dhkem.auth.outsider-cca-lr.proof

Initial state
Game 1 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          return((skS: Z_t <- sk; {23}let (skE: Z_t, pkE_2: G_t) = (z <-R Z_t; (z, exp(g, z))) in dh_2: GG_t <- concatDH(exp(pk_R, skE), exp(pk_R, skS)); enc_1: bitstring <- Serialize(pkE_2); pkS: G_t <- exp(g, skS); kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS); zz_2: eae_output_t <- (key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2); info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2); ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info))); AuthEncap_tuple(zz_2, enc_1) else AuthEncap_None))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          return((skR: Z_t <- sk; let Serialize(pkE_3: G_t) = enc_2 in dh_3: GG_t <- concatDH(exp(pkE_3, skR), exp(pk_S, skR)); pkR_1: G_t <- exp(g, skR); kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S); zz_3: eae_output_t <- (key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3); info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3); ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1))); AuthDecap_Some(zz_3) else AuthDecap_None))
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying expand
  - Expand if/find/let
    - Simplify pattern (skE: Z_t, pkE_2: G_t) (tuple expanded) at 23
    - Remove else branch of let at 23
yields

Game 2 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          skS: Z_t <- sk;
          z <-R Z_t;
          pkE_2: G_t <- exp(g, z);
          skE: Z_t <- z;
          dh_2: GG_t <- concatDH(exp(pk_R, skE), exp(pk_R, skS));
          enc_1: bitstring <- Serialize(pkE_2);
          pkS: G_t <- exp(g, skS);
          kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
          zz_2: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_2, enc_1))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          skR: Z_t <- sk;
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, skR), exp(pk_S, skR));
            pkR_1: G_t <- exp(g, skR);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying remove assignments of findcond
  - Remove assignments on skR (definition removed, all usages removed)
  - Remove assignments on skS (definition removed, all usages removed)
  - Remove assignments on skE (definition removed, all usages removed)
yields

Game 3 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
  {18}    z <-R Z_t;
          pkE_2: G_t <- exp(g, z);
          dh_2: GG_t <- concatDH(exp(pk_R, z), exp(pk_R, sk));
          enc_1: bitstring <- Serialize(pkE_2);
          pkS: G_t <- exp(g, sk);
          kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
          zz_2: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_2, enc_1))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying insert instruction find i1 <= N suchthat
      defined(sk[i1])
      && pk_R = exp(g, sk[i1]) then at occurrence 18
yields

Game 4 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z <-R Z_t;
            pkE_2: G_t <- exp(g, z);
            dh_2: GG_t <- concatDH(exp(pk_R, z), exp(pk_R, sk));
            enc_1: bitstring <- Serialize(pkE_2);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_2: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_2, enc_1))
          else
            z <-R Z_t;
            pkE_2: G_t <- exp(g, z);
            dh_2: GG_t <- concatDH(exp(pk_R, z), exp(pk_R, sk));
            enc_1: bitstring <- Serialize(pkE_2);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_2: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_2, enc_1))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying SA rename z
  - Rename variable z into z_6, z_5
yields

Game 5 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_2: G_t <- exp(g, z_5);
            dh_2: GG_t <- {36}concatDH(exp(pk_R, z_5), exp(pk_R, sk));
            enc_1: bitstring <- Serialize(pkE_2);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_2: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_2, enc_1))
          else
            z_6 <-R Z_t;
            pkE_2: G_t <- exp(g, z_6);
            dh_2: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_1: bitstring <- Serialize(pkE_2);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_2: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_2, enc_1))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying simplify
  - Simplification pass
    - Replaced concatDH(exp(pk_R, z_5), exp(pk_R, sk)) with concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk))) at 36
yields

Game 6 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_2: G_t <- exp(g, z_5);
            dh_2: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_1: bitstring <- Serialize(pkE_2);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_2: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_2, enc_1))
          else
            z_6 <-R Z_t;
            pkE_2: G_t <- exp(g, z_6);
            dh_2: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_1: bitstring <- Serialize(pkE_2);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_2: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_2, enc_1))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying SA rename enc_1
  - Rename variable enc_1 into enc_9, enc_8
yields

Game 7 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_2: G_t <- exp(g, z_5);
            dh_2: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_2);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_2: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_2, enc_8))
          else
            z_6 <-R Z_t;
            pkE_2: G_t <- exp(g, z_6);
            dh_2: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_2);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_2: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_2, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying SA rename zz_2
  - Rename variable zz_2 into zz_11, zz_10
yields

Game 8 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_2: G_t <- exp(g, z_5);
            dh_2: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_2);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_2: G_t <- exp(g, z_6);
            dh_2: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_2);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_2, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying SA rename pkE_2
  - Rename variable pkE_2 into pkE_11, pkE_10
yields

Game 9 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_2: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_10, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_2: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_11, pk_R, pkS);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying SA rename pkS
  - Rename variable pkS into pkS_5, pkS_4
yields

Game 10 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_2: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_2: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_2);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying SA rename dh_2
  - Rename variable dh_2 into dh_11, dh_10
yields

Game 11 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_2: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_2);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying SA rename kemContext_2
  - Rename variable kemContext_2 into kemContext_11, kemContext_10
yields

Game 12 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key, info));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying SA rename key
  - Rename variable key into key_6, key_5
yields

Game 13 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_5, info));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_6, info));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying SA rename info
  - Rename variable info into info_6, info_5
yields

Game 14 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_5, info_5));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_6, info_6));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
 {218}    let Serialize(pkE_3: G_t) = enc_2 in
            dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
            pkR_1: G_t <- exp(g, sk);
            kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
            zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
            return(AuthDecap_Some(zz_3))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying insert instruction find ie1 <= Qeperuser, i1 <= N suchthat
      defined(sk[i1], pk_R[ie1, i1], zz_10[ie1, i1], z_5[ie1, i1], enc_8[ie1, i1])
      && exp(g, sk) = pk_R[ie1, i1]
      && pk_S = exp(g, sk[i1])
      && enc_8[ie1, i1] = enc_2 then at occurrence 218
yields

Game 15 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_5, info_5));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_6, info_6));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(sk[i1_5], pk_R[ie1_1, i1_5], zz_10[ie1_1, i1_5], z_5[ie1_1, i1_5], enc_8[ie1_1, i1_5]) && (exp(g, sk) = pk_R[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
              return(AuthDecap_Some({319}zz_3))
            else
              return(AuthDecap_None)
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
              return(AuthDecap_Some(zz_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying replace term at occurrence 319 with zz_10[ie1, i1_4] [probability N^2 * PCollKey]
yields

Game 16 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_5, info_5));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_6, info_6));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], pk_R[ie1_1, i1_5]) && (exp(g, sk) = pk_R[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
              return(AuthDecap_Some(zz_10[ie1, i1_4]))
            else
              return(AuthDecap_None)
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
              return(AuthDecap_Some(zz_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying remove assignments of findcond
  - Remove assignments on zz_3 (definition removed, all usages removed)
  - Remove assignments on key_1 (definition removed, all usages removed)
  - Remove assignments on info_1 (definition removed, all usages removed)
  - Remove assignments on dh_3 (definition removed, all usages removed)
  - Remove assignments on kemContext_3 (definition removed, all usages removed)
  - Remove assignments on pkR_1 (definition removed, all usages removed)
yields

Game 17 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_5, info_5));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_6, info_6));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
 {218}    find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], pk_R[ie1_1, i1_5]) && {226}((exp(g, sk) = pk_R[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2)) then
 {251}      let Serialize(pkE_3: G_t) = {252}enc_2 in
              return(AuthDecap_Some(zz_10[ie1, i1_4]))
            else
              return(AuthDecap_None)
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
              return(AuthDecap_Some(zz_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying simplify [probability N^2 * PCollKey]
  - Simplification pass
    - Replaced ((exp(g, sk) = pk_R[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2)) with ((i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2)) at 226
    - Replaced enc_2 with Serialize(pkE_10[ie1, i1_4]) at 252
    - Remove else branch of let at 251
    - Simplify pattern Serialize(pkE_3: G_t) (tuple expanded) at 251
    - Replaced defined condition zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], pk_R[ie1_1, i1_5] with zz_10[ie1_1, i1_5], pkE_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5] in find at 218
yields

Game 18 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_5, info_5));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_6, info_6));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], pkE_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            pkE_3: G_t <- pkE_10[ie1, i1_4];
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
              return(AuthDecap_Some(zz_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying remove assignments of findcond
  - Remove assignments on pkE_3 (definition removed, all usages removed)
yields

Game 19 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_5, info_5));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_6, info_6));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], pkE_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
              return(AuthDecap_Some(zz_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
 {353}  return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying insert instruction let eae_input(
      salt: extract_salt_t,
      concatExtract(
        protocol1: label_protocol_t,
        suite1: suite_id_t,
        label1: label_extract_t,
        concatDH(dh1: G_t, dh2: G_t)),
      concatExpand(
        l: two_byte_t,
        protocol2: label_protocol_t,
        suite2: suite_id_t,
        label2: label_expand_t,
        concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in at occurrence 353
yields

Game 20 is
      Ostart() :=
      key_extr_3 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_5, info_5));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_6, info_6));
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], pkE_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_3, eae_input(lbytes_empty, key_1, info_1));
              return(AuthDecap_Some(zz_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          return(ExtractAndExpand_inner(key_extr_3, x1))
        else
          return(ExtractAndExpand_inner(key_extr_3, x1))
      ))


Applying equivalence rom(ExtractAndExpand_inner)
  - Equivalence rom(ExtractAndExpand_inner) with variables: key_extr_3 -> hk
yields

Game 21 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- (x_O_1: eae_input_t <- eae_input(lbytes_empty, key_5, info_5); {104}find [unique] u_42 = ri_38 <= Qeperuser, u_43 = ri_39 <= N suchthat defined(x_O[ri_38, ri_39], r[ri_38, ri_39]) && {109}(x_O_1 = x_O[ri_38, ri_39]) then r[u_42, u_43] orfind u_40 = ri_36 <= Qeperuser, u_41 = ri_37 <= N suchthat defined(x_O_1[ri_36, ri_37], r_1[ri_36, ri_37]) && (x_O_1 = x_O_1[ri_36, ri_37]) then r_1[u_40, u_41] orfind u_38 = ri_34 <= Qdperuser, u_39 = ri_35 <= N suchthat defined(x_O_2[ri_34, ri_35], r_2[ri_34, ri_35]) && (x_O_1 = x_O_2[ri_34, ri_35]) then r_2[u_38, u_39] orfind u_37 = ri_33 <= Qh suchthat defined(x_O_3[ri_33], r_3[ri_33]) && (x_O_1 = x_O_3[ri_33]) then r_3[u_37] orfind u_36 = ri_32 <= Qh suchthat defined(x_O_4[ri_32], r_4[ri_32]) && {173}(x_O_1 = x_O_4[ri_32]) then r_4[u_36] else r_1 <-R eae_output_t; r_1);
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            zz_11: eae_output_t <- (x_O: eae_input_t <- eae_input(lbytes_empty, key_6, info_6); {276}find [unique] u_34 = ri_30 <= Qeperuser, u_35 = ri_31 <= N suchthat defined(x_O[ri_30, ri_31], r[ri_30, ri_31]) && (x_O = x_O[ri_30, ri_31]) then r[u_34, u_35] orfind u_32 = ri_28 <= Qeperuser, u_33 = ri_29 <= N suchthat defined(x_O_1[ri_28, ri_29], r_1[ri_28, ri_29]) && {299}(x_O = x_O_1[ri_28, ri_29]) then r_1[u_32, u_33] orfind u_30 = ri_26 <= Qdperuser, u_31 = ri_27 <= N suchthat defined(x_O_2[ri_26, ri_27], r_2[ri_26, ri_27]) && (x_O = x_O_2[ri_26, ri_27]) then r_2[u_30, u_31] orfind u_29 = ri_25 <= Qh suchthat defined(x_O_3[ri_25], r_3[ri_25]) && (x_O = x_O_3[ri_25]) then r_3[u_29] orfind u_28 = ri_24 <= Qh suchthat defined(x_O_4[ri_24], r_4[ri_24]) && {345}(x_O = x_O_4[ri_24]) then r_4[u_28] else r <-R eae_output_t; r);
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              zz_3: eae_output_t <- (x_O_2: eae_input_t <- eae_input(lbytes_empty, key_1, info_1); {484}find [unique] u_26 = ri_22 <= Qeperuser, u_27 = ri_23 <= N suchthat defined(x_O[ri_22, ri_23], r[ri_22, ri_23]) && (x_O_2 = x_O[ri_22, ri_23]) then r[u_26, u_27] orfind u_24 = ri_20 <= Qeperuser, u_25 = ri_21 <= N suchthat defined(x_O_1[ri_20, ri_21], r_1[ri_20, ri_21]) && (x_O_2 = x_O_1[ri_20, ri_21]) then r_1[u_24, u_25] orfind u_22 = ri_18 <= Qdperuser, u_23 = ri_19 <= N suchthat defined(x_O_2[ri_18, ri_19], r_2[ri_18, ri_19]) && (x_O_2 = x_O_2[ri_18, ri_19]) then r_2[u_22, u_23] orfind u_21 = ri_17 <= Qh suchthat defined(x_O_3[ri_17], r_3[ri_17]) && (x_O_2 = x_O_3[ri_17]) then r_3[u_21] orfind u_20 = ri_16 <= Qh suchthat defined(x_O_4[ri_16], r_4[ri_16]) && {553}(x_O_2 = x_O_4[ri_16]) then r_4[u_20] else r_2 <-R eae_output_t; r_2);
              return(AuthDecap_Some(zz_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          return((x_O_3: eae_input_t <- x1; {604}find [unique] u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(x_O[ri_14, ri_15], r[ri_14, ri_15]) && (x_O_3 = x_O[ri_14, ri_15]) then r[u_18, u_19] orfind u_16 = ri_12 <= Qeperuser, u_17 = ri_13 <= N suchthat defined(x_O_1[ri_12, ri_13], r_1[ri_12, ri_13]) && (x_O_3 = x_O_1[ri_12, ri_13]) then r_1[u_16, u_17] orfind u_14 = ri_10 <= Qdperuser, u_15 = ri_11 <= N suchthat defined(x_O_2[ri_10, ri_11], r_2[ri_10, ri_11]) && (x_O_3 = x_O_2[ri_10, ri_11]) then r_2[u_14, u_15] orfind u_13 = ri_9 <= Qh suchthat defined(x_O_3[ri_9], r_3[ri_9]) && (x_O_3 = x_O_3[ri_9]) then r_3[u_13] orfind u_12 = ri_8 <= Qh suchthat defined(x_O_4[ri_8], r_4[ri_8]) && {662}(x_O_3 = x_O_4[ri_8]) then r_4[u_12] else r_3 <-R eae_output_t; r_3))
        else
          return((x_O_4: eae_input_t <- x1; {679}find [unique] u_10 = ri_6 <= Qeperuser, u_11 = ri_7 <= N suchthat defined(x_O[ri_6, ri_7], r[ri_6, ri_7]) && {684}(x_O_4 = x_O[ri_6, ri_7]) then r[u_10, u_11] orfind u_8 = ri_4 <= Qeperuser, u_9 = ri_5 <= N suchthat defined(x_O_1[ri_4, ri_5], r_1[ri_4, ri_5]) && {699}(x_O_4 = x_O_1[ri_4, ri_5]) then r_1[u_8, u_9] orfind u_6 = ri_2 <= Qdperuser, u_7 = ri_3 <= N suchthat defined(x_O_2[ri_2, ri_3], r_2[ri_2, ri_3]) && {714}(x_O_4 = x_O_2[ri_2, ri_3]) then r_2[u_6, u_7] orfind u_5 = ri_1 <= Qh suchthat defined(x_O_3[ri_1], r_3[ri_1]) && {727}(x_O_4 = x_O_3[ri_1]) then r_3[u_5] orfind u_4 = ri <= Qh suchthat defined(x_O_4[ri], r_4[ri]) && (x_O_4 = x_O_4[ri]) then r_4[u_4] else r_4 <-R eae_output_t; r_4))
      ))


Applying simplify (non-expanded game) [probability (4 * #OAEncap^2 + N^2) * PCollKey]
  - Simplification pass
    - Replaced (x_O_1 = x_O_4[ri_32]) with false at 173
    - Remove branch 5 in find at 104
    - Replaced (x_O_1 = x_O[ri_38, ri_39]) with false at 109
    - Remove branch 1 in find at 104
    - Replaced (x_O = x_O_4[ri_24]) with false at 345
    - Remove branch 5 in find at 276
    - Replaced (x_O = x_O_1[ri_28, ri_29]) with false at 299
    - Remove branch 2 in find at 276
    - Replaced (x_O_2 = x_O_4[ri_16]) with false at 553
    - Remove branch 5 in find at 484
    - Replaced (x_O_3 = x_O_4[ri_8]) with false at 662
    - Remove branch 5 in find at 604
    - Replaced (x_O_4 = x_O_3[ri_1]) with false at 727
    - Remove branch 4 in find at 679
    - Replaced (x_O_4 = x_O_2[ri_2, ri_3]) with false at 714
    - Remove branch 3 in find at 679
    - Replaced (x_O_4 = x_O_1[ri_4, ri_5]) with false at 699
    - Remove branch 2 in find at 679
    - Replaced (x_O_4 = x_O[ri_6, ri_7]) with false at 684
    - Remove branch 1 in find at 679
yields

Game 22 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- (x_O_1: eae_input_t <- eae_input(lbytes_empty, key_5, info_5); {104}find [unique] u_40 = ri_36 <= Qeperuser, u_41 = ri_37 <= N suchthat defined(x_O_1[ri_36, ri_37], r_1[ri_36, ri_37]) && (x_O_1 = x_O_1[ri_36, ri_37]) then r_1[u_40, u_41] orfind u_38 = ri_34 <= Qdperuser, u_39 = ri_35 <= N suchthat defined(x_O_2[ri_34, ri_35], r_2[ri_34, ri_35]) && (x_O_1 = x_O_2[ri_34, ri_35]) then r_2[u_38, u_39] orfind u_37 = ri_33 <= Qh suchthat defined(x_O_3[ri_33], r_3[ri_33]) && (x_O_1 = x_O_3[ri_33]) then r_3[u_37] else r_1 <-R eae_output_t; r_1);
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            zz_11: eae_output_t <- (x_O: eae_input_t <- eae_input(lbytes_empty, key_6, info_6); {246}find [unique] u_34 = ri_30 <= Qeperuser, u_35 = ri_31 <= N suchthat defined(x_O[ri_30, ri_31], r[ri_30, ri_31]) && (x_O = x_O[ri_30, ri_31]) then r[u_34, u_35] orfind u_30 = ri_26 <= Qdperuser, u_31 = ri_27 <= N suchthat defined(x_O_2[ri_26, ri_27], r_2[ri_26, ri_27]) && (x_O = x_O_2[ri_26, ri_27]) then r_2[u_30, u_31] orfind u_29 = ri_25 <= Qh suchthat defined(x_O_3[ri_25], r_3[ri_25]) && (x_O = x_O_3[ri_25]) then r_3[u_29] else r <-R eae_output_t; r);
            return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              zz_3: eae_output_t <- (x_O_2: eae_input_t <- eae_input(lbytes_empty, key_1, info_1); {424}find [unique] u_26 = ri_22 <= Qeperuser, u_27 = ri_23 <= N suchthat defined(x_O[ri_22, ri_23], r[ri_22, ri_23]) && (x_O_2 = x_O[ri_22, ri_23]) then r[u_26, u_27] orfind u_24 = ri_20 <= Qeperuser, u_25 = ri_21 <= N suchthat defined(x_O_1[ri_20, ri_21], r_1[ri_20, ri_21]) && (x_O_2 = x_O_1[ri_20, ri_21]) then r_1[u_24, u_25] orfind u_22 = ri_18 <= Qdperuser, u_23 = ri_19 <= N suchthat defined(x_O_2[ri_18, ri_19], r_2[ri_18, ri_19]) && (x_O_2 = x_O_2[ri_18, ri_19]) then r_2[u_22, u_23] orfind u_21 = ri_17 <= Qh suchthat defined(x_O_3[ri_17], r_3[ri_17]) && (x_O_2 = x_O_3[ri_17]) then r_3[u_21] else r_2 <-R eae_output_t; r_2);
              return(AuthDecap_Some(zz_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          return((x_O_3: eae_input_t <- x1; find [unique] u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(x_O[ri_14, ri_15], r[ri_14, ri_15]) && (x_O_3 = x_O[ri_14, ri_15]) then r[u_18, u_19] orfind u_16 = ri_12 <= Qeperuser, u_17 = ri_13 <= N suchthat defined(x_O_1[ri_12, ri_13], r_1[ri_12, ri_13]) && (x_O_3 = x_O_1[ri_12, ri_13]) then r_1[u_16, u_17] orfind u_14 = ri_10 <= Qdperuser, u_15 = ri_11 <= N suchthat defined(x_O_2[ri_10, ri_11], r_2[ri_10, ri_11]) && (x_O_3 = x_O_2[ri_10, ri_11]) then r_2[u_14, u_15] orfind u_13 = ri_9 <= Qh suchthat defined(x_O_3[ri_9], r_3[ri_9]) && (x_O_3 = x_O_3[ri_9]) then r_3[u_13] else r_3 <-R eae_output_t; r_3))
        else
          return((x_O_4: eae_input_t <- x1; find [unique] u_4 = ri <= Qh suchthat defined(x_O_4[ri], r_4[ri]) && (x_O_4 = x_O_4[ri]) then r_4[u_4] else r_4 <-R eae_output_t; r_4))
      ))


Applying expand [probability (2 * #OAEncap^2 + #OAEncap * N + #OAEncap * #OADecap + N^2) * PCollKey]
  - Expand if/find/let
    - Remove branch 2 in find at 424
    - Remove branch 1 in find at 424
    - Remove branch 2 in find at 246
    - Remove branch 1 in find at 246
    - Remove branch 2 in find at 104
    - Remove branch 1 in find at 104
yields

Game 23 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_1: eae_input_t <- eae_input(lbytes_empty, key_5, info_5);
            find [unique] u_37 = ri_33 <= Qh suchthat defined(x_O_3[ri_33], r_3[ri_33]) && (x_O_1 = x_O_3[ri_33]) then
              zz_10: eae_output_t <- r_3[u_37];
              return(AuthEncap_tuple(zz_10, enc_8))
            else
              r_1 <-R eae_output_t;
              zz_10: eae_output_t <- r_1;
              return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            x_O: eae_input_t <- eae_input(lbytes_empty, key_6, info_6);
            find [unique] u_29 = ri_25 <= Qh suchthat defined(x_O_3[ri_25], r_3[ri_25]) && (x_O = x_O_3[ri_25]) then
              zz_11: eae_output_t <- r_3[u_29];
              return(AuthEncap_tuple(zz_11, enc_9))
            else
              r <-R eae_output_t;
              zz_11: eae_output_t <- r;
              return(AuthEncap_tuple(zz_11, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              x_O_2: eae_input_t <- eae_input(lbytes_empty, key_1, info_1);
              find [unique] u_22 = ri_18 <= Qdperuser, u_23 = ri_19 <= N suchthat defined(x_O_2[ri_18, ri_19], r_2[ri_18, ri_19]) && (x_O_2 = x_O_2[ri_18, ri_19]) then
                zz_3: eae_output_t <- r_2[u_22, u_23];
                return(AuthDecap_Some(zz_3))
              orfind u_21 = ri_17 <= Qh suchthat defined(x_O_3[ri_17], r_3[ri_17]) && (x_O_2 = x_O_3[ri_17]) then
                zz_3: eae_output_t <- r_3[u_21];
                return(AuthDecap_Some(zz_3))
              else
                r_2 <-R eae_output_t;
                zz_3: eae_output_t <- r_2;
                return(AuthDecap_Some(zz_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          x_O_3: eae_input_t <- x1;
          find [unique] u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(x_O[ri_14, ri_15], r[ri_14, ri_15]) && (x_O_3 = x_O[ri_14, ri_15]) then
            return(r[u_18, u_19])
          orfind u_16 = ri_12 <= Qeperuser, u_17 = ri_13 <= N suchthat defined(x_O_1[ri_12, ri_13], r_1[ri_12, ri_13]) && (x_O_3 = x_O_1[ri_12, ri_13]) then
            return(r_1[u_16, u_17])
          orfind u_14 = ri_10 <= Qdperuser, u_15 = ri_11 <= N suchthat defined(x_O_2[ri_10, ri_11], r_2[ri_10, ri_11]) && (x_O_3 = x_O_2[ri_10, ri_11]) then
            return(r_2[u_14, u_15])
          orfind u_13 = ri_9 <= Qh suchthat defined(x_O_3[ri_9], r_3[ri_9]) && (x_O_3 = x_O_3[ri_9]) then
            return(r_3[u_13])
          else
            r_3 <-R eae_output_t;
            return(r_3)
        else
          x_O_4: eae_input_t <- x1;
          find [unique] u_4 = ri <= Qh suchthat defined(x_O_4[ri], r_4[ri]) && (x_O_4 = x_O_4[ri]) then
            return(r_4[u_4])
          else
            r_4 <-R eae_output_t;
            return(r_4)
      ))


Applying remove assignments of findcond
  - Remove assignments on x_O_4 (definition point kept, all usages removed)
  - Remove assignments on x_O_3 (definition point kept, all usages removed)
  - Remove assignments on zz_3 (definition removed, all usages removed)
  - Remove assignments on zz_3 (definition removed, all usages removed)
  - Remove assignments on zz_3 (definition removed, all usages removed)
  - Remove assignments on zz_11 (definition removed, all usages removed)
  - Remove assignments on zz_11 (definition removed, all usages removed)
  - Remove assignments on zz_10 (definition kept, array references kept)
  - Remove assignments on zz_10 (definition kept, array references kept)
yields

Game 24 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_1: eae_input_t <- eae_input(lbytes_empty, key_5, info_5);
 {103}      find [unique] u_37 = ri_33 <= Qh suchthat defined(x1[ri_33], x_O_3[ri_33], r_3[ri_33]) && {107}(x_O_1 = x1[ri_33]) then
              zz_10: eae_output_t <- r_3[u_37];
              return(AuthEncap_tuple(r_3[u_37], enc_8))
            else
              r_1 <-R eae_output_t;
              zz_10: eae_output_t <- r_1;
              return(AuthEncap_tuple(r_1, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            x_O: eae_input_t <- eae_input(lbytes_empty, key_6, info_6);
 {224}      find [unique] u_29 = ri_25 <= Qh suchthat defined(x1[ri_25], x_O_3[ri_25], r_3[ri_25]) && {228}(x_O = x1[ri_25]) then
              return(AuthEncap_tuple(r_3[u_29], enc_9))
            else
              r <-R eae_output_t;
              return(AuthEncap_tuple(r, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              x_O_2: eae_input_t <- eae_input(lbytes_empty, key_1, info_1);
 {370}        find [unique] u_22 = ri_18 <= Qdperuser, u_23 = ri_19 <= N suchthat defined(x_O_2[ri_18, ri_19], r_2[ri_18, ri_19]) && {375}(x_O_2 = x_O_2[ri_18, ri_19]) then
                return(AuthDecap_Some(r_2[u_22, u_23]))
              orfind u_21 = ri_17 <= Qh suchthat defined(x1[ri_17], x_O_3[ri_17], r_3[ri_17]) && {396}(x_O_2 = x1[ri_17]) then
                return(AuthDecap_Some(r_3[u_21]))
              else
                r_2 <-R eae_output_t;
                return(AuthDecap_Some(r_2))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          x_O_3: eae_input_t <- cst_eae_input_t;
 {445}    find [unique] u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(x_O[ri_14, ri_15], r[ri_14, ri_15]) && {450}(x1 = x_O[ri_14, ri_15]) then
            return(r[u_18, u_19])
          orfind u_16 = ri_12 <= Qeperuser, u_17 = ri_13 <= N suchthat defined(x_O_1[ri_12, ri_13], r_1[ri_12, ri_13]) && {468}(x1 = x_O_1[ri_12, ri_13]) then
            return(r_1[u_16, u_17])
          orfind u_14 = ri_10 <= Qdperuser, u_15 = ri_11 <= N suchthat defined(x_O_2[ri_10, ri_11], r_2[ri_10, ri_11]) && {486}(x1 = x_O_2[ri_10, ri_11]) then
            return(r_2[u_14, u_15])
          orfind u_13 = ri_9 <= Qh suchthat defined(x1[ri_9], x_O_3[ri_9], r_3[ri_9]) && {503}(x1 = x1[ri_9]) then
            return(r_3[u_13])
          else
            r_3 <-R eae_output_t;
            return(r_3)
        else
          x_O_4: eae_input_t <- cst_eae_input_t;
 {523}    find [unique] u_4 = ri <= Qh suchthat defined(x1[ri], x_O_4[ri], r_4[ri]) && (x1 = x1[ri]) then
            return(r_4[u_4])
          else
            r_4 <-R eae_output_t;
            return(r_4)
      ))


Applying simplify [probability N^2 * PCollKey]
  - Simplification pass
    - Replaced defined condition x1[ri], x_O_4[ri], r_4[ri] with r_4[ri], x1[ri] in find at 523
    - Replaced (x1 = x1[ri_9]) with ((pkS' = pkS'[ri_9]) && (pkR' = pkR'[ri_9]) && (pkE' = pkE'[ri_9]) && (label2 = label2[ri_9]) && (suite2 = suite2[ri_9]) && (protocol2 = protocol2[ri_9]) && (l = l[ri_9]) && (dh2 = dh2[ri_9]) && (dh1 = dh1[ri_9]) && (label1 = label1[ri_9]) && (suite1 = suite1[ri_9]) && (protocol1 = protocol1[ri_9]) && (salt = salt[ri_9])) at 503
    - Replaced defined condition x1[ri_9], x_O_3[ri_9], r_3[ri_9] with r_3[ri_9], salt[ri_9], protocol1[ri_9], suite1[ri_9], label1[ri_9], dh1[ri_9], dh2[ri_9], l[ri_9], protocol2[ri_9], suite2[ri_9], label2[ri_9], pkE'[ri_9], pkR'[ri_9], pkS'[ri_9] in find at 445
    - Replaced (x1 = x_O_2[ri_10, ri_11]) with ((pkS' = pk_S[ri_10, ri_11]) && (pkR' = pkR_1[ri_10, ri_11]) && (pkE' = pkE_3[ri_10, ri_11]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_10, ri_11], sk[ri_11])) && (dh1 = exp(pkE_3[ri_10, ri_11], sk[ri_11])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty)) at 486
    - Replaced defined condition x_O_2[ri_10, ri_11], r_2[ri_10, ri_11] with r_2[ri_10, ri_11], sk[ri_11], pkE_3[ri_10, ri_11], pkR_1[ri_10, ri_11], pk_S[ri_10, ri_11] in find at 445
    - Replaced (x1 = x_O_1[ri_12, ri_13]) with ((pkS' = pkS_4[ri_12, ri_13]) && (pkR' = pk_R[ri_12, ri_13]) && (pkE' = pkE_10[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[i1_2[ri_12, ri_13]], sk[ri_13]))) && (dh1 = exp(g, mult(sk[i1_2[ri_12, ri_13]], z_5[ri_12, ri_13]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty)) at 468
    - Replaced defined condition x_O_1[ri_12, ri_13], r_1[ri_12, ri_13] with r_1[ri_12, ri_13], z_5[ri_12, ri_13], sk[ri_13], sk[i1_2[ri_12, ri_13]], pkE_10[ri_12, ri_13], pk_R[ri_12, ri_13], pkS_4[ri_12, ri_13] in find at 445
    - Replaced (x1 = x_O[ri_14, ri_15]) with ((pkS' = pkS_5[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_11[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_14, ri_15], sk[ri_15])) && (dh1 = exp(pk_R[ri_14, ri_15], z_6[ri_14, ri_15])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty)) at 450
    - Replaced defined condition x_O[ri_14, ri_15], r[ri_14, ri_15] with r[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], pkE_11[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_5[ri_14, ri_15] in find at 445
    - Replaced (x_O_2 = x1[ri_17]) with ((pk_S = pkS'[ri_17]) && (pkR_1 = pkR'[ri_17]) && (pkE_3 = pkE'[ri_17]) && (label_shared_secret = label2[ri_17]) && (suite_id = suite2[ri_17]) && (RFCXXXX = protocol2[ri_17]) && (I2OSP2(Nsecret) = l[ri_17]) && (exp(pk_S, sk) = dh2[ri_17]) && (exp(pkE_3, sk) = dh1[ri_17]) && (label_eae_prk = label1[ri_17]) && (suite_id = suite1[ri_17]) && (RFCXXXX = protocol1[ri_17]) && (lbytes_empty = salt[ri_17])) at 396
    - Replaced defined condition x1[ri_17], x_O_3[ri_17], r_3[ri_17] with r_3[ri_17], salt[ri_17], protocol1[ri_17], suite1[ri_17], label1[ri_17], dh1[ri_17], dh2[ri_17], l[ri_17], protocol2[ri_17], suite2[ri_17], label2[ri_17], pkE'[ri_17], pkR'[ri_17], pkS'[ri_17] in find at 370
    - Replaced (x_O_2 = x_O_2[ri_18, ri_19]) with ((pk_S = pk_S[ri_18, ri_19]) && (i = ri_19) && (pkE_3 = pkE_3[ri_18, ri_19])) at 375
    - In branch 1 of find at 370, substituting u_23 with i
    - Replaced defined condition x_O_2[ri_18, ri_19], r_2[ri_18, ri_19] with r_2[ri_18], pkE_3[ri_18], pk_S[ri_18] in find at 370
    - Replaced (x_O = x1[ri_25]) with ((pkS_5 = pkS'[ri_25]) && (pk_R = pkR'[ri_25]) && (pkE_11 = pkE'[ri_25]) && (label_shared_secret = label2[ri_25]) && (suite_id = suite2[ri_25]) && (RFCXXXX = protocol2[ri_25]) && (I2OSP2(Nsecret) = l[ri_25]) && (exp(pk_R, sk) = dh2[ri_25]) && (exp(pk_R, z_6) = dh1[ri_25]) && (label_eae_prk = label1[ri_25]) && (suite_id = suite1[ri_25]) && (RFCXXXX = protocol1[ri_25]) && (lbytes_empty = salt[ri_25])) at 228
    - Replaced defined condition x1[ri_25], x_O_3[ri_25], r_3[ri_25] with r_3[ri_25], salt[ri_25], protocol1[ri_25], suite1[ri_25], label1[ri_25], dh1[ri_25], dh2[ri_25], l[ri_25], protocol2[ri_25], suite2[ri_25], label2[ri_25], pkE'[ri_25], pkR'[ri_25], pkS'[ri_25] in find at 224
    - Replaced (x_O_1 = x1[ri_33]) with ((pkS_4 = pkS'[ri_33]) && (pk_R = pkR'[ri_33]) && (pkE_10 = pkE'[ri_33]) && (label_shared_secret = label2[ri_33]) && (suite_id = suite2[ri_33]) && (RFCXXXX = protocol2[ri_33]) && (I2OSP2(Nsecret) = l[ri_33]) && (exp(g, mult(sk[i1_2], sk)) = dh2[ri_33]) && (exp(g, mult(sk[i1_2], z_5)) = dh1[ri_33]) && (label_eae_prk = label1[ri_33]) && (suite_id = suite1[ri_33]) && (RFCXXXX = protocol1[ri_33]) && (lbytes_empty = salt[ri_33])) at 107
    - Replaced defined condition x1[ri_33], x_O_3[ri_33], r_3[ri_33] with r_3[ri_33], salt[ri_33], protocol1[ri_33], suite1[ri_33], label1[ri_33], dh1[ri_33], dh2[ri_33], l[ri_33], protocol2[ri_33], suite2[ri_33], label2[ri_33], pkE'[ri_33], pkR'[ri_33], pkS'[ri_33] in find at 103
yields

Game 25 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_1: eae_input_t <- eae_input(lbytes_empty, key_5, info_5);
            find [unique] u_37 = ri_33 <= Qh suchthat defined(r_3[ri_33], salt[ri_33], protocol1[ri_33], suite1[ri_33], label1[ri_33], dh1[ri_33], dh2[ri_33], l[ri_33], protocol2[ri_33], suite2[ri_33], label2[ri_33], pkE'[ri_33], pkR'[ri_33], pkS'[ri_33]) && (pkS_4 = pkS'[ri_33]) && (pk_R = pkR'[ri_33]) && (pkE_10 = pkE'[ri_33]) && (label_shared_secret = label2[ri_33]) && (suite_id = suite2[ri_33]) && (RFCXXXX = protocol2[ri_33]) && (I2OSP2(Nsecret) = l[ri_33]) && (exp(g, mult(sk[i1_2], sk)) = dh2[ri_33]) && (exp(g, mult(sk[i1_2], z_5)) = dh1[ri_33]) && (label_eae_prk = label1[ri_33]) && (suite_id = suite1[ri_33]) && (RFCXXXX = protocol1[ri_33]) && (lbytes_empty = salt[ri_33]) then
              zz_10: eae_output_t <- r_3[u_37];
              return(AuthEncap_tuple(r_3[u_37], enc_8))
            else
              r_1 <-R eae_output_t;
              zz_10: eae_output_t <- r_1;
              return(AuthEncap_tuple(r_1, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            x_O: eae_input_t <- eae_input(lbytes_empty, key_6, info_6);
            find [unique] u_29 = ri_25 <= Qh suchthat defined(r_3[ri_25], salt[ri_25], protocol1[ri_25], suite1[ri_25], label1[ri_25], dh1[ri_25], dh2[ri_25], l[ri_25], protocol2[ri_25], suite2[ri_25], label2[ri_25], pkE'[ri_25], pkR'[ri_25], pkS'[ri_25]) && (pkS_5 = pkS'[ri_25]) && (pk_R = pkR'[ri_25]) && (pkE_11 = pkE'[ri_25]) && (label_shared_secret = label2[ri_25]) && (suite_id = suite2[ri_25]) && (RFCXXXX = protocol2[ri_25]) && (I2OSP2(Nsecret) = l[ri_25]) && (exp(pk_R, sk) = dh2[ri_25]) && (exp(pk_R, z_6) = dh1[ri_25]) && (label_eae_prk = label1[ri_25]) && (suite_id = suite1[ri_25]) && (RFCXXXX = protocol1[ri_25]) && (lbytes_empty = salt[ri_25]) then
              return(AuthEncap_tuple(r_3[u_29], enc_9))
            else
              r <-R eae_output_t;
              return(AuthEncap_tuple(r, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              x_O_2: eae_input_t <- eae_input(lbytes_empty, key_1, info_1);
              find [unique] u_22 = ri_18 <= Qdperuser suchthat defined(r_2[ri_18], pkE_3[ri_18], pk_S[ri_18]) && {557}((pk_S = pk_S[ri_18]) && (i = i) && (pkE_3 = pkE_3[ri_18])) then
                u_23 <= N <- i;
                return(AuthDecap_Some(r_2[u_22]))
              orfind u_21 = ri_17 <= Qh suchthat defined(r_3[ri_17], salt[ri_17], protocol1[ri_17], suite1[ri_17], label1[ri_17], dh1[ri_17], dh2[ri_17], l[ri_17], protocol2[ri_17], suite2[ri_17], label2[ri_17], pkE'[ri_17], pkR'[ri_17], pkS'[ri_17]) && (pk_S = pkS'[ri_17]) && (pkR_1 = pkR'[ri_17]) && (pkE_3 = pkE'[ri_17]) && (label_shared_secret = label2[ri_17]) && (suite_id = suite2[ri_17]) && (RFCXXXX = protocol2[ri_17]) && (I2OSP2(Nsecret) = l[ri_17]) && (exp(pk_S, sk) = dh2[ri_17]) && (exp(pkE_3, sk) = dh1[ri_17]) && (label_eae_prk = label1[ri_17]) && (suite_id = suite1[ri_17]) && (RFCXXXX = protocol1[ri_17]) && (lbytes_empty = salt[ri_17]) then
                return(AuthDecap_Some(r_3[u_21]))
              else
                r_2 <-R eae_output_t;
                return(AuthDecap_Some(r_2))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          x_O_3: eae_input_t <- cst_eae_input_t;
          find [unique] u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], pkE_11[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_5[ri_14, ri_15]) && (pkS' = pkS_5[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_11[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_14, ri_15], sk[ri_15])) && (dh1 = exp(pk_R[ri_14, ri_15], z_6[ri_14, ri_15])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r[u_18, u_19])
          orfind u_16 = ri_12 <= Qeperuser, u_17 = ri_13 <= N suchthat defined(r_1[ri_12, ri_13], z_5[ri_12, ri_13], sk[ri_13], sk[i1_2[ri_12, ri_13]], pkE_10[ri_12, ri_13], pk_R[ri_12, ri_13], pkS_4[ri_12, ri_13]) && (pkS' = pkS_4[ri_12, ri_13]) && (pkR' = pk_R[ri_12, ri_13]) && (pkE' = pkE_10[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[i1_2[ri_12, ri_13]], sk[ri_13]))) && (dh1 = exp(g, mult(sk[i1_2[ri_12, ri_13]], z_5[ri_12, ri_13]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_1[u_16, u_17])
          orfind u_14 = ri_10 <= Qdperuser, u_15 = ri_11 <= N suchthat defined(r_2[ri_10, ri_11], sk[ri_11], pkE_3[ri_10, ri_11], pkR_1[ri_10, ri_11], pk_S[ri_10, ri_11]) && (pkS' = pk_S[ri_10, ri_11]) && (pkR' = pkR_1[ri_10, ri_11]) && (pkE' = pkE_3[ri_10, ri_11]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_10, ri_11], sk[ri_11])) && (dh1 = exp(pkE_3[ri_10, ri_11], sk[ri_11])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_14, u_15])
          orfind u_13 = ri_9 <= Qh suchthat defined(r_3[ri_9], salt[ri_9], protocol1[ri_9], suite1[ri_9], label1[ri_9], dh1[ri_9], dh2[ri_9], l[ri_9], protocol2[ri_9], suite2[ri_9], label2[ri_9], pkE'[ri_9], pkR'[ri_9], pkS'[ri_9]) && (pkS' = pkS'[ri_9]) && (pkR' = pkR'[ri_9]) && (pkE' = pkE'[ri_9]) && (label2 = label2[ri_9]) && (suite2 = suite2[ri_9]) && (protocol2 = protocol2[ri_9]) && (l = l[ri_9]) && (dh2 = dh2[ri_9]) && (dh1 = dh1[ri_9]) && (label1 = label1[ri_9]) && (suite1 = suite1[ri_9]) && (protocol1 = protocol1[ri_9]) && (salt = salt[ri_9]) then
            return(r_3[u_13])
          else
            r_3 <-R eae_output_t;
            return(r_3)
        else
          x_O_4: eae_input_t <- cst_eae_input_t;
          find [unique] u_4 = ri <= Qh suchthat defined(r_4[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_4[u_4])
          else
            r_4 <-R eae_output_t;
            return(r_4)
      ))


Applying simplify
  - Simplification pass
    - Replaced ((pk_S = pk_S[ri_18]) && (i = i) && (pkE_3 = pkE_3[ri_18])) with ((pk_S = pk_S[ri_18]) && (pkE_3 = pkE_3[ri_18])) at 557
yields

Game 26 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R, pkS_4);
            key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_1: eae_input_t <- eae_input(lbytes_empty, key_5, info_5);
            find [unique] u_37 = ri_33 <= Qh suchthat defined(r_3[ri_33], salt[ri_33], protocol1[ri_33], suite1[ri_33], label1[ri_33], dh1[ri_33], dh2[ri_33], l[ri_33], protocol2[ri_33], suite2[ri_33], label2[ri_33], pkE'[ri_33], pkR'[ri_33], pkS'[ri_33]) && (pkS_4 = pkS'[ri_33]) && (pk_R = pkR'[ri_33]) && (pkE_10 = pkE'[ri_33]) && (label_shared_secret = label2[ri_33]) && (suite_id = suite2[ri_33]) && (RFCXXXX = protocol2[ri_33]) && (I2OSP2(Nsecret) = l[ri_33]) && (exp(g, mult(sk[i1_2], sk)) = dh2[ri_33]) && (exp(g, mult(sk[i1_2], z_5)) = dh1[ri_33]) && (label_eae_prk = label1[ri_33]) && (suite_id = suite1[ri_33]) && (RFCXXXX = protocol1[ri_33]) && (lbytes_empty = salt[ri_33]) then
              zz_10: eae_output_t <- r_3[u_37];
              return(AuthEncap_tuple(r_3[u_37], enc_8))
            else
              r_1 <-R eae_output_t;
              zz_10: eae_output_t <- r_1;
              return(AuthEncap_tuple(r_1, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            kemContext_11: GGG_t <- concatContext(pkE_11, pk_R, pkS_5);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
            x_O: eae_input_t <- eae_input(lbytes_empty, key_6, info_6);
            find [unique] u_29 = ri_25 <= Qh suchthat defined(r_3[ri_25], salt[ri_25], protocol1[ri_25], suite1[ri_25], label1[ri_25], dh1[ri_25], dh2[ri_25], l[ri_25], protocol2[ri_25], suite2[ri_25], label2[ri_25], pkE'[ri_25], pkR'[ri_25], pkS'[ri_25]) && (pkS_5 = pkS'[ri_25]) && (pk_R = pkR'[ri_25]) && (pkE_11 = pkE'[ri_25]) && (label_shared_secret = label2[ri_25]) && (suite_id = suite2[ri_25]) && (RFCXXXX = protocol2[ri_25]) && (I2OSP2(Nsecret) = l[ri_25]) && (exp(pk_R, sk) = dh2[ri_25]) && (exp(pk_R, z_6) = dh1[ri_25]) && (label_eae_prk = label1[ri_25]) && (suite_id = suite1[ri_25]) && (RFCXXXX = protocol1[ri_25]) && (lbytes_empty = salt[ri_25]) then
              return(AuthEncap_tuple(r_3[u_29], enc_9))
            else
              r <-R eae_output_t;
              return(AuthEncap_tuple(r, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pk_S);
              key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
              info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
              x_O_2: eae_input_t <- eae_input(lbytes_empty, key_1, info_1);
              find [unique] u_22 = ri_18 <= Qdperuser suchthat defined(r_2[ri_18], pkE_3[ri_18], pk_S[ri_18]) && (pk_S = pk_S[ri_18]) && (pkE_3 = pkE_3[ri_18]) then
                u_23 <= N <- i;
                return(AuthDecap_Some(r_2[u_22]))
              orfind u_21 = ri_17 <= Qh suchthat defined(r_3[ri_17], salt[ri_17], protocol1[ri_17], suite1[ri_17], label1[ri_17], dh1[ri_17], dh2[ri_17], l[ri_17], protocol2[ri_17], suite2[ri_17], label2[ri_17], pkE'[ri_17], pkR'[ri_17], pkS'[ri_17]) && (pk_S = pkS'[ri_17]) && (pkR_1 = pkR'[ri_17]) && (pkE_3 = pkE'[ri_17]) && (label_shared_secret = label2[ri_17]) && (suite_id = suite2[ri_17]) && (RFCXXXX = protocol2[ri_17]) && (I2OSP2(Nsecret) = l[ri_17]) && (exp(pk_S, sk) = dh2[ri_17]) && (exp(pkE_3, sk) = dh1[ri_17]) && (label_eae_prk = label1[ri_17]) && (suite_id = suite1[ri_17]) && (RFCXXXX = protocol1[ri_17]) && (lbytes_empty = salt[ri_17]) then
                return(AuthDecap_Some(r_3[u_21]))
              else
                r_2 <-R eae_output_t;
                return(AuthDecap_Some(r_2))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          x_O_3: eae_input_t <- cst_eae_input_t;
          find [unique] u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], pkE_11[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_5[ri_14, ri_15]) && (pkS' = pkS_5[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_11[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_14, ri_15], sk[ri_15])) && (dh1 = exp(pk_R[ri_14, ri_15], z_6[ri_14, ri_15])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r[u_18, u_19])
          orfind u_16 = ri_12 <= Qeperuser, u_17 = ri_13 <= N suchthat defined(r_1[ri_12, ri_13], z_5[ri_12, ri_13], sk[ri_13], sk[i1_2[ri_12, ri_13]], pkE_10[ri_12, ri_13], pk_R[ri_12, ri_13], pkS_4[ri_12, ri_13]) && (pkS' = pkS_4[ri_12, ri_13]) && (pkR' = pk_R[ri_12, ri_13]) && (pkE' = pkE_10[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[i1_2[ri_12, ri_13]], sk[ri_13]))) && (dh1 = exp(g, mult(sk[i1_2[ri_12, ri_13]], z_5[ri_12, ri_13]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_1[u_16, u_17])
          orfind u_14 = ri_10 <= Qdperuser, u_15 = ri_11 <= N suchthat defined(r_2[ri_10, ri_11], sk[ri_11], pkE_3[ri_10, ri_11], pkR_1[ri_10, ri_11], pk_S[ri_10, ri_11]) && (pkS' = pk_S[ri_10, ri_11]) && (pkR' = pkR_1[ri_10, ri_11]) && (pkE' = pkE_3[ri_10, ri_11]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_10, ri_11], sk[ri_11])) && (dh1 = exp(pkE_3[ri_10, ri_11], sk[ri_11])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_14, u_15])
          orfind u_13 = ri_9 <= Qh suchthat defined(r_3[ri_9], salt[ri_9], protocol1[ri_9], suite1[ri_9], label1[ri_9], dh1[ri_9], dh2[ri_9], l[ri_9], protocol2[ri_9], suite2[ri_9], label2[ri_9], pkE'[ri_9], pkR'[ri_9], pkS'[ri_9]) && (pkS' = pkS'[ri_9]) && (pkR' = pkR'[ri_9]) && (pkE' = pkE'[ri_9]) && (label2 = label2[ri_9]) && (suite2 = suite2[ri_9]) && (protocol2 = protocol2[ri_9]) && (l = l[ri_9]) && (dh2 = dh2[ri_9]) && (dh1 = dh1[ri_9]) && (label1 = label1[ri_9]) && (suite1 = suite1[ri_9]) && (protocol1 = protocol1[ri_9]) && (salt = salt[ri_9]) then
            return(r_3[u_13])
          else
            r_3 <-R eae_output_t;
            return(r_3)
        else
          x_O_4: eae_input_t <- cst_eae_input_t;
          find [unique] u_4 = ri <= Qh suchthat defined(r_4[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_4[u_4])
          else
            r_4 <-R eae_output_t;
            return(r_4)
      ))


Applying move all binders
  - Move assignment to x_O_4
  - Move assignment to x_O_3
  - Move assignment to x_O_2
  - Move assignment to info_1
  - Move assignment to key_1
  - Move assignment to kemContext_3
  - Move assignment to x_O
  - Move assignment to info_6
  - Move assignment to key_6
  - Move assignment to kemContext_11
  - Move assignment to x_O_1
  - Move assignment to info_5
  - Move assignment to key_5
  - Move assignment to kemContext_10
yields

Game 27 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk[i1_2], z_5)), exp(g, mult(sk[i1_2], sk)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            find [unique] u_37 = ri_33 <= Qh suchthat defined(r_3[ri_33], salt[ri_33], protocol1[ri_33], suite1[ri_33], label1[ri_33], dh1[ri_33], dh2[ri_33], l[ri_33], protocol2[ri_33], suite2[ri_33], label2[ri_33], pkE'[ri_33], pkR'[ri_33], pkS'[ri_33]) && (pkS_4 = pkS'[ri_33]) && (pk_R = pkR'[ri_33]) && (pkE_10 = pkE'[ri_33]) && (label_shared_secret = label2[ri_33]) && (suite_id = suite2[ri_33]) && (RFCXXXX = protocol2[ri_33]) && (I2OSP2(Nsecret) = l[ri_33]) && (exp(g, mult(sk[i1_2], sk)) = dh2[ri_33]) && (exp(g, mult(sk[i1_2], z_5)) = dh1[ri_33]) && (label_eae_prk = label1[ri_33]) && (suite_id = suite1[ri_33]) && (RFCXXXX = protocol1[ri_33]) && (lbytes_empty = salt[ri_33]) then
              zz_10: eae_output_t <- r_3[u_37];
              return(AuthEncap_tuple(r_3[u_37], enc_8))
            else
              r_1 <-R eae_output_t;
              zz_10: eae_output_t <- r_1;
              return(AuthEncap_tuple(r_1, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            dh_11: GG_t <- concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            find [unique] u_29 = ri_25 <= Qh suchthat defined(r_3[ri_25], salt[ri_25], protocol1[ri_25], suite1[ri_25], label1[ri_25], dh1[ri_25], dh2[ri_25], l[ri_25], protocol2[ri_25], suite2[ri_25], label2[ri_25], pkE'[ri_25], pkR'[ri_25], pkS'[ri_25]) && (pkS_5 = pkS'[ri_25]) && (pk_R = pkR'[ri_25]) && (pkE_11 = pkE'[ri_25]) && (label_shared_secret = label2[ri_25]) && (suite_id = suite2[ri_25]) && (RFCXXXX = protocol2[ri_25]) && (I2OSP2(Nsecret) = l[ri_25]) && (exp(pk_R, sk) = dh2[ri_25]) && (exp(pk_R, z_6) = dh1[ri_25]) && (label_eae_prk = label1[ri_25]) && (suite_id = suite1[ri_25]) && (RFCXXXX = protocol1[ri_25]) && (lbytes_empty = salt[ri_25]) then
              return(AuthEncap_tuple(r_3[u_29], enc_9))
            else
              r <-R eae_output_t;
              return(AuthEncap_tuple(r, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              dh_3: GG_t <- concatDH(exp(pkE_3, sk), exp(pk_S, sk));
              pkR_1: G_t <- exp(g, sk);
              find [unique] u_22 = ri_18 <= Qdperuser suchthat defined(r_2[ri_18], pkE_3[ri_18], pk_S[ri_18]) && (pk_S = pk_S[ri_18]) && (pkE_3 = pkE_3[ri_18]) then
                u_23 <= N <- i;
                return(AuthDecap_Some(r_2[u_22]))
              orfind u_21 = ri_17 <= Qh suchthat defined(r_3[ri_17], salt[ri_17], protocol1[ri_17], suite1[ri_17], label1[ri_17], dh1[ri_17], dh2[ri_17], l[ri_17], protocol2[ri_17], suite2[ri_17], label2[ri_17], pkE'[ri_17], pkR'[ri_17], pkS'[ri_17]) && (pk_S = pkS'[ri_17]) && (pkR_1 = pkR'[ri_17]) && (pkE_3 = pkE'[ri_17]) && (label_shared_secret = label2[ri_17]) && (suite_id = suite2[ri_17]) && (RFCXXXX = protocol2[ri_17]) && (I2OSP2(Nsecret) = l[ri_17]) && (exp(pk_S, sk) = dh2[ri_17]) && (exp(pkE_3, sk) = dh1[ri_17]) && (label_eae_prk = label1[ri_17]) && (suite_id = suite1[ri_17]) && (RFCXXXX = protocol1[ri_17]) && (lbytes_empty = salt[ri_17]) then
                return(AuthDecap_Some(r_3[u_21]))
              else
                r_2 <-R eae_output_t;
                return(AuthDecap_Some(r_2))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          find [unique] u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], pkE_11[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_5[ri_14, ri_15]) && (pkS' = pkS_5[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_11[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_14, ri_15], sk[ri_15])) && (dh1 = exp(pk_R[ri_14, ri_15], z_6[ri_14, ri_15])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r[u_18, u_19])
          orfind u_16 = ri_12 <= Qeperuser, u_17 = ri_13 <= N suchthat defined(r_1[ri_12, ri_13], z_5[ri_12, ri_13], sk[ri_13], sk[i1_2[ri_12, ri_13]], pkE_10[ri_12, ri_13], pk_R[ri_12, ri_13], pkS_4[ri_12, ri_13]) && (pkS' = pkS_4[ri_12, ri_13]) && (pkR' = pk_R[ri_12, ri_13]) && (pkE' = pkE_10[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[i1_2[ri_12, ri_13]], sk[ri_13]))) && (dh1 = exp(g, mult(sk[i1_2[ri_12, ri_13]], z_5[ri_12, ri_13]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_1[u_16, u_17])
          orfind u_14 = ri_10 <= Qdperuser, u_15 = ri_11 <= N suchthat defined(r_2[ri_10, ri_11], sk[ri_11], pkE_3[ri_10, ri_11], pkR_1[ri_10, ri_11], pk_S[ri_10, ri_11]) && (pkS' = pk_S[ri_10, ri_11]) && (pkR' = pkR_1[ri_10, ri_11]) && (pkE' = pkE_3[ri_10, ri_11]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_10, ri_11], sk[ri_11])) && (dh1 = exp(pkE_3[ri_10, ri_11], sk[ri_11])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_14, u_15])
          orfind u_13 = ri_9 <= Qh suchthat defined(r_3[ri_9], salt[ri_9], protocol1[ri_9], suite1[ri_9], label1[ri_9], dh1[ri_9], dh2[ri_9], l[ri_9], protocol2[ri_9], suite2[ri_9], label2[ri_9], pkE'[ri_9], pkR'[ri_9], pkS'[ri_9]) && (pkS' = pkS'[ri_9]) && (pkR' = pkR'[ri_9]) && (pkE' = pkE'[ri_9]) && (label2 = label2[ri_9]) && (suite2 = suite2[ri_9]) && (protocol2 = protocol2[ri_9]) && (l = l[ri_9]) && (dh2 = dh2[ri_9]) && (dh1 = dh1[ri_9]) && (label1 = label1[ri_9]) && (suite1 = suite1[ri_9]) && (protocol1 = protocol1[ri_9]) && (salt = salt[ri_9]) then
            return(r_3[u_13])
          else
            r_3 <-R eae_output_t;
            return(r_3)
        else
          find [unique] u_4 = ri <= Qh suchthat defined(r_4[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_4[u_4])
          else
            r_4 <-R eae_output_t;
            return(r_4)
      ))


Applying remove assignments of findcond
  - Remove assignments on dh_3 (definition removed, all usages removed)
  - Remove assignments on u_23 (definition removed, all usages removed)
  - Remove assignments on dh_11 (definition removed, all usages removed)
  - Remove assignments on dh_10 (definition removed, all usages removed)
yields

Game 28 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            find [unique] u_37 = ri_33 <= Qh suchthat defined(r_3[ri_33], salt[ri_33], protocol1[ri_33], suite1[ri_33], label1[ri_33], dh1[ri_33], dh2[ri_33], l[ri_33], protocol2[ri_33], suite2[ri_33], label2[ri_33], pkE'[ri_33], pkR'[ri_33], pkS'[ri_33]) && (pkS_4 = pkS'[ri_33]) && (pk_R = pkR'[ri_33]) && (pkE_10 = pkE'[ri_33]) && (label_shared_secret = label2[ri_33]) && (suite_id = suite2[ri_33]) && (RFCXXXX = protocol2[ri_33]) && (I2OSP2(Nsecret) = l[ri_33]) && (exp(g, mult(sk[i1_2], sk)) = dh2[ri_33]) && (exp(g, mult(sk[i1_2], z_5)) = dh1[ri_33]) && (label_eae_prk = label1[ri_33]) && (suite_id = suite1[ri_33]) && (RFCXXXX = protocol1[ri_33]) && (lbytes_empty = salt[ri_33]) then
              zz_10: eae_output_t <- r_3[u_37];
              return(AuthEncap_tuple(r_3[u_37], enc_8))
            else
              r_1 <-R eae_output_t;
              zz_10: eae_output_t <- r_1;
              return(AuthEncap_tuple(r_1, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            find [unique] u_29 = ri_25 <= Qh suchthat defined(r_3[ri_25], salt[ri_25], protocol1[ri_25], suite1[ri_25], label1[ri_25], dh1[ri_25], dh2[ri_25], l[ri_25], protocol2[ri_25], suite2[ri_25], label2[ri_25], pkE'[ri_25], pkR'[ri_25], pkS'[ri_25]) && (pkS_5 = pkS'[ri_25]) && (pk_R = pkR'[ri_25]) && (pkE_11 = pkE'[ri_25]) && (label_shared_secret = label2[ri_25]) && (suite_id = suite2[ri_25]) && (RFCXXXX = protocol2[ri_25]) && (I2OSP2(Nsecret) = l[ri_25]) && (exp(pk_R, sk) = dh2[ri_25]) && (exp(pk_R, z_6) = dh1[ri_25]) && (label_eae_prk = label1[ri_25]) && (suite_id = suite1[ri_25]) && (RFCXXXX = protocol1[ri_25]) && (lbytes_empty = salt[ri_25]) then
              return(AuthEncap_tuple(r_3[u_29], enc_9))
            else
              r <-R eae_output_t;
              return(AuthEncap_tuple(r, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              pkR_1: G_t <- exp(g, sk);
              find [unique] u_22 = ri_18 <= Qdperuser suchthat defined(r_2[ri_18], pkE_3[ri_18], pk_S[ri_18]) && (pk_S = pk_S[ri_18]) && (pkE_3 = pkE_3[ri_18]) then
                return(AuthDecap_Some(r_2[u_22]))
              orfind u_21 = ri_17 <= Qh suchthat defined(r_3[ri_17], salt[ri_17], protocol1[ri_17], suite1[ri_17], label1[ri_17], dh1[ri_17], dh2[ri_17], l[ri_17], protocol2[ri_17], suite2[ri_17], label2[ri_17], pkE'[ri_17], pkR'[ri_17], pkS'[ri_17]) && (pk_S = pkS'[ri_17]) && (pkR_1 = pkR'[ri_17]) && (pkE_3 = pkE'[ri_17]) && (label_shared_secret = label2[ri_17]) && (suite_id = suite2[ri_17]) && (RFCXXXX = protocol2[ri_17]) && (I2OSP2(Nsecret) = l[ri_17]) && (exp(pk_S, sk) = dh2[ri_17]) && (exp(pkE_3, sk) = dh1[ri_17]) && (label_eae_prk = label1[ri_17]) && (suite_id = suite1[ri_17]) && (RFCXXXX = protocol1[ri_17]) && (lbytes_empty = salt[ri_17]) then
                return(AuthDecap_Some(r_3[u_21]))
              else
                r_2 <-R eae_output_t;
                return(AuthDecap_Some(r_2))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          find [unique] u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], pkE_11[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_5[ri_14, ri_15]) && (pkS' = pkS_5[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_11[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_14, ri_15], sk[ri_15])) && (dh1 = exp(pk_R[ri_14, ri_15], z_6[ri_14, ri_15])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r[u_18, u_19])
          orfind u_16 = ri_12 <= Qeperuser, u_17 = ri_13 <= N suchthat defined(r_1[ri_12, ri_13], z_5[ri_12, ri_13], sk[ri_13], sk[i1_2[ri_12, ri_13]], pkE_10[ri_12, ri_13], pk_R[ri_12, ri_13], pkS_4[ri_12, ri_13]) && (pkS' = pkS_4[ri_12, ri_13]) && (pkR' = pk_R[ri_12, ri_13]) && (pkE' = pkE_10[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[i1_2[ri_12, ri_13]], sk[ri_13]))) && (dh1 = exp(g, mult(sk[i1_2[ri_12, ri_13]], z_5[ri_12, ri_13]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_1[u_16, u_17])
          orfind u_14 = ri_10 <= Qdperuser, u_15 = ri_11 <= N suchthat defined(r_2[ri_10, ri_11], sk[ri_11], pkE_3[ri_10, ri_11], pkR_1[ri_10, ri_11], pk_S[ri_10, ri_11]) && (pkS' = pk_S[ri_10, ri_11]) && (pkR' = pkR_1[ri_10, ri_11]) && (pkE' = pkE_3[ri_10, ri_11]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_10, ri_11], sk[ri_11])) && (dh1 = exp(pkE_3[ri_10, ri_11], sk[ri_11])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_14, u_15])
          orfind u_13 = ri_9 <= Qh suchthat defined(r_3[ri_9], salt[ri_9], protocol1[ri_9], suite1[ri_9], label1[ri_9], dh1[ri_9], dh2[ri_9], l[ri_9], protocol2[ri_9], suite2[ri_9], label2[ri_9], pkE'[ri_9], pkR'[ri_9], pkS'[ri_9]) && (pkS' = pkS'[ri_9]) && (pkR' = pkR'[ri_9]) && (pkE' = pkE'[ri_9]) && (label2 = label2[ri_9]) && (suite2 = suite2[ri_9]) && (protocol2 = protocol2[ri_9]) && (l = l[ri_9]) && (dh2 = dh2[ri_9]) && (dh1 = dh1[ri_9]) && (label1 = label1[ri_9]) && (suite1 = suite1[ri_9]) && (protocol1 = protocol1[ri_9]) && (salt = salt[ri_9]) then
            return(r_3[u_13])
          else
            r_3 <-R eae_output_t;
            return(r_3)
        else
          find [unique] u_4 = ri <= Qh suchthat defined(r_4[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_4[u_4])
          else
            r_4 <-R eae_output_t;
            return(r_4)
      ))


Applying equivalence gdh(exp) with variables: sk -> a, z_5 -> b [probability Adv_GDH(time_1, 5 * Qh) + (#OAEncap + N) * PDistRerandom + (2 * #OAEncap^2 + N^2) * PCollKey]
  - Equivalence gdh(exp) with variables: sk -> a, z_5 -> b
yields

Game 29 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (m_1: G_t <- pk_R; (m_1 = exp(g, sk[i1_3]))) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
  {49}      find [unique] u_37 = ri_33 <= Qh suchthat defined(r_3[ri_33], salt[ri_33], protocol1[ri_33], suite1[ri_33], label1[ri_33], dh1[ri_33], dh2[ri_33], l[ri_33], protocol2[ri_33], suite2[ri_33], label2[ri_33], pkE'[ri_33], pkR'[ri_33], pkS'[ri_33]) && (pkS_4 = pkS'[ri_33]) && (pk_R = pkR'[ri_33]) && (pkE_10 = pkE'[ri_33]) && (label_shared_secret = label2[ri_33]) && (suite_id = suite2[ri_33]) && (RFCXXXX = protocol2[ri_33]) && (I2OSP2(Nsecret) = l[ri_33]) && (m_10: G_t <- dh2[ri_33]; (m_10 = exp(g, mult(sk[i1_2], sk)))) && (m_5: G_t <- dh1[ri_33]; false) && (label_eae_prk = label1[ri_33]) && (suite_id = suite1[ri_33]) && (RFCXXXX = protocol1[ri_33]) && (lbytes_empty = salt[ri_33]) then
              zz_10: eae_output_t <- r_3[u_37];
              return(AuthEncap_tuple(r_3[u_37], enc_8))
            else
              r_1 <-R eae_output_t;
              zz_10: eae_output_t <- r_1;
              return(AuthEncap_tuple(r_1, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            find [unique] u_29 = ri_25 <= Qh suchthat defined(r_3[ri_25], salt[ri_25], protocol1[ri_25], suite1[ri_25], label1[ri_25], dh1[ri_25], dh2[ri_25], l[ri_25], protocol2[ri_25], suite2[ri_25], label2[ri_25], pkE'[ri_25], pkR'[ri_25], pkS'[ri_25]) && (pkS_5 = pkS'[ri_25]) && (pk_R = pkR'[ri_25]) && (pkE_11 = pkE'[ri_25]) && (label_shared_secret = label2[ri_25]) && (suite_id = suite2[ri_25]) && (RFCXXXX = protocol2[ri_25]) && (I2OSP2(Nsecret) = l[ri_25]) && (m: G_t <- dh2[ri_25]; m': G_t <- pk_R; (m = exp(m', sk))) && (exp(pk_R, z_6) = dh1[ri_25]) && (label_eae_prk = label1[ri_25]) && (suite_id = suite1[ri_25]) && (RFCXXXX = protocol1[ri_25]) && (lbytes_empty = salt[ri_25]) then
              return(AuthEncap_tuple(r_3[u_29], enc_9))
            else
              r <-R eae_output_t;
              return(AuthEncap_tuple(r, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (m_13: G_t <- pk_S; (m_13 = exp(g, sk[i1_5]))) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              pkR_1: G_t <- exp(g, sk);
              find [unique] u_22 = ri_18 <= Qdperuser suchthat defined(r_2[ri_18], pkE_3[ri_18], pk_S[ri_18]) && (pk_S = pk_S[ri_18]) && (pkE_3 = pkE_3[ri_18]) then
                return(AuthDecap_Some(r_2[u_22]))
              orfind u_21 = ri_17 <= Qh suchthat defined(r_3[ri_17], salt[ri_17], protocol1[ri_17], suite1[ri_17], label1[ri_17], dh1[ri_17], dh2[ri_17], l[ri_17], protocol2[ri_17], suite2[ri_17], label2[ri_17], pkE'[ri_17], pkR'[ri_17], pkS'[ri_17]) && (pk_S = pkS'[ri_17]) && (pkR_1 = pkR'[ri_17]) && (pkE_3 = pkE'[ri_17]) && (label_shared_secret = label2[ri_17]) && (suite_id = suite2[ri_17]) && (RFCXXXX = protocol2[ri_17]) && (I2OSP2(Nsecret) = l[ri_17]) && (m_12: G_t <- dh2[ri_17]; m'_3: G_t <- pk_S; (m_12 = exp(m'_3, sk))) && (m_11: G_t <- dh1[ri_17]; m'_2: G_t <- pkE_3; (m_11 = exp(m'_2, sk))) && (label_eae_prk = label1[ri_17]) && (suite_id = suite1[ri_17]) && (RFCXXXX = protocol1[ri_17]) && (lbytes_empty = salt[ri_17]) then
                return(AuthDecap_Some(r_3[u_21]))
              else
                r_2 <-R eae_output_t;
                return(AuthDecap_Some(r_2))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
 {575}    find [unique] u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], pkE_11[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_5[ri_14, ri_15]) && (pkS' = pkS_5[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_11[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (m_14: G_t <- dh2; m'_4: G_t <- pk_R[ri_14, ri_15]; (m_14 = exp(m'_4, sk[ri_15]))) && (dh1 = exp(pk_R[ri_14, ri_15], z_6[ri_14, ri_15])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r[u_18, u_19])
          orfind u_16 = ri_12 <= Qeperuser, u_17 = ri_13 <= N suchthat defined(r_1[ri_12, ri_13], sk[ri_13], sk[i1_2[ri_12, ri_13]], pkE_10[ri_12, ri_13], pk_R[ri_12, ri_13], pkS_4[ri_12, ri_13]) && (pkS' = pkS_4[ri_12, ri_13]) && (pkR' = pk_R[ri_12, ri_13]) && (pkE' = pkE_10[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (m_21: G_t <- dh2; (m_21 = exp(g, mult(sk[i1_2[ri_12, ri_13]], sk[ri_13])))) && (m_16: G_t <- dh1; false) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_1[u_16, u_17])
          orfind u_14 = ri_10 <= Qdperuser, u_15 = ri_11 <= N suchthat defined(r_2[ri_10, ri_11], sk[ri_11], pkE_3[ri_10, ri_11], pkR_1[ri_10, ri_11], pk_S[ri_10, ri_11]) && (pkS' = pk_S[ri_10, ri_11]) && (pkR' = pkR_1[ri_10, ri_11]) && (pkE' = pkE_3[ri_10, ri_11]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (m_23: G_t <- dh2; m'_6: G_t <- pk_S[ri_10, ri_11]; (m_23 = exp(m'_6, sk[ri_11]))) && (m_22: G_t <- dh1; m'_5: G_t <- pkE_3[ri_10, ri_11]; (m_22 = exp(m'_5, sk[ri_11]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_14, u_15])
          orfind u_13 = ri_9 <= Qh suchthat defined(r_3[ri_9], salt[ri_9], protocol1[ri_9], suite1[ri_9], label1[ri_9], dh1[ri_9], dh2[ri_9], l[ri_9], protocol2[ri_9], suite2[ri_9], label2[ri_9], pkE'[ri_9], pkR'[ri_9], pkS'[ri_9]) && (pkS' = pkS'[ri_9]) && (pkR' = pkR'[ri_9]) && (pkE' = pkE'[ri_9]) && (label2 = label2[ri_9]) && (suite2 = suite2[ri_9]) && (protocol2 = protocol2[ri_9]) && (l = l[ri_9]) && (dh2 = dh2[ri_9]) && (dh1 = dh1[ri_9]) && (label1 = label1[ri_9]) && (suite1 = suite1[ri_9]) && (protocol1 = protocol1[ri_9]) && (salt = salt[ri_9]) then
            return(r_3[u_13])
          else
            r_3 <-R eae_output_t;
            return(r_3)
        else
          find [unique] u_4 = ri <= Qh suchthat defined(r_4[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_4[u_4])
          else
            r_4 <-R eae_output_t;
            return(r_4)
      ))


Applying expand
  - Expand if/find/let
    - Remove branch 2 in find at 575
    - Remove branch 1 in find at 49
    - Find at 49 removed (else branch kept if any)
yields

Game 30 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (m_1: G_t <- pk_R; (m_1 = exp(g, sk[i1_3]))) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk);
            r_1 <-R eae_output_t;
            zz_10: eae_output_t <- r_1;
            return(AuthEncap_tuple(r_1, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            find [unique] u_29 = ri_25 <= Qh suchthat defined(r_3[ri_25], salt[ri_25], protocol1[ri_25], suite1[ri_25], label1[ri_25], dh1[ri_25], dh2[ri_25], l[ri_25], protocol2[ri_25], suite2[ri_25], label2[ri_25], pkE'[ri_25], pkR'[ri_25], pkS'[ri_25]) && (m: G_t <- dh2[ri_25]; m': G_t <- pk_R; ((pkS_5 = pkS'[ri_25]) && (pk_R = pkR'[ri_25]) && (pkE_11 = pkE'[ri_25]) && (label_shared_secret = label2[ri_25]) && (suite_id = suite2[ri_25]) && (RFCXXXX = protocol2[ri_25]) && (I2OSP2(Nsecret) = l[ri_25]) && (m = exp(m', sk)) && (exp(pk_R, z_6) = dh1[ri_25]) && (label_eae_prk = label1[ri_25]) && (suite_id = suite1[ri_25]) && (RFCXXXX = protocol1[ri_25]) && (lbytes_empty = salt[ri_25]))) then
              return(AuthEncap_tuple(r_3[u_29], enc_9))
            else
              r <-R eae_output_t;
              return(AuthEncap_tuple(r, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(zz_10[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (m_13: G_t <- pk_S; ((i = i1_2[ie1_1, i1_5]) && (m_13 = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2))) then
            return(AuthDecap_Some(zz_10[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              pkR_1: G_t <- exp(g, sk);
              find [unique] u_22 = ri_18 <= Qdperuser suchthat defined(r_2[ri_18], pkE_3[ri_18], pk_S[ri_18]) && (pk_S = pk_S[ri_18]) && (pkE_3 = pkE_3[ri_18]) then
                return(AuthDecap_Some(r_2[u_22]))
              orfind u_21 = ri_17 <= Qh suchthat defined(r_3[ri_17], salt[ri_17], protocol1[ri_17], suite1[ri_17], label1[ri_17], dh1[ri_17], dh2[ri_17], l[ri_17], protocol2[ri_17], suite2[ri_17], label2[ri_17], pkE'[ri_17], pkR'[ri_17], pkS'[ri_17]) && (m_12: G_t <- dh2[ri_17]; m'_3: G_t <- pk_S; m_11: G_t <- dh1[ri_17]; m'_2: G_t <- pkE_3; ((pk_S = pkS'[ri_17]) && (pkR_1 = pkR'[ri_17]) && (pkE_3 = pkE'[ri_17]) && (label_shared_secret = label2[ri_17]) && (suite_id = suite2[ri_17]) && (RFCXXXX = protocol2[ri_17]) && (I2OSP2(Nsecret) = l[ri_17]) && (m_12 = exp(m'_3, sk)) && (m_11 = exp(m'_2, sk)) && (label_eae_prk = label1[ri_17]) && (suite_id = suite1[ri_17]) && (RFCXXXX = protocol1[ri_17]) && (lbytes_empty = salt[ri_17]))) then
                return(AuthDecap_Some(r_3[u_21]))
              else
                r_2 <-R eae_output_t;
                return(AuthDecap_Some(r_2))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          find [unique] u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], pkE_11[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_5[ri_14, ri_15]) && (m_14: G_t <- dh2; m'_4: G_t <- pk_R[ri_14, ri_15]; ((pkS' = pkS_5[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_11[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (m_14 = exp(m'_4, sk[ri_15])) && (dh1 = exp(pk_R[ri_14, ri_15], z_6[ri_14, ri_15])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty))) then
            return(r[u_18, u_19])
          orfind u_14 = ri_10 <= Qdperuser, u_15 = ri_11 <= N suchthat defined(r_2[ri_10, ri_11], sk[ri_11], pkE_3[ri_10, ri_11], pkR_1[ri_10, ri_11], pk_S[ri_10, ri_11]) && (m_23: G_t <- dh2; m'_6: G_t <- pk_S[ri_10, ri_11]; m_22: G_t <- dh1; m'_5: G_t <- pkE_3[ri_10, ri_11]; ((pkS' = pk_S[ri_10, ri_11]) && (pkR' = pkR_1[ri_10, ri_11]) && (pkE' = pkE_3[ri_10, ri_11]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (m_23 = exp(m'_6, sk[ri_11])) && (m_22 = exp(m'_5, sk[ri_11])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty))) then
            return(r_2[u_14, u_15])
          orfind u_13 = ri_9 <= Qh suchthat defined(r_3[ri_9], salt[ri_9], protocol1[ri_9], suite1[ri_9], label1[ri_9], dh1[ri_9], dh2[ri_9], l[ri_9], protocol2[ri_9], suite2[ri_9], label2[ri_9], pkE'[ri_9], pkR'[ri_9], pkS'[ri_9]) && (pkS' = pkS'[ri_9]) && (pkR' = pkR'[ri_9]) && (pkE' = pkE'[ri_9]) && (label2 = label2[ri_9]) && (suite2 = suite2[ri_9]) && (protocol2 = protocol2[ri_9]) && (l = l[ri_9]) && (dh2 = dh2[ri_9]) && (dh1 = dh1[ri_9]) && (label1 = label1[ri_9]) && (suite1 = suite1[ri_9]) && (protocol1 = protocol1[ri_9]) && (salt = salt[ri_9]) then
            return(r_3[u_13])
          else
            r_3 <-R eae_output_t;
            return(r_3)
        else
          find [unique] u_4 = ri <= Qh suchthat defined(r_4[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_4[u_4])
          else
            r_4 <-R eae_output_t;
            return(r_4)
      ))


Applying remove assignments of findcond
  - Remove assignments on m_14 (definition removed, all usages removed)
  - Remove assignments on m'_4 (definition removed, all usages removed)
  - Remove assignments on m_23 (definition removed, all usages removed)
  - Remove assignments on m'_6 (definition removed, all usages removed)
  - Remove assignments on m_22 (definition removed, all usages removed)
  - Remove assignments on m'_5 (definition removed, all usages removed)
  - Remove assignments on m_12 (definition removed, all usages removed)
  - Remove assignments on m'_3 (definition removed, all usages removed)
  - Remove assignments on m_11 (definition removed, all usages removed)
  - Remove assignments on m'_2 (definition removed, all usages removed)
  - Remove assignments on m_13 (definition removed, all usages removed)
  - Remove assignments on m (definition removed, all usages removed)
  - Remove assignments on m' (definition removed, all usages removed)
  - Remove assignments on pkS_4 (definition removed, all usages removed)
  - Remove assignments on zz_10 (definition removed, all usages removed)
  - Remove assignments on m_1 (definition removed, all usages removed)
yields

Game 31 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1_2 = i1_3 <= N suchthat defined(sk[i1_3]) && (pk_R = exp(g, sk[i1_3])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            enc_8: bitstring <- Serialize(pkE_10);
            r_1 <-R eae_output_t;
            return(AuthEncap_tuple(r_1, enc_8))
          else
            z_6 <-R Z_t;
            pkE_11: G_t <- exp(g, z_6);
            enc_9: bitstring <- Serialize(pkE_11);
            pkS_5: G_t <- exp(g, sk);
            find [unique] u_29 = ri_25 <= Qh suchthat defined(r_3[ri_25], salt[ri_25], protocol1[ri_25], suite1[ri_25], label1[ri_25], dh1[ri_25], dh2[ri_25], l[ri_25], protocol2[ri_25], suite2[ri_25], label2[ri_25], pkE'[ri_25], pkR'[ri_25], pkS'[ri_25]) && (pkS_5 = pkS'[ri_25]) && (pk_R = pkR'[ri_25]) && (pkE_11 = pkE'[ri_25]) && (label_shared_secret = label2[ri_25]) && (suite_id = suite2[ri_25]) && (RFCXXXX = protocol2[ri_25]) && (I2OSP2(Nsecret) = l[ri_25]) && (dh2[ri_25] = exp(pk_R, sk)) && (exp(pk_R, z_6) = dh1[ri_25]) && (label_eae_prk = label1[ri_25]) && (suite_id = suite1[ri_25]) && (RFCXXXX = protocol1[ri_25]) && (lbytes_empty = salt[ri_25]) then
              return(AuthEncap_tuple(r_3[u_29], enc_9))
            else
              r <-R eae_output_t;
              return(AuthEncap_tuple(r, enc_9))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, enc_2: bitstring) :=
          find ie1 = ie1_1 <= Qeperuser, i1_4 = i1_5 <= N suchthat defined(r_1[ie1_1, i1_5], enc_8[ie1_1, i1_5], sk[i1_5], i1_2[ie1_1, i1_5]) && (i = i1_2[ie1_1, i1_5]) && (pk_S = exp(g, sk[i1_5])) && (enc_8[ie1_1, i1_5] = enc_2) then
            return(AuthDecap_Some(r_1[ie1, i1_4]))
          else
            let Serialize(pkE_3: G_t) = enc_2 in
              pkR_1: G_t <- exp(g, sk);
              find [unique] u_22 = ri_18 <= Qdperuser suchthat defined(r_2[ri_18], pkE_3[ri_18], pk_S[ri_18]) && (pk_S = pk_S[ri_18]) && (pkE_3 = pkE_3[ri_18]) then
                return(AuthDecap_Some(r_2[u_22]))
              orfind u_21 = ri_17 <= Qh suchthat defined(r_3[ri_17], salt[ri_17], protocol1[ri_17], suite1[ri_17], label1[ri_17], dh1[ri_17], dh2[ri_17], l[ri_17], protocol2[ri_17], suite2[ri_17], label2[ri_17], pkE'[ri_17], pkR'[ri_17], pkS'[ri_17]) && (pk_S = pkS'[ri_17]) && (pkR_1 = pkR'[ri_17]) && (pkE_3 = pkE'[ri_17]) && (label_shared_secret = label2[ri_17]) && (suite_id = suite2[ri_17]) && (RFCXXXX = protocol2[ri_17]) && (I2OSP2(Nsecret) = l[ri_17]) && (dh2[ri_17] = exp(pk_S, sk)) && (dh1[ri_17] = exp(pkE_3, sk)) && (label_eae_prk = label1[ri_17]) && (suite_id = suite1[ri_17]) && (RFCXXXX = protocol1[ri_17]) && (lbytes_empty = salt[ri_17]) then
                return(AuthDecap_Some(r_3[u_21]))
              else
                r_2 <-R eae_output_t;
                return(AuthDecap_Some(r_2))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          find [unique] u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], pkE_11[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_5[ri_14, ri_15]) && (pkS' = pkS_5[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_11[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_14, ri_15], sk[ri_15])) && (dh1 = exp(pk_R[ri_14, ri_15], z_6[ri_14, ri_15])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r[u_18, u_19])
          orfind u_14 = ri_10 <= Qdperuser, u_15 = ri_11 <= N suchthat defined(r_2[ri_10, ri_11], sk[ri_11], pkE_3[ri_10, ri_11], pkR_1[ri_10, ri_11], pk_S[ri_10, ri_11]) && (pkS' = pk_S[ri_10, ri_11]) && (pkR' = pkR_1[ri_10, ri_11]) && (pkE' = pkE_3[ri_10, ri_11]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_10, ri_11], sk[ri_11])) && (dh1 = exp(pkE_3[ri_10, ri_11], sk[ri_11])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_14, u_15])
          orfind u_13 = ri_9 <= Qh suchthat defined(r_3[ri_9], salt[ri_9], protocol1[ri_9], suite1[ri_9], label1[ri_9], dh1[ri_9], dh2[ri_9], l[ri_9], protocol2[ri_9], suite2[ri_9], label2[ri_9], pkE'[ri_9], pkR'[ri_9], pkS'[ri_9]) && (pkS' = pkS'[ri_9]) && (pkR' = pkR'[ri_9]) && (pkE' = pkE'[ri_9]) && (label2 = label2[ri_9]) && (suite2 = suite2[ri_9]) && (protocol2 = protocol2[ri_9]) && (l = l[ri_9]) && (dh2 = dh2[ri_9]) && (dh1 = dh1[ri_9]) && (label1 = label1[ri_9]) && (suite1 = suite1[ri_9]) && (protocol1 = protocol1[ri_9]) && (salt = salt[ri_9]) then
            return(r_3[u_13])
          else
            r_3 <-R eae_output_t;
            return(r_3)
        else
          find [unique] u_4 = ri <= Qh suchthat defined(r_4[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_4[u_4])
          else
            r_4 <-R eae_output_t;
            return(r_4)
      ))

Initial state
Game 32 is
      Ostart() :=
      key_extr_11 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = (exponent_16: Z_t <- sk_1[i1]; exp(g, exponent_16))) then
            let AuthEncap_tuple(k: eae_output_t, ce: bitstring) = (skS_1: Z_t <- sk_1; let (skE_1: Z_t, pkE_8: G_t) = (z_1 <-R Z_t; (z_1, exp(g, z_1))) in dh_8: GG_t <- concatDH(exp(pk_R_1, skE_1), exp(pk_R_1, skS_1)); enc_7: bitstring <- Serialize(pkE_8); pkS_3: G_t <- exp(g, skS_1); kemContext_8: GGG_t <- concatContext(pkE_8, pk_R_1, pkS_3); zz_8: eae_output_t <- (key_3: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_8); info_3: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_8); ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_3, info_3))); AuthEncap_tuple(zz_8, enc_7) else AuthEncap_None) in
              k' <-R eae_output_t;
              insert E(exp(g, sk_1), pk_R_1, ce, k');
              return(AuthEncap_tuple(k', ce))
            else
              return(AuthEncap_None)
          else
            return((skS_1: Z_t <- sk_1; let (skE_1: Z_t, pkE_7: G_t) = (z_1 <-R Z_t; (z_1, exp(g, z_1))) in dh_7: GG_t <- concatDH(exp(pk_R_1, skE_1), exp(pk_R_1, skS_1)); enc_6: bitstring <- Serialize(pkE_7); pkS_2: G_t <- exp(g, skS_1); kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2); zz_7: eae_output_t <- (key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7); info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7); ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_2, info_2))); AuthEncap_tuple(zz_7, enc_6) else AuthEncap_None))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          get E(=pk_S_1, =exp(g, sk_1), =cd, k'': eae_output_t) in
            return(AuthDecap_Some(k''))
          else
            return((skR_1: Z_t <- sk_1; let Serialize(pkE_9: G_t) = cd in dh_9: GG_t <- concatDH(exp(pkE_9, skR_1), exp(pk_S_1, skR_1)); pkR_4: G_t <- exp(g, skR_1); kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1); zz_9: eae_output_t <- (key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9); info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9); ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_4, info_4))); AuthDecap_Some(zz_9) else AuthDecap_None))
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_11, x1_1))
      ))


Applying expand get, insert and prove unique annotations
  - Expand get/insert for table E
yields

Game 33 is
      Ostart() :=
      key_extr_11 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = (exponent_16: Z_t <- sk_1[i1]; exp(g, exponent_16))) then
  {33}      let AuthEncap_tuple(k: eae_output_t, ce: bitstring) = (skS_1: Z_t <- sk_1; {37}let (skE_1: Z_t, pkE_8: G_t) = (z_1 <-R Z_t; (z_1, exp(g, z_1))) in dh_8: GG_t <- concatDH(exp(pk_R_1, skE_1), exp(pk_R_1, skS_1)); enc_7: bitstring <- Serialize(pkE_8); pkS_3: G_t <- exp(g, skS_1); kemContext_8: GGG_t <- concatContext(pkE_8, pk_R_1, pkS_3); zz_8: eae_output_t <- (key_3: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_8); info_3: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_8); ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_3, info_3))); AuthEncap_tuple(zz_8, enc_7) else AuthEncap_None) in
              k' <-R eae_output_t;
              E_1: G_t <- exp(g, sk_1);
              E_2: G_t <- pk_R_1;
              E_3: bitstring <- ce;
              E_4: eae_output_t <- k';
              return(AuthEncap_tuple(k', ce))
            else
              return(AuthEncap_None)
          else
            return((skS_1: Z_t <- sk_1; {164}let (skE_1: Z_t, pkE_7: G_t) = (z_1 <-R Z_t; (z_1, exp(g, z_1))) in dh_7: GG_t <- concatDH(exp(pk_R_1, skE_1), exp(pk_R_1, skS_1)); enc_6: bitstring <- Serialize(pkE_7); pkS_2: G_t <- exp(g, skS_1); kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2); zz_7: eae_output_t <- (key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7); info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7); ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_2, info_2))); AuthEncap_tuple(zz_7, enc_6) else AuthEncap_None))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(E_1[u_2, u_3], E_2[u_2, u_3], E_3[u_2, u_3], E_4[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (E_2[u_2, u_3] = exp(g, sk_1)) && (E_3[u_2, u_3] = cd) then
            return(AuthDecap_Some(E_4[u, u_1]))
          else
            return((skR_1: Z_t <- sk_1; let Serialize(pkE_9: G_t) = cd in dh_9: GG_t <- concatDH(exp(pkE_9, skR_1), exp(pk_S_1, skR_1)); pkR_4: G_t <- exp(g, skR_1); kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1); zz_9: eae_output_t <- (key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9); info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9); ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_4, info_4))); AuthDecap_Some(zz_9) else AuthDecap_None))
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_11, x1_1))
      ))


Applying expand [probability N^2 * PCollKey]
  - Expand if/find/let
    - Simplify pattern (skE_1: Z_t, pkE_7: G_t) (tuple expanded) at 164
    - Remove else branch of let at 164
    - Simplify pattern (skE_1: Z_t, pkE_8: G_t) (tuple expanded) at 37
    - Remove else branch of let at 37
    - Simplify pattern AuthEncap_tuple(k: eae_output_t, ce: bitstring) (tuple expanded) at 33
    - Remove else branch of let at 33
yields

Game 34 is
      Ostart() :=
      key_extr_11 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (exponent_16: Z_t <- sk_1[i1]; (pk_R_1 = exp(g, exponent_16))) then
            skS_1: Z_t <- sk_1;
            z_1 <-R Z_t;
            pkE_8: G_t <- exp(g, z_1);
            skE_1: Z_t <- z_1;
            dh_8: GG_t <- concatDH(exp(pk_R_1, skE_1), exp(pk_R_1, skS_1));
            enc_7: bitstring <- Serialize(pkE_8);
            pkS_3: G_t <- exp(g, skS_1);
            kemContext_8: GGG_t <- concatContext(pkE_8, pk_R_1, pkS_3);
            key_3: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_8);
            info_3: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_8);
            zz_8: eae_output_t <- ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_3, info_3));
            ce: bitstring <- enc_7;
            k: eae_output_t <- zz_8;
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            E_2: G_t <- pk_R_1;
            E_3: bitstring <- ce;
            E_4: eae_output_t <- k';
            return(AuthEncap_tuple(k', ce))
          else
            skS_1: Z_t <- sk_1;
            z_1 <-R Z_t;
            pkE_7: G_t <- exp(g, z_1);
            skE_1: Z_t <- z_1;
            dh_7: GG_t <- concatDH(exp(pk_R_1, skE_1), exp(pk_R_1, skS_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, skS_1);
            kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7);
            zz_7: eae_output_t <- ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_2, info_2));
            return(AuthEncap_tuple(zz_7, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(E_1[u_2, u_3], E_2[u_2, u_3], E_3[u_2, u_3], E_4[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (E_2[u_2, u_3] = exp(g, sk_1)) && (E_3[u_2, u_3] = cd) then
            return(AuthDecap_Some(E_4[u, u_1]))
          else
            skR_1: Z_t <- sk_1;
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, skR_1), exp(pk_S_1, skR_1));
              pkR_4: G_t <- exp(g, skR_1);
              kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1);
              key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
              info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
              zz_9: eae_output_t <- ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_4, info_4));
              return(AuthDecap_Some(zz_9))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_11, x1_1))
      ))


Applying remove assignments of findcond
  - Remove assignments on skR_1 (definition removed, all usages removed)
  - Remove assignments on skS_1 (definition removed, all usages removed)
  - Remove assignments on skE_1 (definition removed, all usages removed)
  - Remove assignments on skS_1 (definition removed, all usages removed)
  - Remove assignments on skE_1 (definition removed, all usages removed)
  - Remove assignments on ce (definition removed, all usages removed)
  - Remove assignments on k (definition removed, all usages removed)
  - Remove assignments on E_2 (definition removed, all usages removed)
  - Remove assignments on E_3 (definition removed, all usages removed)
  - Remove assignments on E_4 (definition removed, all usages removed)
  - Remove assignments on exponent_16 (definition removed, all usages removed)
  - Remove assignments on zz_8 (definition removed, all usages removed)
  - Remove assignments on key_3 (definition removed, all usages removed)
  - Remove assignments on info_3 (definition removed, all usages removed)
  - Remove assignments on dh_8 (definition removed, all usages removed)
  - Remove assignments on kemContext_8 (definition removed, all usages removed)
  - Remove assignments on pkS_3 (definition removed, all usages removed)
yields

Game 35 is
      Ostart() :=
      key_extr_11 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_1 <-R Z_t;
            pkE_8: G_t <- exp(g, z_1);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_1 <-R Z_t;
            pkE_7: G_t <- exp(g, z_1);
            dh_7: GG_t <- concatDH(exp(pk_R_1, z_1), exp(pk_R_1, sk_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7);
            zz_7: eae_output_t <- ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_2, info_2));
            return(AuthEncap_tuple(zz_7, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
 {153}    find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(pk_R_1[u_2, u_3], enc_7[u_2, u_3], k'[u_2, u_3], E_1[u_2, u_3]) && {162}((E_1[u_2, u_3] = pk_S_1) && (pk_R_1[u_2, u_3] = exp(g, sk_1)) && (enc_7[u_2, u_3] = cd)) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, sk_1), exp(pk_S_1, sk_1));
              pkR_4: G_t <- exp(g, sk_1);
              kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1);
              key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
              info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
              zz_9: eae_output_t <- ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_4, info_4));
              return(AuthDecap_Some(zz_9))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_11, x1_1))
      ))


Applying simplify [probability N^2 * PCollKey]
  - Simplification pass
    - Replaced ((E_1[u_2, u_3] = pk_S_1) && (pk_R_1[u_2, u_3] = exp(g, sk_1)) && (enc_7[u_2, u_3] = cd)) with ((E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd)) at 162
    - Replaced defined condition pk_R_1[u_2, u_3], enc_7[u_2, u_3], k'[u_2, u_3], E_1[u_2, u_3] with k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3] in find at 153
yields

Game 36 is
      Ostart() :=
      key_extr_11 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_1 <-R Z_t;
            pkE_8: G_t <- exp(g, z_1);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_1 <-R Z_t;
            pkE_7: G_t <- exp(g, z_1);
            dh_7: GG_t <- concatDH(exp(pk_R_1, z_1), exp(pk_R_1, sk_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7);
            zz_7: eae_output_t <- ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_2, info_2));
            return(AuthEncap_tuple(zz_7, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, sk_1), exp(pk_S_1, sk_1));
              pkR_4: G_t <- exp(g, sk_1);
              kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1);
              key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
              info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
              zz_9: eae_output_t <- ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_4, info_4));
              return(AuthDecap_Some(zz_9))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_11, x1_1))
      ))


Applying remove assignments of findcond
  - Rename variable z_1 into z_4, z_3
yields

Game 37 is
      Ostart() :=
      key_extr_11 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_4 <-R Z_t;
            pkE_8: G_t <- exp(g, z_4);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_3 <-R Z_t;
            pkE_7: G_t <- exp(g, z_3);
            dh_7: GG_t <- concatDH(exp(pk_R_1, z_3), exp(pk_R_1, sk_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7);
            zz_7: eae_output_t <- ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_2, info_2));
            return(AuthEncap_tuple(zz_7, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, sk_1), exp(pk_S_1, sk_1));
              pkR_4: G_t <- exp(g, sk_1);
              kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1);
              key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
              info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
              zz_9: eae_output_t <- ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_4, info_4));
              return(AuthDecap_Some(zz_9))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
 {286}  return(ExtractAndExpand_inner(key_extr_11, x1_1))
      ))


Applying insert instruction let eae_input(
      salt: extract_salt_t,
      concatExtract(
        protocol1: label_protocol_t,
        suite1: suite_id_t,
        label1: label_extract_t,
        concatDH(dh1: G_t, dh2: G_t)),
      concatExpand(l: two_byte_t,
        protocol2: label_protocol_t,
        suite2: suite_id_t,
        label2: label_expand_t,
        concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in at occurrence 286
yields

Game 38 is
      Ostart() :=
      key_extr_11 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_4 <-R Z_t;
            pkE_8: G_t <- exp(g, z_4);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_3 <-R Z_t;
            pkE_7: G_t <- exp(g, z_3);
            dh_7: GG_t <- concatDH(exp(pk_R_1, z_3), exp(pk_R_1, sk_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7);
            zz_7: eae_output_t <- ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_2, info_2));
            return(AuthEncap_tuple(zz_7, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, sk_1), exp(pk_S_1, sk_1));
              pkR_4: G_t <- exp(g, sk_1);
              kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1);
              key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
              info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
              zz_9: eae_output_t <- ExtractAndExpand_inner(key_extr_11, eae_input(lbytes_empty, key_4, info_4));
              return(AuthDecap_Some(zz_9))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          return(ExtractAndExpand_inner(key_extr_11, x1_1))
        else
          return(ExtractAndExpand_inner(key_extr_11, x1_1))
      ))


Applying equivalence rom(ExtractAndExpand_inner)
  - Equivalence rom(ExtractAndExpand_inner) with variables: key_extr_11 -> hk
yields

Game 39 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_4 <-R Z_t;
            pkE_8: G_t <- exp(g, z_4);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_3 <-R Z_t;
            pkE_7: G_t <- exp(g, z_3);
            dh_7: GG_t <- concatDH(exp(pk_R_1, z_3), exp(pk_R_1, sk_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7);
            zz_7: eae_output_t <- (x_O_5: eae_input_t <- eae_input(lbytes_empty, key_2, info_2); {129}find [unique] u_66 = ri_62 <= Qeperuser, u_67 = ri_63 <= N suchthat defined(x_O_5[ri_62, ri_63], r_5[ri_62, ri_63]) && (x_O_5 = x_O_5[ri_62, ri_63]) then r_5[u_66, u_67] orfind u_64 = ri_60 <= Qdperuser, u_65 = ri_61 <= N suchthat defined(x_O_6[ri_60, ri_61], r_6[ri_60, ri_61]) && (x_O_5 = x_O_6[ri_60, ri_61]) then r_6[u_64, u_65] orfind u_63 = ri_59 <= Qh suchthat defined(x_O_7[ri_59], r_7[ri_59]) && (x_O_5 = x_O_7[ri_59]) then r_7[u_63] orfind u_62 = ri_58 <= Qh suchthat defined(x_O_8[ri_58], r_8[ri_58]) && {180}(x_O_5 = x_O_8[ri_58]) then r_8[u_62] else r_5 <-R eae_output_t; r_5);
            return(AuthEncap_tuple(zz_7, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, sk_1), exp(pk_S_1, sk_1));
              pkR_4: G_t <- exp(g, sk_1);
              kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1);
              key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
              info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
              zz_9: eae_output_t <- (x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4); {319}find [unique] u_60 = ri_56 <= Qeperuser, u_61 = ri_57 <= N suchthat defined(x_O_5[ri_56, ri_57], r_5[ri_56, ri_57]) && (x_O_6 = x_O_5[ri_56, ri_57]) then r_5[u_60, u_61] orfind u_58 = ri_54 <= Qdperuser, u_59 = ri_55 <= N suchthat defined(x_O_6[ri_54, ri_55], r_6[ri_54, ri_55]) && (x_O_6 = x_O_6[ri_54, ri_55]) then r_6[u_58, u_59] orfind u_57 = ri_53 <= Qh suchthat defined(x_O_7[ri_53], r_7[ri_53]) && (x_O_6 = x_O_7[ri_53]) then r_7[u_57] orfind u_56 = ri_52 <= Qh suchthat defined(x_O_8[ri_52], r_8[ri_52]) && {370}(x_O_6 = x_O_8[ri_52]) then r_8[u_56] else r_6 <-R eae_output_t; r_6);
              return(AuthDecap_Some(zz_9))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          return((x_O_7: eae_input_t <- x1_1; {421}find [unique] u_54 = ri_50 <= Qeperuser, u_55 = ri_51 <= N suchthat defined(x_O_5[ri_50, ri_51], r_5[ri_50, ri_51]) && (x_O_7 = x_O_5[ri_50, ri_51]) then r_5[u_54, u_55] orfind u_52 = ri_48 <= Qdperuser, u_53 = ri_49 <= N suchthat defined(x_O_6[ri_48, ri_49], r_6[ri_48, ri_49]) && (x_O_7 = x_O_6[ri_48, ri_49]) then r_6[u_52, u_53] orfind u_51 = ri_47 <= Qh suchthat defined(x_O_7[ri_47], r_7[ri_47]) && (x_O_7 = x_O_7[ri_47]) then r_7[u_51] orfind u_50 = ri_46 <= Qh suchthat defined(x_O_8[ri_46], r_8[ri_46]) && {464}(x_O_7 = x_O_8[ri_46]) then r_8[u_50] else r_7 <-R eae_output_t; r_7))
        else
          return((x_O_8: eae_input_t <- x1_1; {481}find [unique] u_48 = ri_44 <= Qeperuser, u_49 = ri_45 <= N suchthat defined(x_O_5[ri_44, ri_45], r_5[ri_44, ri_45]) && {486}(x_O_8 = x_O_5[ri_44, ri_45]) then r_5[u_48, u_49] orfind u_46 = ri_42 <= Qdperuser, u_47 = ri_43 <= N suchthat defined(x_O_6[ri_42, ri_43], r_6[ri_42, ri_43]) && {501}(x_O_8 = x_O_6[ri_42, ri_43]) then r_6[u_46, u_47] orfind u_45 = ri_41 <= Qh suchthat defined(x_O_7[ri_41], r_7[ri_41]) && {514}(x_O_8 = x_O_7[ri_41]) then r_7[u_45] orfind u_44 = ri_40 <= Qh suchthat defined(x_O_8[ri_40], r_8[ri_40]) && (x_O_8 = x_O_8[ri_40]) then r_8[u_44] else r_8 <-R eae_output_t; r_8))
      ))


Applying simplify (non-expanded game) [probability (N^2 + #OAEncap^2) * PCollKey]
  - Simplification pass
    - Replaced (x_O_5 = x_O_8[ri_58]) with false at 180
    - Remove branch 4 in find at 129
    - Replaced (x_O_6 = x_O_8[ri_52]) with false at 370
    - Remove branch 4 in find at 319
    - Replaced (x_O_7 = x_O_8[ri_46]) with false at 464
    - Remove branch 4 in find at 421
    - Replaced (x_O_8 = x_O_7[ri_41]) with false at 514
    - Remove branch 3 in find at 481
    - Replaced (x_O_8 = x_O_6[ri_42, ri_43]) with false at 501
    - Remove branch 2 in find at 481
    - Replaced (x_O_8 = x_O_5[ri_44, ri_45]) with false at 486
    - Remove branch 1 in find at 481
yields

Game 40 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_4 <-R Z_t;
            pkE_8: G_t <- exp(g, z_4);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_3 <-R Z_t;
            pkE_7: G_t <- exp(g, z_3);
            dh_7: GG_t <- concatDH(exp(pk_R_1, z_3), exp(pk_R_1, sk_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7);
            zz_7: eae_output_t <- (x_O_5: eae_input_t <- eae_input(lbytes_empty, key_2, info_2); {129}find [unique] u_66 = ri_62 <= Qeperuser, u_67 = ri_63 <= N suchthat defined(x_O_5[ri_62, ri_63], r_5[ri_62, ri_63]) && (x_O_5 = x_O_5[ri_62, ri_63]) then r_5[u_66, u_67] orfind u_64 = ri_60 <= Qdperuser, u_65 = ri_61 <= N suchthat defined(x_O_6[ri_60, ri_61], r_6[ri_60, ri_61]) && (x_O_5 = x_O_6[ri_60, ri_61]) then r_6[u_64, u_65] orfind u_63 = ri_59 <= Qh suchthat defined(x_O_7[ri_59], r_7[ri_59]) && (x_O_5 = x_O_7[ri_59]) then r_7[u_63] else r_5 <-R eae_output_t; r_5);
            return(AuthEncap_tuple(zz_7, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, sk_1), exp(pk_S_1, sk_1));
              pkR_4: G_t <- exp(g, sk_1);
              kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1);
              key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
              info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
              zz_9: eae_output_t <- (x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4); {307}find [unique] u_60 = ri_56 <= Qeperuser, u_61 = ri_57 <= N suchthat defined(x_O_5[ri_56, ri_57], r_5[ri_56, ri_57]) && (x_O_6 = x_O_5[ri_56, ri_57]) then r_5[u_60, u_61] orfind u_58 = ri_54 <= Qdperuser, u_59 = ri_55 <= N suchthat defined(x_O_6[ri_54, ri_55], r_6[ri_54, ri_55]) && (x_O_6 = x_O_6[ri_54, ri_55]) then r_6[u_58, u_59] orfind u_57 = ri_53 <= Qh suchthat defined(x_O_7[ri_53], r_7[ri_53]) && (x_O_6 = x_O_7[ri_53]) then r_7[u_57] else r_6 <-R eae_output_t; r_6);
              return(AuthDecap_Some(zz_9))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          return((x_O_7: eae_input_t <- x1_1; find [unique] u_54 = ri_50 <= Qeperuser, u_55 = ri_51 <= N suchthat defined(x_O_5[ri_50, ri_51], r_5[ri_50, ri_51]) && (x_O_7 = x_O_5[ri_50, ri_51]) then r_5[u_54, u_55] orfind u_52 = ri_48 <= Qdperuser, u_53 = ri_49 <= N suchthat defined(x_O_6[ri_48, ri_49], r_6[ri_48, ri_49]) && (x_O_7 = x_O_6[ri_48, ri_49]) then r_6[u_52, u_53] orfind u_51 = ri_47 <= Qh suchthat defined(x_O_7[ri_47], r_7[ri_47]) && (x_O_7 = x_O_7[ri_47]) then r_7[u_51] else r_7 <-R eae_output_t; r_7))
        else
          return((x_O_8: eae_input_t <- x1_1; find [unique] u_44 = ri_40 <= Qh suchthat defined(x_O_8[ri_40], r_8[ri_40]) && (x_O_8 = x_O_8[ri_40]) then r_8[u_44] else r_8 <-R eae_output_t; r_8))
      ))


Applying expand [probability (#OAEncap^2 + #OAEncap * N + N^2) * PCollKey]
  - Expand if/find/let
    - Remove branch 1 in find at 307
    - Remove branch 2 in find at 129
    - Remove branch 1 in find at 129
yields

Game 41 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_4 <-R Z_t;
            pkE_8: G_t <- exp(g, z_4);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_3 <-R Z_t;
            pkE_7: G_t <- exp(g, z_3);
            dh_7: GG_t <- concatDH(exp(pk_R_1, z_3), exp(pk_R_1, sk_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7);
            x_O_5: eae_input_t <- eae_input(lbytes_empty, key_2, info_2);
            find [unique] u_63 = ri_59 <= Qh suchthat defined(x_O_7[ri_59], r_7[ri_59]) && (x_O_5 = x_O_7[ri_59]) then
              zz_7: eae_output_t <- r_7[u_63];
              return(AuthEncap_tuple(zz_7, enc_6))
            else
              r_5 <-R eae_output_t;
              zz_7: eae_output_t <- r_5;
              return(AuthEncap_tuple(zz_7, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, sk_1), exp(pk_S_1, sk_1));
              pkR_4: G_t <- exp(g, sk_1);
              kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1);
              key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
              info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
              x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
              find [unique] u_58 = ri_54 <= Qdperuser, u_59 = ri_55 <= N suchthat defined(x_O_6[ri_54, ri_55], r_6[ri_54, ri_55]) && (x_O_6 = x_O_6[ri_54, ri_55]) then
                zz_9: eae_output_t <- r_6[u_58, u_59];
                return(AuthDecap_Some(zz_9))
              orfind u_57 = ri_53 <= Qh suchthat defined(x_O_7[ri_53], r_7[ri_53]) && (x_O_6 = x_O_7[ri_53]) then
                zz_9: eae_output_t <- r_7[u_57];
                return(AuthDecap_Some(zz_9))
              else
                r_6 <-R eae_output_t;
                zz_9: eae_output_t <- r_6;
                return(AuthDecap_Some(zz_9))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          x_O_7: eae_input_t <- x1_1;
          find [unique] u_54 = ri_50 <= Qeperuser, u_55 = ri_51 <= N suchthat defined(x_O_5[ri_50, ri_51], r_5[ri_50, ri_51]) && (x_O_7 = x_O_5[ri_50, ri_51]) then
            return(r_5[u_54, u_55])
          orfind u_52 = ri_48 <= Qdperuser, u_53 = ri_49 <= N suchthat defined(x_O_6[ri_48, ri_49], r_6[ri_48, ri_49]) && (x_O_7 = x_O_6[ri_48, ri_49]) then
            return(r_6[u_52, u_53])
          orfind u_51 = ri_47 <= Qh suchthat defined(x_O_7[ri_47], r_7[ri_47]) && (x_O_7 = x_O_7[ri_47]) then
            return(r_7[u_51])
          else
            r_7 <-R eae_output_t;
            return(r_7)
        else
          x_O_8: eae_input_t <- x1_1;
          find [unique] u_44 = ri_40 <= Qh suchthat defined(x_O_8[ri_40], r_8[ri_40]) && (x_O_8 = x_O_8[ri_40]) then
            return(r_8[u_44])
          else
            r_8 <-R eae_output_t;
            return(r_8)
      ))


Applying remove assignments of findcond
  - Remove assignments on x_O_8 (definition point kept, all usages removed)
  - Remove assignments on x_O_7 (definition point kept, all usages removed)
  - Remove assignments on zz_9 (definition removed, all usages removed)
  - Remove assignments on zz_9 (definition removed, all usages removed)
  - Remove assignments on zz_9 (definition removed, all usages removed)
  - Remove assignments on zz_7 (definition removed, all usages removed)
  - Remove assignments on zz_7 (definition removed, all usages removed)
yields

Game 42 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_4 <-R Z_t;
            pkE_8: G_t <- exp(g, z_4);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_3 <-R Z_t;
            pkE_7: G_t <- exp(g, z_3);
            dh_7: GG_t <- concatDH(exp(pk_R_1, z_3), exp(pk_R_1, sk_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7);
            x_O_5: eae_input_t <- eae_input(lbytes_empty, key_2, info_2);
 {128}      find [unique] u_63 = ri_59 <= Qh suchthat defined(x1_1[ri_59], x_O_7[ri_59], r_7[ri_59]) && {132}(x_O_5 = x1_1[ri_59]) then
              return(AuthEncap_tuple(r_7[u_63], enc_6))
            else
              r_5 <-R eae_output_t;
              return(AuthEncap_tuple(r_5, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, sk_1), exp(pk_S_1, sk_1));
              pkR_4: G_t <- exp(g, sk_1);
              kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1);
              key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
              info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
              x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
 {274}        find [unique] u_58 = ri_54 <= Qdperuser, u_59 = ri_55 <= N suchthat defined(x_O_6[ri_54, ri_55], r_6[ri_54, ri_55]) && {279}(x_O_6 = x_O_6[ri_54, ri_55]) then
                return(AuthDecap_Some(r_6[u_58, u_59]))
              orfind u_57 = ri_53 <= Qh suchthat defined(x1_1[ri_53], x_O_7[ri_53], r_7[ri_53]) && {300}(x_O_6 = x1_1[ri_53]) then
                return(AuthDecap_Some(r_7[u_57]))
              else
                r_6 <-R eae_output_t;
                return(AuthDecap_Some(r_6))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          x_O_7: eae_input_t <- cst_eae_input_t;
 {349}    find [unique] u_54 = ri_50 <= Qeperuser, u_55 = ri_51 <= N suchthat defined(x_O_5[ri_50, ri_51], r_5[ri_50, ri_51]) && {354}(x1_1 = x_O_5[ri_50, ri_51]) then
            return(r_5[u_54, u_55])
          orfind u_52 = ri_48 <= Qdperuser, u_53 = ri_49 <= N suchthat defined(x_O_6[ri_48, ri_49], r_6[ri_48, ri_49]) && {372}(x1_1 = x_O_6[ri_48, ri_49]) then
            return(r_6[u_52, u_53])
          orfind u_51 = ri_47 <= Qh suchthat defined(x1_1[ri_47], x_O_7[ri_47], r_7[ri_47]) && {389}(x1_1 = x1_1[ri_47]) then
            return(r_7[u_51])
          else
            r_7 <-R eae_output_t;
            return(r_7)
        else
          x_O_8: eae_input_t <- cst_eae_input_t;
 {409}    find [unique] u_44 = ri_40 <= Qh suchthat defined(x1_1[ri_40], x_O_8[ri_40], r_8[ri_40]) && (x1_1 = x1_1[ri_40]) then
            return(r_8[u_44])
          else
            r_8 <-R eae_output_t;
            return(r_8)
      ))


Applying simplify [probability N^2 * PCollKey]
  - Simplification pass
    - Replaced defined condition x1_1[ri_40], x_O_8[ri_40], r_8[ri_40] with r_8[ri_40], x1_1[ri_40] in find at 409
    - Replaced (x1_1 = x1_1[ri_47]) with ((pkS'' = pkS''[ri_47]) && (pkR'' = pkR''[ri_47]) && (pkE'' = pkE''[ri_47]) && (label2_1 = label2_1[ri_47]) && (suite2_1 = suite2_1[ri_47]) && (protocol2_1 = protocol2_1[ri_47]) && (l_1 = l_1[ri_47]) && (dh2_1 = dh2_1[ri_47]) && (dh1_1 = dh1_1[ri_47]) && (label1_1 = label1_1[ri_47]) && (suite1_1 = suite1_1[ri_47]) && (protocol1_1 = protocol1_1[ri_47]) && (salt_1 = salt_1[ri_47])) at 389
    - Replaced defined condition x1_1[ri_47], x_O_7[ri_47], r_7[ri_47] with r_7[ri_47], salt_1[ri_47], protocol1_1[ri_47], suite1_1[ri_47], label1_1[ri_47], dh1_1[ri_47], dh2_1[ri_47], l_1[ri_47], protocol2_1[ri_47], suite2_1[ri_47], label2_1[ri_47], pkE''[ri_47], pkR''[ri_47], pkS''[ri_47] in find at 349
    - Replaced (x1_1 = x_O_6[ri_48, ri_49]) with ((pkS'' = pk_S_1[ri_48, ri_49]) && (pkR'' = pkR_4[ri_48, ri_49]) && (pkE'' = pkE_9[ri_48, ri_49]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_48, ri_49], sk_1[ri_49])) && (dh1_1 = exp(pkE_9[ri_48, ri_49], sk_1[ri_49])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty)) at 372
    - Replaced defined condition x_O_6[ri_48, ri_49], r_6[ri_48, ri_49] with r_6[ri_48, ri_49], sk_1[ri_49], pkE_9[ri_48, ri_49], pkR_4[ri_48, ri_49], pk_S_1[ri_48, ri_49] in find at 349
    - Replaced (x1_1 = x_O_5[ri_50, ri_51]) with ((pkS'' = pkS_2[ri_50, ri_51]) && (pkR'' = pk_R_1[ri_50, ri_51]) && (pkE'' = pkE_7[ri_50, ri_51]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_50, ri_51], sk_1[ri_51])) && (dh1_1 = exp(pk_R_1[ri_50, ri_51], z_3[ri_50, ri_51])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty)) at 354
    - Replaced defined condition x_O_5[ri_50, ri_51], r_5[ri_50, ri_51] with r_5[ri_50, ri_51], z_3[ri_50, ri_51], sk_1[ri_51], pkE_7[ri_50, ri_51], pk_R_1[ri_50, ri_51], pkS_2[ri_50, ri_51] in find at 349
    - Replaced (x_O_6 = x1_1[ri_53]) with ((pk_S_1 = pkS''[ri_53]) && (pkR_4 = pkR''[ri_53]) && (pkE_9 = pkE''[ri_53]) && (label_shared_secret = label2_1[ri_53]) && (suite_id = suite2_1[ri_53]) && (RFCXXXX = protocol2_1[ri_53]) && (I2OSP2(Nsecret) = l_1[ri_53]) && (exp(pk_S_1, sk_1) = dh2_1[ri_53]) && (exp(pkE_9, sk_1) = dh1_1[ri_53]) && (label_eae_prk = label1_1[ri_53]) && (suite_id = suite1_1[ri_53]) && (RFCXXXX = protocol1_1[ri_53]) && (lbytes_empty = salt_1[ri_53])) at 300
    - Replaced defined condition x1_1[ri_53], x_O_7[ri_53], r_7[ri_53] with r_7[ri_53], salt_1[ri_53], protocol1_1[ri_53], suite1_1[ri_53], label1_1[ri_53], dh1_1[ri_53], dh2_1[ri_53], l_1[ri_53], protocol2_1[ri_53], suite2_1[ri_53], label2_1[ri_53], pkE''[ri_53], pkR''[ri_53], pkS''[ri_53] in find at 274
    - Replaced (x_O_6 = x_O_6[ri_54, ri_55]) with ((pk_S_1 = pk_S_1[ri_54, ri_55]) && (i_1 = ri_55) && (pkE_9 = pkE_9[ri_54, ri_55])) at 279
    - In branch 1 of find at 274, substituting u_59 with i_1
    - Replaced defined condition x_O_6[ri_54, ri_55], r_6[ri_54, ri_55] with r_6[ri_54], pkE_9[ri_54], pk_S_1[ri_54] in find at 274
    - Replaced (x_O_5 = x1_1[ri_59]) with ((pkS_2 = pkS''[ri_59]) && (pk_R_1 = pkR''[ri_59]) && (pkE_7 = pkE''[ri_59]) && (label_shared_secret = label2_1[ri_59]) && (suite_id = suite2_1[ri_59]) && (RFCXXXX = protocol2_1[ri_59]) && (I2OSP2(Nsecret) = l_1[ri_59]) && (exp(pk_R_1, sk_1) = dh2_1[ri_59]) && (exp(pk_R_1, z_3) = dh1_1[ri_59]) && (label_eae_prk = label1_1[ri_59]) && (suite_id = suite1_1[ri_59]) && (RFCXXXX = protocol1_1[ri_59]) && (lbytes_empty = salt_1[ri_59])) at 132
    - Replaced defined condition x1_1[ri_59], x_O_7[ri_59], r_7[ri_59] with r_7[ri_59], salt_1[ri_59], protocol1_1[ri_59], suite1_1[ri_59], label1_1[ri_59], dh1_1[ri_59], dh2_1[ri_59], l_1[ri_59], protocol2_1[ri_59], suite2_1[ri_59], label2_1[ri_59], pkE''[ri_59], pkR''[ri_59], pkS''[ri_59] in find at 128
yields

Game 43 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_4 <-R Z_t;
            pkE_8: G_t <- exp(g, z_4);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_3 <-R Z_t;
            pkE_7: G_t <- exp(g, z_3);
            dh_7: GG_t <- concatDH(exp(pk_R_1, z_3), exp(pk_R_1, sk_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7);
            x_O_5: eae_input_t <- eae_input(lbytes_empty, key_2, info_2);
            find [unique] u_63 = ri_59 <= Qh suchthat defined(r_7[ri_59], salt_1[ri_59], protocol1_1[ri_59], suite1_1[ri_59], label1_1[ri_59], dh1_1[ri_59], dh2_1[ri_59], l_1[ri_59], protocol2_1[ri_59], suite2_1[ri_59], label2_1[ri_59], pkE''[ri_59], pkR''[ri_59], pkS''[ri_59]) && (pkS_2 = pkS''[ri_59]) && (pk_R_1 = pkR''[ri_59]) && (pkE_7 = pkE''[ri_59]) && (label_shared_secret = label2_1[ri_59]) && (suite_id = suite2_1[ri_59]) && (RFCXXXX = protocol2_1[ri_59]) && (I2OSP2(Nsecret) = l_1[ri_59]) && (exp(pk_R_1, sk_1) = dh2_1[ri_59]) && (exp(pk_R_1, z_3) = dh1_1[ri_59]) && (label_eae_prk = label1_1[ri_59]) && (suite_id = suite1_1[ri_59]) && (RFCXXXX = protocol1_1[ri_59]) && (lbytes_empty = salt_1[ri_59]) then
              return(AuthEncap_tuple(r_7[u_63], enc_6))
            else
              r_5 <-R eae_output_t;
              return(AuthEncap_tuple(r_5, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, sk_1), exp(pk_S_1, sk_1));
              pkR_4: G_t <- exp(g, sk_1);
              kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1);
              key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
              info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
              x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
              find [unique] u_58 = ri_54 <= Qdperuser suchthat defined(r_6[ri_54], pkE_9[ri_54], pk_S_1[ri_54]) && {368}((pk_S_1 = pk_S_1[ri_54]) && (i_1 = i_1) && (pkE_9 = pkE_9[ri_54])) then
                u_59 <= N <- i_1;
                return(AuthDecap_Some(r_6[u_58]))
              orfind u_57 = ri_53 <= Qh suchthat defined(r_7[ri_53], salt_1[ri_53], protocol1_1[ri_53], suite1_1[ri_53], label1_1[ri_53], dh1_1[ri_53], dh2_1[ri_53], l_1[ri_53], protocol2_1[ri_53], suite2_1[ri_53], label2_1[ri_53], pkE''[ri_53], pkR''[ri_53], pkS''[ri_53]) && (pk_S_1 = pkS''[ri_53]) && (pkR_4 = pkR''[ri_53]) && (pkE_9 = pkE''[ri_53]) && (label_shared_secret = label2_1[ri_53]) && (suite_id = suite2_1[ri_53]) && (RFCXXXX = protocol2_1[ri_53]) && (I2OSP2(Nsecret) = l_1[ri_53]) && (exp(pk_S_1, sk_1) = dh2_1[ri_53]) && (exp(pkE_9, sk_1) = dh1_1[ri_53]) && (label_eae_prk = label1_1[ri_53]) && (suite_id = suite1_1[ri_53]) && (RFCXXXX = protocol1_1[ri_53]) && (lbytes_empty = salt_1[ri_53]) then
                return(AuthDecap_Some(r_7[u_57]))
              else
                r_6 <-R eae_output_t;
                return(AuthDecap_Some(r_6))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          x_O_7: eae_input_t <- cst_eae_input_t;
          find [unique] u_54 = ri_50 <= Qeperuser, u_55 = ri_51 <= N suchthat defined(r_5[ri_50, ri_51], z_3[ri_50, ri_51], sk_1[ri_51], pkE_7[ri_50, ri_51], pk_R_1[ri_50, ri_51], pkS_2[ri_50, ri_51]) && (pkS'' = pkS_2[ri_50, ri_51]) && (pkR'' = pk_R_1[ri_50, ri_51]) && (pkE'' = pkE_7[ri_50, ri_51]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_50, ri_51], sk_1[ri_51])) && (dh1_1 = exp(pk_R_1[ri_50, ri_51], z_3[ri_50, ri_51])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_5[u_54, u_55])
          orfind u_52 = ri_48 <= Qdperuser, u_53 = ri_49 <= N suchthat defined(r_6[ri_48, ri_49], sk_1[ri_49], pkE_9[ri_48, ri_49], pkR_4[ri_48, ri_49], pk_S_1[ri_48, ri_49]) && (pkS'' = pk_S_1[ri_48, ri_49]) && (pkR'' = pkR_4[ri_48, ri_49]) && (pkE'' = pkE_9[ri_48, ri_49]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_48, ri_49], sk_1[ri_49])) && (dh1_1 = exp(pkE_9[ri_48, ri_49], sk_1[ri_49])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_52, u_53])
          orfind u_51 = ri_47 <= Qh suchthat defined(r_7[ri_47], salt_1[ri_47], protocol1_1[ri_47], suite1_1[ri_47], label1_1[ri_47], dh1_1[ri_47], dh2_1[ri_47], l_1[ri_47], protocol2_1[ri_47], suite2_1[ri_47], label2_1[ri_47], pkE''[ri_47], pkR''[ri_47], pkS''[ri_47]) && (pkS'' = pkS''[ri_47]) && (pkR'' = pkR''[ri_47]) && (pkE'' = pkE''[ri_47]) && (label2_1 = label2_1[ri_47]) && (suite2_1 = suite2_1[ri_47]) && (protocol2_1 = protocol2_1[ri_47]) && (l_1 = l_1[ri_47]) && (dh2_1 = dh2_1[ri_47]) && (dh1_1 = dh1_1[ri_47]) && (label1_1 = label1_1[ri_47]) && (suite1_1 = suite1_1[ri_47]) && (protocol1_1 = protocol1_1[ri_47]) && (salt_1 = salt_1[ri_47]) then
            return(r_7[u_51])
          else
            r_7 <-R eae_output_t;
            return(r_7)
        else
          x_O_8: eae_input_t <- cst_eae_input_t;
          find [unique] u_44 = ri_40 <= Qh suchthat defined(r_8[ri_40], x1_1[ri_40]) && (x1_1 = x1_1[ri_40]) then
            return(r_8[u_44])
          else
            r_8 <-R eae_output_t;
            return(r_8)
      ))


Applying simplify
  - Simplification pass
    - Replaced ((pk_S_1 = pk_S_1[ri_54]) && (i_1 = i_1) && (pkE_9 = pkE_9[ri_54])) with ((pk_S_1 = pk_S_1[ri_54]) && (pkE_9 = pkE_9[ri_54])) at 368
yields

Game 44 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_4 <-R Z_t;
            pkE_8: G_t <- exp(g, z_4);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_3 <-R Z_t;
            pkE_7: G_t <- exp(g, z_3);
            dh_7: GG_t <- concatDH(exp(pk_R_1, z_3), exp(pk_R_1, sk_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            kemContext_7: GGG_t <- concatContext(pkE_7, pk_R_1, pkS_2);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_7);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_7);
            x_O_5: eae_input_t <- eae_input(lbytes_empty, key_2, info_2);
            find [unique] u_63 = ri_59 <= Qh suchthat defined(r_7[ri_59], salt_1[ri_59], protocol1_1[ri_59], suite1_1[ri_59], label1_1[ri_59], dh1_1[ri_59], dh2_1[ri_59], l_1[ri_59], protocol2_1[ri_59], suite2_1[ri_59], label2_1[ri_59], pkE''[ri_59], pkR''[ri_59], pkS''[ri_59]) && (pkS_2 = pkS''[ri_59]) && (pk_R_1 = pkR''[ri_59]) && (pkE_7 = pkE''[ri_59]) && (label_shared_secret = label2_1[ri_59]) && (suite_id = suite2_1[ri_59]) && (RFCXXXX = protocol2_1[ri_59]) && (I2OSP2(Nsecret) = l_1[ri_59]) && (exp(pk_R_1, sk_1) = dh2_1[ri_59]) && (exp(pk_R_1, z_3) = dh1_1[ri_59]) && (label_eae_prk = label1_1[ri_59]) && (suite_id = suite1_1[ri_59]) && (RFCXXXX = protocol1_1[ri_59]) && (lbytes_empty = salt_1[ri_59]) then
              return(AuthEncap_tuple(r_7[u_63], enc_6))
            else
              r_5 <-R eae_output_t;
              return(AuthEncap_tuple(r_5, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, sk_1), exp(pk_S_1, sk_1));
              pkR_4: G_t <- exp(g, sk_1);
              kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pk_S_1);
              key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
              info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
              x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
              find [unique] u_58 = ri_54 <= Qdperuser suchthat defined(r_6[ri_54], pkE_9[ri_54], pk_S_1[ri_54]) && (pk_S_1 = pk_S_1[ri_54]) && (pkE_9 = pkE_9[ri_54]) then
                u_59 <= N <- i_1;
                return(AuthDecap_Some(r_6[u_58]))
              orfind u_57 = ri_53 <= Qh suchthat defined(r_7[ri_53], salt_1[ri_53], protocol1_1[ri_53], suite1_1[ri_53], label1_1[ri_53], dh1_1[ri_53], dh2_1[ri_53], l_1[ri_53], protocol2_1[ri_53], suite2_1[ri_53], label2_1[ri_53], pkE''[ri_53], pkR''[ri_53], pkS''[ri_53]) && (pk_S_1 = pkS''[ri_53]) && (pkR_4 = pkR''[ri_53]) && (pkE_9 = pkE''[ri_53]) && (label_shared_secret = label2_1[ri_53]) && (suite_id = suite2_1[ri_53]) && (RFCXXXX = protocol2_1[ri_53]) && (I2OSP2(Nsecret) = l_1[ri_53]) && (exp(pk_S_1, sk_1) = dh2_1[ri_53]) && (exp(pkE_9, sk_1) = dh1_1[ri_53]) && (label_eae_prk = label1_1[ri_53]) && (suite_id = suite1_1[ri_53]) && (RFCXXXX = protocol1_1[ri_53]) && (lbytes_empty = salt_1[ri_53]) then
                return(AuthDecap_Some(r_7[u_57]))
              else
                r_6 <-R eae_output_t;
                return(AuthDecap_Some(r_6))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          x_O_7: eae_input_t <- cst_eae_input_t;
          find [unique] u_54 = ri_50 <= Qeperuser, u_55 = ri_51 <= N suchthat defined(r_5[ri_50, ri_51], z_3[ri_50, ri_51], sk_1[ri_51], pkE_7[ri_50, ri_51], pk_R_1[ri_50, ri_51], pkS_2[ri_50, ri_51]) && (pkS'' = pkS_2[ri_50, ri_51]) && (pkR'' = pk_R_1[ri_50, ri_51]) && (pkE'' = pkE_7[ri_50, ri_51]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_50, ri_51], sk_1[ri_51])) && (dh1_1 = exp(pk_R_1[ri_50, ri_51], z_3[ri_50, ri_51])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_5[u_54, u_55])
          orfind u_52 = ri_48 <= Qdperuser, u_53 = ri_49 <= N suchthat defined(r_6[ri_48, ri_49], sk_1[ri_49], pkE_9[ri_48, ri_49], pkR_4[ri_48, ri_49], pk_S_1[ri_48, ri_49]) && (pkS'' = pk_S_1[ri_48, ri_49]) && (pkR'' = pkR_4[ri_48, ri_49]) && (pkE'' = pkE_9[ri_48, ri_49]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_48, ri_49], sk_1[ri_49])) && (dh1_1 = exp(pkE_9[ri_48, ri_49], sk_1[ri_49])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_52, u_53])
          orfind u_51 = ri_47 <= Qh suchthat defined(r_7[ri_47], salt_1[ri_47], protocol1_1[ri_47], suite1_1[ri_47], label1_1[ri_47], dh1_1[ri_47], dh2_1[ri_47], l_1[ri_47], protocol2_1[ri_47], suite2_1[ri_47], label2_1[ri_47], pkE''[ri_47], pkR''[ri_47], pkS''[ri_47]) && (pkS'' = pkS''[ri_47]) && (pkR'' = pkR''[ri_47]) && (pkE'' = pkE''[ri_47]) && (label2_1 = label2_1[ri_47]) && (suite2_1 = suite2_1[ri_47]) && (protocol2_1 = protocol2_1[ri_47]) && (l_1 = l_1[ri_47]) && (dh2_1 = dh2_1[ri_47]) && (dh1_1 = dh1_1[ri_47]) && (label1_1 = label1_1[ri_47]) && (suite1_1 = suite1_1[ri_47]) && (protocol1_1 = protocol1_1[ri_47]) && (salt_1 = salt_1[ri_47]) then
            return(r_7[u_51])
          else
            r_7 <-R eae_output_t;
            return(r_7)
        else
          x_O_8: eae_input_t <- cst_eae_input_t;
          find [unique] u_44 = ri_40 <= Qh suchthat defined(r_8[ri_40], x1_1[ri_40]) && (x1_1 = x1_1[ri_40]) then
            return(r_8[u_44])
          else
            r_8 <-R eae_output_t;
            return(r_8)
      ))


Applying move all binders
  - Move assignment to x_O_8
  - Move assignment to x_O_7
  - Move assignment to x_O_6
  - Move assignment to info_4
  - Move assignment to key_4
  - Move assignment to kemContext_9
  - Move assignment to x_O_5
  - Move assignment to info_2
  - Move assignment to key_2
  - Move assignment to kemContext_7
yields

Game 45 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_4 <-R Z_t;
            pkE_8: G_t <- exp(g, z_4);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_3 <-R Z_t;
            pkE_7: G_t <- exp(g, z_3);
            dh_7: GG_t <- concatDH(exp(pk_R_1, z_3), exp(pk_R_1, sk_1));
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            find [unique] u_63 = ri_59 <= Qh suchthat defined(r_7[ri_59], salt_1[ri_59], protocol1_1[ri_59], suite1_1[ri_59], label1_1[ri_59], dh1_1[ri_59], dh2_1[ri_59], l_1[ri_59], protocol2_1[ri_59], suite2_1[ri_59], label2_1[ri_59], pkE''[ri_59], pkR''[ri_59], pkS''[ri_59]) && (pkS_2 = pkS''[ri_59]) && (pk_R_1 = pkR''[ri_59]) && (pkE_7 = pkE''[ri_59]) && (label_shared_secret = label2_1[ri_59]) && (suite_id = suite2_1[ri_59]) && (RFCXXXX = protocol2_1[ri_59]) && (I2OSP2(Nsecret) = l_1[ri_59]) && (exp(pk_R_1, sk_1) = dh2_1[ri_59]) && (exp(pk_R_1, z_3) = dh1_1[ri_59]) && (label_eae_prk = label1_1[ri_59]) && (suite_id = suite1_1[ri_59]) && (RFCXXXX = protocol1_1[ri_59]) && (lbytes_empty = salt_1[ri_59]) then
              return(AuthEncap_tuple(r_7[u_63], enc_6))
            else
              r_5 <-R eae_output_t;
              return(AuthEncap_tuple(r_5, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              dh_9: GG_t <- concatDH(exp(pkE_9, sk_1), exp(pk_S_1, sk_1));
              pkR_4: G_t <- exp(g, sk_1);
              find [unique] u_58 = ri_54 <= Qdperuser suchthat defined(r_6[ri_54], pkE_9[ri_54], pk_S_1[ri_54]) && (pk_S_1 = pk_S_1[ri_54]) && (pkE_9 = pkE_9[ri_54]) then
                u_59 <= N <- i_1;
                return(AuthDecap_Some(r_6[u_58]))
              orfind u_57 = ri_53 <= Qh suchthat defined(r_7[ri_53], salt_1[ri_53], protocol1_1[ri_53], suite1_1[ri_53], label1_1[ri_53], dh1_1[ri_53], dh2_1[ri_53], l_1[ri_53], protocol2_1[ri_53], suite2_1[ri_53], label2_1[ri_53], pkE''[ri_53], pkR''[ri_53], pkS''[ri_53]) && (pk_S_1 = pkS''[ri_53]) && (pkR_4 = pkR''[ri_53]) && (pkE_9 = pkE''[ri_53]) && (label_shared_secret = label2_1[ri_53]) && (suite_id = suite2_1[ri_53]) && (RFCXXXX = protocol2_1[ri_53]) && (I2OSP2(Nsecret) = l_1[ri_53]) && (exp(pk_S_1, sk_1) = dh2_1[ri_53]) && (exp(pkE_9, sk_1) = dh1_1[ri_53]) && (label_eae_prk = label1_1[ri_53]) && (suite_id = suite1_1[ri_53]) && (RFCXXXX = protocol1_1[ri_53]) && (lbytes_empty = salt_1[ri_53]) then
                return(AuthDecap_Some(r_7[u_57]))
              else
                r_6 <-R eae_output_t;
                return(AuthDecap_Some(r_6))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          find [unique] u_54 = ri_50 <= Qeperuser, u_55 = ri_51 <= N suchthat defined(r_5[ri_50, ri_51], z_3[ri_50, ri_51], sk_1[ri_51], pkE_7[ri_50, ri_51], pk_R_1[ri_50, ri_51], pkS_2[ri_50, ri_51]) && (pkS'' = pkS_2[ri_50, ri_51]) && (pkR'' = pk_R_1[ri_50, ri_51]) && (pkE'' = pkE_7[ri_50, ri_51]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_50, ri_51], sk_1[ri_51])) && (dh1_1 = exp(pk_R_1[ri_50, ri_51], z_3[ri_50, ri_51])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_5[u_54, u_55])
          orfind u_52 = ri_48 <= Qdperuser, u_53 = ri_49 <= N suchthat defined(r_6[ri_48, ri_49], sk_1[ri_49], pkE_9[ri_48, ri_49], pkR_4[ri_48, ri_49], pk_S_1[ri_48, ri_49]) && (pkS'' = pk_S_1[ri_48, ri_49]) && (pkR'' = pkR_4[ri_48, ri_49]) && (pkE'' = pkE_9[ri_48, ri_49]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_48, ri_49], sk_1[ri_49])) && (dh1_1 = exp(pkE_9[ri_48, ri_49], sk_1[ri_49])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_52, u_53])
          orfind u_51 = ri_47 <= Qh suchthat defined(r_7[ri_47], salt_1[ri_47], protocol1_1[ri_47], suite1_1[ri_47], label1_1[ri_47], dh1_1[ri_47], dh2_1[ri_47], l_1[ri_47], protocol2_1[ri_47], suite2_1[ri_47], label2_1[ri_47], pkE''[ri_47], pkR''[ri_47], pkS''[ri_47]) && (pkS'' = pkS''[ri_47]) && (pkR'' = pkR''[ri_47]) && (pkE'' = pkE''[ri_47]) && (label2_1 = label2_1[ri_47]) && (suite2_1 = suite2_1[ri_47]) && (protocol2_1 = protocol2_1[ri_47]) && (l_1 = l_1[ri_47]) && (dh2_1 = dh2_1[ri_47]) && (dh1_1 = dh1_1[ri_47]) && (label1_1 = label1_1[ri_47]) && (suite1_1 = suite1_1[ri_47]) && (protocol1_1 = protocol1_1[ri_47]) && (salt_1 = salt_1[ri_47]) then
            return(r_7[u_51])
          else
            r_7 <-R eae_output_t;
            return(r_7)
        else
          find [unique] u_44 = ri_40 <= Qh suchthat defined(r_8[ri_40], x1_1[ri_40]) && (x1_1 = x1_1[ri_40]) then
            return(r_8[u_44])
          else
            r_8 <-R eae_output_t;
            return(r_8)
      ))


Applying remove assignments of findcond
  - Remove assignments on dh_9 (definition removed, all usages removed)
  - Remove assignments on u_59 (definition removed, all usages removed)
  - Remove assignments on dh_7 (definition removed, all usages removed)
yields

Game 46 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_4 <-R Z_t;
            pkE_8: G_t <- exp(g, z_4);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk_1);
            return(AuthEncap_tuple(k', enc_7))
          else
            z_3 <-R Z_t;
            pkE_7: G_t <- exp(g, z_3);
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            find [unique] u_63 = ri_59 <= Qh suchthat defined(r_7[ri_59], salt_1[ri_59], protocol1_1[ri_59], suite1_1[ri_59], label1_1[ri_59], dh1_1[ri_59], dh2_1[ri_59], l_1[ri_59], protocol2_1[ri_59], suite2_1[ri_59], label2_1[ri_59], pkE''[ri_59], pkR''[ri_59], pkS''[ri_59]) && (pkS_2 = pkS''[ri_59]) && (pk_R_1 = pkR''[ri_59]) && (pkE_7 = pkE''[ri_59]) && (label_shared_secret = label2_1[ri_59]) && (suite_id = suite2_1[ri_59]) && (RFCXXXX = protocol2_1[ri_59]) && (I2OSP2(Nsecret) = l_1[ri_59]) && (exp(pk_R_1, sk_1) = dh2_1[ri_59]) && (exp(pk_R_1, z_3) = dh1_1[ri_59]) && (label_eae_prk = label1_1[ri_59]) && (suite_id = suite1_1[ri_59]) && (RFCXXXX = protocol1_1[ri_59]) && (lbytes_empty = salt_1[ri_59]) then
              return(AuthEncap_tuple(r_7[u_63], enc_6))
            else
              r_5 <-R eae_output_t;
              return(AuthEncap_tuple(r_5, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3], E_1[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              pkR_4: G_t <- exp(g, sk_1);
              find [unique] u_58 = ri_54 <= Qdperuser suchthat defined(r_6[ri_54], pkE_9[ri_54], pk_S_1[ri_54]) && (pk_S_1 = pk_S_1[ri_54]) && (pkE_9 = pkE_9[ri_54]) then
                return(AuthDecap_Some(r_6[u_58]))
              orfind u_57 = ri_53 <= Qh suchthat defined(r_7[ri_53], salt_1[ri_53], protocol1_1[ri_53], suite1_1[ri_53], label1_1[ri_53], dh1_1[ri_53], dh2_1[ri_53], l_1[ri_53], protocol2_1[ri_53], suite2_1[ri_53], label2_1[ri_53], pkE''[ri_53], pkR''[ri_53], pkS''[ri_53]) && (pk_S_1 = pkS''[ri_53]) && (pkR_4 = pkR''[ri_53]) && (pkE_9 = pkE''[ri_53]) && (label_shared_secret = label2_1[ri_53]) && (suite_id = suite2_1[ri_53]) && (RFCXXXX = protocol2_1[ri_53]) && (I2OSP2(Nsecret) = l_1[ri_53]) && (exp(pk_S_1, sk_1) = dh2_1[ri_53]) && (exp(pkE_9, sk_1) = dh1_1[ri_53]) && (label_eae_prk = label1_1[ri_53]) && (suite_id = suite1_1[ri_53]) && (RFCXXXX = protocol1_1[ri_53]) && (lbytes_empty = salt_1[ri_53]) then
                return(AuthDecap_Some(r_7[u_57]))
              else
                r_6 <-R eae_output_t;
                return(AuthDecap_Some(r_6))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          find [unique] u_54 = ri_50 <= Qeperuser, u_55 = ri_51 <= N suchthat defined(r_5[ri_50, ri_51], z_3[ri_50, ri_51], sk_1[ri_51], pkE_7[ri_50, ri_51], pk_R_1[ri_50, ri_51], pkS_2[ri_50, ri_51]) && (pkS'' = pkS_2[ri_50, ri_51]) && (pkR'' = pk_R_1[ri_50, ri_51]) && (pkE'' = pkE_7[ri_50, ri_51]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_50, ri_51], sk_1[ri_51])) && (dh1_1 = exp(pk_R_1[ri_50, ri_51], z_3[ri_50, ri_51])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_5[u_54, u_55])
          orfind u_52 = ri_48 <= Qdperuser, u_53 = ri_49 <= N suchthat defined(r_6[ri_48, ri_49], sk_1[ri_49], pkE_9[ri_48, ri_49], pkR_4[ri_48, ri_49], pk_S_1[ri_48, ri_49]) && (pkS'' = pk_S_1[ri_48, ri_49]) && (pkR'' = pkR_4[ri_48, ri_49]) && (pkE'' = pkE_9[ri_48, ri_49]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_48, ri_49], sk_1[ri_49])) && (dh1_1 = exp(pkE_9[ri_48, ri_49], sk_1[ri_49])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_52, u_53])
          orfind u_51 = ri_47 <= Qh suchthat defined(r_7[ri_47], salt_1[ri_47], protocol1_1[ri_47], suite1_1[ri_47], label1_1[ri_47], dh1_1[ri_47], dh2_1[ri_47], l_1[ri_47], protocol2_1[ri_47], suite2_1[ri_47], label2_1[ri_47], pkE''[ri_47], pkR''[ri_47], pkS''[ri_47]) && (pkS'' = pkS''[ri_47]) && (pkR'' = pkR''[ri_47]) && (pkE'' = pkE''[ri_47]) && (label2_1 = label2_1[ri_47]) && (suite2_1 = suite2_1[ri_47]) && (protocol2_1 = protocol2_1[ri_47]) && (l_1 = l_1[ri_47]) && (dh2_1 = dh2_1[ri_47]) && (dh1_1 = dh1_1[ri_47]) && (label1_1 = label1_1[ri_47]) && (suite1_1 = suite1_1[ri_47]) && (protocol1_1 = protocol1_1[ri_47]) && (salt_1 = salt_1[ri_47]) then
            return(r_7[u_51])
          else
            r_7 <-R eae_output_t;
            return(r_7)
        else
          find [unique] u_44 = ri_40 <= Qh suchthat defined(r_8[ri_40], x1_1[ri_40]) && (x1_1 = x1_1[ri_40]) then
            return(r_8[u_44])
          else
            r_8 <-R eae_output_t;
            return(r_8)
      ))


Applying remove assignments of binder E_1
  - Remove assignments on E_1 (definition removed, all usages removed)
yields

Game 47 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i1_1 = i1 <= N suchthat defined(sk_1[i1]) && (pk_R_1 = exp(g, sk_1[i1])) then
            z_4 <-R Z_t;
            pkE_8: G_t <- exp(g, z_4);
            enc_7: bitstring <- Serialize(pkE_8);
            k' <-R eae_output_t;
            return(AuthEncap_tuple(k', enc_7))
          else
            z_3 <-R Z_t;
            pkE_7: G_t <- exp(g, z_3);
            enc_6: bitstring <- Serialize(pkE_7);
            pkS_2: G_t <- exp(g, sk_1);
            find [unique] u_63 = ri_59 <= Qh suchthat defined(r_7[ri_59], salt_1[ri_59], protocol1_1[ri_59], suite1_1[ri_59], label1_1[ri_59], dh1_1[ri_59], dh2_1[ri_59], l_1[ri_59], protocol2_1[ri_59], suite2_1[ri_59], label2_1[ri_59], pkE''[ri_59], pkR''[ri_59], pkS''[ri_59]) && (pkS_2 = pkS''[ri_59]) && (pk_R_1 = pkR''[ri_59]) && (pkE_7 = pkE''[ri_59]) && (label_shared_secret = label2_1[ri_59]) && (suite_id = suite2_1[ri_59]) && (RFCXXXX = protocol2_1[ri_59]) && (I2OSP2(Nsecret) = l_1[ri_59]) && (exp(pk_R_1, sk_1) = dh2_1[ri_59]) && (exp(pk_R_1, z_3) = dh1_1[ri_59]) && (label_eae_prk = label1_1[ri_59]) && (suite_id = suite1_1[ri_59]) && (RFCXXXX = protocol1_1[ri_59]) && (lbytes_empty = salt_1[ri_59]) then
              return(AuthEncap_tuple(r_7[u_63], enc_6))
            else
              r_5 <-R eae_output_t;
              return(AuthEncap_tuple(r_5, enc_6))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd: bitstring) :=
          find u = u_2 <= Qeperuser, u_1 = u_3 <= N suchthat defined(sk_1[u_3], k'[u_2, u_3], enc_7[u_2, u_3], i1_1[u_2, u_3]) && (exp(g, sk_1[u_3]) = pk_S_1) && (i1_1[u_2, u_3] = i_1) && (enc_7[u_2, u_3] = cd) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_9: G_t) = cd in
              pkR_4: G_t <- exp(g, sk_1);
              find [unique] u_58 = ri_54 <= Qdperuser suchthat defined(r_6[ri_54], pkE_9[ri_54], pk_S_1[ri_54]) && (pk_S_1 = pk_S_1[ri_54]) && (pkE_9 = pkE_9[ri_54]) then
                return(AuthDecap_Some(r_6[u_58]))
              orfind u_57 = ri_53 <= Qh suchthat defined(r_7[ri_53], salt_1[ri_53], protocol1_1[ri_53], suite1_1[ri_53], label1_1[ri_53], dh1_1[ri_53], dh2_1[ri_53], l_1[ri_53], protocol2_1[ri_53], suite2_1[ri_53], label2_1[ri_53], pkE''[ri_53], pkR''[ri_53], pkS''[ri_53]) && (pk_S_1 = pkS''[ri_53]) && (pkR_4 = pkR''[ri_53]) && (pkE_9 = pkE''[ri_53]) && (label_shared_secret = label2_1[ri_53]) && (suite_id = suite2_1[ri_53]) && (RFCXXXX = protocol2_1[ri_53]) && (I2OSP2(Nsecret) = l_1[ri_53]) && (exp(pk_S_1, sk_1) = dh2_1[ri_53]) && (exp(pkE_9, sk_1) = dh1_1[ri_53]) && (label_eae_prk = label1_1[ri_53]) && (suite_id = suite1_1[ri_53]) && (RFCXXXX = protocol1_1[ri_53]) && (lbytes_empty = salt_1[ri_53]) then
                return(AuthDecap_Some(r_7[u_57]))
              else
                r_6 <-R eae_output_t;
                return(AuthDecap_Some(r_6))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          find [unique] u_54 = ri_50 <= Qeperuser, u_55 = ri_51 <= N suchthat defined(r_5[ri_50, ri_51], z_3[ri_50, ri_51], sk_1[ri_51], pkE_7[ri_50, ri_51], pk_R_1[ri_50, ri_51], pkS_2[ri_50, ri_51]) && (pkS'' = pkS_2[ri_50, ri_51]) && (pkR'' = pk_R_1[ri_50, ri_51]) && (pkE'' = pkE_7[ri_50, ri_51]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_50, ri_51], sk_1[ri_51])) && (dh1_1 = exp(pk_R_1[ri_50, ri_51], z_3[ri_50, ri_51])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_5[u_54, u_55])
          orfind u_52 = ri_48 <= Qdperuser, u_53 = ri_49 <= N suchthat defined(r_6[ri_48, ri_49], sk_1[ri_49], pkE_9[ri_48, ri_49], pkR_4[ri_48, ri_49], pk_S_1[ri_48, ri_49]) && (pkS'' = pk_S_1[ri_48, ri_49]) && (pkR'' = pkR_4[ri_48, ri_49]) && (pkE'' = pkE_9[ri_48, ri_49]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_48, ri_49], sk_1[ri_49])) && (dh1_1 = exp(pkE_9[ri_48, ri_49], sk_1[ri_49])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_52, u_53])
          orfind u_51 = ri_47 <= Qh suchthat defined(r_7[ri_47], salt_1[ri_47], protocol1_1[ri_47], suite1_1[ri_47], label1_1[ri_47], dh1_1[ri_47], dh2_1[ri_47], l_1[ri_47], protocol2_1[ri_47], suite2_1[ri_47], label2_1[ri_47], pkE''[ri_47], pkR''[ri_47], pkS''[ri_47]) && (pkS'' = pkS''[ri_47]) && (pkR'' = pkR''[ri_47]) && (pkE'' = pkE''[ri_47]) && (label2_1 = label2_1[ri_47]) && (suite2_1 = suite2_1[ri_47]) && (protocol2_1 = protocol2_1[ri_47]) && (l_1 = l_1[ri_47]) && (dh2_1 = dh2_1[ri_47]) && (dh1_1 = dh1_1[ri_47]) && (label1_1 = label1_1[ri_47]) && (suite1_1 = suite1_1[ri_47]) && (protocol1_1 = protocol1_1[ri_47]) && (salt_1 = salt_1[ri_47]) then
            return(r_7[u_51])
          else
            r_7 <-R eae_output_t;
            return(r_7)
        else
          find [unique] u_44 = ri_40 <= Qh suchthat defined(r_8[ri_40], x1_1[ri_40]) && (x1_1 = x1_1[ri_40]) then
            return(r_8[u_44])
          else
            r_8 <-R eae_output_t;
            return(r_8)
      ))


Proved indistinguishability between game 47 and game 1
Game 47 is the same as game 31.
Adv[Game 1: indistinguishability from game 31] <= Adv_GDH(time_1, 5 * Qh) + (N + #OAEncap) * PDistRerandom + (#OAEncap * #OADecap + #OAEncap * N + 8 * #OAEncap^2 + 6 * N^2) * PCollKey + Adv[Game 31: indistinguishability from game 31]
Adv[Game 32: indistinguishability from game 47] <= (#OAEncap * N + 2 * #OAEncap^2 + 5 * N^2) * PCollKey + Adv[Game 47: indistinguishability from game 47]
RESULT Proved indistinguishability between game 32 and game 1 up to probability Adv_GDH(time_1, 5 * Qh) + (N + #OAEncap) * PDistRerandom + (#OAEncap * #OADecap + 2 * #OAEncap * N + 10 * #OAEncap^2 + 11 * N^2) * PCollKey
RESULT time_1 = #OAEncap * time(AuthEncap_tuple, maxlength(game 28: enc_8)) + #OAEncap * time(Serialize) + #OAEncap * time(AuthEncap_tuple, maxlength(game 28: enc_9)) + #OADecap * #OAEncap * time(= bitstring, maxlength(game 28: enc_8), maxlength(game 28: enc_2)) + #OADecap * time(let Serialize) + #OADecap * time(AuthDecap_Some) + Qh * time(let eae_input) + Qh * time(let concatExpand) + Qh * time(let concatContext) + Qh * time(let concatExtract) + Qh * time(let concatDH) + (3 * Qh * #OAEncap + 2 * Qh * #OADecap) * time(I2OSP2) + (2 * Qh * #OAEncap + 1 + 2 * #OAEncap + N) * time(exp) + time
All queries proved.