软件质量 - 欢迎访问北京大学信息学院软工所.PPT

* * * * * * * * * * * * * * * * * * * * * * * active proctype Alice() { /* honest initiator for one protocol run */ mtype partner_key, partner_nonce; Crypt data; if /* nondeterministically choose a partner for this run */ :: partnerA = bob; partner_key = keyB; :: partnerA = intruder; partner_key = keyI; fi; d_step { /* Construct msg1 and send it to chosen partner */ data.key = partner_key; data.d1 = alice; data.d2 = nonceA; } network ! msg1(partnerA, data); /* wait for partner to send back msg2 and decipher it */ network ? msg2(alice, data); end_errA: /* make sure the partner used As key and that the first nonce matches, otherwise block. */ (data.key == keyA) (data.d1 == nonceA); partner_nonce = data.d2; d_step { /* respond with msg3 and declare success */ data.key = partner_key; data.d1 = partner_nonce; data.d2 = 0; } network ! msg3(partnerA, data); statusA = ok; } /* proctype Alice() */ active proctype Bob() { /* honest responder for one run */ mtype partner_key, partner_nonce; Crypt data; network ? msg1(bob, data); end_errB1: (data.key == keyB); partnerB = data.d1; d_step { partner_nonce = data.d2; if :: (partnerB == alice) - partner_key = keyA; :: (partnerB == bob) - partner_key = keyB; /* shouldnt happen */ :: (partnerB == intruder) - partner_key = keyI; fi; /* respond with msg2 */ data.key = partner_key; data.d1 = partner_nonce; data.d2 = nonceB; } network ! msg2(partnerB, data); /* wait for msg3, check the key and the nonce, and declare success */ network ? msg3(bob, data); end_errB2: (data.key == keyB) (data.d1 == nonceB); statusB = ok; } active proctype Intruder() { mtype msg; Crypt data, intercepted; mtype icp_type; /* type of intercepted message */ do :: /* Send msg1 to B (sending it to anybody else would be foolish). May use own identity or pretend to be A; send some nonce known to I.*/ if /* either replay intercepted message or constr