2 (pubk d))))-    ((recv (enc a c d na (pubk b)))-      (send (enc a b d na nb-3 (pubk c)))))-  (label 95)-  (parent 36)-  (unrealized (0 1) (2 0) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 7 1 resp1 2) na (6 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-2 (pubk c))))-    ((recv (enc a b d na nb-2 (pubk c)))-      (send (enc a b c na nb-2 nc-2 (pubk d)))))-  (label 96)-  (parent 36)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (6 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 7 3 resp1 2) na (6 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-2 (pubk c))))-    ((recv (enc a b d na nb-2 (pubk c)))-      (send (enc a b c na nb-2 nc-2 (pubk d)))))-  (label 97)-  (parent 36)-  (unrealized (0 1) (2 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (6 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 7 5 resp1 2) na (6 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-2 (pubk c))))-    ((recv (enc a b d na nb-2 (pubk c)))-      (send (enc a b c na nb-2 nc-2 (pubk d)))))-  (label 98)-  (parent 36)-  (unrealized (0 1) (2 0) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 1 resp1 2) na (6 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))-  (label 99)-  (parent 36)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (6 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 7 3 resp1 2) na (6 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b d nb-1 nb-2 (pubk c)))-      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))-  (label 100)-  (parent 36)-  (unrealized (0 1) (2 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-2) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-2) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-2) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-2) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-2) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-2) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-2) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (6 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-2)-  (operation nonce-test (displaced 7 5 resp1 2) na (6 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-2 (pubk b)))-      (recv (enc b c d nb-2 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-2 (pubk b)))-      (send (enc a b d nb-2 nb-0 (pubk c))))-    ((recv (enc a b d nb-2 nb-0 (pubk c)))-      (send (enc a b c nb-2 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-2 (pubk b)))-      (send (enc a b d nb-2 nb-1 (pubk c))))-    ((recv (enc a b d nb-2 nb-1 (pubk c)))-      (send (enc a b c nb-2 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-2 (pubk b)))-      (send (enc a b d nb-2 nb-2 (pubk c))))-    ((recv (enc a b d nb-2 nb-2 (pubk c)))-      (send (enc a b c nb-2 nb-2 nc-2 (pubk d)))))-  (label 101)-  (parent 36)-  (unrealized (0 1) (2 0) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp3 2) na (0 1)-    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-0 nc-1 (pubk d))-    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-1 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))-  (label 102)-  (parent 37)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp3 2) na (0 1)-    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-0 nc-1 (pubk d))-    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-1 (pubk d))))-    ((recv (enc a b c na nb-0 nc-1 (pubk d)))-      (send (enc b c d na nb-0 nc-1 nd-0 (pubk a)))))-  (label 103)-  (parent 37)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp3 2) na (0 1)-    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-1 nc-1 (pubk d))-    (enc a b d na nb-0 (pubk c)) (enc a b d na nb-1 (pubk c))-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))-  (label 104)-  (parent 38)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp3 2) na (0 1)-    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-1 nc-1 (pubk d))-    (enc a b d na nb-0 (pubk c)) (enc a b d na nb-1 (pubk c))-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b c na nb-1 nc-1 (pubk d)))-      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a)))))-  (label 105)-  (parent 38)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)-    (enc a b c nb-1 nb-0 nc-0 (pubk d))-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))-    (enc a b d nb-1 nb-1 (pubk c)) (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-1 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-1 nb-0 nc-0 nd-0 (pubk a)))))-  (label 106)-  (parent 39)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)-    (enc a b c nb-1 nb-0 nc-0 (pubk d))-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))-    (enc a b d nb-1 nb-1 (pubk c)) (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 107)-  (parent 39)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 nb-2 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-2 (pubk d))))-    ((recv (enc a c d na (pubk b)))-      (send (enc a b d na nb-2 (pubk c)))))-  (label 108)-  (parent 40)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-2 (pubk d)))))-  (label 109)-  (parent 40)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))-    ((3 1) (5 0)) ((4 1) (2 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 6 3 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-2 (pubk d)))))-  (label 110)-  (parent 40)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 111)-  (parent 40)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))-    ((3 1) (5 0)) ((4 1) (2 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 6 3 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-2 (pubk d)))))-  (label 112)-  (parent 40)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp3 2) na (0 1)-    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-1 nc-1 (pubk d))-    (enc a b d na nb-0 (pubk c)) (enc a b d na nb-1 (pubk c))-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))-  (label 113)-  (parent 41)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp3 2) na (0 1)-    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-1 nc-1 (pubk d))-    (enc a b d na nb-0 (pubk c)) (enc a b d na nb-1 (pubk c))-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b c na nb-1 nc-1 (pubk d)))-      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a)))))-  (label 114)-  (parent 41)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 115)-  (parent 42)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))-  (label 116)-  (parent 42)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 nb-2 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0))-    ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b c na nb-1 nc-1 (pubk d)))-      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a))))-    ((recv (enc a c d na (pubk b)))-      (send (enc a b d na nb-2 (pubk c)))))-  (label 117)-  (parent 43)-  (unrealized (0 1) (2 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b c na nb-1 nc-1 (pubk d)))-      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a)))))-  (label 118)-  (parent 43)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))-    ((3 1) (4 0)) ((3 1) (5 0)) ((4 1) (2 0)) ((5 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 6 3 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a b c na nb-1 nc-1 (pubk d)))-      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a)))))-  (label 119)-  (parent 43)-  (unrealized (0 1) (2 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))-  (label 120)-  (parent 43)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))-    ((3 1) (4 0)) ((3 1) (5 0)) ((4 1) (2 0)) ((5 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 6 3 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 121)-  (parent 43)-  (unrealized (0 1) (2 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (5 0)) ((5 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-1)-  (operation nonce-test (displaced 6 4 resp2 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nc-1 (pubk b)))-      (recv (enc b c d nc-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nb-0 (pubk c))))-    ((recv (enc a b d nc-1 nb-0 (pubk c)))-      (send (enc a b c nc-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nb-1 (pubk c))))-    ((recv (enc a b d nc-1 nb-1 (pubk c)))-      (send (enc a b c nc-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nc-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nc-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 122)-  (parent 43)-  (unrealized (0 1) (2 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 123)-  (parent 44)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 124)-  (parent 44)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-1 nd-0 (pubk a)))))-  (label 125)-  (parent 44)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 126)-  (parent 45)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))-  (label 127)-  (parent 45)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 128)-  (parent 46)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))-    ((3 1) (5 0)) ((4 1) (2 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 129)-  (parent 46)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (4 0)) ((3 1) (1 0))-    ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 3 resp1 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 130)-  (parent 46)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (3 0))-    ((3 1) (1 0)) ((4 1) (1 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (contracted (nb-2 nb-0)) nb-0 (2 0)-    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 131)-  (parent 47)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))-    ((5 1) (2 0)) ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp2 2) nb-1 (2 0)-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))-    (enc a b d nb-1 nb-2 (pubk c)) (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b d nb-1 nb-2 (pubk c)))-      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))-  (label 132)-  (parent 47)-  (unrealized (0 1) (2 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))-    ((5 1) (2 0)) ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp3 2) nb-1 (2 0)-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))-    (enc a b d nb-1 nb-2 (pubk c)) (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 133)-  (parent 47)-  (unrealized (0 1) (2 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)-    (enc a b c nb-1 nb-0 nc-0 (pubk d))-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))-    (enc a b d nb-1 nb-1 (pubk c)) (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-1 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-1 nb-0 nc-0 nd-0 (pubk a)))))-  (label 134)-  (parent 48)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)-    (enc a b c nb-1 nb-0 nc-0 (pubk d))-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))-    (enc a b d nb-1 nb-1 (pubk c)) (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 135)-  (parent 48)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0))-    ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp1 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c)))))-  (label 136)-  (parent 49)-  (unrealized (0 1) (2 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 6 1 resp1 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 137)-  (parent 49)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-1 nd-0 (pubk a)))))-  (label 138)-  (parent 49)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nc-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nc-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-1) (nb nc-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))-    ((3 1) (4 0)) ((4 1) (5 0)) ((5 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-1)-  (operation nonce-test (displaced 6 4 resp2 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-1 (pubk b)))-      (recv (enc b c d nc-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nb-0 (pubk c))))-    ((recv (enc a b d nc-1 nb-0 (pubk c)))-      (send (enc a b c nc-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nc-1 (pubk c))))-    ((recv (enc a b d nc-1 nc-1 (pubk c)))-      (send (enc a b c nc-1 nc-1 nc-1 (pubk d))))-    ((recv (enc a b c nc-1 nc-1 nc-1 (pubk d)))-      (send (enc b c d nc-1 nc-1 nc-1 nd-0 (pubk a)))))-  (label 139)-  (parent 49)-  (unrealized (0 1) (2 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (3 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0))-    ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (3 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 140)-  (parent 50)-  (unrealized (0 1) (3 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))-    ((3 1) (0 1)) ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 2 resp2 2) nb-0 (3 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 141)-  (parent 50)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (3 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0))-    ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (3 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 142)-  (parent 50)-  (unrealized (0 1) (3 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0))-    ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d))))-    ((recv (enc a c d na (pubk b)))-      (send (enc a b d na nb-2 (pubk c)))))-  (label 143)-  (parent 51)-  (unrealized (0 1) (3 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d)))))-  (label 144)-  (parent 51)-  (unrealized (0 1) (3 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (0 1)) ((4 1) (5 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 6 4 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))-    ((recv (enc a b d na nb-1 (pubk c)))-      (send (enc a b c na nb-1 nc-1 (pubk d)))))-  (label 145)-  (parent 51)-  (unrealized (0 1) (3 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 146)-  (parent 51)-  (unrealized (0 1) (3 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (0 1)) ((4 1) (5 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 6 4 resp1 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-1 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-1 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d)))))-  (label 147)-  (parent 51)-  (unrealized (0 1) (3 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (5 0))-    ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) na (5 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-1 (pubk c))))-    ((recv (enc a b d nc-0 nb-1 (pubk c)))-      (send (enc a b c nc-0 nb-1 nc-1 (pubk d)))))-  (label 148)-  (parent 51)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb) (nc nc) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (contracted (nb-0 nb) (nc-0 nc) (nd-0 nd)) na-    (0 1) (enc a b c na nb nc (pubk d)) (enc a b d na nb (pubk c))-    (enc a c d na (pubk b)) (enc b c d na nb nc nd (pubk a)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb (pubk c))))-    ((recv (enc a b d na nb (pubk c)))-      (send (enc a b c na nb nc (pubk d))))-    ((recv (enc a b c na nb nc (pubk d)))-      (send (enc b c d na nb nc nd (pubk a)))))-  (label 149)-  (parent 52)-  (unrealized)-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nd-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (5 0)) ((1 1) (2 0)) ((1 1) (3 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (added-strand resp1 2) na (4 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-1 (pubk d))))-    ((recv (enc a c d na (pubk b)))-      (send (enc a b d na nb-1 (pubk c)))))-  (label 150)-  (parent 53)-  (unrealized (0 1) (3 0) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (na nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1))-    ((3 1) (0 1)) ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig na)-  (operation nonce-test (displaced 5 1 resp1 2) na (4 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d na (pubk b)))-      (recv (enc b c d na nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-0 (pubk d))))-    ((recv (enc a b c na nb-0 nc-0 (pubk d)))-      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d na nb-0 (pubk c)))-      (send (enc a b c na nb-0 nc-1 (pubk d)))))-  (label 151)-  (parent 53)-  (unrealized (0 1) (3 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1))-    ((3 1) (0 1)) ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 1 resp1 2) na (4 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 152)-  (parent 53)-  (unrealized (0 1) (3 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (4 0)) ((3 1) (0 1))-    ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 5 2 resp2 2) na (4 0)-    (enc a c d na (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 153)-  (parent 53)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (5 0)) ((1 1) (2 0)) ((1 1) (3 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 154)-  (parent 54)-  (unrealized (0 1) (3 0) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (4 0)) ((3 1) (0 1))-    ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 5 2 resp2 2) nb-0 (4 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 155)-  (parent 54)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd text) (a b c d name))-  (defstrand init 3 (na nb) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb) (nb nb) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb) (nb nb) (nc nc) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb)-  (operation nonce-test (contracted (nb-0 nb) (nc-0 nc) (nd-0 nd)) nb-    (0 1) (enc a b c nb nb nc (pubk d)) (enc a b d nb nb (pubk c))-    (enc a c d nb (pubk b)) (enc b c d nb nb nc nd (pubk a)))-  (traces-    ((send (enc a c d nb (pubk b)))-      (recv (enc b c d nb nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb (pubk b))) (send (enc a b d nb nb (pubk c))))-    ((recv (enc a b d nb nb (pubk c)))-      (send (enc a b c nb nb nc (pubk d))))-    ((recv (enc a b c nb nb nc (pubk d)))-      (send (enc b c d nb nb nc nd (pubk a)))))-  (label 156)-  (parent 55)-  (unrealized)-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a c d nb-0 (pubk b)) (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 157)-  (parent 55)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (5 0)) ((1 1) (2 0)) ((2 1) (3 0))-    ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp1 2) nc-0 (4 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-1 (pubk c)))))-  (label 158)-  (parent 57)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (3 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 5 1 resp1 2) nc-0 (4 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 159)-  (parent 57)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nd-0 nc-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nb-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nb-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (3 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 1 resp1 2) nc-1 (4 0)-    (enc a c d nc-1 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nb-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nb-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nb-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d)))))-  (label 160)-  (parent 57)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((2 1) (4 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 5 2 resp2 2) nc-0 (4 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 161)-  (parent 57)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nd-0 nc-0 text) (a b c d name))-  (defstrand init 3 (na nd-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nd-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nd-0) (nb nb-0) (nc nd-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nd-0) (nb nb-0) (nc nd-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nd-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (4 0))-    ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nd-0)-  (operation nonce-test (displaced 5 3 resp3 2) nc-1 (4 0)-    (enc a c d nc-1 (pubk b)))-  (traces-    ((send (enc a c d nd-0 (pubk b)))-      (recv (enc b c d nd-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nd-0 (pubk b)))-      (send (enc a b d nd-0 nb-0 (pubk c))))-    ((recv (enc a b d nd-0 nb-0 (pubk c)))-      (send (enc a b c nd-0 nb-0 nd-0 (pubk d))))-    ((recv (enc a b c nd-0 nb-0 nd-0 (pubk d)))-      (send (enc b c d nd-0 nb-0 nd-0 nd-0 (pubk a))))-    ((recv (enc a b d nd-0 nb-0 (pubk c)))-      (send (enc a b c nd-0 nb-0 nc-0 (pubk d)))))-  (label 162)-  (parent 57)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (4 0)-    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 163)-  (parent 58)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 3 resp1 2) nb-2 (4 0)-    (enc a b d nb-2 nb-1 (pubk c)) (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 164)-  (parent 58)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))-  (label 165)-  (parent 58)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) nb-2 (4 0)-    (enc a b d nb-2 nb-1 (pubk c)) (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-1 (pubk c)))))-  (label 166)-  (parent 58)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 167)-  (parent 59)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 168)-  (parent 59)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 169)-  (parent 60)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))-  (label 170)-  (parent 60)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 171)-  (parent 61)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 172)-  (parent 61)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (contracted (nb-0 nc-0)) nc-0 (4 0)-    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 173)-  (parent 62)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (4 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 5 3 resp1 2) nc-0 (4 0)-    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 174)-  (parent 62)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp2 2) nc-0 (4 0)-    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))-  (label 175)-  (parent 62)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp3 2) nc-0 (4 0)-    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))-  (label 176)-  (parent 62)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 177)-  (parent 63)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 178)-  (parent 64)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 179)-  (parent 64)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nc nb nd text) (a b c d name))-  (defstrand init 3 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc) (nb nc) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc) (nb nc) (nc nc) (a a) (b b) (c c) (d d))-  (defstrand resp1 2 (na nc) (nb nb) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc)-  (operation nonce-test (contracted (nb-0 nc) (nc-0 nc) (nd-0 nd)) nc-    (0 1) (enc a b c nc nc nc (pubk d)) (enc a b d nc nc (pubk c))-    (enc a b d nc nb (pubk c)) (enc a c d nc (pubk b))-    (enc b c d nc nc nc nd (pubk a)))-  (traces-    ((send (enc a c d nc (pubk b)))-      (recv (enc b c d nc nc nc nd (pubk a)))-      (send (enc nc nc nd (pubk b))))-    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nc (pubk c))))-    ((recv (enc a b d nc nc (pubk c)))-      (send (enc a b c nc nc nc (pubk d))))-    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nb (pubk c))))-    ((recv (enc a b c nc nc nc (pubk d)))-      (send (enc b c d nc nc nc nd (pubk a)))))-  (label 180)-  (parent 65)-  (unrealized)-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)-    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))-    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 181)-  (parent 65)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)-    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))-    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 182)-  (parent 65)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0))-    ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 183)-  (parent 66)-  (unrealized (0 1) (3 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (0 1)) ((4 1) (5 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 4 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 184)-  (parent 66)-  (unrealized (0 1) (3 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nd-0 nb-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (0 1)) ((4 1) (5 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 4 resp1 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 185)-  (parent 66)-  (unrealized (0 1) (3 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nd-0 nb-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (5 0))-    ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 186)-  (parent 66)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nc nd nb text) (a b c d name))-  (defstrand init 3 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc) (nb nc) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc) (nb nc) (nc nc) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc) (nb nb) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))-    ((3 1) (0 1)) ((4 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc)-  (operation nonce-test (contracted (nb-0 nc) (nc-0 nc) (nd-0 nd)) nc-    (0 1) (enc a b c nc nc nc (pubk d)) (enc a b d nc nc (pubk c))-    (enc a b d nc nb (pubk c)) (enc a c d nc (pubk b))-    (enc b c d nc nc nc nd (pubk a)))-  (traces-    ((send (enc a c d nc (pubk b)))-      (recv (enc b c d nc nc nc nd (pubk a)))-      (send (enc nc nc nd (pubk b))))-    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nc (pubk c))))-    ((recv (enc a b d nc nc (pubk c)))-      (send (enc a b c nc nc nc (pubk d))))-    ((recv (enc a b c nc nc nc (pubk d)))-      (send (enc b c d nc nc nc nd (pubk a))))-    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nb (pubk c)))))-  (label 187)-  (parent 67)-  (unrealized)-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nd-0 nb-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (3 0)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)-    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))-    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 188)-  (parent 67)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nd-0 nb-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (3 0)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)-    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))-    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))-    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 189)-  (parent 67)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nd-0 nc-1 nb-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (5 0)) ((1 1) (2 0)) ((2 1) (3 0))-    ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp1 2) nc-0 (4 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c)))))-  (label 190)-  (parent 69)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((2 1) (4 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 5 2 resp2 2) nc-0 (4 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 191)-  (parent 69)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nd-0 nc-0 text) (a b c d name))-  (defstrand init 3 (na nd-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nd-0) (nb nd-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nd-0) (nb nd-0) (nc nd-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nd-0) (nb nd-0) (nc nd-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nd-0) (nb nd-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (4 0))-    ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nd-0)-  (operation nonce-test (displaced 5 3 resp3 2) nc-1 (4 0)-    (enc a c d nc-1 (pubk b)))-  (traces-    ((send (enc a c d nd-0 (pubk b)))-      (recv (enc b c d nd-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nd-0 (pubk b)))-      (send (enc a b d nd-0 nd-0 (pubk c))))-    ((recv (enc a b d nd-0 nd-0 (pubk c)))-      (send (enc a b c nd-0 nd-0 nd-0 (pubk d))))-    ((recv (enc a b c nd-0 nd-0 nd-0 (pubk d)))-      (send (enc b c d nd-0 nd-0 nd-0 nd-0 (pubk a))))-    ((recv (enc a b d nd-0 nd-0 (pubk c)))-      (send (enc a b c nd-0 nd-0 nc-0 (pubk d)))))-  (label 192)-  (parent 69)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 193)-  (parent 70)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))-  (label 194)-  (parent 70)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (contracted (nb-2 nb-1)) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c)))))-  (label 195)-  (parent 71)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0))-    ((4 1) (0 1)) ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 196)-  (parent 71)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0))-    ((4 1) (0 1)) ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))-  (label 197)-  (parent 71)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 nb-3 text)-    (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-3) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))-    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (4 0)) ((7 1) (6 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-3 (pubk c)))))-  (label 198)-  (parent 72)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (6 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 1 resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))-  (label 199)-  (parent 72)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (6 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 3 resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))-  (label 200)-  (parent 72)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (6 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 5 resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))-  (label 201)-  (parent 72)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (6 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 7 5 resp1 2) nb-2 (6 0)-    (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-2 (pubk d)))))-  (label 202)-  (parent 72)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-1) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (6 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 7 2 resp2 2) nb-2 (6 0)-    (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-1 (pubk c))))-    ((recv (enc a b d nc-0 nb-1 (pubk c)))-      (send (enc a b c nc-0 nb-1 nc-2 (pubk d)))))-  (label 203)-  (parent 72)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0))-    ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 204)-  (parent 73)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0))-    ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))-  (label 205)-  (parent 73)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 206)-  (parent 74)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 207)-  (parent 74)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 208)-  (parent 74)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (5 0))-    ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))-  (label 209)-  (parent 74)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))-    ((5 1) (0 1)) ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 210)-  (parent 75)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))-    ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 211)-  (parent 75)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((3 1) (4 0)) ((3 1) (5 0)) ((4 1) (0 1))-    ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 212)-  (parent 75)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (5 0))-    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))-  (label 213)-  (parent 75)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nc-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nc-1) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-1) (nb nc-1) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (5 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-1)-  (operation nonce-test (displaced 6 4 resp2 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-1 (pubk b)))-      (recv (enc b c d nc-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nc-1 (pubk c))))-    ((recv (enc a b d nc-1 nc-1 (pubk c)))-      (send (enc a b c nc-1 nc-1 nc-0 (pubk d))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nb-0 (pubk c))))-    ((recv (enc a b d nc-1 nb-0 (pubk c)))-      (send (enc a b c nc-1 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-1 nc-1 nc-0 (pubk d)))-      (send (enc b c d nc-1 nc-1 nc-0 nd-0 (pubk a)))))-  (label 214)-  (parent 75)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))-    ((5 1) (0 1)) ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 215)-  (parent 76)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))-    ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))-  (label 216)-  (parent 76)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((3 1) (4 0)) ((3 1) (5 0)) ((4 1) (0 1))-    ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))-  (label 217)-  (parent 76)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (5 0))-    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a)))))-  (label 218)-  (parent 76)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nc-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nc-1) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-1) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (5 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-1)-  (operation nonce-test (displaced 6 4 resp2 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-1 (pubk b)))-      (recv (enc b c d nc-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nc-1 (pubk c))))-    ((recv (enc a b d nc-1 nc-1 (pubk c)))-      (send (enc a b c nc-1 nc-1 nc-0 (pubk d))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nb-0 (pubk c))))-    ((recv (enc a b d nc-1 nb-0 (pubk c)))-      (send (enc a b c nc-1 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-1 nb-0 nc-1 (pubk d)))-      (send (enc b c d nc-1 nb-0 nc-1 nd-0 (pubk a)))))-  (label 219)-  (parent 76)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 nb-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1))-    ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-2 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-1 (pubk c)))))-  (label 220)-  (parent 77)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 1 resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))-  (label 221)-  (parent 77)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 3 resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))-  (label 222)-  (parent 77)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((2 1) (5 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))-  (label 223)-  (parent 77)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 1) (5 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 4 resp2 2) nc-2 (5 0)-    (enc a c d nc-2 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 224)-  (parent 77)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 nb-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1))-    ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-1 (pubk c)))))-  (label 225)-  (parent 78)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 1 resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))-  (label 226)-  (parent 78)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 3 resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))-  (label 227)-  (parent 78)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nb-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nb-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (2 0)) ((1 1) (3 0)) ((2 1) (1 0)) ((2 1) (4 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 3 resp1 2) nc-1 (5 0)-    (enc a c d nc-1 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nb-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nb-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nb-0 nd-0 (pubk a)))))-  (label 228)-  (parent 78)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((2 1) (5 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))-  (label 229)-  (parent 78)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 1) (5 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 4 resp2 2) nc-1 (5 0)-    (enc a c d nc-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))-  (label 230)-  (parent 78)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 nb-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1))-    ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-1 (pubk c)))))-  (label 231)-  (parent 79)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 1 resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a)))))-  (label 232)-  (parent 79)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 3 resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a)))))-  (label 233)-  (parent 79)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nb-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (2 0)) ((1 1) (3 0)) ((2 1) (1 0)) ((2 1) (4 0))-    ((3 1) (0 1)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 3 resp1 2) nc-1 (5 0)-    (enc a c d nc-1 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nb-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 234)-  (parent 79)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((2 1) (5 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a)))))-  (label 235)-  (parent 79)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 1) (5 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 4 resp2 2) nc-1 (5 0)-    (enc a c d nc-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 236)-  (parent 79)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0))-    ((4 1) (0 1)) ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 237)-  (parent 80)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0))-    ((4 1) (0 1)) ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-1 (pubk d)))))-  (label 238)-  (parent 80)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 nb-3 text)-    (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-3) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))-    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (4 0)) ((7 1) (6 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-3 (pubk c)))))-  (label 239)-  (parent 81)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (6 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 1 resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-1 (pubk d)))))-  (label 240)-  (parent 81)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (6 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 3 resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-1 (pubk d)))))-  (label 241)-  (parent 81)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (6 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 5 resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-1 (pubk d)))))-  (label 242)-  (parent 81)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (6 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 7 5 resp1 2) nb-2 (6 0)-    (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b c nb-1 nb-1 nc-0 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d)))))-  (label 243)-  (parent 81)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nb-1 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (6 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 7 2 resp2 2) nb-2 (6 0)-    (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-1 (pubk c))))-    ((recv (enc a b d nc-0 nb-1 (pubk c)))-      (send (enc a b c nc-0 nb-1 nc-1 (pubk d)))))-  (label 244)-  (parent 81)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nb-0 nd text) (a b c d name))-  (defstrand init 3 (na nb) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb) (nb nb) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb) (nb nb) (nc nc) (a a) (b b) (c c) (d d))-  (defstrand resp1 2 (na nb) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb)-  (operation nonce-test (contracted (nb-1 nb) (nc-0 nc) (nd-0 nd)) nb-    (0 1) (enc a b c nb nb nc (pubk d)) (enc a b d nb nb (pubk c))-    (enc a b d nb nb-0 (pubk c)) (enc a c d nb (pubk b))-    (enc b c d nb nb nc nd (pubk a)))-  (traces-    ((send (enc a c d nb (pubk b)))-      (recv (enc b c d nb nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb (pubk b))) (send (enc a b d nb nb (pubk c))))-    ((recv (enc a b d nb nb (pubk c)))-      (send (enc a b c nb nb nc (pubk d))))-    ((recv (enc a c d nb (pubk b))) (send (enc a b d nb nb-0 (pubk c))))-    ((recv (enc a b c nb nb nc (pubk d)))-      (send (enc b c d nb nb nc nd (pubk a)))))-  (label 245)-  (parent 82)-  (unrealized)-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b))-    (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 246)-  (parent 82)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0))-    ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 247)-  (parent 83)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0))-    ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)-    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 248)-  (parent 83)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 249)-  (parent 84)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 250)-  (parent 84)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))-  (label 251)-  (parent 84)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (5 0))-    ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 252)-  (parent 84)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 nb-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))-    ((5 1) (4 0)) ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c)))))-  (label 253)-  (parent 85)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))-    ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 254)-  (parent 85)-  (unrealized (0 1) (4 0) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))-    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))-  (label 255)-  (parent 85)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (5 0))-    ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 256)-  (parent 85)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1))-    ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-1 (pubk c)))))-  (label 257)-  (parent 87)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 1 resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 258)-  (parent 87)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 3 resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 259)-  (parent 87)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((2 1) (5 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 2 resp2 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))-  (label 260)-  (parent 87)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nd-0 nc-0 text) (a b c d name))-  (defstrand init 3 (na nd-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nd-0) (nb nd-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nd-0) (nb nd-0) (nc nd-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nd-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nd-0) (nb nd-0) (nc nd-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nd-0) (nb nd-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 1) (5 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nd-0)-  (operation nonce-test (displaced 6 4 resp3 2) nc-1 (5 0)-    (enc a c d nc-1 (pubk b)))-  (traces-    ((send (enc a c d nd-0 (pubk b)))-      (recv (enc b c d nd-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nd-0 (pubk b)))-      (send (enc a b d nd-0 nd-0 (pubk c))))-    ((recv (enc a b d nd-0 nd-0 (pubk c)))-      (send (enc a b c nd-0 nd-0 nd-0 (pubk d))))-    ((recv (enc a c d nd-0 (pubk b)))-      (send (enc a b d nd-0 nb-0 (pubk c))))-    ((recv (enc a b c nd-0 nd-0 nd-0 (pubk d)))-      (send (enc b c d nd-0 nd-0 nd-0 nd-0 (pubk a))))-    ((recv (enc a b d nd-0 nd-0 (pubk c)))-      (send (enc a b c nd-0 nd-0 nc-0 (pubk d)))))-  (label 261)-  (parent 87)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 nb-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1))-    ((6 1) (5 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (added-strand resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-1 (pubk c)))))-  (label 262)-  (parent 88)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))-  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))-    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-0)-  (operation nonce-test (displaced 6 1 resp1 2) nc-0 (5 0)-    (enc a c d nc-0 (pubk b)))-  (traces-    ((send (enc a c d nc-0 (pubk b)))-      (recv (enc b c d nc-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nc-0 (pubk c))))-    ((recv (enc a b d nc-0 nc-0 (pubk c)))-      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-0 (pubk b)))-      (send (enc a b d nc-0 nb-0 (pubk c))))-    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))-      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))-    ((recv (enc a b d nc-0 nb-0 (pubk c)))-      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))-  (label 263)-  (parent 88)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nd-0 nc-0 text) (a b c d name))-  (defstrand init 3 (na nd-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nd-0) (nb nd-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nd-0) (nb nd-0) (nc nd-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nd-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nd-0) (nb nd-0) (nc nd-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp2 2 (na nd-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))-    ((3 1) (2 0)) ((4 1) (5 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nd-0)-  (operation nonce-test (displaced 6 4 resp3 2) nc-1 (5 0)-    (enc a c d nc-1 (pubk b)))-  (traces-    ((send (enc a c d nd-0 (pubk b)))-      (recv (enc b c d nd-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nd-0 (pubk b)))-      (send (enc a b d nd-0 nd-0 (pubk c))))-    ((recv (enc a b d nd-0 nd-0 (pubk c)))-      (send (enc a b c nd-0 nd-0 nd-0 (pubk d))))-    ((recv (enc a c d nd-0 (pubk b)))-      (send (enc a b d nd-0 nb-0 (pubk c))))-    ((recv (enc a b c nd-0 nd-0 nd-0 (pubk d)))-      (send (enc b c d nd-0 nd-0 nd-0 nd-0 (pubk a))))-    ((recv (enc a b d nd-0 nb-0 (pubk c)))-      (send (enc a b c nd-0 nb-0 nc-0 (pubk d)))))-  (label 264)-  (parent 88)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (3 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (3 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp2 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-2 (pubk d)))))-  (label 265)-  (parent 89)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (3 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (3 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))-  (label 266)-  (parent 89)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (3 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (3 0)) ((5 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)-    (enc a b c nb-0 nb-0 nc-0 (pubk d))-    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))-    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-1 nd-0 (pubk a)))))-  (label 267)-  (parent 89)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 1 resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 268)-  (parent 90)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (5 0))-    ((3 1) (1 0)) ((4 1) (3 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 3 resp1 2) nb-2 (6 0)-    (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))-  (label 269)-  (parent 90)-  (unrealized (0 1))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 nb-3 text)-    (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-3) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))-    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (4 0)) ((7 1) (6 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (added-strand resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-3 (pubk c)))))-  (label 270)-  (parent 91)-  (unrealized (0 1) (4 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (6 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 3 resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))-  (label 271)-  (parent 91)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))-    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (6 0))-    ((6 1) (4 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 5 resp1 2) nb-0 (6 0)-    (enc a c d nb-0 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-2 (pubk c))))-    ((recv (enc a b d nb-0 nb-2 (pubk c)))-      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))-  (label 272)-  (parent 91)-  (unrealized (0 1) (4 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (5 0))-    ((3 1) (1 0)) ((4 1) (3 0)) ((5 1) (3 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 3 resp1 2) nb-2 (6 0)-    (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-2 (pubk d)))))-  (label 273)-  (parent 91)-  (unrealized (0 1) (5 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp2 2) nb-1 (0 1)-    (enc a b c nb-1 nb-0 nc-0 (pubk d))-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))-    (enc a b d nb-1 nb-1 (pubk c)) (enc a b d nb-1 nb-2 (pubk c))-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b d nb-1 nb-2 (pubk c)))-      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))-  (label 274)-  (parent 92)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)-    (enc a b c nb-1 nb-0 nc-0 (pubk d))-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))-    (enc a b d nb-1 nb-1 (pubk c)) (enc a b d nb-1 nb-2 (pubk c))-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b c nb-1 nb-0 nc-0 (pubk d)))-      (send (enc b c d nb-1 nb-0 nc-0 nd-0 (pubk a)))))-  (label 275)-  (parent 92)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))-    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (0 1)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)-    (enc a b c nb-1 nb-0 nc-0 (pubk d))-    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))-    (enc a b d nb-1 nb-1 (pubk c)) (enc a b d nb-1 nb-2 (pubk c))-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 276)-  (parent 92)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 nb-3 text)-    (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-3) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))-    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (2 0)) ((7 1) (6 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp1 2) nb-1 (6 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b d nb-1 nb-2 (pubk c)))-      (send (enc a b c nb-1 nb-2 nc-2 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-3 (pubk c)))))-  (label 277)-  (parent 93)-  (unrealized (0 1) (2 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 7 1 resp1 2) nb-1 (6 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b d nb-1 nb-2 (pubk c)))-      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))-  (label 278)-  (parent 93)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((3 1) (6 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 7 3 resp1 2) nb-1 (6 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b d nb-1 nb-2 (pubk c)))-      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))-  (label 279)-  (parent 93)-  (unrealized (0 1) (2 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((5 1) (6 0)) ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 7 5 resp1 2) nb-1 (6 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b d nb-1 nb-2 (pubk c)))-      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))-  (label 280)-  (parent 93)-  (unrealized (0 1) (2 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 1 resp1 2) nb-2 (6 0)-    (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b d nb-0 nb-1 (pubk c)))-      (send (enc a b c nb-0 nb-1 nc-2 (pubk d)))))-  (label 281)-  (parent 93)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nc-2 text) (a b c d name))-  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nc-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nc-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nb-1) (nc nc-2) (a a) (b b) (c c)-    (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (6 0)) ((5 1) (4 0))-    ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-1)-  (operation nonce-test (displaced 7 4 resp2 2) nb-2 (6 0)-    (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nc-1 (pubk b)))-      (recv (enc b c d nc-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nb-0 (pubk c))))-    ((recv (enc a b d nc-1 nb-0 (pubk c)))-      (send (enc a b c nc-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nc-1 (pubk c))))-    ((recv (enc a b d nc-1 nc-1 (pubk c)))-      (send (enc a b c nc-1 nc-1 nc-1 (pubk d))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nb-1 (pubk c))))-    ((recv (enc a b d nc-1 nb-1 (pubk c)))-      (send (enc a b c nc-1 nb-1 nc-2 (pubk d)))))-  (label 282)-  (parent 93)-  (unrealized (0 1) (2 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 nb-3 text)-    (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-3) (a a) (b b) (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))-    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (2 0)) ((7 1) (6 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (added-strand resp1 2) nb-1 (6 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-3 (pubk c)))))-  (label 283)-  (parent 94)-  (unrealized (0 1) (2 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 7 1 resp1 2) nb-1 (6 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 284)-  (parent 94)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((3 1) (6 0)) ((4 1) (2 0))-    ((5 1) (4 0)) ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 7 3 resp1 2) nb-1 (6 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 285)-  (parent 94)-  (unrealized (0 1) (2 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((5 1) (6 0)) ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-1)-  (operation nonce-test (displaced 7 5 resp1 2) nb-1 (6 0)-    (enc a c d nb-1 (pubk b)))-  (traces-    ((send (enc a c d nb-1 (pubk b)))-      (recv (enc b c d nb-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-0 (pubk c))))-    ((recv (enc a b d nb-1 nb-0 (pubk c)))-      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-1 (pubk c))))-    ((recv (enc a b d nb-1 nb-1 (pubk c)))-      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))-    ((recv (enc a c d nb-1 (pubk b)))-      (send (enc a b d nb-1 nb-2 (pubk c))))-    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))-      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))-  (label 286)-  (parent 94)-  (unrealized (0 1) (2 0) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))-    ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nb-0)-  (operation nonce-test (displaced 7 1 resp1 2) nb-2 (6 0)-    (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nb-0 (pubk b)))-      (recv (enc b c d nb-0 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-0 (pubk c))))-    ((recv (enc a b d nb-0 nb-0 (pubk c)))-      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))-    ((recv (enc a c d nb-0 (pubk b)))-      (send (enc a b d nb-0 nb-1 (pubk c))))-    ((recv (enc a b c nb-0 nb-0 nc-1 (pubk d)))-      (send (enc b c d nb-0 nb-0 nc-1 nd-0 (pubk a)))))-  (label 287)-  (parent 94)-  (unrealized (0 1) (6 0))-  (comment "aborted"))--(defskeleton nsl4cm-  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))-  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nc-1) (a a) (b b) (c c) (d d))-  (defstrand resp2 2 (na nc-1) (nb nc-1) (nc nc-1) (a a) (b b) (c c)-    (d d))-  (defstrand resp1 2 (na nc-1) (nb nb-1) (a a) (b b) (c c) (d d))-  (defstrand resp3 2 (na nc-1) (nb nc-1) (nc nc-1) (nd nd-0) (a a) (b b)-    (c c) (d d))-  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))-    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (6 0)) ((5 1) (4 0))-    ((6 1) (2 0)))-  (non-orig (privk a) (privk b) (privk c) (privk d))-  (uniq-orig nc-1)-  (operation nonce-test (displaced 7 4 resp2 2) nb-2 (6 0)-    (enc a c d nb-2 (pubk b)))-  (traces-    ((send (enc a c d nc-1 (pubk b)))-      (recv (enc b c d nc-1 nb nc nd (pubk a)))-      (send (enc nb nc nd (pubk b))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nb-0 (pubk c))))-    ((recv (enc a b d nc-1 nb-0 (pubk c)))-      (send (enc a b c nc-1 nb-0 nc-0 (pubk d))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nc-1 (pubk c))))-    ((recv (enc a b d nc-1 nc-1 (pubk c)))-      (send (enc a b c nc-1 nc-1 nc-1 (pubk d))))-    ((recv (enc a c d nc-1 (pubk b)))-      (send (enc a b d nc-1 nb-1 (pubk c))))-    ((recv (enc a b c nc-1 nc-1 nc-1 (pubk d)))-      (send (enc b c d nc-1 nc-1 nc-1 nd-0 (pubk a)))))-  (label 288)-  (parent 94)+(comment "CPSA 2.2.3")+(comment "All input read")++(defprotocol nsl4cm basic+  (defrole init+    (vars (a b c d name) (na nb nc nd text))+    (trace (send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b)))))+  (defrole resp1+    (vars (a b c d name) (na nb nc nd text))+    (trace (recv (enc a c d na (pubk b)))+      (send (enc a b d na nb (pubk c))) (recv (enc nb nc nd (pubk b)))+      (send (enc nc nd (pubk c)))))+  (defrole resp2+    (vars (a b c d name) (na nb nc nd text))+    (trace (recv (enc a b d na nb (pubk c)))+      (send (enc a b c na nb nc (pubk d))) (recv (enc nc nd (pubk c)))+      (send (enc nd (pubk d)))))+  (defrole resp3+    (vars (a b c d name) (na nb nc nd text))+    (trace (recv (enc a b c na nb nc (pubk d)))+      (send (enc b c d na nb nc nd (pubk a)))+      (recv (enc nd (pubk d))))))++(defskeleton nsl4cm+  (vars (na nb nc nd text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b)))))+  (label 0)+  (unrealized (0 1))+  (comment "1 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp1 2) na (0 1)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b)))+      (send (enc a b d na nb-0 (pubk c)))))+  (label 1)+  (parent 0)+  (unrealized (0 1))+  (comment "1 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp2 2) na (0 1)+    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d)))))+  (label 2)+  (parent 1)+  (unrealized (0 1) (2 0))+  (comment "3 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))+    ((3 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp1 2) na (2 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b)))+      (send (enc a b d na nb-1 (pubk c)))))+  (label 3)+  (parent 2)+  (seen 4)+  (unrealized (0 1) (2 0))+  (comment "4 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 3 1 resp1 2) na (2 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d)))))+  (label 4)+  (parent 2)+  (unrealized (0 1))+  (comment "1 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 3 1 resp1 2) na (2 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d)))))+  (label 5)+  (parent 2)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 4 1 resp1 2) na (2 0)+    (enc a b d na nb-1 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 6)+  (parent 3)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp2 2) na (2 0)+    (enc a b d na nb-1 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d)))))+  (label 7)+  (parent 3)+  (unrealized (0 1) (2 0) (4 0))+  (comment "5 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp3 2) na (0 1)+    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b d na nb-0 (pubk c))+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))+  (label 8)+  (parent 4)+  (unrealized (0 1) (3 0))+  (comment "4 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 9)+  (parent 5)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 10)+  (parent 5)+  (seen 20)+  (unrealized (0 1) (3 0))+  (comment "4 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 11)+  (parent 6)+  (seen 27)+  (unrealized (0 1) (4 0))+  (comment "6 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 12)+  (parent 6)+  (seen 32)+  (unrealized (0 1) (4 0))+  (comment "6 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp1 2) na (4 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a c d na (pubk b)))+      (send (enc a b d na nb-2 (pubk c)))))+  (label 13)+  (parent 7)+  (seen 15)+  (unrealized (0 1) (2 0) (4 0))+  (comment "5 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 5 1 resp1 2) na (4 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d)))))+  (label 14)+  (parent 7)+  (unrealized (0 1) (4 0))+  (comment "4 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 5 3 resp1 2) na (4 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d)))))+  (label 15)+  (parent 7)+  (seen 39)+  (unrealized (0 1) (2 0))+  (comment "4 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 1 resp1 2) na (4 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 16)+  (parent 7)+  (seen 36)+  (unrealized (0 1) (4 0))+  (comment "5 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 5 3 resp1 2) na (4 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d)))))+  (label 17)+  (parent 7)+  (seen 46)+  (unrealized (0 1) (2 0))+  (comment "5 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nd-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (0 1)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp1 2) na (3 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d na (pubk b)))+      (send (enc a b d na nb-1 (pubk c)))))+  (label 18)+  (parent 8)+  (unrealized (0 1) (3 0))+  (comment "4 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (3 0)) ((2 1) (0 1))+    ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 4 1 resp1 2) na (3 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))+  (label 19)+  (parent 8)+  (seen 21 56)+  (unrealized (0 1) (3 0))+  (comment "3 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (3 0)) ((2 1) (0 1))+    ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 4 1 resp1 2) na (3 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 20)+  (parent 8)+  (seen 25 54)+  (unrealized (0 1) (3 0))+  (comment "4 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 4 2 resp2 2) na (3 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 21)+  (parent 8)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 22)+  (parent 9)+  (seen 64)+  (unrealized (0 1) (4 0))+  (comment "6 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 23)+  (parent 9)+  (seen 24 68)+  (unrealized (0 1) (4 0))+  (comment "6 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (0 1)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (3 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 24)+  (parent 10)+  (seen 54 60)+  (unrealized (0 1) (3 0))+  (comment "5 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 4 2 resp2 2) nb-0 (3 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 25)+  (parent 10)+  (seen 70)+  (unrealized (0 1))+  (comment "3 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 26)+  (parent 11)+  (seen 28 41 76)+  (unrealized (0 1) (4 0))+  (comment "8 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 1 resp1 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 27)+  (parent 11)+  (seen 5 30 41 76)+  (unrealized (0 1) (4 0))+  (comment "7 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 28)+  (parent 11)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-1 (4 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 29)+  (parent 11)+  (seen 9 10)+  (unrealized (0 1))+  (comment "3 in cohort - 0 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) nb-1 (4 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 30)+  (parent 11)+  (unrealized (0 1))+  (comment "3 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 31)+  (parent 12)+  (seen 88)+  (unrealized (0 1) (4 0))+  (comment "6 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 1 resp1 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 32)+  (parent 12)+  (seen 35 88 91)+  (unrealized (0 1) (4 0))+  (comment "5 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 33)+  (parent 12)+  (seen 35 60 93)+  (unrealized (0 1) (4 0))+  (comment "5 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-1 (4 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 34)+  (parent 12)+  (seen 54 59 60)+  (unrealized (0 1) (4 0))+  (comment "4 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) nb-1 (4 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 35)+  (parent 12)+  (unrealized (0 1))+  (comment "3 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) na (4 0)+    (enc a b d na nb-2 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 36)+  (parent 13)+  (seen 47)+  (unrealized (0 1) (4 0))+  (comment "6 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 6 3 resp1 2) na (4 0)+    (enc a b d na nb-2 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c)))))+  (label 37)+  (parent 13)+  (seen 41 100)+  (unrealized (0 1) (2 0))+  (comment "6 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp2 2) na (4 0)+    (enc a b d na nb-2 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-2 (pubk c))))+    ((recv (enc a b d na nb-2 (pubk c)))+      (send (enc a b c na nb-2 nc-2 (pubk d)))))+  (label 38)+  (parent 13)+  (unrealized (0 1) (2 0) (4 0) (6 0))+  (comment "7 in cohort - 7 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (3 0)) ((2 1) (0 1)) ((3 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (contracted (nb-1 nb-0)) na (4 0)+    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-1 (pubk d)))))+  (label 39)+  (parent 14)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 5 3 resp1 2) na (4 0)+    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d)))))+  (label 40)+  (parent 14)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 5 3 resp1 2) na (4 0)+    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d)))))+  (label 41)+  (parent 14)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp2 2) na (4 0)+    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-2 (pubk d)))))+  (label 42)+  (parent 14)+  (unrealized (0 1) (4 0) (5 0))+  (comment "5 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 5 1 resp1 2) na (2 0)+    (enc a b c na nb-1 nc-1 (pubk d)) (enc a b d na nb-1 (pubk c))+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d)))))+  (label 43)+  (parent 15)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 1 resp1 2) na (2 0)+    (enc a b c na nb-1 nc-1 (pubk d)) (enc a b d na nb-1 (pubk c))+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 44)+  (parent 15)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp3 2) na (2 0)+    (enc a b c na nb-1 nc-1 (pubk d)) (enc a b d na nb-1 (pubk c))+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b c na nb-1 nc-1 (pubk d)))+      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a)))))+  (label 45)+  (parent 15)+  (unrealized (0 1) (2 0) (5 0))+  (comment "6 in cohort - 6 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (3 0)) ((2 1) (0 1)) ((3 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (contracted (nb-1 nb-0)) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 46)+  (parent 16)+  (unrealized (0 1))+  (comment "3 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 47)+  (parent 16)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-1 (4 0)+    (enc a b d nb-1 nb-1 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 48)+  (parent 16)+  (seen 136 137 138)+  (unrealized (0 1))+  (comment "3 in cohort - 0 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 49)+  (parent 16)+  (seen 124)+  (unrealized (0 1) (4 0) (5 0))+  (comment "5 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp1 2) nb-1 (2 0)+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c)))))+  (label 50)+  (parent 17)+  (seen 51)+  (unrealized (0 1) (2 0))+  (comment "6 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 5 1 resp1 2) nb-1 (2 0)+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d)))))+  (label 51)+  (parent 17)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 1 resp1 2) nb-1 (2 0)+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 52)+  (parent 17)+  (seen 136 137 138)+  (unrealized (0 1))+  (comment "3 in cohort - 0 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp3 2) nb-1 (2 0)+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 53)+  (parent 17)+  (seen 134)+  (unrealized (0 1) (2 0) (5 0))+  (comment "6 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((1 1) (3 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 1 resp1 2) na (3 0)+    (enc a b d na nb-1 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 54)+  (parent 18)+  (seen 60 72)+  (unrealized (0 1) (3 0))+  (comment "5 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp2 2) na (3 0)+    (enc a b d na nb-1 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d)))))+  (label 55)+  (parent 18)+  (unrealized (0 1) (3 0) (5 0))+  (comment "6 in cohort - 6 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 5 2 resp2 2) na (3 0)+    (enc a b d na nb-1 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))+  (label 56)+  (parent 18)+  (unrealized (0 1))+  (comment "1 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))+    ((3 1) (0 1)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) na (3 0)+    (enc a b d na nb-1 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c)))))+  (label 57)+  (parent 18)+  (seen 61 62)+  (unrealized (0 1))+  (comment "3 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((1 1) (3 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp2 2) na (3 0)+    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-1 (pubk d)))))+  (label 58)+  (parent 19)+  (unrealized (0 1) (3 0) (4 0))+  (comment "4 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((1 1) (3 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (3 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 59)+  (parent 20)+  (seen 167)+  (unrealized (0 1) (3 0) (4 0))+  (comment "4 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 4 2 resp2 2) nb-0 (3 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 60)+  (parent 20)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd text) (a b c d name))+  (defstrand init 3 (na nc) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc) (nb nb) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc) (nb nb) (nc nc) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc)+  (operation nonce-test (contracted (nb-0 nb) (nc-0 nc) (nd-0 nd)) nc+    (0 1) (enc a b c nc nb nc (pubk d)) (enc a b d nc nb (pubk c))+    (enc a c d nc (pubk b)) (enc b c d nc nb nc nd (pubk a)))+  (traces+    ((send (enc a c d nc (pubk b)))+      (recv (enc b c d nc nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nb (pubk c))))+    ((recv (enc a b d nc nb (pubk c)))+      (send (enc a b c nc nb nc (pubk d))))+    ((recv (enc a b c nc nb nc (pubk d)))+      (send (enc b c d nc nb nc nd (pubk a)))))+  (label 61)+  (parent 21)+  (seen 163)+  (unrealized)+  (comment "1 in cohort - 0 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))+    ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nb-0 nc-0 (pubk d)) (enc a b d nc-0 nb-0 (pubk c))+    (enc a c d nc-0 (pubk b)) (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 62)+  (parent 21)+  (unrealized (0 1) (4 0))+  (comment "5 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 63)+  (parent 22)+  (seen 17 65 178)+  (unrealized (0 1) (4 0))+  (comment "8 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 1 resp1 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 64)+  (parent 22)+  (seen 5 17 29 67 178)+  (unrealized (0 1) (4 0))+  (comment "7 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 65)+  (parent 22)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-1 (4 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 66)+  (parent 22)+  (seen 187)+  (unrealized (0 1))+  (comment "3 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) nb-1 (4 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 67)+  (parent 22)+  (seen 181)+  (unrealized (0 1) (4 0))+  (comment "6 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 1 resp1 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 68)+  (parent 23)+  (seen 54 70 172)+  (unrealized (0 1) (4 0))+  (comment "5 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-1 (4 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 69)+  (parent 23)+  (seen 60)+  (unrealized (0 1) (4 0))+  (comment "4 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) nb-1 (4 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 70)+  (parent 23)+  (unrealized (0 1))+  (comment "3 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (3 0)+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 71)+  (parent 24)+  (seen 160)+  (unrealized (0 1) (3 0) (5 0))+  (comment "6 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 nb-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))+    ((3 1) (0 1)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) nb-1 (3 0)+    (enc a b d nb-1 nb-0 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c)))))+  (label 72)+  (parent 24)+  (unrealized (0 1))+  (comment "3 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nc nd text) (a b c d name))+  (defstrand init 3 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc) (nb nc) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc) (nb nc) (nc nc) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc)+  (operation nonce-test (contracted (nb nc) (nc-0 nc) (nd-0 nd)) nc+    (0 1) (enc a b c nc nc nc (pubk d)) (enc a b d nc nc (pubk c))+    (enc a c d nc (pubk b)) (enc b c d nc nc nc nd (pubk a)))+  (traces+    ((send (enc a c d nc (pubk b)))+      (recv (enc b c d nc nc nc nd (pubk a)))+      (send (enc nc nc nd (pubk b))))+    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nc (pubk c))))+    ((recv (enc a b d nc nc (pubk c)))+      (send (enc a b c nc nc nc (pubk d))))+    ((recv (enc a b c nc nc nc (pubk d)))+      (send (enc b c d nc nc nc nd (pubk a)))))+  (label 73)+  (parent 25)+  (seen 171)+  (unrealized)+  (comment "1 in cohort - 0 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))+    ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a c d nc-0 (pubk b)) (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 74)+  (parent 25)+  (seen 175)+  (unrealized (0 1) (4 0))+  (comment "5 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (contracted (nb-2 nb-1)) nb-0 (4 0)+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 75)+  (parent 26)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (4 0)+    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 76)+  (parent 26)+  (seen 6 41 79 80)+  (unrealized (0 1) (4 0))+  (comment "9 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-2 (4 0)+    (enc a b d nb-2 nb-1 (pubk c)) (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 77)+  (parent 26)+  (seen 11 12)+  (unrealized (0 1))+  (comment "3 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))+  (label 78)+  (parent 26)+  (seen 218)+  (unrealized (0 1) (4 0) (6 0))+  (comment "8 in cohort - 7 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nb-2 (4 0)+    (enc a b d nb-2 nb-1 (pubk c)) (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c)))))+  (label 79)+  (parent 26)+  (seen 85 86 87)+  (unrealized (0 1))+  (comment "4 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 80)+  (parent 27)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-1 (4 0)+    (enc a b d nb-1 nb-1 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 81)+  (parent 27)+  (seen 9 10)+  (unrealized (0 1))+  (comment "3 in cohort - 0 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 82)+  (parent 27)+  (seen 228)+  (unrealized (0 1) (4 0) (5 0))+  (comment "6 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))+    ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 83)+  (parent 28)+  (seen 233)+  (unrealized (0 1) (5 0))+  (comment "7 in cohort - 6 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))+    ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))+  (label 84)+  (parent 28)+  (seen 239)+  (unrealized (0 1) (5 0))+  (comment "7 in cohort - 6 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d))+    (enc a b c nc-0 nb-0 nc-1 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))+  (label 85)+  (parent 30)+  (seen 245)+  (unrealized (0 1) (5 0))+  (comment "7 in cohort - 6 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp3 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d))+    (enc a b c nc-0 nb-0 nc-1 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 86)+  (parent 30)+  (seen 251)+  (unrealized (0 1) (5 0))+  (comment "7 in cohort - 6 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp3 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d))+    (enc a b c nc-0 nb-0 nc-1 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a)))))+  (label 87)+  (parent 30)+  (seen 257)+  (unrealized (0 1) (5 0))+  (comment "7 in cohort - 6 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (4 0)+    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 88)+  (parent 31)+  (seen 91 92)+  (unrealized (0 1) (4 0))+  (comment "5 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-2 (4 0)+    (enc a b d nb-2 nb-1 (pubk c)) (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 89)+  (parent 31)+  (seen 60 154 155 156)+  (unrealized (0 1) (4 0))+  (comment "5 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-1 (pubk d)))))+  (label 90)+  (parent 31)+  (seen 266)+  (unrealized (0 1) (4 0) (6 0))+  (comment "8 in cohort - 7 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 2 resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 91)+  (parent 31)+  (unrealized (0 1))+  (comment "2 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nb-2 (4 0)+    (enc a b d nb-2 nb-1 (pubk c)) (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c)))))+  (label 92)+  (parent 31)+  (seen 97 98 99)+  (unrealized (0 1))+  (comment "4 in cohort - 1 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 93)+  (parent 32)+  (seen 35 60 91)+  (unrealized (0 1) (4 0))+  (comment "5 in cohort - 2 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 94)+  (parent 32)+  (seen 278)+  (unrealized (0 1) (4 0) (5 0))+  (comment "6 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 95)+  (parent 33)+  (seen 283)+  (unrealized (0 1) (4 0) (5 0))+  (comment "6 in cohort - 5 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 96)+  (parent 34)+  (seen 70 73 74)+  (unrealized (0 1))+  (comment "3 in cohort - 0 not yet seen"))++(defskeleton nsl4cm+  (vars (nc nb nd text) (a b c d name))+  (defstrand init 3 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc) (nb nc) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc) (nb nc) (nc nc) (a a) (b b) (c c) (d d))+  (defstrand resp1 2 (na nc) (nb nb) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc)+  (operation nonce-test (contracted (nb-0 nc) (nc-0 nc) (nd-0 nd)) nc+    (0 1) (enc a b c nc nc nc (pubk d)) (enc a b d nc nc (pubk c))+    (enc a b d nc nb (pubk c)) (enc a c d nc (pubk b))+    (enc b c d nc nc nc nd (pubk a)))+  (traces+    ((send (enc a c d nc (pubk b)))+      (recv (enc b c d nc nc nc nd (pubk a)))+      (send (enc nc nc nd (pubk b))))+    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nc (pubk c))))+    ((recv (enc a b d nc nc (pubk c)))+      (send (enc a b c nc nc nc (pubk d))))+    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nb (pubk c))))+    ((recv (enc a b c nc nc nc (pubk d)))+      (send (enc b c d nc nc nc nd (pubk a)))))+  (label 97)+  (parent 35)+  (seen 73)+  (unrealized)+  (comment "1 in cohort - 0 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))+    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 98)+  (parent 35)+  (seen 288)+  (unrealized (0 1) (5 0))+  (comment "7 in cohort - 6 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))+    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 99)+  (parent 35)+  (seen 236 254 290 294)+  (unrealized (0 1) (5 0))+  (comment "7 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (contracted (nb-2 nb-0)) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 100)+  (parent 36)+  (unrealized (0 1))+  (comment "3 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-2 (4 0)+    (enc a b d nb-2 nb-2 (pubk c)) (enc a b d nb-2 nb-1 (pubk c))+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 101)+  (parent 36)+  (seen 296 297 298)+  (unrealized (0 1))+  (comment "3 in cohort - 0 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 102)+  (parent 36)+  (seen 141 142 299)+  (unrealized (0 1) (4 0) (6 0))+  (comment "7 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))+  (label 103)+  (parent 36)+  (seen 112 301)+  (unrealized (0 1) (4 0) (6 0))+  (comment "7 in cohort - 4 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 6 1 resp1 2) nb-1 (2 0)+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))+    (enc a b d nb-1 nb-2 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c)))))+  (label 104)+  (parent 37)+  (unrealized (0 1))+  (comment "3 in cohort - 3 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) nb-2 (2 0)+    (enc a b c nb-2 nb-2 nc-1 (pubk d)) (enc a b d nb-2 nb-2 (pubk c))+    (enc a b d nb-2 nb-1 (pubk c)) (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 105)+  (parent 37)+  (seen 296 297 298)+  (unrealized (0 1))+  (comment "3 in cohort - 0 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp2 2) nb-1 (2 0)+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))+    (enc a b d nb-1 nb-2 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b d nb-1 nb-2 (pubk c)))+      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))+  (label 106)+  (parent 37)+  (seen 311)+  (unrealized (0 1) (2 0) (6 0))+  (comment "8 in cohort - 7 not yet seen"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp3 2) nb-1 (2 0)+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))+    (enc a b d nb-1 nb-2 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 107)+  (parent 37)+  (seen 318)+  (unrealized (0 1) (2 0) (6 0))+  (comment "8 in cohort - 7 not yet seen"))++(comment "Strand bound exceeded--aborting run")++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 nb-3 text)+    (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-3) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))+    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (4 0)) ((7 1) (6 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp1 2) na (6 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-2 (pubk c))))+    ((recv (enc a b d na nb-2 (pubk c)))+      (send (enc a b c na nb-2 nc-2 (pubk d))))+    ((recv (enc a c d na (pubk b)))+      (send (enc a b d na nb-3 (pubk c)))))+  (label 108)+  (parent 38)+  (unrealized (0 1) (2 0) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 7 1 resp1 2) na (6 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-2 (pubk c))))+    ((recv (enc a b d na nb-2 (pubk c)))+      (send (enc a b c na nb-2 nc-2 (pubk d)))))+  (label 109)+  (parent 38)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (6 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 7 3 resp1 2) na (6 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-2 (pubk c))))+    ((recv (enc a b d na nb-2 (pubk c)))+      (send (enc a b c na nb-2 nc-2 (pubk d)))))+  (label 110)+  (parent 38)+  (unrealized (0 1) (2 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (6 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 7 5 resp1 2) na (6 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-2 (pubk c))))+    ((recv (enc a b d na nb-2 (pubk c)))+      (send (enc a b c na nb-2 nc-2 (pubk d)))))+  (label 111)+  (parent 38)+  (unrealized (0 1) (2 0) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 1 resp1 2) na (6 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))+  (label 112)+  (parent 38)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (6 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 3 resp1 2) na (6 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b d nb-1 nb-2 (pubk c)))+      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))+  (label 113)+  (parent 38)+  (unrealized (0 1) (2 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-2) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-2) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-2) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-2) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-2) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-2) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-2) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (6 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-2)+  (operation nonce-test (displaced 7 5 resp1 2) na (6 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-2 (pubk b)))+      (recv (enc b c d nb-2 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-2 (pubk b)))+      (send (enc a b d nb-2 nb-0 (pubk c))))+    ((recv (enc a b d nb-2 nb-0 (pubk c)))+      (send (enc a b c nb-2 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-2 (pubk b)))+      (send (enc a b d nb-2 nb-1 (pubk c))))+    ((recv (enc a b d nb-2 nb-1 (pubk c)))+      (send (enc a b c nb-2 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-2 (pubk b)))+      (send (enc a b d nb-2 nb-2 (pubk c))))+    ((recv (enc a b d nb-2 nb-2 (pubk c)))+      (send (enc a b c nb-2 nb-2 nc-2 (pubk d)))))+  (label 114)+  (parent 38)+  (unrealized (0 1) (2 0) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp3 2) na (0 1)+    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-0 nc-1 (pubk d))+    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-1 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))+  (label 115)+  (parent 39)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp3 2) na (0 1)+    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-0 nc-1 (pubk d))+    (enc a b d na nb-0 (pubk c)) (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-1 (pubk d))))+    ((recv (enc a b c na nb-0 nc-1 (pubk d)))+      (send (enc b c d na nb-0 nc-1 nd-0 (pubk a)))))+  (label 116)+  (parent 39)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp3 2) na (0 1)+    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-1 nc-1 (pubk d))+    (enc a b d na nb-0 (pubk c)) (enc a b d na nb-1 (pubk c))+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))+  (label 117)+  (parent 40)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp3 2) na (0 1)+    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-1 nc-1 (pubk d))+    (enc a b d na nb-0 (pubk c)) (enc a b d na nb-1 (pubk c))+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b c na nb-1 nc-1 (pubk d)))+      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a)))))+  (label 118)+  (parent 40)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)+    (enc a b c nb-1 nb-0 nc-0 (pubk d))+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))+    (enc a b d nb-1 nb-1 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-1 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-1 nb-0 nc-0 nd-0 (pubk a)))))+  (label 119)+  (parent 41)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)+    (enc a b c nb-1 nb-0 nc-0 (pubk d))+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))+    (enc a b d nb-1 nb-1 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 120)+  (parent 41)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 nb-2 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-2 (pubk d))))+    ((recv (enc a c d na (pubk b)))+      (send (enc a b d na nb-2 (pubk c)))))+  (label 121)+  (parent 42)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-2 (pubk d)))))+  (label 122)+  (parent 42)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (5 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 6 3 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-2 (pubk d)))))+  (label 123)+  (parent 42)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 124)+  (parent 42)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (5 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 6 3 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-2 (pubk d)))))+  (label 125)+  (parent 42)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp3 2) na (0 1)+    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-1 nc-1 (pubk d))+    (enc a b d na nb-0 (pubk c)) (enc a b d na nb-1 (pubk c))+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a)))))+  (label 126)+  (parent 43)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp3 2) na (0 1)+    (enc a b c na nb-0 nc-0 (pubk d)) (enc a b c na nb-1 nc-1 (pubk d))+    (enc a b d na nb-0 (pubk c)) (enc a b d na nb-1 (pubk c))+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b c na nb-1 nc-1 (pubk d)))+      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a)))))+  (label 127)+  (parent 43)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 128)+  (parent 44)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))+  (label 129)+  (parent 44)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 nb-2 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0))+    ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b c na nb-1 nc-1 (pubk d)))+      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a))))+    ((recv (enc a c d na (pubk b)))+      (send (enc a b d na nb-2 (pubk c)))))+  (label 130)+  (parent 45)+  (unrealized (0 1) (2 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b c na nb-1 nc-1 (pubk d)))+      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a)))))+  (label 131)+  (parent 45)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))+    ((3 1) (4 0)) ((3 1) (5 0)) ((4 1) (2 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 6 3 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a b c na nb-1 nc-1 (pubk d)))+      (send (enc b c d na nb-1 nc-1 nd-0 (pubk a)))))+  (label 132)+  (parent 45)+  (unrealized (0 1) (2 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))+  (label 133)+  (parent 45)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))+    ((3 1) (4 0)) ((3 1) (5 0)) ((4 1) (2 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 6 3 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 134)+  (parent 45)+  (unrealized (0 1) (2 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (5 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-1)+  (operation nonce-test (displaced 6 4 resp2 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nc-1 (pubk b)))+      (recv (enc b c d nc-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nb-0 (pubk c))))+    ((recv (enc a b d nc-1 nb-0 (pubk c)))+      (send (enc a b c nc-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nb-1 (pubk c))))+    ((recv (enc a b d nc-1 nb-1 (pubk c)))+      (send (enc a b c nc-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nc-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nc-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 135)+  (parent 45)+  (unrealized (0 1) (2 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 136)+  (parent 46)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 137)+  (parent 46)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (3 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-1 nd-0 (pubk a)))))+  (label 138)+  (parent 46)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 139)+  (parent 47)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))+  (label 140)+  (parent 47)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 141)+  (parent 49)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (5 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 142)+  (parent 49)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (5 0)) ((4 1) (2 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 143)+  (parent 49)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (3 0))+    ((3 1) (1 0)) ((4 1) (1 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (contracted (nb-2 nb-0)) nb-0 (2 0)+    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 144)+  (parent 50)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) nb-2 (2 0)+    (enc a b c nb-2 nb-2 nc-1 (pubk d)) (enc a b d nb-2 nb-2 (pubk c))+    (enc a b d nb-2 nb-1 (pubk c)) (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 145)+  (parent 50)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))+    ((5 1) (2 0)) ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp2 2) nb-1 (2 0)+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))+    (enc a b d nb-1 nb-2 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b d nb-1 nb-2 (pubk c)))+      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))+  (label 146)+  (parent 50)+  (unrealized (0 1) (2 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))+    ((5 1) (2 0)) ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp3 2) nb-1 (2 0)+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-1 (pubk c))+    (enc a b d nb-1 nb-2 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 147)+  (parent 50)+  (unrealized (0 1) (2 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)+    (enc a b c nb-1 nb-0 nc-0 (pubk d))+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))+    (enc a b d nb-1 nb-1 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-1 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-1 nb-0 nc-0 nd-0 (pubk a)))))+  (label 148)+  (parent 51)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)+    (enc a b c nb-1 nb-0 nc-0 (pubk d))+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))+    (enc a b d nb-1 nb-1 (pubk c)) (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 149)+  (parent 51)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0))+    ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp1 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c)))))+  (label 150)+  (parent 53)+  (unrealized (0 1) (2 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 6 1 resp1 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 151)+  (parent 53)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (5 0)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-1 nd-0 (pubk a)))))+  (label 152)+  (parent 53)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nc-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nc-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-1) (nb nc-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (0 1))+    ((3 1) (4 0)) ((4 1) (5 0)) ((5 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-1)+  (operation nonce-test (displaced 6 4 resp2 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-1 (pubk b)))+      (recv (enc b c d nc-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nb-0 (pubk c))))+    ((recv (enc a b d nc-1 nb-0 (pubk c)))+      (send (enc a b c nc-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nc-1 (pubk c))))+    ((recv (enc a b d nc-1 nc-1 (pubk c)))+      (send (enc a b c nc-1 nc-1 nc-1 (pubk d))))+    ((recv (enc a b c nc-1 nc-1 nc-1 (pubk d)))+      (send (enc b c d nc-1 nc-1 nc-1 nd-0 (pubk a)))))+  (label 153)+  (parent 53)+  (unrealized (0 1) (2 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (3 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0))+    ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (3 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 154)+  (parent 54)+  (unrealized (0 1) (3 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))+    ((3 1) (0 1)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 2 resp2 2) nb-0 (3 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 155)+  (parent 54)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (3 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0))+    ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (3 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 156)+  (parent 54)+  (unrealized (0 1) (3 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0))+    ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d))))+    ((recv (enc a c d na (pubk b)))+      (send (enc a b d na nb-2 (pubk c)))))+  (label 157)+  (parent 55)+  (unrealized (0 1) (3 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d)))))+  (label 158)+  (parent 55)+  (unrealized (0 1) (3 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (0 1)) ((4 1) (5 0)) ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 6 4 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-1 (pubk c))))+    ((recv (enc a b d na nb-1 (pubk c)))+      (send (enc a b c na nb-1 nc-1 (pubk d)))))+  (label 159)+  (parent 55)+  (unrealized (0 1) (3 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 160)+  (parent 55)+  (unrealized (0 1) (3 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (0 1)) ((4 1) (5 0)) ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 6 4 resp1 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-1 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-1 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d)))))+  (label 161)+  (parent 55)+  (unrealized (0 1) (3 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (5 0))+    ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) na (5 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c))))+    ((recv (enc a b d nc-0 nb-1 (pubk c)))+      (send (enc a b c nc-0 nb-1 nc-1 (pubk d)))))+  (label 162)+  (parent 55)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb) (nc nc) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (contracted (nb-0 nb) (nc-0 nc) (nd-0 nd)) na+    (0 1) (enc a b c na nb nc (pubk d)) (enc a b d na nb (pubk c))+    (enc a c d na (pubk b)) (enc b c d na nb nc nd (pubk a)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb (pubk c))))+    ((recv (enc a b d na nb (pubk c)))+      (send (enc a b c na nb nc (pubk d))))+    ((recv (enc a b c na nb nc (pubk d)))+      (send (enc b c d na nb nc nd (pubk a)))))+  (label 163)+  (parent 56)+  (unrealized)+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (3 0)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nb-0 nc-0 (pubk d)) (enc a b d nc-0 nb-0 (pubk c))+    (enc a b d nc-0 nb-1 (pubk c)) (enc a c d nc-0 (pubk b))+    (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c))))+    ((recv (enc a b d nc-0 nb-1 (pubk c)))+      (send (enc a b c nc-0 nb-1 nc-1 (pubk d)))))+  (label 164)+  (parent 57)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nd-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (5 0)) ((1 1) (2 0)) ((1 1) (3 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (added-strand resp1 2) na (4 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-1 (pubk d))))+    ((recv (enc a c d na (pubk b)))+      (send (enc a b d na nb-1 (pubk c)))))+  (label 165)+  (parent 58)+  (unrealized (0 1) (3 0) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (na nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na na) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na na) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na na) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na na) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (0 1)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig na)+  (operation nonce-test (displaced 5 1 resp1 2) na (4 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d na (pubk b)))+      (recv (enc b c d na nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d na (pubk b))) (send (enc a b d na nb-0 (pubk c))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-0 (pubk d))))+    ((recv (enc a b c na nb-0 nc-0 (pubk d)))+      (send (enc b c d na nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d na nb-0 (pubk c)))+      (send (enc a b c na nb-0 nc-1 (pubk d)))))+  (label 166)+  (parent 58)+  (unrealized (0 1) (3 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1))+    ((3 1) (0 1)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 1 resp1 2) na (4 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 167)+  (parent 58)+  (unrealized (0 1) (3 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (4 0)) ((3 1) (0 1))+    ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) na (4 0)+    (enc a c d na (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 168)+  (parent 58)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (5 0)) ((1 1) (2 0)) ((1 1) (3 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 169)+  (parent 59)+  (unrealized (0 1) (3 0) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (4 0)) ((3 1) (0 1))+    ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) nb-0 (4 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 170)+  (parent 59)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd text) (a b c d name))+  (defstrand init 3 (na nb) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb) (nb nb) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb) (nb nb) (nc nc) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb)+  (operation nonce-test (contracted (nb-0 nb) (nc-0 nc) (nd-0 nd)) nb+    (0 1) (enc a b c nb nb nc (pubk d)) (enc a b d nb nb (pubk c))+    (enc a c d nb (pubk b)) (enc b c d nb nb nc nd (pubk a)))+  (traces+    ((send (enc a c d nb (pubk b)))+      (recv (enc b c d nb nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb (pubk b))) (send (enc a b d nb nb (pubk c))))+    ((recv (enc a b d nb nb (pubk c)))+      (send (enc a b c nb nb nc (pubk d))))+    ((recv (enc a b c nb nb nc (pubk d)))+      (send (enc b c d nb nb nc nd (pubk a)))))+  (label 171)+  (parent 60)+  (unrealized)+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))+    ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a c d nb-0 (pubk b)) (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 172)+  (parent 60)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (5 0)) ((1 1) (2 0)) ((2 1) (3 0))+    ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp1 2) nc-0 (4 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c)))))+  (label 173)+  (parent 62)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (3 0))+    ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 1 resp1 2) nc-0 (4 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 174)+  (parent 62)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nd-0 nc-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nb-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nb-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (3 0))+    ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 1 resp1 2) nc-1 (4 0)+    (enc a c d nc-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nb-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nb-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nb-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d)))))+  (label 175)+  (parent 62)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((2 1) (4 0))+    ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) nc-0 (4 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 176)+  (parent 62)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nd-0 nc-0 text) (a b c d name))+  (defstrand init 3 (na nd-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nd-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nd-0) (nb nb-0) (nc nd-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nd-0) (nb nb-0) (nc nd-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nd-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (4 0))+    ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nd-0)+  (operation nonce-test (displaced 5 3 resp3 2) nc-1 (4 0)+    (enc a c d nc-1 (pubk b)))+  (traces+    ((send (enc a c d nd-0 (pubk b)))+      (recv (enc b c d nd-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nd-0 (pubk b)))+      (send (enc a b d nd-0 nb-0 (pubk c))))+    ((recv (enc a b d nd-0 nb-0 (pubk c)))+      (send (enc a b c nd-0 nb-0 nd-0 (pubk d))))+    ((recv (enc a b c nd-0 nb-0 nd-0 (pubk d)))+      (send (enc b c d nd-0 nb-0 nd-0 nd-0 (pubk a))))+    ((recv (enc a b d nd-0 nb-0 (pubk c)))+      (send (enc a b c nd-0 nb-0 nc-0 (pubk d)))))+  (label 177)+  (parent 62)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (4 0)+    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 178)+  (parent 63)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-2 (4 0)+    (enc a b d nb-2 nb-1 (pubk c)) (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 179)+  (parent 63)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-2 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))+  (label 180)+  (parent 63)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nb-2 (4 0)+    (enc a b d nb-2 nb-1 (pubk c)) (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c)))))+  (label 181)+  (parent 63)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 182)+  (parent 64)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 183)+  (parent 64)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 184)+  (parent 65)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))+  (label 185)+  (parent 65)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 186)+  (parent 66)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 187)+  (parent 66)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (contracted (nb-0 nc-0)) nc-0 (4 0)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 188)+  (parent 67)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 3 resp1 2) nc-0 (4 0)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 189)+  (parent 67)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nb-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 5 3 resp1 2) nc-1 (4 0)+    (enc a b c nc-1 nc-1 nc-1 (pubk d)) (enc a b d nc-1 nc-1 (pubk c))+    (enc a c d nc-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nb-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d)))))+  (label 190)+  (parent 67)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (4 0)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))+  (label 191)+  (parent 67)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp3 2) nc-0 (4 0)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 192)+  (parent 67)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 193)+  (parent 68)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 194)+  (parent 69)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 195)+  (parent 69)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (4 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 196)+  (parent 69)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nc nb nd text) (a b c d name))+  (defstrand init 3 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc) (nb nc) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc) (nb nc) (nc nc) (a a) (b b) (c c) (d d))+  (defstrand resp1 2 (na nc) (nb nb) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc)+  (operation nonce-test (contracted (nb-0 nc) (nc-0 nc) (nd-0 nd)) nc+    (0 1) (enc a b c nc nc nc (pubk d)) (enc a b d nc nc (pubk c))+    (enc a b d nc nb (pubk c)) (enc a c d nc (pubk b))+    (enc b c d nc nc nc nd (pubk a)))+  (traces+    ((send (enc a c d nc (pubk b)))+      (recv (enc b c d nc nc nc nd (pubk a)))+      (send (enc nc nc nd (pubk b))))+    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nc (pubk c))))+    ((recv (enc a b d nc nc (pubk c)))+      (send (enc a b c nc nc nc (pubk d))))+    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nb (pubk c))))+    ((recv (enc a b c nc nc nc (pubk d)))+      (send (enc b c d nc nc nc nd (pubk a)))))+  (label 197)+  (parent 70)+  (unrealized)+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))+    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 198)+  (parent 70)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))+    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 199)+  (parent 70)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0))+    ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 200)+  (parent 71)+  (unrealized (0 1) (3 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (0 1)) ((4 1) (5 0)) ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 4 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 201)+  (parent 71)+  (unrealized (0 1) (3 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 nb-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (0 1)) ((4 1) (5 0)) ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 4 resp1 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 202)+  (parent 71)+  (unrealized (0 1) (3 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 nb-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (5 0))+    ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 203)+  (parent 71)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nc nd nb text) (a b c d name))+  (defstrand init 3 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc) (nb nc) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc) (nb nc) (nc nc) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc) (nb nc) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc) (nb nb) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((1 1) (2 0)) ((2 1) (3 0))+    ((3 1) (0 1)) ((4 1) (3 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc)+  (operation nonce-test (contracted (nb-0 nc) (nc-0 nc) (nd-0 nd)) nc+    (0 1) (enc a b c nc nc nc (pubk d)) (enc a b d nc nc (pubk c))+    (enc a b d nc nb (pubk c)) (enc a c d nc (pubk b))+    (enc b c d nc nc nc nd (pubk a)))+  (traces+    ((send (enc a c d nc (pubk b)))+      (recv (enc b c d nc nc nc nd (pubk a)))+      (send (enc nc nc nd (pubk b))))+    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nc (pubk c))))+    ((recv (enc a b d nc nc (pubk c)))+      (send (enc a b c nc nc nc (pubk d))))+    ((recv (enc a b c nc nc nc (pubk d)))+      (send (enc b c d nc nc nc nd (pubk a))))+    ((recv (enc a c d nc (pubk b))) (send (enc a b d nc nb (pubk c)))))+  (label 204)+  (parent 72)+  (unrealized)+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 nb-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (3 0)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))+    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 205)+  (parent 72)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 nb-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (3 0)) ((3 1) (0 1)) ((4 1) (3 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a b d nc-0 nb-0 (pubk c)) (enc a c d nc-0 (pubk b))+    (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 206)+  (parent 72)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 nc-1 nb-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (5 0)) ((1 1) (2 0)) ((2 1) (3 0))+    ((3 1) (0 1)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp1 2) nc-0 (4 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c)))))+  (label 207)+  (parent 74)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((2 1) (4 0))+    ((3 1) (0 1)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 5 2 resp2 2) nc-0 (4 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 208)+  (parent 74)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nd-0 nc-0 text) (a b c d name))+  (defstrand init 3 (na nd-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nd-0) (nb nd-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nd-0) (nb nd-0) (nc nd-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nd-0) (nb nd-0) (nc nd-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nd-0) (nb nd-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((1 1) (2 0)) ((2 1) (3 0)) ((3 1) (4 0))+    ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nd-0)+  (operation nonce-test (displaced 5 3 resp3 2) nc-1 (4 0)+    (enc a c d nc-1 (pubk b)))+  (traces+    ((send (enc a c d nd-0 (pubk b)))+      (recv (enc b c d nd-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nd-0 (pubk b)))+      (send (enc a b d nd-0 nd-0 (pubk c))))+    ((recv (enc a b d nd-0 nd-0 (pubk c)))+      (send (enc a b c nd-0 nd-0 nd-0 (pubk d))))+    ((recv (enc a b c nd-0 nd-0 nd-0 (pubk d)))+      (send (enc b c d nd-0 nd-0 nd-0 nd-0 (pubk a))))+    ((recv (enc a b d nd-0 nd-0 (pubk c)))+      (send (enc a b c nd-0 nd-0 nc-0 (pubk d)))))+  (label 209)+  (parent 74)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 210)+  (parent 75)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))+  (label 211)+  (parent 75)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (contracted (nb-2 nb-1)) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 212)+  (parent 76)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0))+    ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-2 (4 0)+    (enc a b d nb-2 nb-2 (pubk c)) (enc a b d nb-2 nb-1 (pubk c))+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c)))))+  (label 213)+  (parent 76)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0))+    ((4 1) (0 1)) ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 214)+  (parent 76)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0))+    ((4 1) (0 1)) ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))+  (label 215)+  (parent 76)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (1 0)) ((2 1) (3 0)) ((3 1) (0 1)) ((4 1) (3 0))+    ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 216)+  (parent 77)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 nb-3 text)+    (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-3) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))+    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (4 0)) ((7 1) (6 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-3 (pubk c)))))+  (label 217)+  (parent 78)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (6 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 1 resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))+  (label 218)+  (parent 78)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (6 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 3 resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))+  (label 219)+  (parent 78)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (6 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 5 resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))+  (label 220)+  (parent 78)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (6 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 3 resp1 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-2 (pubk d)))))+  (label 221)+  (parent 78)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (6 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 5 resp1 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-2 (pubk d)))))+  (label 222)+  (parent 78)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-1) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (6 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 7 2 resp2 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c))))+    ((recv (enc a b d nc-0 nb-1 (pubk c)))+      (send (enc a b c nc-0 nb-1 nc-2 (pubk d)))))+  (label 223)+  (parent 78)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-1) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d))+    (enc a b c nc-0 nb-0 nc-1 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a b d nc-0 nb-0 (pubk c)) (enc a b d nc-0 nb-1 (pubk c))+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c))))+    ((recv (enc a b d nc-0 nb-1 (pubk c)))+      (send (enc a b c nc-0 nb-1 nc-2 (pubk d)))))+  (label 224)+  (parent 79)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0))+    ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 225)+  (parent 80)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0))+    ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-1 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))+  (label 226)+  (parent 80)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 227)+  (parent 82)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 228)+  (parent 82)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 229)+  (parent 82)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 230)+  (parent 82)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (5 0))+    ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))+  (label 231)+  (parent 82)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))+    ((5 1) (0 1)) ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 232)+  (parent 83)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))+    ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 233)+  (parent 83)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (4 0)) ((3 1) (5 0)) ((4 1) (0 1))+    ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 234)+  (parent 83)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (4 0)) ((3 1) (5 0)) ((4 1) (0 1))+    ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 235)+  (parent 83)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (5 0))+    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 236)+  (parent 83)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nc-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nc-1) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-1) (nb nc-1) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (5 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-1)+  (operation nonce-test (displaced 6 4 resp2 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-1 (pubk b)))+      (recv (enc b c d nc-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nc-1 (pubk c))))+    ((recv (enc a b d nc-1 nc-1 (pubk c)))+      (send (enc a b c nc-1 nc-1 nc-0 (pubk d))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nb-0 (pubk c))))+    ((recv (enc a b d nc-1 nb-0 (pubk c)))+      (send (enc a b c nc-1 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-1 nc-1 nc-0 (pubk d)))+      (send (enc b c d nc-1 nc-1 nc-0 nd-0 (pubk a)))))+  (label 237)+  (parent 83)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))+    ((5 1) (0 1)) ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 238)+  (parent 84)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))+    ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))+  (label 239)+  (parent 84)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (4 0)) ((3 1) (5 0)) ((4 1) (0 1))+    ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-1 nc-1 nd-0 (pubk a)))))+  (label 240)+  (parent 84)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (4 0)) ((3 1) (5 0)) ((4 1) (0 1))+    ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-1 nd-0 (pubk a)))))+  (label 241)+  (parent 84)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (5 0))+    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a)))))+  (label 242)+  (parent 84)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nc-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nc-1) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-1) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (5 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-1)+  (operation nonce-test (displaced 6 4 resp2 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-1 (pubk b)))+      (recv (enc b c d nc-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nc-1 (pubk c))))+    ((recv (enc a b d nc-1 nc-1 (pubk c)))+      (send (enc a b c nc-1 nc-1 nc-0 (pubk d))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nb-0 (pubk c))))+    ((recv (enc a b d nc-1 nb-0 (pubk c)))+      (send (enc a b c nc-1 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-1 nb-0 nc-1 (pubk d)))+      (send (enc b c d nc-1 nb-0 nc-1 nd-0 (pubk a)))))+  (label 243)+  (parent 84)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 nb-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1))+    ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-2 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c)))))+  (label 244)+  (parent 85)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 1 resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))+  (label 245)+  (parent 85)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 3 resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))+  (label 246)+  (parent 85)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nb-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nc-2 (5 0)+    (enc a c d nc-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nb-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 247)+  (parent 85)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((2 1) (5 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-2 (pubk d)))))+  (label 248)+  (parent 85)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((4 1) (5 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 4 resp2 2) nc-2 (5 0)+    (enc a c d nc-2 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 249)+  (parent 85)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1))+    ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c)))))+  (label 250)+  (parent 86)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 1 resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 251)+  (parent 86)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 3 resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 252)+  (parent 86)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nb-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nb-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nc-1 (5 0)+    (enc a c d nc-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nb-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nb-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nb-0 nd-0 (pubk a)))))+  (label 253)+  (parent 86)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((2 1) (5 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 254)+  (parent 86)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((4 1) (5 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 4 resp2 2) nc-1 (5 0)+    (enc a c d nc-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))))+  (label 255)+  (parent 86)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 nb-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1))+    ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c)))))+  (label 256)+  (parent 87)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 1 resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a)))))+  (label 257)+  (parent 87)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 3 resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a)))))+  (label 258)+  (parent 87)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nb-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nc-1 (5 0)+    (enc a c d nc-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nb-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 259)+  (parent 87)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((2 1) (5 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-1 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-1 nd-0 (pubk a)))))+  (label 260)+  (parent 87)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp3 2 (na nc-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((4 1) (5 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 4 resp2 2) nc-1 (5 0)+    (enc a c d nc-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b c nc-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 261)+  (parent 87)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0))+    ((4 1) (0 1)) ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 262)+  (parent 88)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0))+    ((4 1) (0 1)) ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-2 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-1 (pubk d)))))+  (label 263)+  (parent 88)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nd-0 nb-0 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (4 0)+    (enc a b d nb-1 nb-1 (pubk c)) (enc a b d nb-1 nb-0 (pubk c))+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c)))))+  (label 264)+  (parent 89)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 nb-3 text)+    (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-3) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))+    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (4 0)) ((7 1) (6 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-3 (pubk c)))))+  (label 265)+  (parent 90)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (6 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 1 resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-1 (pubk d)))))+  (label 266)+  (parent 90)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (6 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 3 resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-1 (pubk d)))))+  (label 267)+  (parent 90)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nb-2 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (6 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 5 resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-1 (pubk d)))))+  (label 268)+  (parent 90)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (6 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 3 resp1 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 269)+  (parent 90)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (6 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 5 resp1 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b c nb-1 nb-1 nc-0 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d)))))+  (label 270)+  (parent 90)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (6 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 7 2 resp2 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c))))+    ((recv (enc a b d nc-0 nb-1 (pubk c)))+      (send (enc a b c nc-0 nb-1 nc-1 (pubk d)))))+  (label 271)+  (parent 90)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nb-0 nd text) (a b c d name))+  (defstrand init 3 (na nb) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb) (nb nb) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb) (nb nb) (nc nc) (a a) (b b) (c c) (d d))+  (defstrand resp1 2 (na nb) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((4 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb)+  (operation nonce-test (contracted (nb-1 nb) (nc-0 nc) (nd-0 nd)) nb+    (0 1) (enc a b c nb nb nc (pubk d)) (enc a b d nb nb (pubk c))+    (enc a b d nb nb-0 (pubk c)) (enc a c d nb (pubk b))+    (enc b c d nb nb nc nd (pubk a)))+  (traces+    ((send (enc a c d nb (pubk b)))+      (recv (enc b c d nb nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb (pubk b))) (send (enc a b d nb nb (pubk c))))+    ((recv (enc a b d nb nb (pubk c)))+      (send (enc a b c nb nb nc (pubk d))))+    ((recv (enc a c d nb (pubk b))) (send (enc a b d nb nb-0 (pubk c))))+    ((recv (enc a b c nb nb nc (pubk d)))+      (send (enc b c d nb nb nc nd (pubk a)))))+  (label 272)+  (parent 91)+  (unrealized)+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b))+    (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 273)+  (parent 91)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nb-1 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp2 2) nc-0 (0 1)+    (enc a b c nc-0 nc-0 nc-0 (pubk d)) (enc a b d nc-0 nc-0 (pubk c))+    (enc a b d nc-0 nb-0 (pubk c)) (enc a b d nc-0 nb-1 (pubk c))+    (enc a c d nc-0 (pubk b)) (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c))))+    ((recv (enc a b d nc-0 nb-1 (pubk c)))+      (send (enc a b c nc-0 nb-1 nc-1 (pubk d)))))+  (label 274)+  (parent 92)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0))+    ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 275)+  (parent 93)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0))+    ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (4 0)+    (enc a b d nb-0 nb-0 (pubk c)) (enc a b d nb-0 nb-1 (pubk c))+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 276)+  (parent 93)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 277)+  (parent 94)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 278)+  (parent 94)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 279)+  (parent 94)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 280)+  (parent 94)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (5 0))+    ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 281)+  (parent 94)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 nb-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))+    ((5 1) (4 0)) ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c)))))+  (label 282)+  (parent 95)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((3 1) (4 0)) ((4 1) (0 1))+    ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 1 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 283)+  (parent 95)+  (unrealized (0 1) (4 0) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-0 (5 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d)))))+  (label 284)+  (parent 95)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (0 1))+    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d)))))+  (label 285)+  (parent 95)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (5 0))+    ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nb-1 (5 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 286)+  (parent 95)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1))+    ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c)))))+  (label 287)+  (parent 98)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 1 resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 288)+  (parent 98)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 3 resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 289)+  (parent 98)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nd-0 nc-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nb-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nb-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((3 1) (5 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 6 3 resp1 2) nc-1 (5 0)+    (enc a c d nc-1 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nb-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nb-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nb-0 nd-0 (pubk a))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d)))))+  (label 290)+  (parent 98)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((2 1) (5 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 2 resp2 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-1 (pubk d)))))+  (label 291)+  (parent 98)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nd-0 nc-0 text) (a b c d name))+  (defstrand init 3 (na nd-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nd-0) (nb nd-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nd-0) (nb nd-0) (nc nd-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nd-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nd-0) (nb nd-0) (nc nd-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nd-0) (nb nd-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((4 1) (5 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nd-0)+  (operation nonce-test (displaced 6 4 resp3 2) nc-1 (5 0)+    (enc a c d nc-1 (pubk b)))+  (traces+    ((send (enc a c d nd-0 (pubk b)))+      (recv (enc b c d nd-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nd-0 (pubk b)))+      (send (enc a b d nd-0 nd-0 (pubk c))))+    ((recv (enc a b d nd-0 nd-0 (pubk c)))+      (send (enc a b c nd-0 nd-0 nd-0 (pubk d))))+    ((recv (enc a c d nd-0 (pubk b)))+      (send (enc a b d nd-0 nb-0 (pubk c))))+    ((recv (enc a b c nd-0 nd-0 nd-0 (pubk d)))+      (send (enc b c d nd-0 nd-0 nd-0 nd-0 (pubk a))))+    ((recv (enc a b d nd-0 nd-0 (pubk c)))+      (send (enc a b c nd-0 nd-0 nc-0 (pubk d)))))+  (label 292)+  (parent 98)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 nb-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (6 0)) ((1 1) (2 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1))+    ((6 1) (5 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (added-strand resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-1 (pubk c)))))+  (label 293)+  (parent 99)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nd-0 nc-1 text) (a b c d name))+  (defstrand init 3 (na nc-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nc-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nc-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-0) (nb nc-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nc-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((1 1) (5 0))+    ((2 1) (4 0)) ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-0)+  (operation nonce-test (displaced 6 1 resp1 2) nc-0 (5 0)+    (enc a c d nc-0 (pubk b)))+  (traces+    ((send (enc a c d nc-0 (pubk b)))+      (recv (enc b c d nc-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nc-0 (pubk c))))+    ((recv (enc a b d nc-0 nc-0 (pubk c)))+      (send (enc a b c nc-0 nc-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-0 (pubk b)))+      (send (enc a b d nc-0 nb-0 (pubk c))))+    ((recv (enc a b c nc-0 nc-0 nc-0 (pubk d)))+      (send (enc b c d nc-0 nc-0 nc-0 nd-0 (pubk a))))+    ((recv (enc a b d nc-0 nb-0 (pubk c)))+      (send (enc a b c nc-0 nb-0 nc-1 (pubk d)))))+  (label 294)+  (parent 99)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nd-0 nc-0 text) (a b c d name))+  (defstrand init 3 (na nd-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nd-0) (nb nd-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nd-0) (nb nd-0) (nc nd-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nd-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nd-0) (nb nd-0) (nc nd-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp2 2 (na nd-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((1 1) (2 0)) ((2 1) (4 0))+    ((3 1) (2 0)) ((4 1) (5 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nd-0)+  (operation nonce-test (displaced 6 4 resp3 2) nc-1 (5 0)+    (enc a c d nc-1 (pubk b)))+  (traces+    ((send (enc a c d nd-0 (pubk b)))+      (recv (enc b c d nd-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nd-0 (pubk b)))+      (send (enc a b d nd-0 nd-0 (pubk c))))+    ((recv (enc a b d nd-0 nd-0 (pubk c)))+      (send (enc a b c nd-0 nd-0 nd-0 (pubk d))))+    ((recv (enc a c d nd-0 (pubk b)))+      (send (enc a b d nd-0 nb-0 (pubk c))))+    ((recv (enc a b c nd-0 nd-0 nd-0 (pubk d)))+      (send (enc b c d nd-0 nd-0 nd-0 nd-0 (pubk a))))+    ((recv (enc a b d nd-0 nb-0 (pubk c)))+      (send (enc a b c nd-0 nb-0 nc-0 (pubk d)))))+  (label 295)+  (parent 99)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (3 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (3 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp2 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-2 (pubk d)))))+  (label 296)+  (parent 100)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (3 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (3 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-0 nd-0 (pubk a)))))+  (label 297)+  (parent 100)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (3 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (3 0)) ((5 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp3 2) nb-0 (0 1)+    (enc a b c nb-0 nb-0 nc-0 (pubk d))+    (enc a b c nb-0 nb-0 nc-1 (pubk d)) (enc a b d nb-0 nb-0 (pubk c))+    (enc a b d nb-0 nb-1 (pubk c)) (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-1 nd-0 (pubk a)))))+  (label 298)+  (parent 100)+  (unrealized (0 1) (5 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 1 resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 299)+  (parent 102)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (6 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 3 resp1 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-2 (pubk d)))))+  (label 300)+  (parent 102)+  (unrealized (0 1))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (6 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 5 resp1 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-2 (pubk d)))))+  (label 301)+  (parent 102)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 nb-3 text)+    (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-3) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))+    ((1 1) (4 0)) ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (4 0)) ((7 1) (6 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (added-strand resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-3 (pubk c)))))+  (label 302)+  (parent 103)+  (unrealized (0 1) (4 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (6 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 3 resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))+  (label 303)+  (parent 103)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (2 0)) ((4 1) (2 0)) ((5 1) (6 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 5 resp1 2) nb-0 (6 0)+    (enc a c d nb-0 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-2 (pubk c))))+    ((recv (enc a b d nb-0 nb-2 (pubk c)))+      (send (enc a b c nb-0 nb-2 nc-2 (pubk d)))))+  (label 304)+  (parent 103)+  (unrealized (0 1) (4 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nc-0 nb-0 nc-1 nb-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (4 0))+    ((2 1) (0 1)) ((3 1) (6 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (4 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 3 resp1 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-2 (pubk d)))))+  (label 305)+  (parent 103)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp2 2) nb-1 (0 1)+    (enc a b c nb-1 nb-0 nc-0 (pubk d))+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))+    (enc a b d nb-1 nb-1 (pubk c)) (enc a b d nb-1 nb-2 (pubk c))+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b d nb-1 nb-2 (pubk c)))+      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))+  (label 306)+  (parent 104)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-0) (nc nc-0) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)+    (enc a b c nb-1 nb-0 nc-0 (pubk d))+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))+    (enc a b d nb-1 nb-1 (pubk c)) (enc a b d nb-1 nb-2 (pubk c))+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b c nb-1 nb-0 nc-0 (pubk d)))+      (send (enc b c d nb-1 nb-0 nc-0 nd-0 (pubk a)))))+  (label 307)+  (parent 104)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (6 0))+    ((1 1) (2 0)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (0 1)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp3 2) nb-1 (0 1)+    (enc a b c nb-1 nb-0 nc-0 (pubk d))+    (enc a b c nb-1 nb-1 nc-1 (pubk d)) (enc a b d nb-1 nb-0 (pubk c))+    (enc a b d nb-1 nb-1 (pubk c)) (enc a b d nb-1 nb-2 (pubk c))+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 308)+  (parent 104)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 nb-3 text)+    (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-3) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))+    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (2 0)) ((7 1) (6 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp1 2) nb-1 (6 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b d nb-1 nb-2 (pubk c)))+      (send (enc a b c nb-1 nb-2 nc-2 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-3 (pubk c)))))+  (label 309)+  (parent 106)+  (unrealized (0 1) (2 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 1 resp1 2) nb-1 (6 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b d nb-1 nb-2 (pubk c)))+      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))+  (label 310)+  (parent 106)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((3 1) (6 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 3 resp1 2) nb-1 (6 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b d nb-1 nb-2 (pubk c)))+      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))+  (label 311)+  (parent 106)+  (unrealized (0 1) (2 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-2) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((5 1) (6 0)) ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 5 resp1 2) nb-1 (6 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b d nb-1 nb-2 (pubk c)))+      (send (enc a b c nb-1 nb-2 nc-2 (pubk d)))))+  (label 312)+  (parent 106)+  (unrealized (0 1) (2 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-1) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 1 resp1 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b d nb-0 nb-1 (pubk c)))+      (send (enc a b c nb-0 nb-1 nc-2 (pubk d)))))+  (label 313)+  (parent 106)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((5 1) (6 0)) ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 5 resp1 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-2 (pubk d)))))+  (label 314)+  (parent 106)+  (unrealized (0 1) (2 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nc-2 text) (a b c d name))+  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nc-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nc-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nb-1) (nc nc-2) (a a) (b b) (c c)+    (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (6 0)) ((5 1) (4 0))+    ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-1)+  (operation nonce-test (displaced 7 4 resp2 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nc-1 (pubk b)))+      (recv (enc b c d nc-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nb-0 (pubk c))))+    ((recv (enc a b d nc-1 nb-0 (pubk c)))+      (send (enc a b c nc-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nc-1 (pubk c))))+    ((recv (enc a b d nc-1 nc-1 (pubk c)))+      (send (enc a b c nc-1 nc-1 nc-1 (pubk d))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nb-1 (pubk c))))+    ((recv (enc a b d nc-1 nb-1 (pubk c)))+      (send (enc a b c nc-1 nb-1 nc-2 (pubk d)))))+  (label 315)+  (parent 106)+  (unrealized (0 1) (2 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 nb-3 text)+    (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-3) (a a) (b b) (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((0 0) (7 0))+    ((1 1) (0 1)) ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (2 0)) ((7 1) (6 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (added-strand resp1 2) nb-1 (6 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-3 (pubk c)))))+  (label 316)+  (parent 107)+  (unrealized (0 1) (2 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 1 resp1 2) nb-1 (6 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 317)+  (parent 107)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((3 1) (6 0)) ((4 1) (2 0))+    ((5 1) (4 0)) ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 3 resp1 2) nb-1 (6 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 318)+  (parent 107)+  (unrealized (0 1) (2 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nb-1 nc-1 nb-2 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-2) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((5 1) (6 0)) ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 5 resp1 2) nb-1 (6 0)+    (enc a c d nb-1 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-2 (pubk c))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 319)+  (parent 107)+  (unrealized (0 1) (2 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-0) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-0) (nb nb-0) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-0) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-0) (nb nb-0) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (6 0))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-0)+  (operation nonce-test (displaced 7 1 resp1 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-0 (pubk b)))+      (recv (enc b c d nb-0 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-0 (pubk c))))+    ((recv (enc a b d nb-0 nb-0 (pubk c)))+      (send (enc a b c nb-0 nb-0 nc-1 (pubk d))))+    ((recv (enc a c d nb-0 (pubk b)))+      (send (enc a b d nb-0 nb-1 (pubk c))))+    ((recv (enc a b c nb-0 nb-0 nc-1 (pubk d)))+      (send (enc b c d nb-0 nb-0 nc-1 nd-0 (pubk a)))))+  (label 320)+  (parent 107)+  (unrealized (0 1) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nb-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nb-1) (nb nb-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nb-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nb-1) (nb nb-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (2 0)) ((5 1) (4 0))+    ((5 1) (6 0)) ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nb-1)+  (operation nonce-test (displaced 7 5 resp1 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nb-1 (pubk b)))+      (recv (enc b c d nb-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-0 (pubk c))))+    ((recv (enc a b d nb-1 nb-0 (pubk c)))+      (send (enc a b c nb-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b d nb-1 nb-1 (pubk c)))+      (send (enc a b c nb-1 nb-1 nc-1 (pubk d))))+    ((recv (enc a c d nb-1 (pubk b)))+      (send (enc a b d nb-1 nb-1 (pubk c))))+    ((recv (enc a b c nb-1 nb-1 nc-1 (pubk d)))+      (send (enc b c d nb-1 nb-1 nc-1 nd-0 (pubk a)))))+  (label 321)+  (parent 107)+  (unrealized (0 1) (2 0) (6 0))+  (comment "aborted"))++(defskeleton nsl4cm+  (vars (nb nc nd nb-0 nc-0 nc-1 nb-1 nd-0 text) (a b c d name))+  (defstrand init 3 (na nc-1) (nb nb) (nc nc) (nd nd) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nb-0) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nb-0) (nc nc-0) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nc-1) (a a) (b b) (c c) (d d))+  (defstrand resp2 2 (na nc-1) (nb nc-1) (nc nc-1) (a a) (b b) (c c)+    (d d))+  (defstrand resp1 2 (na nc-1) (nb nb-1) (a a) (b b) (c c) (d d))+  (defstrand resp3 2 (na nc-1) (nb nc-1) (nc nc-1) (nd nd-0) (a a) (b b)+    (c c) (d d))+  (precedes ((0 0) (1 0)) ((0 0) (3 0)) ((0 0) (5 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (4 0)) ((4 1) (6 0)) ((5 1) (4 0))+    ((6 1) (2 0)))+  (non-orig (privk a) (privk b) (privk c) (privk d))+  (uniq-orig nc-1)+  (operation nonce-test (displaced 7 4 resp2 2) nb-2 (6 0)+    (enc a c d nb-2 (pubk b)))+  (traces+    ((send (enc a c d nc-1 (pubk b)))+      (recv (enc b c d nc-1 nb nc nd (pubk a)))+      (send (enc nb nc nd (pubk b))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nb-0 (pubk c))))+    ((recv (enc a b d nc-1 nb-0 (pubk c)))+      (send (enc a b c nc-1 nb-0 nc-0 (pubk d))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nc-1 (pubk c))))+    ((recv (enc a b d nc-1 nc-1 (pubk c)))+      (send (enc a b c nc-1 nc-1 nc-1 (pubk d))))+    ((recv (enc a c d nc-1 (pubk b)))+      (send (enc a b d nc-1 nb-1 (pubk c))))+    ((recv (enc a b c nc-1 nc-1 nc-1 (pubk d)))+      (send (enc b c d nc-1 nc-1 nc-1 nd-0 (pubk a)))))+  (label 322)+  (parent 107)   (unrealized (0 1) (2 0))   (comment "aborted"))
tst/nslsk.tst view
@@ -1,6 +1,6 @@ (herald "Needham-Schroeder-Lowe Protocol with symmetric encryption") -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol nslsk basic@@ -76,7 +76,8 @@   (label 3)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (k k) (b b) (n n) (t t)))))  (comment "Nothing left to do") @@ -118,7 +119,8 @@   (label 5)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((b b) (n n) (a a) (k k) (t t)))))  (comment "Nothing left to do") @@ -195,7 +197,8 @@   (label 9)   (parent 7)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (k k) (b b) (n n)))))  (comment "Nothing left to do") @@ -237,6 +240,7 @@   (label 11)   (parent 10)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((b b) (n n) (a a) (k k)))))  (comment "Nothing left to do")
tst/or.tst view
@@ -1,7 +1,7 @@ (herald "Otway-Rees Protocol"   (comment "Standard version using variables of sort mesg")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol or basic@@ -139,7 +139,8 @@   (label 5)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((nb nb) (s s) (a a) (b a) (k k) (m m) (x x) (y y)))))  (defskeleton or   (vars (x y x-0 mesg) (nb m nb-0 text) (s a name) (k skey))@@ -164,6 +165,7 @@   (seen 7)   (unrealized)   (shape)+  (maps ((0) ((nb nb) (s s) (a a) (b a) (k k) (m m) (x x) (y y))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton or@@ -184,7 +186,8 @@   (label 7)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((nb nb) (s s) (a a) (b a) (k k) (m m) (x x) (y y)))))  (defskeleton or   (vars (x y mesg) (nb m na text) (s a b name) (k skey))@@ -206,7 +209,8 @@   (label 8)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((nb nb) (s s) (a a) (b b) (k k) (m m) (x x) (y y)))))  (defskeleton or   (vars (x y x-0 mesg) (nb m na text) (s a name) (k skey))@@ -231,6 +235,7 @@   (seen 7)   (unrealized)   (shape)+  (maps ((0) ((nb nb) (s s) (a a) (b a) (k k) (m m) (x x) (y y))))   (comment "1 in cohort - 0 not yet seen"))  (comment "Nothing left to do")
tst/pca.tst view
@@ -1,7 +1,7 @@ (herald "Privacy Certificate Authority"   (comment "Generation of an Attestation Identity Certificate")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol pca basic@@ -208,6 +208,7 @@   (seen 10)   (unrealized)   (shape)+  (maps ((0) ((ki ki) (kp kp) (t t) (a a))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton pca@@ -256,7 +257,8 @@   (label 10)   (parent 6)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((ki ki) (kp kp) (t t) (a a)))))  (defskeleton pca   (vars (t a a-0 a-1 text) (ki kp ke km ki-0 km-0 ke-0 km-1 ki-1 akey))
+ tst/pkinit.scm view
@@ -0,0 +1,22 @@+(herald "Kerberos PK init")++(defprotocol pkinit basic+  (defrole client+    (vars (c t as name) (n2 n1 text) (tc tk tgt data) (k ak skey))+    (trace (send (cat (enc tc n2 (privk c)) c t n1))+      (recv+        (cat (enc (enc k n2 (privk as)) (pubk c)) c tgt+          (enc ak n1 tk t k))))+    (uniq-orig n1 n2))+  (defrole auth+    (vars (c t as name) (n2 n1 text) (tc tk tgt data) (k ak skey))+    (trace (recv (cat (enc tc n2 (privk c)) c t n1))+      (send+        (cat (enc (enc k n2 (privk as)) (pubk c)) c tgt+          (enc ak n1 tk t k))))+    (uniq-orig k ak)))++(defskeleton pkinit+  (vars (c as name))+  (defstrand client 2 (c c) (as as))+  (non-orig (privk c) (privk as)))
+ tst/pkinit.tst view
@@ -0,0 +1,67 @@+(herald "Kerberos PK init")++(comment "CPSA 2.2.3")+(comment "All input read")++(defprotocol pkinit basic+  (defrole client+    (vars (c t as name) (n2 n1 text) (tc tk tgt data) (k ak skey))+    (trace (send (cat (enc tc n2 (privk c)) c t n1))+      (recv+        (cat (enc (enc k n2 (privk as)) (pubk c)) c tgt+          (enc ak n1 tk t k))))+    (uniq-orig n2 n1))+  (defrole auth+    (vars (c t as name) (n2 n1 text) (tc tk tgt data) (k ak skey))+    (trace (recv (cat (enc tc n2 (privk c)) c t n1))+      (send+        (cat (enc (enc k n2 (privk as)) (pubk c)) c tgt+          (enc ak n1 tk t k))))+    (uniq-orig k ak)))++(defskeleton pkinit+  (vars (n2 n1 text) (tc tk tgt data) (c as t name) (k ak skey))+  (defstrand client 2 (n2 n2) (n1 n1) (tc tc) (tk tk) (tgt tgt) (c c)+    (t t) (as as) (k k) (ak ak))+  (non-orig (privk c) (privk as))+  (uniq-orig n2 n1)+  (traces+    ((send (cat (enc tc n2 (privk c)) c t n1))+      (recv+        (cat (enc (enc k n2 (privk as)) (pubk c)) c tgt+          (enc ak n1 tk t k)))))+  (label 0)+  (unrealized (0 1))+  (comment "1 in cohort - 1 not yet seen"))++(defskeleton pkinit+  (vars (n2 n1 n1-0 text) (tc tk tgt tc-0 tk-0 tgt-0 data)+    (c as t c-0 t-0 name) (k ak ak-0 skey))+  (defstrand client 2 (n2 n2) (n1 n1) (tc tc) (tk tk) (tgt tgt) (c c)+    (t t) (as as) (k k) (ak ak))+  (defstrand auth 2 (n2 n2) (n1 n1-0) (tc tc-0) (tk tk-0) (tgt tgt-0)+    (c c-0) (t t-0) (as as) (k k) (ak ak-0))+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))+  (non-orig (privk c) (privk as))+  (uniq-orig n2 n1 k ak-0)+  (operation encryption-test (added-strand auth 2) (enc k n2 (privk as))+    (0 1))+  (traces+    ((send (cat (enc tc n2 (privk c)) c t n1))+      (recv+        (cat (enc (enc k n2 (privk as)) (pubk c)) c tgt+          (enc ak n1 tk t k))))+    ((recv (cat (enc tc-0 n2 (privk c-0)) c-0 t-0 n1-0))+      (send+        (cat (enc (enc k n2 (privk as)) (pubk c-0)) c-0 tgt-0+          (enc ak-0 n1-0 tk-0 t-0 k)))))+  (label 1)+  (parent 0)+  (unrealized)+  (shape)+  (maps+    ((0)+      ((c c) (as as) (t t) (n2 n2) (n1 n1) (tc tc) (tk tk) (tgt tgt)+        (k k) (ak ak)))))++(comment "Nothing left to do")
tst/pruning1.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol prune basic@@ -104,7 +104,8 @@   (label 4)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n n)))))  (comment "Nothing left to do") @@ -138,6 +139,7 @@       (send (enc n (privk b) (pubk a)))))   (label 5)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1 2) ((n n) (a a) (b b)))))  (comment "Nothing left to do")
tst/sigenc.tst view
@@ -1,7 +1,7 @@ (herald "Signed Encrypted Message Example"   (comment "Shows examples of key usage of asymmetric keys")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol mult-keys-sig-enc basic@@ -68,7 +68,8 @@   (label 2)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n1 n1) (n2 n2)))))  (comment "Nothing left to do") @@ -139,6 +140,7 @@   (seen 6)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (n2 n2) (n1 n1))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton mult-keys-sig-enc@@ -160,7 +162,8 @@   (label 6)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n2 n2) (n1 n1)))))  (comment "Nothing left to do") @@ -208,7 +211,8 @@   (label 8)   (parent 7)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n2 n2) (n1 n1)))))  (comment "Nothing left to do") @@ -323,6 +327,7 @@   (seen 16)   (unrealized)   (shape)+  (maps ((0) ((a a) (b b) (n2 n2) (n1 n1))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton mult-keys-sig-enc@@ -398,7 +403,8 @@   (label 16)   (parent 12)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (n2 n2) (n1 n1)))))  (defskeleton mult-keys-sig-enc   (vars (n2 n1 text) (a b b-0 name))
tst/sorted_epmo_acctnum.tst view
@@ -4,7 +4,7 @@     "This version uses sorts to avoid confusion"     "between a nonce and other data")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read") (comment "Displacement disabled") @@ -386,7 +386,11 @@   (label 8)   (parent 5)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((b b) (m m) (c c) (nm nm) (nc nc) (nb nb) (hash hash)+        (goods goods) (price price)))))  (defskeleton sorted_epmo_acctnum   (vars (price acctnum goods price-0 text) (nm nc nb nm-0 data)@@ -1230,7 +1234,11 @@   (label 27)   (parent 25)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0)+      ((b b) (m m) (c c) (nm nm) (nb nb) (nc nc) (hash hash)+        (acctnum acctnum) (price price)))))  (defskeleton sorted_epmo_acctnum   (vars (acctnum price acctnum-0 goods text) (nm nb nc nb-0 data)
tst/targetterms2.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol targetterms2 basic@@ -141,7 +141,8 @@   (label 6)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (n n)))))  (defskeleton targetterms2   (vars (n text) (a name))
tst/targetterms6.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol targetterms6 basic@@ -166,7 +166,8 @@   (label 6)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (n n)))))  (defskeleton targetterms6   (vars (m mesg) (n text) (a name))@@ -230,6 +231,7 @@       (send (enc n (enc n (enc n (pubk a)) (pubk a)) (pubk a)))))   (label 8)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1 2) ((n n) (a a)))))  (comment "Nothing left to do")
tst/targetterms8.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol targetterms8 basic@@ -49,7 +49,8 @@   (label 2)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (n1 n2) (n2 n2) (k k)))))  (comment "Nothing left to do") @@ -87,6 +88,7 @@   (label 4)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (n1 n1) (k k)))))  (comment "Nothing left to do")
tst/tor.tst view
@@ -1,7 +1,7 @@ (herald "Tor Circuit-Level Handshake Protocol" (algebra diffie-hellman)   (comment "Achieves unilateral authentication")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol tor diffie-hellman@@ -84,7 +84,8 @@   (label 3)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((b b) (x x) (y y)))))  (defskeleton tor   (vars (b b-0 name) (x y expn))@@ -154,7 +155,8 @@       (recv (enc n (exp (exp (gen) x) y)))))   (label 6)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((b b) (x x) (y y) (n n)))))  (comment "Nothing left to do") @@ -183,7 +185,9 @@       (recv (cat (exp (gen) y) (enc "hash" (exp (exp (gen) x) y))))       (send (enc n (exp (exp (gen) x) y)))) ((recv n) (send n)))   (label 7)-  (unrealized (0 1) (1 0)))+  (unrealized (0 1) (1 0))+  (preskeleton)+  (comment "Not a skeleton"))  (defskeleton tor   (vars (n text) (b name) (x y expn))
tst/uncarried_keys.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol uncarried-keys basic@@ -42,9 +42,8 @@     ((recv (enc "start" a A B (pubk B))) (send (enc a A B (pubk A)))))   (label 1)   (parent 0)-  (seen 4)   (unrealized (0 3))-  (comment "5 in cohort - 4 not yet seen"))+  (comment "5 in cohort - 5 not yet seen"))  (defskeleton uncarried-keys   (vars (a text) (A B name) (K akey))@@ -67,6 +66,7 @@   (seen 3)   (unrealized)   (shape)+  (maps ((0) ((a a) (A A) (B B) (K K))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton uncarried-keys@@ -85,13 +85,15 @@   (label 3)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (A A) (B B) (K K)))))  (defskeleton uncarried-keys   (vars (a text) (A B name))   (defstrand init 4 (a a) (A A) (B B) (K (pubk A)))   (defstrand resp 2 (a a) (A A) (B B))-  (precedes ((0 0) (1 0)) ((1 1) (0 1)))+  (defstrand resp 2 (a a) (A A) (B B))+  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (0 3)))   (non-orig (privk A) (privk B))   (uniq-orig a (pubk A))   (operation encryption-test (added-strand resp 2) (enc a A B (pubk A))@@ -99,13 +101,34 @@   (traces     ((send (enc "start" a A B (pubk B))) (recv (enc a A B (pubk A)))       (send (enc a (pubk A) (pubk B))) (recv (enc a A B (pubk A))))+    ((recv (enc "start" a A B (pubk B))) (send (enc a A B (pubk A))))     ((recv (enc "start" a A B (pubk B))) (send (enc a A B (pubk A)))))   (label 4)   (parent 1)+  (seen 5)   (unrealized)-  (shape))+  (comment "1 in cohort - 0 not yet seen"))  (defskeleton uncarried-keys+  (vars (a text) (A B name))+  (defstrand init 4 (a a) (A A) (B B) (K (pubk A)))+  (defstrand resp 2 (a a) (A A) (B B))+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))+  (non-orig (privk A) (privk B))+  (uniq-orig a (pubk A))+  (operation encryption-test (displaced 2 1 resp 2) (enc a A B (pubk A))+    (0 3))+  (traces+    ((send (enc "start" a A B (pubk B))) (recv (enc a A B (pubk A)))+      (send (enc a (pubk A) (pubk B))) (recv (enc a A B (pubk A))))+    ((recv (enc "start" a A B (pubk B))) (send (enc a A B (pubk A)))))+  (label 5)+  (parent 1)+  (unrealized)+  (shape)+  (maps ((0) ((a a) (A A) (B B) (K (pubk A))))))++(defskeleton uncarried-keys   (vars (a text) (A B name) (K akey))   (defstrand init 4 (a a) (A A) (B B) (K K))   (defstrand resp 2 (a a) (A A) (B B))@@ -119,7 +142,7 @@       (send (enc a K (pubk B))) (recv (enc a A B K)))     ((recv (enc "start" a A B (pubk B))) (send (enc a A B (pubk A))))     ((recv K) (send K)))-  (label 5)+  (label 6)   (parent 1)   (unrealized (2 0))   (comment "empty cohort"))
tst/uo.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol uniq-orig basic@@ -12,7 +12,9 @@   (uniq-orig n)   (traces ((send n)) ((send (enc m n)) (recv n)))   (label 0)-  (unrealized (1 1)))+  (unrealized (1 1))+  (preskeleton)+  (comment "Not a skeleton"))  (defskeleton uniq-orig   (vars (n m text))@@ -24,6 +26,7 @@   (label 1)   (parent 0)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((n n) (m m)))))  (comment "Nothing left to do")
tst/weird.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol weird basic@@ -14,7 +14,8 @@   (traces ((send k)) ((send (enc a k))))   (label 0)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((k k) (a a)))))  (comment "Nothing left to do") @@ -45,7 +46,8 @@   (label 2)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((k k) (a a)))))  (defskeleton weird   (vars (a name) (k skey))@@ -72,6 +74,7 @@   (label 4)   (parent 3)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((k k) (a a)))))  (comment "Nothing left to do")
tst/wide-mouth-frog.tst view
@@ -1,7 +1,7 @@ (herald "Wide-Mouth Frog Protocol"   (comment "This protocol has an infinite number of shapes")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol wide-mouth-frog basic@@ -24,7 +24,8 @@   (traces ((send (cat a (enc ta b k (ltk a t))))))   (label 0)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (t t) (k k) (b b) (ta ta)))))  (comment "Nothing left to do") @@ -64,7 +65,8 @@   (label 2)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((b b) (t t) (k k) (a a) (tb tb)))))  (defskeleton wide-mouth-frog   (vars (tb ta text) (b t a name) (k skey))@@ -81,7 +83,8 @@   (label 3)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((b b) (t t) (k k) (a a) (tb tb)))))  (comment "Nothing left to do") @@ -125,7 +128,8 @@   (label 5)   (parent 4)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (t t) (k k) (ta ta) (tb tb)))))  (defskeleton wide-mouth-frog   (vars (ta tb ta-0 text) (a b t name) (k skey))@@ -165,7 +169,8 @@   (label 7)   (parent 6)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (t t) (k k) (ta ta) (tb tb)))))  (defskeleton wide-mouth-frog   (vars (ta tb ta-0 ta-1 text) (a b t name) (k skey))@@ -211,7 +216,8 @@   (label 9)   (parent 8)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (t t) (k k) (ta ta) (tb tb)))))  (defskeleton wide-mouth-frog   (vars (ta tb ta-0 ta-1 ta-2 text) (a b t name) (k skey))@@ -263,7 +269,8 @@   (label 11)   (parent 10)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (t t) (k k) (ta ta) (tb tb)))))  (defskeleton wide-mouth-frog   (vars (ta tb ta-0 ta-1 ta-2 ta-3 text) (a b t name) (k skey))@@ -322,7 +329,8 @@   (label 13)   (parent 12)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (t t) (k k) (ta ta) (tb tb)))))  (defskeleton wide-mouth-frog   (vars (ta tb ta-0 ta-1 ta-2 ta-3 ta-4 text) (a b t name) (k skey))@@ -388,7 +396,8 @@   (label 15)   (parent 14)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (t t) (k k) (ta ta) (tb tb)))))  (defskeleton wide-mouth-frog   (vars (ta tb ta-0 ta-1 ta-2 ta-3 ta-4 ta-5 text) (a b t name)
tst/wonthull.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol wonthull basic@@ -94,7 +94,8 @@   (label 4)   (parent 2)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (x1 x1) (x2 x2) (x3 y3) (x4 y3)))))  (defskeleton wonthull   (vars (x1 y3 text) (a name))@@ -143,6 +144,7 @@     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x3 x1 (pubk a)))))   (label 6)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((a a) (x1 x1) (x3 x3)))))  (comment "Nothing left to do")
tst/wonthull2.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol wonthull2 basic@@ -119,7 +119,8 @@   (label 5)   (parent 2)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (x1 x1) (x2 x2) (x3 y3) (x4 y3)))))  (defskeleton wonthull2   (vars (x2 y3 y3-0 text) (a name))@@ -200,7 +201,8 @@   (label 9)   (parent 6)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (x1 y3) (x2 x2) (x3 y3-0) (x4 y3)))))  (defskeleton wonthull2   (vars (x2 y3 text) (a name))@@ -368,7 +370,8 @@   (label 17)   (parent 12)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((x1 x1) (x3 x3) (a a) (x1-0 x1) (x3-0 x3) (a-0 a)))))  (defskeleton wonthull2   (vars (x3 x1 text) (a name))@@ -386,7 +389,8 @@   (label 18)   (parent 12)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((x1 x3) (x3 x3) (a a) (x1-0 x1) (x3-0 x3) (a-0 a)))))  (defskeleton wonthull2   (vars (x1 x3 x1-0 y3 text) (a a-0 name))@@ -426,9 +430,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))   (label 20)   (parent 13)-  (seen 14 34)+  (seen 34)   (unrealized (1 0))-  (comment "8 in cohort - 5 not yet seen"))+  (comment "6 in cohort - 5 not yet seen"))  (defskeleton wonthull2   (vars (x1 x3 y3 text) (a a-0 name))@@ -474,9 +478,9 @@       (send (enc "okay" y3-0 x1-0 (pubk a)))))   (label 22)   (parent 13)-  (seen 21 24)+  (seen 21 39)   (unrealized (0 1))-  (comment "9 in cohort - 3 not yet seen"))+  (comment "9 in cohort - 5 not yet seen"))  (defskeleton wonthull2   (vars (x1 x3 y3 text) (a name))@@ -496,7 +500,7 @@     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a)))))   (label 23)   (parent 13)-  (seen 24 30 39)+  (seen 24 30 40)   (unrealized (0 1))   (comment "9 in cohort - 0 not yet seen")) @@ -540,9 +544,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))   (label 25)   (parent 15)-  (seen 18 32 43)+  (seen 32 45)   (unrealized (1 0))-  (comment "8 in cohort - 4 not yet seen"))+  (comment "6 in cohort - 4 not yet seen"))  (defskeleton wonthull2   (vars (x1 x3 x1-0 y3 text) (a a-0 name))@@ -584,7 +588,7 @@     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" y3 x1 (pubk a)))))   (label 27)   (parent 15)-  (seen 24 39 40 45)+  (seen 24 40 42 47)   (unrealized (0 1))   (comment "9 in cohort - 0 not yet seen")) @@ -672,7 +676,7 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))   (label 31)   (parent 20)-  (seen 51)+  (seen 53)   (unrealized (1 0))   (comment "5 in cohort - 4 not yet seen")) @@ -693,7 +697,7 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))   (label 32)   (parent 20)-  (seen 49)+  (seen 51)   (unrealized (1 0))   (comment "2 in cohort - 1 not yet seen")) @@ -717,7 +721,7 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))   (label 33)   (parent 20)-  (seen 49 50 54)+  (seen 51 52 56)   (unrealized (1 0))   (comment "5 in cohort - 2 not yet seen")) @@ -738,7 +742,7 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))   (label 34)   (parent 20)-  (seen 51 54)+  (seen 53 56)   (unrealized (1 0))   (comment "3 in cohort - 1 not yet seen")) @@ -779,7 +783,7 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))   (label 36)   (parent 21)-  (seen 52)+  (seen 54)   (unrealized (1 0))   (comment "2 in cohort - 1 not yet seen")) @@ -807,9 +811,9 @@       (send (enc "okay" y3-0 y3-0 (pubk a)))))   (label 37)   (parent 22)-  (seen 24 41 61)+  (seen 43 63)   (unrealized (1 0))-  (comment "11 in cohort - 6 not yet seen"))+  (comment "9 in cohort - 6 not yet seen"))  (defskeleton wonthull2   (vars (x3 y3 y3-0 text) (a a-0 name))@@ -832,11 +836,36 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))   (label 38)   (parent 22)-  (seen 24 31 60 62 66)+  (seen 31 62 64 68)   (unrealized (1 0))-  (comment "11 in cohort - 4 not yet seen"))+  (comment "9 in cohort - 4 not yet seen"))  (defskeleton wonthull2+  (vars (x1 x3 y3 y3-0 text) (a a-0 name))+  (defstrand init 2 (x1 x3) (x2 x3) (x3 x3) (x4 x1) (a a))+  (defstrand resp 2 (y1 x1) (y2 x3) (y3 x3) (a a-0))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3-0) (a a))+  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((0 0) (3 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (0 1)))+  (non-orig (privk a))+  (uniq-orig x3)+  (operation nonce-test (added-strand init 1) x3 (0 1)+    (enc "okay" y3 x3 (pubk a)) (enc "okay" y3-0 x3 (pubk a))+    (enc x3 x3 (pubk a)))+  (traces+    ((send (cat (enc x3 x3 (pubk a)) (enc x3 x3 (pubk a))))+      (recv (enc "okay" x3 x1 (pubk a))))+    ((recv (enc x1 x3 (pubk a-0))) (send (enc "okay" x3 x1 (pubk a-0))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3-0 x3 (pubk a)))))+  (label 39)+  (parent 22)+  (seen 24 35 70)+  (unrealized (1 0))+  (comment "6 in cohort - 1 not yet seen"))++(defskeleton wonthull2   (vars (x1 x3 y3 y3-0 text) (a name))   (defstrand init 2 (x1 x1) (x2 x3) (x3 x1) (x4 x1) (a a))   (defstrand resp 2 (y1 x1) (y2 x3) (y3 x3) (a a))@@ -855,13 +884,38 @@     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x3 x1 (pubk a))))     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a))))     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" y3-0 x1 (pubk a)))))-  (label 39)+  (label 40)   (parent 22)-  (seen 24 58 64)+  (seen 24 41 60 66)   (unrealized (0 1))   (comment "11 in cohort - 0 not yet seen"))  (defskeleton wonthull2+  (vars (x3 y3 y3-0 text) (a name))+  (defstrand init 2 (x1 x3) (x2 x3) (x3 x3) (x4 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3-0) (a a))+  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((0 0) (3 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (0 1)))+  (non-orig (privk a))+  (uniq-orig x3)+  (operation nonce-test (displaced 4 1 resp 2) x1 (0 1)+    (enc "okay" y3 x1 (pubk a-0)) (enc "okay" y3-0 x1 (pubk a-0))+    (enc x1 x3 (pubk a-0)) (enc x1 x1 (pubk a-0)))+  (traces+    ((send (cat (enc x3 x3 (pubk a)) (enc x3 x3 (pubk a))))+      (recv (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3-0 x3 (pubk a)))))+  (label 41)+  (parent 22)+  (seen 24)+  (unrealized)+  (comment "1 in cohort - 0 not yet seen"))++(defskeleton wonthull2   (vars (x3 x1 y3 text) (a name))   (defstrand init 2 (x1 x1) (x2 x3) (x3 y3) (x4 y3) (a a))   (defstrand resp 2 (y1 y3) (y2 x3) (y3 x3) (a a))@@ -876,11 +930,12 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 40)+  (label 42)   (parent 25)   (seen 18)   (unrealized)   (shape)+  (maps ((0 1) ((x1 y3) (x3 x3) (a a) (x1-0 x1) (x3-0 y3) (a-0 a))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton wonthull2@@ -901,9 +956,9 @@     ((recv (enc x1 x3 (pubk a-0))) (send (enc "okay" x3 x1 (pubk a-0))))     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x1 x1 (pubk a))))     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a)))))-  (label 41)+  (label 43)   (parent 25)-  (seen 49 70)+  (seen 51 73)   (unrealized (1 0))   (comment "5 in cohort - 3 not yet seen")) @@ -925,9 +980,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 42)+  (label 44)   (parent 25)-  (seen 49 69 72)+  (seen 51 72 75)   (unrealized (1 0))   (comment "5 in cohort - 2 not yet seen")) @@ -946,9 +1001,9 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 43)+  (label 45)   (parent 25)-  (seen 70 72)+  (seen 73 75)   (unrealized (1 0))   (comment "3 in cohort - 1 not yet seen")) @@ -967,7 +1022,7 @@       (recv (enc "okay" x3 x1 (pubk a))))     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x3 x1 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))-  (label 44)+  (label 46)   (parent 26)   (seen 17)   (unrealized)@@ -988,7 +1043,7 @@       (recv (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))-  (label 45)+  (label 47)   (parent 26)   (seen 18)   (unrealized)@@ -1009,7 +1064,7 @@       (recv (enc "okay" y3 x1 (pubk a))))     ((recv (enc x1 y3 (pubk a-0))) (send (enc "okay" y3 x1 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 46)+  (label 48)   (parent 26)   (unrealized (1 0))   (comment "3 in cohort - 3 not yet seen"))@@ -1029,7 +1084,7 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 y3-0 (pubk a)))       (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 47)+  (label 49)   (parent 30)   (unrealized)   (comment "1 in cohort - 1 not yet seen"))@@ -1053,7 +1108,7 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 48)+  (label 50)   (parent 31)   (seen 30)   (unrealized)@@ -1078,7 +1133,7 @@     ((recv (enc y3 y3 (pubk a-0))) (send (enc "okay" y3 y3 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 49)+  (label 51)   (parent 31)   (unrealized (1 0))   (comment "1 in cohort - 1 not yet seen"))@@ -1104,9 +1159,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 50)+  (label 52)   (parent 31)-  (seen 49 80)+  (seen 51 83)   (unrealized (1 0))   (comment "4 in cohort - 2 not yet seen")) @@ -1129,9 +1184,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 51)+  (label 53)   (parent 31)-  (seen 80)+  (seen 83)   (unrealized (1 0))   (comment "2 in cohort - 1 not yet seen")) @@ -1150,7 +1205,7 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 52)+  (label 54)   (parent 32)   (seen 14)   (unrealized)@@ -1175,7 +1230,7 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 53)+  (label 55)   (parent 33)   (seen 30)   (unrealized)@@ -1200,9 +1255,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 54)+  (label 56)   (parent 33)-  (seen 80)+  (seen 83)   (unrealized (1 0))   (comment "2 in cohort - 1 not yet seen")) @@ -1222,7 +1277,7 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 55)+  (label 57)   (parent 34)   (seen 30)   (unrealized)@@ -1243,7 +1298,7 @@       (recv (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))-  (label 56)+  (label 58)   (parent 35)   (seen 14)   (unrealized)@@ -1267,9 +1322,9 @@     ((recv (enc x1 y3 (pubk a-0))) (send (enc "okay" y3 x1 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 57)+  (label 59)   (parent 36)-  (seen 78)+  (seen 81)   (unrealized (1 0))   (comment "1 in cohort - 0 not yet seen")) @@ -1293,7 +1348,7 @@       (send (enc "okay" y3 y3-0 (pubk a))))     ((recv (enc y3-0 x3 (pubk a)))       (send (enc "okay" y3-0 y3-0 (pubk a)))))-  (label 58)+  (label 60)   (parent 37)   (unrealized)   (comment "1 in cohort - 1 not yet seen"))@@ -1322,11 +1377,11 @@       (send (enc "okay" y3-0 y3-0 (pubk a))))     ((recv (enc y3-0 x3 (pubk a)))       (send (enc "okay" y3-1 y3-0 (pubk a)))))-  (label 59)+  (label 61)   (parent 37)-  (seen 49 69 85)+  (seen 72 88)   (unrealized (1 0))-  (comment "7 in cohort - 3 not yet seen"))+  (comment "7 in cohort - 4 not yet seen"))  (defskeleton wonthull2   (vars (y3 y3-0 text) (a a-0 name))@@ -1349,9 +1404,9 @@       (send (enc "okay" y3 y3-0 (pubk a))))     ((recv (enc y3-0 y3-0 (pubk a)))       (send (enc "okay" y3-0 y3-0 (pubk a)))))-  (label 60)+  (label 62)   (parent 37)-  (seen 49 56)+  (seen 51 58)   (unrealized (1 0))   (comment "3 in cohort - 0 not yet seen")) @@ -1376,9 +1431,9 @@       (send (enc "okay" y3 y3-0 (pubk a))))     ((recv (enc y3-0 x3 (pubk a)))       (send (enc "okay" y3-0 y3-0 (pubk a)))))-  (label 61)+  (label 63)   (parent 37)-  (seen 49 70 85)+  (seen 51 73 88)   (unrealized (1 0))   (comment "5 in cohort - 1 not yet seen")) @@ -1400,9 +1455,9 @@     ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a)))))-  (label 62)+  (label 64)   (parent 37)-  (seen 49)+  (seen 51)   (unrealized (1 0))   (comment "3 in cohort - 1 not yet seen")) @@ -1424,9 +1479,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 63)+  (label 65)   (parent 37)-  (seen 86)+  (seen 90)   (unrealized (1 0))   (comment "3 in cohort - 2 not yet seen")) @@ -1448,7 +1503,7 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 64)+  (label 66)   (parent 38)   (seen 30)   (unrealized)@@ -1474,11 +1529,11 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 65)+  (label 67)   (parent 38)-  (seen 49 50 92)+  (seen 51 52 96)   (unrealized (1 0))-  (comment "7 in cohort - 3 not yet seen"))+  (comment "8 in cohort - 4 not yet seen"))  (defskeleton wonthull2   (vars (x3 y3 y3-0 text) (a a-0 name))@@ -1498,9 +1553,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 66)+  (label 68)   (parent 38)-  (seen 49 51 92)+  (seen 51 53 96)   (unrealized (1 0))   (comment "5 in cohort - 1 not yet seen")) @@ -1522,13 +1577,37 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 67)+  (label 69)   (parent 38)-  (seen 93)+  (seen 98)   (unrealized (1 0))   (comment "3 in cohort - 2 not yet seen"))  (defskeleton wonthull2+  (vars (x1 y3 y3-0 text) (a a-0 name))+  (defstrand init 2 (x1 y3) (x2 y3) (x3 y3) (x4 x1) (a a))+  (defstrand resp 2 (y1 x1) (y2 y3) (y3 y3) (a a-0))+  (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3) (a a))+  (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3-0) (a a))+  (precedes ((0 0) (2 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (1 0))+    ((3 1) (0 1)))+  (non-orig (privk a))+  (uniq-orig y3)+  (operation nonce-test (displaced 4 2 resp 2) x3 (1 0)+    (enc x3 x3 (pubk a)))+  (traces+    ((send (cat (enc y3 y3 (pubk a)) (enc y3 y3 (pubk a))))+      (recv (enc "okay" y3 x1 (pubk a))))+    ((recv (enc x1 y3 (pubk a-0))) (send (enc "okay" y3 x1 (pubk a-0))))+    ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))+    ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))+  (label 70)+  (parent 39)+  (seen 59 92)+  (unrealized (1 0))+  (comment "3 in cohort - 0 not yet seen"))++(defskeleton wonthull2   (vars (x3 x1 y3 text) (a name))   (defstrand init 2 (x1 x1) (x2 x3) (x3 x1) (x4 x1) (a a))   (defstrand resp 2 (y1 x1) (y2 x3) (y3 x3) (a a))@@ -1547,9 +1626,9 @@     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x3 x1 (pubk a))))     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x1 x1 (pubk a))))     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a)))))-  (label 68)-  (parent 41)-  (seen 83)+  (label 71)+  (parent 43)+  (seen 86)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -1574,11 +1653,11 @@     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x1 x1 (pubk a))))     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a))))     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" y3-0 x1 (pubk a)))))-  (label 69)-  (parent 41)-  (seen 49 98)+  (label 72)+  (parent 43)+  (seen 103)   (unrealized (1 0))-  (comment "4 in cohort - 2 not yet seen"))+  (comment "4 in cohort - 3 not yet seen"))  (defskeleton wonthull2   (vars (x3 x1 y3 text) (a a-0 name))@@ -1599,9 +1678,9 @@     ((recv (enc x1 x3 (pubk a-0))) (send (enc "okay" x3 x1 (pubk a-0))))     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x1 x1 (pubk a))))     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a)))))-  (label 70)-  (parent 41)-  (seen 98)+  (label 73)+  (parent 43)+  (seen 103)   (unrealized (1 0))   (comment "2 in cohort - 1 not yet seen")) @@ -1624,9 +1703,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 71)-  (parent 42)-  (seen 40)+  (label 74)+  (parent 44)+  (seen 42)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -1649,9 +1728,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 72)-  (parent 42)-  (seen 98)+  (label 75)+  (parent 44)+  (seen 103)   (unrealized (1 0))   (comment "2 in cohort - 1 not yet seen")) @@ -1671,9 +1750,9 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 73)-  (parent 43)-  (seen 40)+  (label 76)+  (parent 45)+  (seen 42)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -1693,8 +1772,8 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 74)-  (parent 46)+  (label 77)+  (parent 48)   (seen 18)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -1715,8 +1794,8 @@       (recv (enc "okay" y3 x1 (pubk a))))     ((recv (enc x1 y3 (pubk a))) (send (enc "okay" y3 x1 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 75)-  (parent 46)+  (label 78)+  (parent 48)   (seen 17)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -1740,8 +1819,8 @@     ((recv (enc x1 y3 (pubk a-0))) (send (enc "okay" y3 x1 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 76)-  (parent 46)+  (label 79)+  (parent 48)   (unrealized (1 0))   (comment "2 in cohort - 2 not yet seen")) @@ -1760,8 +1839,8 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 y3-0 (pubk a)))       (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 77)-  (parent 47)+  (label 80)+  (parent 49)   (unrealized)   (comment "1 in cohort - 1 not yet seen")) @@ -1784,9 +1863,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 78)-  (parent 49)-  (seen 56)+  (label 81)+  (parent 51)+  (seen 58)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -1811,9 +1890,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 79)-  (parent 50)-  (seen 53)+  (label 82)+  (parent 52)+  (seen 55)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -1838,8 +1917,8 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 80)-  (parent 50)+  (label 83)+  (parent 52)   (unrealized (1 0))   (comment "1 in cohort - 1 not yet seen")) @@ -1862,9 +1941,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 81)-  (parent 51)-  (seen 55)+  (label 84)+  (parent 53)+  (seen 57)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -1887,9 +1966,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 82)-  (parent 54)-  (seen 55)+  (label 85)+  (parent 56)+  (seen 57)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -1907,9 +1986,9 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 83)-  (parent 58)-  (seen 40)+  (label 86)+  (parent 60)+  (seen 42)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -1937,8 +2016,8 @@       (send (enc "okay" y3-0 y3-0 (pubk a))))     ((recv (enc y3-0 x3 (pubk a)))       (send (enc "okay" y3-1 y3-0 (pubk a)))))-  (label 84)-  (parent 59)+  (label 87)+  (parent 61)   (unrealized)   (comment "1 in cohort - 1 not yet seen")) @@ -1967,14 +2046,41 @@       (send (enc "okay" y3-0 y3-0 (pubk a))))     ((recv (enc y3-0 x3 (pubk a)))       (send (enc "okay" y3-1 y3-0 (pubk a)))))-  (label 85)-  (parent 59)-  (seen 98)+  (label 88)+  (parent 61)+  (seen 103)   (unrealized (1 0))   (comment "3 in cohort - 1 not yet seen"))  (defskeleton wonthull2   (vars (x3 y3 y3-0 text) (a a-0 name))+  (defstrand init 2 (x1 x3) (x2 x3) (x3 x3) (x4 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3-0) (a a))+  (precedes ((0 0) (2 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (1 0)) ((4 1) (1 0)))+  (non-orig (privk a))+  (uniq-orig x3)+  (operation nonce-test (displaced 5 3 resp 2) y3-1 (1 0)+    (enc "okay" y3-0 y3-1 (pubk a)) (enc y3-1 x3 (pubk a))+    (enc y3-1 y3-1 (pubk a)))+  (traces+    ((send (cat (enc x3 x3 (pubk a)) (enc x3 x3 (pubk a))))+      (recv (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3-0 x3 (pubk a)))))+  (label 89)+  (parent 61)+  (seen 81)+  (unrealized (1 0))+  (comment "1 in cohort - 0 not yet seen"))++(defskeleton wonthull2+  (vars (x3 y3 y3-0 text) (a a-0 name))   (defstrand init 2 (x1 y3) (x2 x3) (x3 y3) (x4 y3) (a a))   (defstrand resp 2 (y1 y3) (y2 x3) (y3 x3) (a a-0))   (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3) (a a))@@ -1994,8 +2100,8 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 86)-  (parent 59)+  (label 90)+  (parent 61)   (unrealized (1 0))   (comment "2 in cohort - 2 not yet seen")) @@ -2020,8 +2126,8 @@       (send (enc "okay" y3 y3-0 (pubk a))))     ((recv (enc y3-0 x3 (pubk a)))       (send (enc "okay" y3-0 y3-0 (pubk a)))))-  (label 87)-  (parent 61)+  (label 91)+  (parent 63)   (unrealized)   (comment "1 in cohort - 1 not yet seen")) @@ -2043,9 +2149,9 @@     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a)))))-  (label 88)-  (parent 62)-  (seen 52)+  (label 92)+  (parent 64)+  (seen 54)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2068,9 +2174,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 89)-  (parent 63)-  (seen 83)+  (label 93)+  (parent 65)+  (seen 86)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2095,9 +2201,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 90)-  (parent 63)-  (seen 108)+  (label 94)+  (parent 65)+  (seen 114)   (unrealized (1 0))   (comment "2 in cohort - 1 not yet seen")) @@ -2122,9 +2228,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 91)-  (parent 65)-  (seen 53)+  (label 95)+  (parent 67)+  (seen 55)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2149,14 +2255,41 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 92)-  (parent 65)-  (seen 80)+  (label 96)+  (parent 67)+  (seen 83 104)   (unrealized (1 0))-  (comment "3 in cohort - 1 not yet seen"))+  (comment "4 in cohort - 1 not yet seen"))  (defskeleton wonthull2   (vars (x3 y3 y3-0 text) (a a-0 name))+  (defstrand init 2 (x1 x3) (x2 x3) (x3 x3) (x4 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3-0) (a a))+  (precedes ((0 0) (2 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (0 1))+    ((2 1) (0 1)) ((3 1) (1 0)) ((4 1) (1 0)))+  (non-orig (privk a))+  (uniq-orig x3)+  (operation nonce-test (displaced 5 3 resp 2) y3-1 (1 0)+    (enc "okay" y3-0 y3-1 (pubk a)) (enc y3-1 x3 (pubk a))+    (enc y3-1 y3-1 (pubk a)))+  (traces+    ((send (cat (enc x3 x3 (pubk a)) (enc x3 x3 (pubk a))))+      (recv (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3-0 x3 (pubk a)))))+  (label 97)+  (parent 67)+  (seen 51 58)+  (unrealized (1 0))+  (comment "3 in cohort - 0 not yet seen"))++(defskeleton wonthull2+  (vars (x3 y3 y3-0 text) (a a-0 name))   (defstrand init 2 (x1 y3) (x2 x3) (x3 y3) (x4 y3) (a a))   (defstrand resp 2 (y1 y3) (y2 x3) (y3 x3) (a a-0))   (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3) (a a))@@ -2176,8 +2309,8 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 93)-  (parent 65)+  (label 98)+  (parent 67)   (unrealized (1 0))   (comment "2 in cohort - 2 not yet seen")) @@ -2200,9 +2333,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 94)-  (parent 66)-  (seen 55)+  (label 99)+  (parent 68)+  (seen 57)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2225,9 +2358,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 95)-  (parent 67)-  (seen 109)+  (label 100)+  (parent 69)+  (seen 115)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2252,9 +2385,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 96)-  (parent 67)-  (seen 113)+  (label 101)+  (parent 69)+  (seen 119)   (unrealized (1 0))   (comment "2 in cohort - 1 not yet seen")) @@ -2279,9 +2412,9 @@     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x1 x1 (pubk a))))     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a))))     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" y3-0 x1 (pubk a)))))-  (label 97)-  (parent 69)-  (seen 105)+  (label 102)+  (parent 72)+  (seen 111)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2306,12 +2439,39 @@     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x1 x1 (pubk a))))     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a))))     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" y3-0 x1 (pubk a)))))-  (label 98)-  (parent 69)+  (label 103)+  (parent 72)   (unrealized (1 0))   (comment "1 in cohort - 1 not yet seen"))  (defskeleton wonthull2+  (vars (x3 y3 y3-0 text) (a a-0 name))+  (defstrand init 2 (x1 x3) (x2 x3) (x3 x3) (x4 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3-0) (a a))+  (precedes ((0 0) (2 0)) ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (0 1))+    ((2 1) (1 0)) ((3 1) (1 0)) ((4 1) (1 0)))+  (non-orig (privk a))+  (uniq-orig x3)+  (operation nonce-test (displaced 5 2 resp 2) x1 (1 0)+    (enc "okay" y3 x1 (pubk a)) (enc "okay" y3-0 x1 (pubk a))+    (enc x1 x3 (pubk a)) (enc x1 x1 (pubk a)))+  (traces+    ((send (cat (enc x3 x3 (pubk a)) (enc x3 x3 (pubk a))))+      (recv (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3-0 x3 (pubk a)))))+  (label 104)+  (parent 72)+  (seen 81)+  (unrealized (1 0))+  (comment "1 in cohort - 0 not yet seen"))++(defskeleton wonthull2   (vars (x3 x1 y3 text) (a name))   (defstrand init 2 (x1 x1) (x2 x3) (x3 x1) (x4 x1) (a a))   (defstrand resp 2 (y1 x1) (y2 x3) (y3 x3) (a a))@@ -2330,9 +2490,9 @@     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x3 x1 (pubk a))))     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x1 x1 (pubk a))))     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a)))))-  (label 99)-  (parent 70)-  (seen 109)+  (label 105)+  (parent 73)+  (seen 115)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2355,9 +2515,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 100)-  (parent 72)-  (seen 73)+  (label 106)+  (parent 75)+  (seen 76)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2380,8 +2540,8 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 101)-  (parent 76)+  (label 107)+  (parent 79)   (seen 29)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -2405,8 +2565,8 @@     ((recv (enc x1 y3 (pubk a))) (send (enc "okay" y3 x1 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 102)-  (parent 76)+  (label 108)+  (parent 79)   (seen 28)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -2426,11 +2586,12 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 y3-0 (pubk a)))       (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 103)-  (parent 77)+  (label 109)+  (parent 80)   (seen 17)   (unrealized)   (shape)+  (maps ((0 1) ((x1 y3) (x3 x3) (a a) (x1-0 y3) (x3-0 y3-0) (a-0 a-0))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton wonthull2@@ -2455,9 +2616,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 104)-  (parent 80)-  (seen 82)+  (label 110)+  (parent 83)+  (seen 85)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2478,9 +2639,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 105)-  (parent 84)-  (seen 83)+  (label 111)+  (parent 87)+  (seen 86)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2508,8 +2669,8 @@       (send (enc "okay" y3-0 y3-0 (pubk a))))     ((recv (enc y3-0 x3 (pubk a)))       (send (enc "okay" y3-1 y3-0 (pubk a)))))-  (label 106)-  (parent 85)+  (label 112)+  (parent 88)   (unrealized)   (comment "1 in cohort - 1 not yet seen")) @@ -2534,9 +2695,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 107)-  (parent 86)-  (seen 105)+  (label 113)+  (parent 90)+  (seen 111)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2564,8 +2725,8 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 108)-  (parent 86)+  (label 114)+  (parent 90)   (unrealized (1 0))   (comment "1 in cohort - 1 not yet seen")) @@ -2583,9 +2744,9 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 109)-  (parent 87)-  (seen 83)+  (label 115)+  (parent 91)+  (seen 86)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2610,9 +2771,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 110)-  (parent 90)-  (seen 68)+  (label 116)+  (parent 94)+  (seen 71)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2637,9 +2798,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 111)-  (parent 92)-  (seen 82)+  (label 117)+  (parent 96)+  (seen 85)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2664,9 +2825,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 112)-  (parent 93)-  (seen 99)+  (label 118)+  (parent 98)+  (seen 105)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2694,8 +2855,8 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 113)-  (parent 93)+  (label 119)+  (parent 98)   (unrealized (1 0))   (comment "1 in cohort - 1 not yet seen")) @@ -2720,9 +2881,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 114)-  (parent 96)-  (seen 116)+  (label 120)+  (parent 101)+  (seen 122)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2748,9 +2909,9 @@     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x1 x1 (pubk a))))     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a))))     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" y3-0 x1 (pubk a)))))-  (label 115)-  (parent 98)-  (seen 116)+  (label 121)+  (parent 103)+  (seen 122)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2771,9 +2932,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 116)-  (parent 106)-  (seen 109)+  (label 122)+  (parent 112)+  (seen 115)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2802,9 +2963,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 117)-  (parent 108)-  (seen 97)+  (label 123)+  (parent 114)+  (seen 102)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2833,9 +2994,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-1 y3 (pubk a)))))-  (label 118)-  (parent 113)-  (seen 115)+  (label 124)+  (parent 119)+  (seen 121)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))
tst/wonthull3.tst view
@@ -1,4 +1,4 @@-(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol wonthull3 basic@@ -219,7 +219,8 @@   (label 10)   (parent 6)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (x1 x1) (x2 x2) (x3 y3) (x4 y3)))))  (defskeleton wonthull3   (vars (y3 text) (a name))@@ -354,7 +355,8 @@   (label 16)   (parent 13)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((x1 x1) (x3 x3) (a a) (x1-0 x1) (x3-0 x3) (a-0 a)))))  (defskeleton wonthull3   (vars (x3 x1 text) (a name))@@ -373,7 +375,8 @@   (label 17)   (parent 13)   (unrealized)-  (shape))+  (shape)+  (maps ((0 1) ((x1 x3) (x3 x3) (a a) (x1-0 x1) (x3-0 x3) (a-0 a)))))  (defskeleton wonthull3   (vars (x1 x3 x1-0 y3 text) (a a-0 name))@@ -570,9 +573,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))   (label 26)   (parent 19)-  (seen 42 44)+  (seen 43)   (unrealized (1 0))-  (comment "6 in cohort - 4 not yet seen"))+  (comment "4 in cohort - 3 not yet seen"))  (defskeleton wonthull3   (vars (x1 x3 y3 text) (a a-0 name))@@ -615,7 +618,7 @@     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" y3 x1 (pubk a)))))   (label 28)   (parent 19)-  (seen 41 45)+  (seen 41 44)   (unrealized (0 2))   (comment "6 in cohort - 0 not yet seen")) @@ -684,9 +687,9 @@     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3-0 x3 (pubk a)))))   (label 31)   (parent 20)-  (seen 24 25)+  (seen 25 47)   (unrealized (1 0) (3 0))-  (comment "7 in cohort - 1 not yet seen"))+  (comment "7 in cohort - 2 not yet seen"))  (defskeleton wonthull3   (vars (x1 x1-0 y3 text) (a a-0 name))@@ -727,9 +730,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))   (label 33)   (parent 21)-  (seen 17 54)+  (seen 53 55)   (unrealized (1 0))-  (comment "6 in cohort - 3 not yet seen"))+  (comment "6 in cohort - 4 not yet seen"))  (defskeleton wonthull3   (vars (x1 x3 x1-0 y3 text) (a name))@@ -819,7 +822,7 @@     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3-0 x3 (pubk a)))))   (label 37)   (parent 22)-  (seen 55 56)+  (seen 56 57)   (unrealized (1 0) (3 0))   (comment "6 in cohort - 2 not yet seen")) @@ -841,9 +844,8 @@     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a)))))   (label 38)   (parent 24)-  (seen 42)   (unrealized)-  (comment "1 in cohort - 0 not yet seen"))+  (comment "1 in cohort - 1 not yet seen"))  (defskeleton wonthull3   (vars (x3 x1 y3 text) (a name))@@ -914,26 +916,6 @@   (comment "1 in cohort - 0 not yet seen"))  (defskeleton wonthull3-  (vars (x3 text) (a name))-  (defstrand init 3 (x1 x3) (x2 x3) (x3 x3) (x4 x3) (a a))-  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))-  (precedes ((0 1) (1 0)) ((1 1) (0 2)))-  (non-orig (privk a))-  (uniq-orig x3)-  (operation nonce-test (added-strand init 2) x3 (1 0) (enc x3 (pubk a))-    (enc x3 x3 (pubk a)))-  (traces-    ((send (enc x3 (pubk a)))-      (send (cat (enc x3 x3 (pubk a)) (enc x3 x3 (pubk a))))-      (recv (enc "okay" x3 x3 (pubk a))))-    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a)))))-  (label 42)-  (parent 26)-  (seen 17)-  (unrealized)-  (comment "1 in cohort - 0 not yet seen"))--(defskeleton wonthull3   (vars (x3 y3 y3-0 text) (a a-0 name))   (defstrand init 3 (x1 y3) (x2 x3) (x3 y3) (x4 y3) (a a))   (defstrand resp 2 (y1 y3) (y2 x3) (y3 x3) (a a-0))@@ -952,9 +934,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 43)+  (label 42)   (parent 26)-  (seen 57 58)+  (seen 59 60)   (unrealized (1 0) (3 0))   (comment "7 in cohort - 3 not yet seen")) @@ -974,7 +956,7 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 44)+  (label 43)   (parent 26)   (unrealized (1 0))   (comment "2 in cohort - 2 not yet seen"))@@ -995,9 +977,9 @@       (recv (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))-  (label 45)+  (label 44)   (parent 27)-  (seen 42)+  (seen 58)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -1020,7 +1002,7 @@     ((recv (enc x1 x3 (pubk a-0))) (send (enc "okay" x3 x1 (pubk a-0))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3-0 x3 (pubk a)))))-  (label 46)+  (label 45)   (parent 27)   (seen 24)   (unrealized (1 0) (3 0))@@ -1042,13 +1024,41 @@       (recv (enc "okay" y3 x1 (pubk a))))     ((recv (enc x1 y3 (pubk a-0))) (send (enc "okay" y3 x1 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 47)+  (label 46)   (parent 27)   (unrealized (1 0))   (comment "2 in cohort - 2 not yet seen"))  (defskeleton wonthull3   (vars (x1 x1-0 y3 y3-0 text) (a a-0 name))+  (defstrand init 3 (x1 x1-0) (x2 x1-0) (x3 x1-0) (x4 x1) (a a))+  (defstrand resp 2 (y1 x1) (y2 x1-0) (y3 x1-0) (a a-0))+  (defstrand resp 2 (y1 x1-0) (y2 x1-0) (y3 y3) (a a))+  (defstrand resp 2 (y1 x1-0) (y2 x1-0) (y3 y3-0) (a a))+  (precedes ((0 1) (2 0)) ((0 1) (3 0)) ((1 1) (0 2)) ((2 1) (0 2))+    ((3 1) (1 0)))+  (non-orig (privk a))+  (uniq-orig x1-0)+  (operation nonce-test (added-strand init 2) x1-0 (3 0)+    (enc x1-0 (pubk a)))+  (traces+    ((send (enc x1-0 (pubk a)))+      (send (cat (enc x1-0 x1-0 (pubk a)) (enc x1-0 x1-0 (pubk a))))+      (recv (enc "okay" x1-0 x1 (pubk a))))+    ((recv (enc x1 x1-0 (pubk a-0)))+      (send (enc "okay" x1-0 x1 (pubk a-0))))+    ((recv (enc x1-0 x1-0 (pubk a)))+      (send (enc "okay" y3 x1-0 (pubk a))))+    ((recv (enc x1-0 x1-0 (pubk a)))+      (send (enc "okay" y3-0 x1-0 (pubk a)))))+  (label 47)+  (parent 31)+  (seen 38)+  (unrealized (1 0))+  (comment "2 in cohort - 1 not yet seen"))++(defskeleton wonthull3+  (vars (x1 x1-0 y3 y3-0 text) (a a-0 name))   (defstrand init 3 (x1 x1-0) (x2 y3) (x3 y3) (x4 x1) (a a))   (defstrand resp 2 (y1 x1) (y2 y3) (y3 y3) (a a-0))   (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3) (a a))@@ -1138,9 +1148,9 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))   (label 51)   (parent 32)-  (seen 48 67 68)+  (seen 48 67 70)   (unrealized (1 0) (3 0))-  (comment "7 in cohort - 2 not yet seen"))+  (comment "7 in cohort - 1 not yet seen"))  (defskeleton wonthull3   (vars (x3 x1 y3 text) (a name))@@ -1163,9 +1173,32 @@   (seen 17)   (unrealized)   (shape)+  (maps ((0 1) ((x1 y3) (x3 x3) (a a) (x1-0 x1) (x3-0 y3) (a-0 a))))   (comment "1 in cohort - 0 not yet seen"))  (defskeleton wonthull3+  (vars (x3 x1 text) (a a-0 name))+  (defstrand init 3 (x1 x1) (x2 x3) (x3 x3) (x4 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))+  (precedes ((0 1) (1 0)) ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (0 2)))+  (non-orig (privk a))+  (uniq-orig x3)+  (operation nonce-test (added-strand init 2) x3 (1 0) (enc x3 (pubk a))+    (enc x3 x3 (pubk a)))+  (traces+    ((send (enc x3 (pubk a)))+      (send (cat (enc x1 x3 (pubk a)) (enc x3 x3 (pubk a))))+      (recv (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a)))))+  (label 53)+  (parent 33)+  (seen 17 72)+  (unrealized (1 0))+  (comment "10 in cohort - 2 not yet seen"))++(defskeleton wonthull3   (vars (x3 x1 y3 y3-0 text) (a a-0 name))   (defstrand init 3 (x1 x1) (x2 x3) (x3 y3) (x4 y3) (a a))   (defstrand resp 2 (y1 y3) (y2 x3) (y3 x3) (a a-0))@@ -1184,9 +1217,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 53)+  (label 54)   (parent 33)-  (seen 57 69 70)+  (seen 59 73 74)   (unrealized (1 0) (3 0))   (comment "7 in cohort - 3 not yet seen")) @@ -1206,11 +1239,11 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 54)+  (label 55)   (parent 33)-  (seen 73)+  (seen 72)   (unrealized (1 0))-  (comment "4 in cohort - 3 not yet seen"))+  (comment "4 in cohort - 2 not yet seen"))  (defskeleton wonthull3   (vars (x1 x1-0 y3 y3-0 text) (a a-0 name))@@ -1233,7 +1266,7 @@       (send (enc "okay" y3 x1-0 (pubk a))))     ((recv (enc x1-0 x1-0 (pubk a)))       (send (enc "okay" y3-0 x1-0 (pubk a)))))-  (label 55)+  (label 56)   (parent 37)   (unrealized (1 0))   (comment "1 in cohort - 1 not yet seen"))@@ -1256,12 +1289,31 @@     ((recv (enc x1 x3 (pubk a-0))) (send (enc "okay" x3 x1 (pubk a-0))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3-0 x3 (pubk a)))))-  (label 56)+  (label 57)   (parent 37)   (unrealized (1 0))   (comment "2 in cohort - 2 not yet seen"))  (defskeleton wonthull3+  (vars (x1 text) (a name))+  (defstrand init 3 (x1 x1) (x2 x1) (x3 x1) (x4 x1) (a a))+  (defstrand resp 2 (y1 x1) (y2 x1) (y3 x1) (a a))+  (precedes ((0 1) (1 0)) ((1 1) (0 2)))+  (non-orig (privk a))+  (uniq-orig x1)+  (operation generalization deleted (2 0))+  (traces+    ((send (enc x1 (pubk a)))+      (send (cat (enc x1 x1 (pubk a)) (enc x1 x1 (pubk a))))+      (recv (enc "okay" x1 x1 (pubk a))))+    ((recv (enc x1 x1 (pubk a))) (send (enc "okay" x1 x1 (pubk a)))))+  (label 58)+  (parent 38)+  (seen 17)+  (unrealized)+  (comment "1 in cohort - 0 not yet seen"))++(defskeleton wonthull3   (vars (x3 y3 y3-0 text) (a a-0 name))   (defstrand init 3 (x1 y3) (x2 x3) (x3 y3) (x4 y3) (a a))   (defstrand resp 2 (y1 y3) (y2 x3) (y3 x3) (a a-0))@@ -1280,9 +1332,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 57)-  (parent 43)-  (seen 79)+  (label 59)+  (parent 42)+  (seen 82)   (unrealized (1 0))   (comment "3 in cohort - 2 not yet seen")) @@ -1305,9 +1357,9 @@     ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))-  (label 58)-  (parent 43)-  (seen 38 80)+  (label 60)+  (parent 42)+  (seen 38 83)   (unrealized (1 0))   (comment "3 in cohort - 1 not yet seen")) @@ -1329,8 +1381,8 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 59)-  (parent 43)+  (label 61)+  (parent 42)   (unrealized (1 0))   (comment "1 in cohort - 1 not yet seen")) @@ -1350,8 +1402,8 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 60)-  (parent 44)+  (label 62)+  (parent 43)   (seen 41)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -1375,9 +1427,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 61)-  (parent 44)-  (seen 59 79 80)+  (label 63)+  (parent 43)+  (seen 61 82 83)   (unrealized (1 0) (3 0))   (comment "7 in cohort - 0 not yet seen")) @@ -1399,8 +1451,8 @@     ((recv (enc x1 y3 (pubk a-0))) (send (enc "okay" y3 x1 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 62)-  (parent 46)+  (label 64)+  (parent 45)   (unrealized (1 0))   (comment "1 in cohort - 1 not yet seen")) @@ -1420,9 +1472,9 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 63)-  (parent 47)-  (seen 42)+  (label 65)+  (parent 46)+  (seen 58)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -1445,13 +1497,38 @@     ((recv (enc x1 y3 (pubk a-0))) (send (enc "okay" y3 x1 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 64)-  (parent 47)-  (seen 62 67)+  (label 66)+  (parent 46)+  (seen 64 67)   (unrealized (1 0) (3 0))   (comment "7 in cohort - 0 not yet seen"))  (defskeleton wonthull3+  (vars (x1 y3 y3-0 text) (a a-0 name))+  (defstrand init 3 (x1 y3) (x2 y3) (x3 y3) (x4 x1) (a a))+  (defstrand resp 2 (y1 x1) (y2 y3) (y3 y3) (a a-0))+  (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3) (a a))+  (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3-0) (a a))+  (precedes ((0 1) (2 0)) ((0 1) (3 0)) ((1 1) (0 2)) ((2 1) (1 0))+    ((3 1) (1 0)))+  (non-orig (privk a))+  (uniq-orig y3)+  (operation nonce-test (displaced 4 2 resp 2) x1-0 (1 0)+    (enc x1-0 (pubk a)) (enc "okay" y3-0 x1-0 (pubk a))+    (enc x1-0 x1-0 (pubk a)))+  (traces+    ((send (enc y3 (pubk a)))+      (send (cat (enc y3 y3 (pubk a)) (enc y3 y3 (pubk a))))+      (recv (enc "okay" y3 x1 (pubk a))))+    ((recv (enc x1 y3 (pubk a-0))) (send (enc "okay" y3 x1 (pubk a-0))))+    ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))+    ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))+  (label 67)+  (parent 47)+  (unrealized (1 0))+  (comment "1 in cohort - 1 not yet seen"))++(defskeleton wonthull3   (vars (x1 y3 y3-0 text) (a name))   (defstrand init 3 (x1 x1) (x2 y3) (x3 y3) (x4 y3) (a a))   (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3) (a a))@@ -1471,7 +1548,7 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 65)+  (label 68)   (parent 48)   (seen 40)   (unrealized)@@ -1497,40 +1574,13 @@     ((recv (enc x1 y3 (pubk a))) (send (enc "okay" y3 x1 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 66)+  (label 69)   (parent 48)   (seen 39)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))  (defskeleton wonthull3-  (vars (x1 x1-0 y3 text) (a a-0 name))-  (defstrand init 3 (x1 x1-0) (x2 x1-0) (x3 x1-0) (x4 x1) (a a))-  (defstrand resp 2 (y1 x1) (y2 x1-0) (y3 x1-0) (a a-0))-  (defstrand resp 2 (y1 x1-0) (y2 x1-0) (y3 x1-0) (a a))-  (defstrand resp 2 (y1 x1-0) (y2 x1-0) (y3 y3) (a a))-  (precedes ((0 1) (2 0)) ((0 1) (3 0)) ((1 1) (0 2)) ((2 1) (1 0))-    ((3 1) (1 0)))-  (non-orig (privk a))-  (uniq-orig x1-0)-  (operation nonce-test (added-strand init 2) x1-0 (3 0)-    (enc x1-0 (pubk a)))-  (traces-    ((send (enc x1-0 (pubk a)))-      (send (cat (enc x1-0 x1-0 (pubk a)) (enc x1-0 x1-0 (pubk a))))-      (recv (enc "okay" x1-0 x1 (pubk a))))-    ((recv (enc x1 x1-0 (pubk a-0)))-      (send (enc "okay" x1-0 x1 (pubk a-0))))-    ((recv (enc x1-0 x1-0 (pubk a)))-      (send (enc "okay" x1-0 x1-0 (pubk a))))-    ((recv (enc x1-0 x1-0 (pubk a)))-      (send (enc "okay" y3 x1-0 (pubk a)))))-  (label 67)-  (parent 51)-  (unrealized (1 0))-  (comment "1 in cohort - 1 not yet seen"))--(defskeleton wonthull3   (vars (x1 x1-0 y3 y3-0 text) (a a-0 name))   (defstrand init 3 (x1 x1-0) (x2 y3) (x3 y3) (x4 x1) (a a))   (defstrand resp 2 (y1 x1) (y2 y3) (y3 y3) (a a-0))@@ -1549,7 +1599,7 @@     ((recv (enc x1 y3 (pubk a-0))) (send (enc "okay" y3 x1 (pubk a-0))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 68)+  (label 70)   (parent 51)   (unrealized (1 0))   (comment "2 in cohort - 2 not yet seen"))@@ -1560,6 +1610,53 @@   (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))   (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))   (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))+  (precedes ((0 0) (3 0)) ((0 1) (1 0)) ((0 1) (2 0)) ((1 1) (0 2))+    ((2 1) (0 2)) ((3 1) (1 0)))+  (non-orig (privk a))+  (uniq-orig x3)+  (operation nonce-test (added-strand resp 2) x3 (1 0) (enc x3 (pubk a))+    (enc x3 x3 (pubk a)) (enc x1 x3 (pubk a)))+  (traces+    ((send (enc x3 (pubk a)))+      (send (cat (enc x1 x3 (pubk a)) (enc x3 x3 (pubk a))))+      (recv (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))+  (label 71)+  (parent 53)+  (seen 60 73)+  (unrealized (1 0) (3 0))+  (comment "7 in cohort - 1 not yet seen"))++(defskeleton wonthull3+  (vars (x3 x1 text) (a a-0 name))+  (defstrand init 3 (x1 x1) (x2 x3) (x3 x3) (x4 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)))+  (non-orig (privk a))+  (uniq-orig x3)+  (operation nonce-test (displaced 3 2 resp 2) x3 (1 0)+    (enc x3 (pubk a)) (enc x3 x3 (pubk a)) (enc x1 x3 (pubk a)))+  (traces+    ((send (enc x3 (pubk a)))+      (send (cat (enc x1 x3 (pubk a)) (enc x3 x3 (pubk a))))+      (recv (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a)))))+  (label 72)+  (parent 53)+  (seen 49)+  (unrealized (1 0))+  (comment "2 in cohort - 1 not yet seen"))++(defskeleton wonthull3+  (vars (x3 x1 y3 text) (a a-0 name))+  (defstrand init 3 (x1 x1) (x2 x3) (x3 x3) (x4 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))   (precedes ((0 1) (2 0)) ((0 1) (3 0)) ((1 1) (0 2)) ((2 1) (0 2))     ((3 1) (1 0)))   (non-orig (privk a))@@ -1573,9 +1670,9 @@     ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))-  (label 69)-  (parent 53)-  (seen 40 86)+  (label 73)+  (parent 54)+  (seen 40 91)   (unrealized (1 0))   (comment "3 in cohort - 1 not yet seen")) @@ -1598,9 +1695,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 70)-  (parent 53)-  (seen 69 88)+  (label 74)+  (parent 54)+  (seen 73 93)   (unrealized (1 0))   (comment "5 in cohort - 2 not yet seen")) @@ -1622,11 +1719,11 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 71)-  (parent 53)-  (seen 90)+  (label 75)+  (parent 54)+  (seen 89)   (unrealized (1 0))-  (comment "3 in cohort - 2 not yet seen"))+  (comment "3 in cohort - 1 not yet seen"))  (defskeleton wonthull3   (vars (x3 x1 y3 text) (a name))@@ -1644,35 +1741,13 @@       (recv (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a)))))-  (label 72)-  (parent 54)+  (label 76)+  (parent 55)   (seen 52)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))  (defskeleton wonthull3-  (vars (x3 x1 text) (a a-0 name))-  (defstrand init 3 (x1 x1) (x2 x3) (x3 x3) (x4 x3) (a a))-  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))-  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))-  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)))-  (non-orig (privk a))-  (uniq-orig x3)-  (operation nonce-test (added-strand init 2) x3 (1 0) (enc x3 (pubk a))-    (enc "okay" x3 x3 (pubk a)) (enc x3 x3 (pubk a)))-  (traces-    ((send (enc x3 (pubk a)))-      (send (cat (enc x1 x3 (pubk a)) (enc x3 x3 (pubk a))))-      (recv (enc "okay" x3 x3 (pubk a))))-    ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))-    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a)))))-  (label 73)-  (parent 54)-  (seen 49)-  (unrealized (1 0))-  (comment "2 in cohort - 1 not yet seen"))--(defskeleton wonthull3   (vars (x3 x1 y3 y3-0 text) (a a-0 name))   (defstrand init 3 (x1 x1) (x2 x3) (x3 y3) (x4 y3) (a a))   (defstrand resp 2 (y1 y3) (y2 x3) (y3 x3) (a a-0))@@ -1691,9 +1766,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 74)-  (parent 54)-  (seen 71 79 86 88)+  (label 77)+  (parent 55)+  (seen 75 82 91 93)   (unrealized (1 0) (3 0))   (comment "7 in cohort - 0 not yet seen")) @@ -1716,8 +1791,8 @@     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" x1 x1 (pubk a))))     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a))))     ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3-0 x1 (pubk a)))))-  (label 75)-  (parent 55)+  (label 78)+  (parent 56)   (seen 38)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -1741,8 +1816,8 @@     ((recv (enc x1 x3 (pubk a))) (send (enc "okay" x3 x1 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3-0 x3 (pubk a)))))-  (label 76)-  (parent 56)+  (label 79)+  (parent 57)   (seen 39)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -1766,8 +1841,8 @@     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3-0 x3 (pubk a)))))-  (label 77)-  (parent 56)+  (label 80)+  (parent 57)   (seen 40)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -1791,8 +1866,8 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 78)-  (parent 57)+  (label 81)+  (parent 59)   (seen 41)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -1817,8 +1892,8 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 79)-  (parent 57)+  (label 82)+  (parent 59)   (unrealized (1 0))   (comment "1 in cohort - 1 not yet seen")) @@ -1841,9 +1916,9 @@     ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))-  (label 80)-  (parent 58)-  (seen 83)+  (label 83)+  (parent 60)+  (seen 86)   (unrealized (1 0))   (comment "1 in cohort - 0 not yet seen")) @@ -1866,9 +1941,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 81)-  (parent 59)-  (seen 60)+  (label 84)+  (parent 61)+  (seen 62)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -1891,33 +1966,33 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 82)-  (parent 62)+  (label 85)+  (parent 64)   (seen 38)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))  (defskeleton wonthull3-  (vars (x1 y3 text) (a name))-  (defstrand init 3 (x1 x1) (x2 x1) (x3 x1) (x4 x1) (a a))-  (defstrand resp 2 (y1 x1) (y2 x1) (y3 x1) (a a))-  (defstrand resp 2 (y1 x1) (y2 x1) (y3 x1) (a a))-  (defstrand resp 2 (y1 x1) (y2 x1) (y3 y3) (a a))+  (vars (y3 y3-0 text) (a name))+  (defstrand init 3 (x1 y3) (x2 y3) (x3 y3) (x4 y3) (a a))+  (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3) (a a))+  (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3) (a a))+  (defstrand resp 2 (y1 y3) (y2 y3) (y3 y3-0) (a a))   (precedes ((0 1) (2 0)) ((0 1) (3 0)) ((1 1) (0 2)) ((2 1) (1 0))     ((3 1) (1 0)))   (non-orig (privk a))-  (uniq-orig x1)-  (operation nonce-test (contracted (x1-0 x1) (a-0 a)) x1 (1 0)-    (enc x1 (pubk a)) (enc "okay" x1 x1 (pubk a))-    (enc "okay" y3 x1 (pubk a)) (enc x1 x1 (pubk a)))+  (uniq-orig y3)+  (operation nonce-test (contracted (x1 y3) (a-0 a)) y3 (1 0)+    (enc y3 (pubk a)) (enc "okay" y3 y3 (pubk a))+    (enc "okay" y3-0 y3 (pubk a)) (enc y3 y3 (pubk a)))   (traces-    ((send (enc x1 (pubk a)))-      (send (cat (enc x1 x1 (pubk a)) (enc x1 x1 (pubk a))))-      (recv (enc "okay" x1 x1 (pubk a))))-    ((recv (enc x1 x1 (pubk a))) (send (enc "okay" x1 x1 (pubk a))))-    ((recv (enc x1 x1 (pubk a))) (send (enc "okay" x1 x1 (pubk a))))-    ((recv (enc x1 x1 (pubk a))) (send (enc "okay" y3 x1 (pubk a)))))-  (label 83)+    ((send (enc y3 (pubk a)))+      (send (cat (enc y3 y3 (pubk a)) (enc y3 y3 (pubk a))))+      (recv (enc "okay" y3 y3 (pubk a))))+    ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))+    ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))+    ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))+  (label 86)   (parent 67)   (seen 38)   (unrealized)@@ -1944,8 +2019,8 @@     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 84)-  (parent 68)+  (label 87)+  (parent 70)   (seen 40)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -1971,8 +2046,8 @@     ((recv (enc x1 y3 (pubk a))) (send (enc "okay" y3 x1 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 y3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 85)-  (parent 68)+  (label 88)+  (parent 70)   (seen 39)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -1983,6 +2058,56 @@   (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))   (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))   (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (3 0)) ((3 1) (1 0)))+  (non-orig (privk a))+  (uniq-orig x3)+  (operation nonce-test (displaced 4 2 resp 2) x3 (3 0)+    (enc x3 (pubk a)))+  (traces+    ((send (enc x3 (pubk a)))+      (send (cat (enc x1 x3 (pubk a)) (enc x3 x3 (pubk a))))+      (recv (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))+  (label 89)+  (parent 71)+  (seen 68)+  (unrealized (1 0))+  (comment "1 in cohort - 0 not yet seen"))++(defskeleton wonthull3+  (vars (x3 x1 y3 text) (a a-0 name))+  (defstrand init 3 (x1 x1) (x2 x3) (x3 x3) (x4 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))+  (precedes ((0 0) (3 0)) ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0))+    ((3 1) (1 0)))+  (non-orig (privk a))+  (uniq-orig x3)+  (operation nonce-test (added-strand resp 2) x3 (1 0) (enc x3 (pubk a))+    (enc "okay" x3 x3 (pubk a)) (enc x3 x3 (pubk a))+    (enc x1 x3 (pubk a)))+  (traces+    ((send (enc x3 (pubk a)))+      (send (cat (enc x1 x3 (pubk a)) (enc x3 x3 (pubk a))))+      (recv (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))+    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))+  (label 90)+  (parent 72)+  (seen 83 89 91)+  (unrealized (1 0) (3 0))+  (comment "7 in cohort - 0 not yet seen"))++(defskeleton wonthull3+  (vars (x3 x1 y3 text) (a a-0 name))+  (defstrand init 3 (x1 x1) (x2 x3) (x3 x3) (x4 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))+  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))   (precedes ((0 1) (2 0)) ((0 1) (3 0)) ((1 1) (0 2)) ((2 1) (1 0))     ((3 1) (1 0)))   (non-orig (privk a))@@ -1997,9 +2122,9 @@     ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))     ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))-  (label 86)-  (parent 69)-  (seen 84)+  (label 91)+  (parent 73)+  (seen 87)   (unrealized (1 0))   (comment "1 in cohort - 0 not yet seen")) @@ -2022,8 +2147,8 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 87)-  (parent 70)+  (label 92)+  (parent 74)   (seen 52)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -2048,9 +2173,9 @@     ((recv (enc y3 x3 (pubk a-0))) (send (enc "okay" x3 y3 (pubk a-0))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 88)-  (parent 70)-  (seen 86)+  (label 93)+  (parent 74)+  (seen 91)   (unrealized (1 0))   (comment "3 in cohort - 1 not yet seen")) @@ -2073,64 +2198,13 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 89)-  (parent 71)-  (seen 72)+  (label 94)+  (parent 75)+  (seen 76)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))  (defskeleton wonthull3-  (vars (x3 x1 y3 text) (a a-0 name))-  (defstrand init 3 (x1 x1) (x2 x3) (x3 x3) (x4 x3) (a a))-  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))-  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))-  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))-  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (3 0)) ((3 1) (1 0)))-  (non-orig (privk a))-  (uniq-orig x3)-  (operation nonce-test (added-strand init 2) x3 (1 0) (enc x3 (pubk a))-    (enc "okay" x3 x3 (pubk a)) (enc "okay" y3 x3 (pubk a))-    (enc x3 x3 (pubk a)))-  (traces-    ((send (enc x3 (pubk a)))-      (send (cat (enc x1 x3 (pubk a)) (enc x3 x3 (pubk a))))-      (recv (enc "okay" x3 x3 (pubk a))))-    ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))-    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))-    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))-  (label 90)-  (parent 71)-  (seen 65)-  (unrealized (1 0))-  (comment "1 in cohort - 0 not yet seen"))--(defskeleton wonthull3-  (vars (x3 x1 y3 text) (a a-0 name))-  (defstrand init 3 (x1 x1) (x2 x3) (x3 x3) (x4 x3) (a a))-  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a-0))-  (defstrand resp 2 (y1 x3) (y2 x3) (y3 x3) (a a))-  (defstrand resp 2 (y1 x3) (y2 x3) (y3 y3) (a a))-  (precedes ((0 0) (3 0)) ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0))-    ((3 1) (1 0)))-  (non-orig (privk a))-  (uniq-orig x3)-  (operation nonce-test (added-strand resp 2) x3 (1 0) (enc x3 (pubk a))-    (enc "okay" x3 x3 (pubk a)) (enc x3 x3 (pubk a))-    (enc x1 x3 (pubk a)))-  (traces-    ((send (enc x3 (pubk a)))-      (send (cat (enc x1 x3 (pubk a)) (enc x3 x3 (pubk a))))-      (recv (enc "okay" x3 x3 (pubk a))))-    ((recv (enc x3 x3 (pubk a-0))) (send (enc "okay" x3 x3 (pubk a-0))))-    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" x3 x3 (pubk a))))-    ((recv (enc x3 x3 (pubk a))) (send (enc "okay" y3 x3 (pubk a)))))-  (label 91)-  (parent 73)-  (seen 80 86 90)-  (unrealized (1 0) (3 0))-  (comment "7 in cohort - 0 not yet seen"))--(defskeleton wonthull3   (vars (x3 y3 y3-0 text) (a name))   (defstrand init 3 (x1 y3) (x2 x3) (x3 y3) (x4 y3) (a a))   (defstrand resp 2 (y1 y3) (y2 x3) (y3 x3) (a a))@@ -2150,9 +2224,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 92)-  (parent 79)-  (seen 60)+  (label 95)+  (parent 82)+  (seen 62)   (unrealized)   (comment "1 in cohort - 0 not yet seen")) @@ -2176,9 +2250,9 @@     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" x3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3 y3 (pubk a))))     ((recv (enc y3 x3 (pubk a))) (send (enc "okay" y3-0 y3 (pubk a)))))-  (label 93)-  (parent 88)-  (seen 72)+  (label 96)+  (parent 93)+  (seen 76)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))
tst/woolam.tst view
@@ -1,6 +1,6 @@ (herald "Woo-Lam Protocol") -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol woolam basic@@ -95,6 +95,7 @@   (label 3)   (parent 2)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (s s) (b b) (n n)))))  (comment "Nothing left to do")
tst/yahalom-6.3.6.tst view
@@ -4,7 +4,7 @@     "Yahalom Protocol, Section 6.3.6, Page 49")   (url "http://www.eecs.umich.edu/acal/swerve/docs/49-1.pdf")) -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol yahalom basic@@ -78,7 +78,9 @@   (label 2)   (parent 1)   (unrealized)-  (shape))+  (shape)+  (maps+    ((0) ((a a) (b b) (s s) (n-a n-a) (n-b n-b) (k k) (blob blob)))))  (comment "Nothing left to do") @@ -387,9 +389,9 @@       (send (cat (enc b k-0 n-a n-b (ltk a s)) (enc a k-0 (ltk b s))))))   (label 15)   (parent 11)-  (seen 16)+  (seen 16 19)   (unrealized (3 1))-  (comment "2 in cohort - 1 not yet seen"))+  (comment "4 in cohort - 2 not yet seen"))  (defskeleton yahalom   (vars (blob mesg) (n-a n-b text) (a b s name) (k skey))@@ -412,7 +414,8 @@   (label 16)   (parent 13)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (s s) (n-a n-a) (n-b n-b) (k k)))))  (defskeleton yahalom   (vars (blob blob-0 mesg) (n-a n-b n-a-0 text) (a b s a-0 b-0 s-0 name)@@ -477,11 +480,41 @@       (send (cat blob-0 (enc n-b k-0)))))   (label 18)   (parent 15)-  (seen 20)+  (seen 21)   (unrealized (3 1))   (comment "3 in cohort - 2 not yet seen"))  (defskeleton yahalom+  (vars (blob mesg) (n-a n-b n-a-0 text) (a b s a-0 b-0 s-0 name)+    (k k-0 skey))+  (defstrand resp 3 (n-a n-a) (n-b n-b) (a a) (b b) (s s) (k k))+  (defstrand serv 2 (n-a n-a) (n-b n-b) (a a) (b b) (s s) (k k))+  (defstrand init 3 (blob blob) (n-a n-a-0) (n-b n-b) (a a-0) (b b-0)+    (s s-0) (k k))+  (defstrand serv 2 (n-a n-a) (n-b n-b) (a a) (b b) (s s) (k k-0))+  (precedes ((0 1) (1 0)) ((0 1) (3 0)) ((1 1) (2 1)) ((2 2) (0 2))+    ((3 1) (2 1)))+  (non-orig (ltk a s) (ltk b s))+  (uniq-orig n-a n-b k k-0)+  (operation nonce-test (displaced 5 2 resp 2) n-b-0 (3 1)+    (enc a n-a n-b-0 (ltk b s)) (enc b k-0 n-a n-b-0 (ltk a s)))+  (traces+    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b s))))+      (recv (cat (enc a k (ltk b s)) (enc n-b k))))+    ((recv (cat b (enc a n-a n-b (ltk b s))))+      (send (cat (enc b k n-a n-b (ltk a s)) (enc a k (ltk b s)))))+    ((send (cat a-0 n-a-0))+      (recv (cat (enc b-0 k n-a-0 n-b (ltk a-0 s-0)) blob))+      (send (cat blob (enc n-b k))))+    ((recv (cat b (enc a n-a n-b (ltk b s))))+      (send (cat (enc b k-0 n-a n-b (ltk a s)) (enc a k-0 (ltk b s))))))+  (label 19)+  (parent 15)+  (seen 16 17 21)+  (unrealized (2 1))+  (comment "3 in cohort - 0 not yet seen"))++(defskeleton yahalom   (vars (blob blob-0 mesg) (n-a n-b n-a-0 text) (a b s a-0 b-0 s-0 name)     (k skey))   (defstrand resp 3 (n-a n-a) (n-b n-b) (a a) (b b) (s s) (k k))@@ -507,7 +540,7 @@       (send (cat blob (enc n-b k))))     ((send (cat a n-a)) (recv (cat (enc b k n-a n-b (ltk a s)) blob-0))       (send (cat blob-0 (enc n-b k)))) ((recv k) (send k)))-  (label 19)+  (label 20)   (parent 17)   (unrealized (4 0))   (comment "empty cohort"))@@ -542,7 +575,7 @@     ((send (cat a n-a))       (recv (cat (enc b k-0 n-a n-b (ltk a s)) blob-0))       (send (cat blob-0 (enc n-b k-0)))))-  (label 20)+  (label 21)   (parent 18)   (unrealized (2 1))   (comment "1 in cohort - 1 not yet seen"))@@ -580,7 +613,7 @@     ((send (cat a n-a))       (recv (cat (enc b k-0 n-a n-b (ltk a s)) blob-0))       (send (cat blob-0 (enc n-b k-0)))) ((recv k-0) (send k-0)))-  (label 21)+  (label 22)   (parent 18)   (unrealized (3 1) (6 0))   (comment "empty cohort"))@@ -617,8 +650,8 @@     ((send (cat a n-a))       (recv (cat (enc b k-0 n-a n-b (ltk a s)) blob-0))       (send (cat blob-0 (enc n-b k-0)))) ((recv k-0) (send k-0)))-  (label 22)-  (parent 20)+  (label 23)+  (parent 21)   (unrealized (2 1) (5 0))   (comment "empty cohort")) @@ -650,7 +683,7 @@   (traces     ((recv (cat b (enc a n-a n-b (ltk b s))))       (send (cat (enc b k n-a n-b (ltk a s)) (enc a k (ltk b s))))))-  (label 23)+  (label 24)   (unrealized (0 0))   (comment "1 in cohort - 1 not yet seen")) @@ -667,9 +700,10 @@     ((recv (cat b (enc a n-a n-b (ltk b s))))       (send (cat (enc b k n-a n-b (ltk a s)) (enc a k (ltk b s)))))     ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b s))))))-  (label 24)-  (parent 23)+  (label 25)+  (parent 24)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (s s) (n-a n-a) (n-b n-b) (k k)))))  (comment "Nothing left to do")
tst/yahalom.tst view
@@ -1,6 +1,6 @@ (herald "Yahalom Protocol Without Forwarding") -(comment "CPSA 2.2.2")+(comment "CPSA 2.2.3") (comment "All input read")  (defprotocol yahalom basic@@ -207,9 +207,9 @@       (send (enc b k-0 n-a n-b (ltk a c)))))   (label 8)   (parent 4)-  (seen 10)+  (seen 10 14)   (unrealized (3 1))-  (comment "2 in cohort - 1 not yet seen"))+  (comment "4 in cohort - 2 not yet seen"))  (defskeleton yahalom   (vars (n-b n-a n-a-0 n-b-0 text) (a b c name) (k skey))@@ -254,7 +254,8 @@   (label 10)   (parent 6)   (unrealized)-  (shape))+  (shape)+  (maps ((0) ((a a) (b b) (c c) (n-b n-b) (n-a n-a) (k k)))))  (defskeleton yahalom   (vars (n-b n-a n-a-0 text) (a b c a-0 b-0 c-0 name) (k skey))@@ -332,11 +333,38 @@       (send (enc n-b k-0))))   (label 13)   (parent 8)-  (seen 14 16)+  (seen 15 17)   (unrealized (3 1))   (comment "4 in cohort - 2 not yet seen"))  (defskeleton yahalom+  (vars (n-a n-b n-a-0 text) (a b c a-0 b-0 c-0 name) (k k-0 skey))+  (defstrand resp 4 (n-a n-a) (n-b n-b) (b b) (a a) (c c) (k k))+  (defstrand serv 3 (n-a n-a) (n-b n-b) (c c) (a a) (b b) (k k))+  (defstrand init 3 (n-a n-a-0) (n-b n-b) (a a-0) (b b-0) (c c-0) (k k))+  (defstrand serv 2 (n-a n-a) (n-b n-b) (c c) (a a) (b b) (k k-0))+  (precedes ((0 1) (1 0)) ((0 1) (3 0)) ((1 1) (2 1)) ((1 2) (0 2))+    ((2 2) (0 3)) ((3 1) (2 1)))+  (non-orig (ltk a c) (ltk b c))+  (uniq-orig n-b k k-0)+  (operation nonce-test (displaced 5 2 resp 2) n-b-0 (3 1)+    (enc a n-a n-b-0 (ltk b c)) (enc b k-0 n-a n-b-0 (ltk a c)))+  (traces+    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))+      (recv (enc a k (ltk b c))) (recv (enc n-b k)))+    ((recv (cat b (enc a n-a n-b (ltk b c))))+      (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c))))+    ((send (cat a-0 n-a-0)) (recv (enc b-0 k n-a-0 n-b (ltk a-0 c-0)))+      (send (enc n-b k)))+    ((recv (cat b (enc a n-a n-b (ltk b c))))+      (send (enc b k-0 n-a n-b (ltk a c)))))+  (label 14)+  (parent 8)+  (seen 10 11 17)+  (unrealized (2 1))+  (comment "3 in cohort - 0 not yet seen"))++(defskeleton yahalom   (vars (n-b n-a text) (a b c name) (k skey))   (defstrand resp 4 (n-a n-a) (n-b n-b) (b b) (a a) (c c) (k k))   (defstrand serv 3 (n-a n-a) (n-b n-b) (c c) (a a) (b b) (k k))@@ -358,7 +386,7 @@       (send (enc n-b k)))     ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))       (send (enc n-b k))))-  (label 14)+  (label 15)   (parent 11)   (seen 10)   (unrealized)@@ -386,9 +414,9 @@       (send (enc n-b k)))     ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))       (send (enc n-b k))) ((recv k) (send k)))-  (label 15)+  (label 16)   (parent 11)-  (seen 18)+  (seen 19)   (unrealized (4 0))   (comment "2 in cohort - 1 not yet seen")) @@ -417,7 +445,7 @@       (send (enc b k-0 n-a n-b (ltk a c))))     ((send (cat a n-a)) (recv (enc b k-0 n-a n-b (ltk a c)))       (send (enc n-b k-0))))-  (label 16)+  (label 17)   (parent 13)   (unrealized (2 1))   (comment "3 in cohort - 3 not yet seen"))@@ -451,9 +479,9 @@       (send (enc b k-0 n-a n-b (ltk a c))))     ((send (cat a n-a)) (recv (enc b k-0 n-a n-b (ltk a c)))       (send (enc n-b k-0))) ((recv k-0) (send k-0)))-  (label 17)+  (label 18)   (parent 13)-  (seen 18 22)+  (seen 19 23)   (unrealized (3 1) (6 0))   (comment "3 in cohort - 1 not yet seen")) @@ -479,8 +507,8 @@       (send (enc n-b k)))     ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))       (send (enc n-b k))) ((recv k) (send k)))-  (label 18)-  (parent 15)+  (label 19)+  (parent 16)   (unrealized (4 0))   (comment "empty cohort")) @@ -509,8 +537,8 @@       (send (enc b k-0 n-a n-b (ltk a c))))     ((send (cat a n-a)) (recv (enc b k-0 n-a n-b (ltk a c)))       (send (enc n-b k-0))))-  (label 19)-  (parent 16)+  (label 20)+  (parent 17)   (unrealized)   (comment "1 in cohort - 1 not yet seen")) @@ -542,8 +570,8 @@       (send (enc n-b k-0)))     ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))       (send (enc n-b k))))-  (label 20)-  (parent 16)+  (label 21)+  (parent 17)   (unrealized (2 1))   (comment "3 in cohort - 3 not yet seen")) @@ -574,9 +602,9 @@       (send (enc b k-0 n-a n-b (ltk a c))))     ((send (cat a n-a)) (recv (enc b k-0 n-a n-b (ltk a c)))       (send (enc n-b k-0))) ((recv k-0) (send k-0)))-  (label 21)-  (parent 16)-  (seen 18 27)+  (label 22)+  (parent 17)+  (seen 19 28)   (unrealized (2 1) (5 0))   (comment "3 in cohort - 1 not yet seen")) @@ -610,8 +638,8 @@     ((recv (cat b (enc a n-a n-b (ltk b c))))       (send (enc b k-0 n-a n-b (ltk a c)))       (send (enc a k-0 (ltk b c)))))-  (label 22)-  (parent 17)+  (label 23)+  (parent 18)   (unrealized (3 1) (5 0))   (comment "empty cohort")) @@ -635,8 +663,8 @@       (send (enc n-b k)))     ((recv (cat b (enc a n-a n-b (ltk b c))))       (send (enc b k-0 n-a n-b (ltk a c)))))-  (label 23)-  (parent 19)+  (label 24)+  (parent 20)   (seen 10)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -669,8 +697,8 @@       (send (enc n-b k-0)))     ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))       (send (enc n-b k))))-  (label 24)-  (parent 20)+  (label 25)+  (parent 21)   (unrealized)   (comment "1 in cohort - 1 not yet seen")) @@ -704,11 +732,11 @@       (send (enc n-b k-0)))     ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))       (send (enc n-b k))) ((recv k) (send k)))-  (label 25)-  (parent 20)-  (seen 18 29)+  (label 26)+  (parent 21)+  (seen 30)   (unrealized (6 0))-  (comment "3 in cohort - 1 not yet seen"))+  (comment "3 in cohort - 2 not yet seen"))  (defskeleton yahalom   (vars (n-a n-b n-a-0 text) (a b c a-0 b-0 c-0 name) (k k-0 skey))@@ -740,9 +768,9 @@       (send (enc n-b k-0)))     ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))       (send (enc n-b k))) ((recv k-0) (send k-0)))-  (label 26)-  (parent 20)-  (seen 18 30)+  (label 27)+  (parent 21)+  (seen 31 32)   (unrealized (2 1) (6 0))   (comment "3 in cohort - 1 not yet seen")) @@ -773,8 +801,8 @@     ((recv (cat b (enc a n-a n-b (ltk b c))))       (send (enc b k-0 n-a n-b (ltk a c)))       (send (enc a k-0 (ltk b c)))))-  (label 27)-  (parent 21)+  (label 28)+  (parent 22)   (unrealized (2 1) (4 0))   (comment "empty cohort")) @@ -801,8 +829,8 @@       (send (enc n-b k-0)))     ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))       (send (enc n-b k))))-  (label 28)-  (parent 24)+  (label 29)+  (parent 25)   (unrealized)   (comment "1 in cohort - 1 not yet seen")) @@ -835,12 +863,43 @@       (send (enc n-b k-0)))     ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))       (send (enc n-b k))) ((recv k) (send k)))-  (label 29)-  (parent 25)+  (label 30)+  (parent 26)   (unrealized (6 0))   (comment "empty cohort"))  (defskeleton yahalom+  (vars (n-a n-b n-a-0 text) (a b c a-0 b-0 c-0 name) (k skey))+  (defstrand resp 4 (n-a n-a) (n-b n-b) (b b) (a a) (c c) (k k))+  (defstrand serv 3 (n-a n-a) (n-b n-b) (c c) (a a) (b b) (k k))+  (defstrand init 3 (n-a n-a-0) (n-b n-b) (a a-0) (b b-0) (c c-0) (k k))+  (defstrand init 3 (n-a n-a) (n-b n-b) (a a) (b b) (c c) (k k))+  (defstrand init 3 (n-a n-a) (n-b n-b) (a a) (b b) (c c) (k k))+  (deflistener k)+  (precedes ((0 1) (1 0)) ((1 1) (3 1)) ((1 1) (4 1)) ((1 2) (0 2))+    ((1 2) (5 0)) ((2 2) (0 3)) ((3 2) (2 1)) ((4 2) (2 1))+    ((5 1) (2 1)))+  (non-orig (ltk a c) (ltk b c))+  (uniq-orig n-b k)+  (operation nonce-test (displaced 3 7 serv 3) k (6 0)+    (enc b k n-a n-b (ltk a c)))+  (traces+    ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))+      (recv (enc a k (ltk b c))) (recv (enc n-b k)))+    ((recv (cat b (enc a n-a n-b (ltk b c))))+      (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c))))+    ((send (cat a-0 n-a-0)) (recv (enc b-0 k n-a-0 n-b (ltk a-0 c-0)))+      (send (enc n-b k)))+    ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))+      (send (enc n-b k)))+    ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))+      (send (enc n-b k))) ((recv k) (send k)))+  (label 31)+  (parent 26)+  (unrealized (5 0))+  (comment "empty cohort"))++(defskeleton yahalom   (vars (n-a n-b n-a-0 text) (a b c a-0 b-0 c-0 name) (k k-0 skey))   (defstrand resp 4 (n-a n-a) (n-b n-b) (b b) (a a) (c c) (k k))   (defstrand serv 3 (n-a n-a) (n-b n-b) (c c) (a a) (b b) (k k))@@ -870,8 +929,8 @@     ((recv (cat b (enc a n-a n-b (ltk b c))))       (send (enc b k-0 n-a n-b (ltk a c)))       (send (enc a k-0 (ltk b c)))))-  (label 30)-  (parent 26)+  (label 32)+  (parent 27)   (unrealized (2 1) (5 0))   (comment "empty cohort")) @@ -895,8 +954,8 @@       (send (enc b k-0 n-a n-b (ltk a c))))     ((send (cat a n-a)) (recv (enc b k n-a n-b (ltk a c)))       (send (enc n-b k))))-  (label 31)-  (parent 28)+  (label 33)+  (parent 29)   (seen 10)   (unrealized)   (comment "1 in cohort - 0 not yet seen"))@@ -928,7 +987,7 @@     ((recv (cat a n-a)) (send (cat b (enc a n-a n-b (ltk b c))))       (recv (enc a k (ltk b c))) (recv (enc n-b k)))     ((recv k) (send k)))-  (label 32)+  (label 34)   (unrealized (0 2) (0 3))   (comment "1 in cohort - 1 not yet seen")) @@ -948,8 +1007,8 @@     ((recv (cat b (enc a n-a-0 n-b-0 (ltk b c))))       (send (enc b k n-a-0 n-b-0 (ltk a c)))       (send (enc a k (ltk b c)))))-  (label 33)-  (parent 32)+  (label 35)+  (parent 34)   (unrealized (0 3) (1 0) (2 0))   (comment "2 in cohort - 2 not yet seen")) @@ -970,9 +1029,9 @@     ((recv (cat b (enc a n-a-0 n-b-0 (ltk b c))))       (send (enc b k n-a-0 n-b-0 (ltk a c))) (send (enc a k (ltk b c))))     ((recv (cat a n-a-0)) (send (cat b (enc a n-a-0 n-b-0 (ltk b c))))))-  (label 34)-  (parent 33)-  (seen 36)+  (label 36)+  (parent 35)+  (seen 38)   (unrealized (0 3) (1 0))   (comment "2 in cohort - 1 not yet seen")) @@ -991,9 +1050,9 @@       (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))     ((recv (cat b (enc a n-a n-b (ltk b c))))       (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c)))))-  (label 35)-  (parent 33)-  (seen 37)+  (label 37)+  (parent 35)+  (seen 39)   (unrealized (0 3) (1 0))   (comment "2 in cohort - 1 not yet seen")) @@ -1014,8 +1073,8 @@     ((recv (cat b (enc a n-a-0 n-b-0 (ltk b c))))       (send (enc b k n-a-0 n-b-0 (ltk a c))) (send (enc a k (ltk b c))))     ((recv (cat a n-a-0)) (send (cat b (enc a n-a-0 n-b-0 (ltk b c))))))-  (label 36)-  (parent 34)+  (label 38)+  (parent 36)   (unrealized (0 3) (1 0))   (comment "empty cohort")) @@ -1034,8 +1093,8 @@       (recv (enc a k (ltk b c))) (recv (enc n-b k))) ((recv k) (send k))     ((recv (cat b (enc a n-a n-b (ltk b c))))       (send (enc b k n-a n-b (ltk a c))) (send (enc a k (ltk b c)))))-  (label 37)-  (parent 35)+  (label 39)+  (parent 37)   (unrealized (0 3) (1 0))   (comment "empty cohort"))