dhkem.auth.insider-cca-lr.proof

Initial state
Game 1 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          return((pkR_1: G_t <- exp(g, sk); {26}let (skE_2: Z_t, pkE_3: G_t) = (z_1 <-R Z_t; (z_1, exp(g, z_1))) in dh_3: GG_t <- concatDH(exp(pkR_1, skE_2), exp(pkR_1, sk')); enc_2: bitstring <- Serialize(pkE_3); pkS: G_t <- exp(g, sk'); kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS); zz_3: eae_output_t <- (key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3); info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3); ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info))); AuthEncap_tuple(zz_3, enc_2) else AuthEncap_None))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          return({119}(let (skE_3: Z_t, pkE_4: G_t) = (z_2 <-R Z_t; (z_2, exp(g, z_2))) in dh_4: GG_t <- concatDH(exp(pk_R, skE_3), exp(pk_R, sk)); enc_3: bitstring <- Serialize(pkE_4); pkS_1: G_t <- exp(g, sk); kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1); zz_4: eae_output_t <- (key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4); info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4); ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1))); AuthEncap_tuple(zz_4, enc_3) else AuthEncap_None))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          return((skR: Z_t <- sk; let Serialize(pkE_5: G_t) = cd in dh_5: GG_t <- concatDH(exp(pkE_5, skR), exp(pk_S, skR)); pkR_2: G_t <- exp(g, skR); kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S); zz_5: eae_output_t <- (key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5); info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5); ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2))); AuthDecap_Some(zz_5) else AuthDecap_None))
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying expand
  - Expand if/find/let
    - Simplify pattern (skE_3: Z_t, pkE_4: G_t) (tuple expanded) at 119
    - Remove else branch of let at 119
    - Simplify pattern (skE_2: Z_t, pkE_3: G_t) (tuple expanded) at 26
    - Remove else branch of let at 26
yields

Game 2 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          skE_2: Z_t <- z_1;
          dh_3: GG_t <- concatDH(exp(pkR_1, skE_2), exp(pkR_1, sk'));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          z_2 <-R Z_t;
          pkE_4: G_t <- exp(g, z_2);
          skE_3: Z_t <- z_2;
          dh_4: GG_t <- concatDH(exp(pk_R, skE_3), exp(pk_R, sk));
          enc_3: bitstring <- Serialize(pkE_4);
          pkS_1: G_t <- exp(g, sk);
          kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
          key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
          info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
          zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
          return(AuthEncap_tuple(zz_4, enc_3))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          skR: Z_t <- sk;
          let Serialize(pkE_5: G_t) = cd in
            dh_5: GG_t <- concatDH(exp(pkE_5, skR), exp(pk_S, skR));
            pkR_2: G_t <- exp(g, skR);
            kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
            zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
            return(AuthDecap_Some(zz_5))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying remove assignments of findcond
  - Remove assignments on skR (definition removed, all usages removed)
  - Remove assignments on skE_3 (definition removed, all usages removed)
  - Remove assignments on skE_2 (definition removed, all usages removed)
yields

Game 3 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- {32}concatDH(exp(pkR_1, z_1), exp(pkR_1, sk'));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          z_2 <-R Z_t;
          pkE_4: G_t <- exp(g, z_2);
          dh_4: GG_t <- concatDH(exp(pk_R, z_2), exp(pk_R, sk));
          enc_3: bitstring <- Serialize(pkE_4);
          pkS_1: G_t <- exp(g, sk);
          kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
          key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
          info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
          zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
          return(AuthEncap_tuple(zz_4, enc_3))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          let Serialize(pkE_5: G_t) = cd in
            dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
            pkR_2: G_t <- exp(g, sk);
            kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
            zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
            return(AuthDecap_Some(zz_5))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying simplify
  - Simplification pass
    - Replaced concatDH(exp(pkR_1, z_1), exp(pkR_1, sk')) with concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk'))) at 32
yields

Game 4 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          z_2 <-R Z_t;
          pkE_4: G_t <- exp(g, z_2);
          dh_4: GG_t <- concatDH(exp(pk_R, z_2), exp(pk_R, sk));
          enc_3: bitstring <- Serialize(pkE_4);
          pkS_1: G_t <- exp(g, sk);
          kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
          key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
          info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
          zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
          return(AuthEncap_tuple(zz_4, enc_3))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
 {217}    let Serialize(pkE_5: G_t) = cd in
            dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
            pkR_2: G_t <- exp(g, sk);
            kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
            zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
            return(AuthDecap_Some(zz_5))
          else
            return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying insert instruction find ic_1 = ic <= Qcperuser suchthat
      defined(zz_3[ic], sk'[ic], enc_2[ic])
      && (enc_2[ic] = cd)
      && (exp(g, sk'[ic]) = pk_S)
      then at occurrence 217
yields

Game 5 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          z_2 <-R Z_t;
          pkE_4: G_t <- exp(g, z_2);
          dh_4: GG_t <- concatDH(exp(pk_R, z_2), exp(pk_R, sk));
          enc_3: bitstring <- Serialize(pkE_4);
          pkS_1: G_t <- exp(g, sk);
          kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
          key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
          info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
          zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
          return(AuthEncap_tuple(zz_4, enc_3))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
 {217}    find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
 {241}      let Serialize(pkE_5: G_t) = {242}cd in
              dh_5: GG_t <- {246}concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying simplify
  - Simplification pass
    - Replaced cd with Serialize(pkE_3[ic_2]) at 242
    - Remove else branch of let at 241
    - Simplify pattern Serialize(pkE_5: G_t) (tuple expanded) at 241
    - Replaced concatDH(exp(pkE_5, sk), exp(pk_S, sk)) with concatDH(exp(g, mult(z_1[ic_2], sk)), exp(g, mult(sk'[ic_2], sk))) at 246
    - Replaced defined condition zz_3[ic_3], sk'[ic_3], enc_2[ic_3] with zz_3[ic_3], z_1[ic_3], pkE_3[ic_3], sk'[ic_3], enc_2[ic_3] in find at 217
yields

Game 6 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          z_2 <-R Z_t;
          pkE_4: G_t <- exp(g, z_2);
          dh_4: GG_t <- concatDH(exp(pk_R, z_2), exp(pk_R, sk));
          enc_3: bitstring <- Serialize(pkE_4);
          pkS_1: G_t <- exp(g, sk);
          kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
          key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
          info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
          zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
          return(AuthEncap_tuple(zz_4, enc_3))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], z_1[ic_3], pkE_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            pkE_5: G_t <- pkE_3[ic_2];
            dh_5: GG_t <- concatDH(exp(g, mult(z_1[ic_2], sk)), exp(g, mult(sk'[ic_2], sk)));
            pkR_2: G_t <- exp(g, sk);
            kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
            zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
            return(AuthDecap_Some({321}zz_5))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying replace term at occurrence 321 with zz_3[ic_2]
yields

Game 7 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          z_2 <-R Z_t;
          pkE_4: G_t <- exp(g, z_2);
          dh_4: GG_t <- concatDH(exp(pk_R, z_2), exp(pk_R, sk));
          enc_3: bitstring <- Serialize(pkE_4);
          pkS_1: G_t <- exp(g, sk);
          kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
          key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
          info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
          zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
          return(AuthEncap_tuple(zz_4, enc_3))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], z_1[ic_3], pkE_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            pkE_5: G_t <- pkE_3[ic_2];
            dh_5: GG_t <- concatDH(exp(g, mult(z_1[ic_2], sk)), exp(g, mult(sk'[ic_2], sk)));
            pkR_2: G_t <- exp(g, sk);
            kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
            key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
            info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
            zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying remove assignments of useless
  - Remove assignments on pkE_5 (definition removed, all usages removed)
  - Remove assignments on zz_5 (definition removed, all usages removed)
  - Remove assignments on key_2 (definition removed, all usages removed)
  - Remove assignments on info_2 (definition removed, all usages removed)
  - Remove assignments on dh_5 (definition removed, all usages removed)
  - Remove assignments on kemContext_5 (definition removed, all usages removed)
  - Remove assignments on pkR_2 (definition removed, all usages removed)
yields

Game 8 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          z_2 <-R Z_t;
          pkE_4: G_t <- exp(g, z_2);
          dh_4: GG_t <- concatDH(exp(pk_R, z_2), exp(pk_R, sk));
          enc_3: bitstring <- Serialize(pkE_4);
          pkS_1: G_t <- exp(g, sk);
          kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
          key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
          info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
          zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
          return(AuthEncap_tuple(zz_4, enc_3))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
 {217}    find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], z_1[ic_3], pkE_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying simplify
  - Simplification pass
    - Replaced defined condition zz_3[ic_3], z_1[ic_3], pkE_3[ic_3], sk'[ic_3], enc_2[ic_3] with zz_3[ic_3], sk'[ic_3], enc_2[ic_3] in find at 217
yields

Game 9 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
 {123}    z_2 <-R Z_t;
          pkE_4: G_t <- exp(g, z_2);
          dh_4: GG_t <- concatDH(exp(pk_R, z_2), exp(pk_R, sk));
          enc_3: bitstring <- Serialize(pkE_4);
          pkS_1: G_t <- exp(g, sk);
          kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
          key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
          info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
          zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
          return(AuthEncap_tuple(zz_4, enc_3))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying insert instruction find i1 <= N suchthat
      defined(sk[i1])
      && pk_R = exp(g, sk[i1]) then at occurrence 123
yields

Game 10 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_2 <-R Z_t;
            pkE_4: G_t <- exp(g, z_2);
            dh_4: GG_t <- concatDH(exp(pk_R, z_2), exp(pk_R, sk));
            enc_3: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_4, enc_3))
          else
            z_2 <-R Z_t;
            pkE_4: G_t <- exp(g, z_2);
            dh_4: GG_t <- concatDH(exp(pk_R, z_2), exp(pk_R, sk));
            enc_3: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_4, enc_3))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying SA rename z_2
  - Rename variable z_2 into z_7, z_6
yields

Game 11 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_4: G_t <- exp(g, z_6);
            dh_4: GG_t <- {141}concatDH(exp(pk_R, z_6), exp(pk_R, sk));
            enc_3: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_4, enc_3))
          else
            z_7 <-R Z_t;
            pkE_4: G_t <- exp(g, z_7);
            dh_4: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_3: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_4, enc_3))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying simplify
  - Simplification pass
    - Replaced concatDH(exp(pk_R, z_6), exp(pk_R, sk)) with concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk))) at 141
yields

Game 12 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_4: G_t <- exp(g, z_6);
            dh_4: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_3: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_4, enc_3))
          else
            z_7 <-R Z_t;
            pkE_4: G_t <- exp(g, z_7);
            dh_4: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_3: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_4, enc_3))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying SA rename enc_3
  - Rename variable enc_3 into enc_10, enc_9
yields

Game 13 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_4: G_t <- exp(g, z_6);
            dh_4: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_4, enc_9))
          else
            z_7 <-R Z_t;
            pkE_4: G_t <- exp(g, z_7);
            dh_4: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_4);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_4, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying SA rename dh_4
  - Rename variable dh_4 into dh_13, dh_12
yields

Game 14 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_4: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_4, enc_9))
          else
            z_7 <-R Z_t;
            pkE_4: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_4: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_4, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying SA rename zz_4
  - Rename variable zz_4 into zz_13, zz_12
yields

Game 15 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_4: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_12: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_12, enc_9))
          else
            z_7 <-R Z_t;
            pkE_4: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_4);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_4, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_13: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_13, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying SA rename pkE_4
  - Rename variable pkE_4 into pkE_13, pkE_12
yields

Game 16 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_12, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_12: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_12, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            kemContext_4: GGG_t <- concatContext(pkE_13, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_4);
            zz_13: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_13, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying SA rename kemContext_4
  - Rename variable kemContext_4 into kemContext_13, kemContext_12
yields

Game 17 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            kemContext_12: GGG_t <- concatContext(pkE_12, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_12);
            zz_12: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_12, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            kemContext_13: GGG_t <- concatContext(pkE_13, pk_R, pkS_1);
            key_1: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_13);
            zz_13: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_1, info_1));
            return(AuthEncap_tuple(zz_13, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying SA rename key_1
  - Rename variable key_1 into key_7, key_6
yields

Game 18 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            kemContext_12: GGG_t <- concatContext(pkE_12, pk_R, pkS_1);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_12);
            zz_12: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_6, info_1));
            return(AuthEncap_tuple(zz_12, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            kemContext_13: GGG_t <- concatContext(pkE_13, pk_R, pkS_1);
            key_7: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_1: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_13);
            zz_13: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_7, info_1));
            return(AuthEncap_tuple(zz_13, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying SA rename info_1
  - Rename variable info_1 into info_7, info_6
yields

Game 19 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            kemContext_12: GGG_t <- concatContext(pkE_12, pk_R, pkS_1);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_12);
            zz_12: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_6, info_6));
            return(AuthEncap_tuple(zz_12, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            kemContext_13: GGG_t <- concatContext(pkE_13, pk_R, pkS_1);
            key_7: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_7: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_13);
            zz_13: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_7, info_7));
            return(AuthEncap_tuple(zz_13, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
 {448}  return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying insert instruction let eae_input(
      salt: extract_salt_t,
      concatExtract(
        protocol1: label_protocol_t,
        suite1: suite_id_t,
        label1: label_extract_t,
        concatDH(dh1: G_t, dh2: G_t)),
      concatExpand(
        l: two_byte_t,
        protocol2: label_protocol_t,
        suite2: suite_id_t,
        label2: label_expand_t,
        concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in at occurrence 448
yields

Game 20 is
      Ostart() :=
      key_extr_4 <-R hash_key_t;
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key, info));
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            kemContext_12: GGG_t <- concatContext(pkE_12, pk_R, pkS_1);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_12);
            zz_12: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_6, info_6));
            return(AuthEncap_tuple(zz_12, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            kemContext_13: GGG_t <- concatContext(pkE_13, pk_R, pkS_1);
            key_7: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_7: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_13);
            zz_13: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_7, info_7));
            return(AuthEncap_tuple(zz_13, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- ExtractAndExpand_inner(key_extr_4, eae_input(lbytes_empty, key_2, info_2));
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          return(ExtractAndExpand_inner(key_extr_4, x1))
        else
          return(ExtractAndExpand_inner(key_extr_4, x1))
      ))


Applying equivalence rom(ExtractAndExpand_inner)
  - Equivalence rom(ExtractAndExpand_inner) with variables: key_extr_4 -> hk
yields

Game 21 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- (x_O: eae_input_t <- eae_input(lbytes_empty, key, info); {98}find [unique] u_62 = ri_58 <= Qcperuser, u_63 = ri_59 <= N suchthat defined(x_O[ri_58, ri_59], r[ri_58, ri_59]) && (x_O = x_O[ri_58, ri_59]) then r[u_62, u_63] orfind u_60 = ri_56 <= Qeperuser, u_61 = ri_57 <= N suchthat defined(x_O_1[ri_56, ri_57], r_1[ri_56, ri_57]) && {121}(x_O = x_O_1[ri_56, ri_57]) then r_1[u_60, u_61] orfind u_58 = ri_54 <= Qeperuser, u_59 = ri_55 <= N suchthat defined(x_O_2[ri_54, ri_55], r_2[ri_54, ri_55]) && {139}(x_O = x_O_2[ri_54, ri_55]) then r_2[u_58, u_59] orfind u_56 = ri_52 <= Qdperuser, u_57 = ri_53 <= N suchthat defined(x_O_3[ri_52, ri_53], r_3[ri_52, ri_53]) && (x_O = x_O_3[ri_52, ri_53]) then r_3[u_56, u_57] orfind u_55 = ri_51 <= Qh suchthat defined(x_O_4[ri_51], r_4[ri_51]) && (x_O = x_O_4[ri_51]) then r_4[u_55] orfind u_54 = ri_50 <= Qh suchthat defined(x_O_5[ri_50], r_5[ri_50]) && {185}(x_O = x_O_5[ri_50]) then r_5[u_54] else r <-R eae_output_t; r);
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            kemContext_12: GGG_t <- concatContext(pkE_12, pk_R, pkS_1);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_12);
            zz_12: eae_output_t <- (x_O_2: eae_input_t <- eae_input(lbytes_empty, key_6, info_6); {309}find [unique] u_52 = ri_48 <= Qcperuser, u_53 = ri_49 <= N suchthat defined(x_O[ri_48, ri_49], r[ri_48, ri_49]) && {314}(x_O_2 = x_O[ri_48, ri_49]) then r[u_52, u_53] orfind u_50 = ri_46 <= Qeperuser, u_51 = ri_47 <= N suchthat defined(x_O_1[ri_46, ri_47], r_1[ri_46, ri_47]) && {332}(x_O_2 = x_O_1[ri_46, ri_47]) then r_1[u_50, u_51] orfind u_48 = ri_44 <= Qeperuser, u_49 = ri_45 <= N suchthat defined(x_O_2[ri_44, ri_45], r_2[ri_44, ri_45]) && (x_O_2 = x_O_2[ri_44, ri_45]) then r_2[u_48, u_49] orfind u_46 = ri_42 <= Qdperuser, u_47 = ri_43 <= N suchthat defined(x_O_3[ri_42, ri_43], r_3[ri_42, ri_43]) && (x_O_2 = x_O_3[ri_42, ri_43]) then r_3[u_46, u_47] orfind u_45 = ri_41 <= Qh suchthat defined(x_O_4[ri_41], r_4[ri_41]) && (x_O_2 = x_O_4[ri_41]) then r_4[u_45] orfind u_44 = ri_40 <= Qh suchthat defined(x_O_5[ri_40], r_5[ri_40]) && {396}(x_O_2 = x_O_5[ri_40]) then r_5[u_44] else r_2 <-R eae_output_t; r_2);
            return(AuthEncap_tuple(zz_12, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            kemContext_13: GGG_t <- concatContext(pkE_13, pk_R, pkS_1);
            key_7: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_7: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_13);
            zz_13: eae_output_t <- (x_O_1: eae_input_t <- eae_input(lbytes_empty, key_7, info_7); {499}find [unique] u_42 = ri_38 <= Qcperuser, u_43 = ri_39 <= N suchthat defined(x_O[ri_38, ri_39], r[ri_38, ri_39]) && {504}(x_O_1 = x_O[ri_38, ri_39]) then r[u_42, u_43] orfind u_40 = ri_36 <= Qeperuser, u_41 = ri_37 <= N suchthat defined(x_O_1[ri_36, ri_37], r_1[ri_36, ri_37]) && (x_O_1 = x_O_1[ri_36, ri_37]) then r_1[u_40, u_41] orfind u_38 = ri_34 <= Qeperuser, u_39 = ri_35 <= N suchthat defined(x_O_2[ri_34, ri_35], r_2[ri_34, ri_35]) && {540}(x_O_1 = x_O_2[ri_34, ri_35]) then r_2[u_38, u_39] orfind u_36 = ri_32 <= Qdperuser, u_37 = ri_33 <= N suchthat defined(x_O_3[ri_32, ri_33], r_3[ri_32, ri_33]) && (x_O_1 = x_O_3[ri_32, ri_33]) then r_3[u_36, u_37] orfind u_35 = ri_31 <= Qh suchthat defined(x_O_4[ri_31], r_4[ri_31]) && (x_O_1 = x_O_4[ri_31]) then r_4[u_35] orfind u_34 = ri_30 <= Qh suchthat defined(x_O_5[ri_30], r_5[ri_30]) && {586}(x_O_1 = x_O_5[ri_30]) then r_5[u_34] else r_1 <-R eae_output_t; r_1);
            return(AuthEncap_tuple(zz_13, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- (x_O_3: eae_input_t <- eae_input(lbytes_empty, key_2, info_2); {717}find [unique] u_32 = ri_28 <= Qcperuser, u_33 = ri_29 <= N suchthat defined(x_O[ri_28, ri_29], r[ri_28, ri_29]) && (x_O_3 = x_O[ri_28, ri_29]) then r[u_32, u_33] orfind u_30 = ri_26 <= Qeperuser, u_31 = ri_27 <= N suchthat defined(x_O_1[ri_26, ri_27], r_1[ri_26, ri_27]) && (x_O_3 = x_O_1[ri_26, ri_27]) then r_1[u_30, u_31] orfind u_28 = ri_24 <= Qeperuser, u_29 = ri_25 <= N suchthat defined(x_O_2[ri_24, ri_25], r_2[ri_24, ri_25]) && (x_O_3 = x_O_2[ri_24, ri_25]) then r_2[u_28, u_29] orfind u_26 = ri_22 <= Qdperuser, u_27 = ri_23 <= N suchthat defined(x_O_3[ri_22, ri_23], r_3[ri_22, ri_23]) && (x_O_3 = x_O_3[ri_22, ri_23]) then r_3[u_26, u_27] orfind u_25 = ri_21 <= Qh suchthat defined(x_O_4[ri_21], r_4[ri_21]) && (x_O_3 = x_O_4[ri_21]) then r_4[u_25] orfind u_24 = ri_20 <= Qh suchthat defined(x_O_5[ri_20], r_5[ri_20]) && {804}(x_O_3 = x_O_5[ri_20]) then r_5[u_24] else r_3 <-R eae_output_t; r_3);
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          return((x_O_4: eae_input_t <- x1; {855}find [unique] u_22 = ri_18 <= Qcperuser, u_23 = ri_19 <= N suchthat defined(x_O[ri_18, ri_19], r[ri_18, ri_19]) && (x_O_4 = x_O[ri_18, ri_19]) then r[u_22, u_23] orfind u_20 = ri_16 <= Qeperuser, u_21 = ri_17 <= N suchthat defined(x_O_1[ri_16, ri_17], r_1[ri_16, ri_17]) && (x_O_4 = x_O_1[ri_16, ri_17]) then r_1[u_20, u_21] orfind u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(x_O_2[ri_14, ri_15], r_2[ri_14, ri_15]) && (x_O_4 = x_O_2[ri_14, ri_15]) then r_2[u_18, u_19] orfind u_16 = ri_12 <= Qdperuser, u_17 = ri_13 <= N suchthat defined(x_O_3[ri_12, ri_13], r_3[ri_12, ri_13]) && (x_O_4 = x_O_3[ri_12, ri_13]) then r_3[u_16, u_17] orfind u_15 = ri_11 <= Qh suchthat defined(x_O_4[ri_11], r_4[ri_11]) && (x_O_4 = x_O_4[ri_11]) then r_4[u_15] orfind u_14 = ri_10 <= Qh suchthat defined(x_O_5[ri_10], r_5[ri_10]) && {928}(x_O_4 = x_O_5[ri_10]) then r_5[u_14] else r_4 <-R eae_output_t; r_4))
        else
          return((x_O_5: eae_input_t <- x1; {945}find [unique] u_12 = ri_8 <= Qcperuser, u_13 = ri_9 <= N suchthat defined(x_O[ri_8, ri_9], r[ri_8, ri_9]) && {950}(x_O_5 = x_O[ri_8, ri_9]) then r[u_12, u_13] orfind u_10 = ri_6 <= Qeperuser, u_11 = ri_7 <= N suchthat defined(x_O_1[ri_6, ri_7], r_1[ri_6, ri_7]) && {965}(x_O_5 = x_O_1[ri_6, ri_7]) then r_1[u_10, u_11] orfind u_8 = ri_4 <= Qeperuser, u_9 = ri_5 <= N suchthat defined(x_O_2[ri_4, ri_5], r_2[ri_4, ri_5]) && {980}(x_O_5 = x_O_2[ri_4, ri_5]) then r_2[u_8, u_9] orfind u_6 = ri_2 <= Qdperuser, u_7 = ri_3 <= N suchthat defined(x_O_3[ri_2, ri_3], r_3[ri_2, ri_3]) && {995}(x_O_5 = x_O_3[ri_2, ri_3]) then r_3[u_6, u_7] orfind u_5 = ri_1 <= Qh suchthat defined(x_O_4[ri_1], r_4[ri_1]) && {1008}(x_O_5 = x_O_4[ri_1]) then r_4[u_5] orfind u_4 = ri <= Qh suchthat defined(x_O_5[ri], r_5[ri]) && (x_O_5 = x_O_5[ri]) then r_5[u_4] else r_5 <-R eae_output_t; r_5))
      ))


Applying simplify (non-expanded game) [probability (4 * #OAEncap^2 + #Ochall^2 + 4 * #Ochall * #OAEncap + N^2) * PCollKey]
  - Simplification pass
    - Replaced (x_O = x_O_5[ri_50]) with false at 185
    - Remove branch 6 in find at 98
    - Replaced (x_O = x_O_2[ri_54, ri_55]) with false at 139
    - Remove branch 3 in find at 98
    - Replaced (x_O = x_O_1[ri_56, ri_57]) with false at 121
    - Remove branch 2 in find at 98
    - Replaced (x_O_2 = x_O_5[ri_40]) with false at 396
    - Remove branch 6 in find at 309
    - Replaced (x_O_2 = x_O_1[ri_46, ri_47]) with false at 332
    - Remove branch 2 in find at 309
    - Replaced (x_O_2 = x_O[ri_48, ri_49]) with false at 314
    - Remove branch 1 in find at 309
    - Replaced (x_O_1 = x_O_5[ri_30]) with false at 586
    - Remove branch 6 in find at 499
    - Replaced (x_O_1 = x_O_2[ri_34, ri_35]) with false at 540
    - Remove branch 3 in find at 499
    - Replaced (x_O_1 = x_O[ri_38, ri_39]) with false at 504
    - Remove branch 1 in find at 499
    - Replaced (x_O_3 = x_O_5[ri_20]) with false at 804
    - Remove branch 6 in find at 717
    - Replaced (x_O_4 = x_O_5[ri_10]) with false at 928
    - Remove branch 6 in find at 855
    - Replaced (x_O_5 = x_O_4[ri_1]) with false at 1008
    - Remove branch 5 in find at 945
    - Replaced (x_O_5 = x_O_3[ri_2, ri_3]) with false at 995
    - Remove branch 4 in find at 945
    - Replaced (x_O_5 = x_O_2[ri_4, ri_5]) with false at 980
    - Remove branch 3 in find at 945
    - Replaced (x_O_5 = x_O_1[ri_6, ri_7]) with false at 965
    - Remove branch 2 in find at 945
    - Replaced (x_O_5 = x_O[ri_8, ri_9]) with false at 950
    - Remove branch 1 in find at 945
yields

Game 22 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          zz_3: eae_output_t <- (x_O: eae_input_t <- eae_input(lbytes_empty, key, info); {98}find [unique] u_62 = ri_58 <= Qcperuser, u_63 = ri_59 <= N suchthat defined(x_O[ri_58, ri_59], r[ri_58, ri_59]) && (x_O = x_O[ri_58, ri_59]) then r[u_62, u_63] orfind u_56 = ri_52 <= Qdperuser, u_57 = ri_53 <= N suchthat defined(x_O_3[ri_52, ri_53], r_3[ri_52, ri_53]) && (x_O = x_O_3[ri_52, ri_53]) then r_3[u_56, u_57] orfind u_55 = ri_51 <= Qh suchthat defined(x_O_4[ri_51], r_4[ri_51]) && (x_O = x_O_4[ri_51]) then r_4[u_55] else r <-R eae_output_t; r);
          return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            kemContext_12: GGG_t <- concatContext(pkE_12, pk_R, pkS_1);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_12);
            zz_12: eae_output_t <- (x_O_2: eae_input_t <- eae_input(lbytes_empty, key_6, info_6); {261}find [unique] u_48 = ri_44 <= Qeperuser, u_49 = ri_45 <= N suchthat defined(x_O_2[ri_44, ri_45], r_2[ri_44, ri_45]) && (x_O_2 = x_O_2[ri_44, ri_45]) then r_2[u_48, u_49] orfind u_46 = ri_42 <= Qdperuser, u_47 = ri_43 <= N suchthat defined(x_O_3[ri_42, ri_43], r_3[ri_42, ri_43]) && (x_O_2 = x_O_3[ri_42, ri_43]) then r_3[u_46, u_47] orfind u_45 = ri_41 <= Qh suchthat defined(x_O_4[ri_41], r_4[ri_41]) && (x_O_2 = x_O_4[ri_41]) then r_4[u_45] else r_2 <-R eae_output_t; r_2);
            return(AuthEncap_tuple(zz_12, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            kemContext_13: GGG_t <- concatContext(pkE_13, pk_R, pkS_1);
            key_7: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_7: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_13);
            zz_13: eae_output_t <- (x_O_1: eae_input_t <- eae_input(lbytes_empty, key_7, info_7); {403}find [unique] u_40 = ri_36 <= Qeperuser, u_41 = ri_37 <= N suchthat defined(x_O_1[ri_36, ri_37], r_1[ri_36, ri_37]) && (x_O_1 = x_O_1[ri_36, ri_37]) then r_1[u_40, u_41] orfind u_36 = ri_32 <= Qdperuser, u_37 = ri_33 <= N suchthat defined(x_O_3[ri_32, ri_33], r_3[ri_32, ri_33]) && (x_O_1 = x_O_3[ri_32, ri_33]) then r_3[u_36, u_37] orfind u_35 = ri_31 <= Qh suchthat defined(x_O_4[ri_31], r_4[ri_31]) && (x_O_1 = x_O_4[ri_31]) then r_4[u_35] else r_1 <-R eae_output_t; r_1);
            return(AuthEncap_tuple(zz_13, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              zz_5: eae_output_t <- (x_O_3: eae_input_t <- eae_input(lbytes_empty, key_2, info_2); {573}find [unique] u_32 = ri_28 <= Qcperuser, u_33 = ri_29 <= N suchthat defined(x_O[ri_28, ri_29], r[ri_28, ri_29]) && (x_O_3 = x_O[ri_28, ri_29]) then r[u_32, u_33] orfind u_30 = ri_26 <= Qeperuser, u_31 = ri_27 <= N suchthat defined(x_O_1[ri_26, ri_27], r_1[ri_26, ri_27]) && (x_O_3 = x_O_1[ri_26, ri_27]) then r_1[u_30, u_31] orfind u_28 = ri_24 <= Qeperuser, u_29 = ri_25 <= N suchthat defined(x_O_2[ri_24, ri_25], r_2[ri_24, ri_25]) && (x_O_3 = x_O_2[ri_24, ri_25]) then r_2[u_28, u_29] orfind u_26 = ri_22 <= Qdperuser, u_27 = ri_23 <= N suchthat defined(x_O_3[ri_22, ri_23], r_3[ri_22, ri_23]) && (x_O_3 = x_O_3[ri_22, ri_23]) then r_3[u_26, u_27] orfind u_25 = ri_21 <= Qh suchthat defined(x_O_4[ri_21], r_4[ri_21]) && (x_O_3 = x_O_4[ri_21]) then r_4[u_25] else r_3 <-R eae_output_t; r_3);
              return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          return((x_O_4: eae_input_t <- x1; find [unique] u_22 = ri_18 <= Qcperuser, u_23 = ri_19 <= N suchthat defined(x_O[ri_18, ri_19], r[ri_18, ri_19]) && (x_O_4 = x_O[ri_18, ri_19]) then r[u_22, u_23] orfind u_20 = ri_16 <= Qeperuser, u_21 = ri_17 <= N suchthat defined(x_O_1[ri_16, ri_17], r_1[ri_16, ri_17]) && (x_O_4 = x_O_1[ri_16, ri_17]) then r_1[u_20, u_21] orfind u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(x_O_2[ri_14, ri_15], r_2[ri_14, ri_15]) && (x_O_4 = x_O_2[ri_14, ri_15]) then r_2[u_18, u_19] orfind u_16 = ri_12 <= Qdperuser, u_17 = ri_13 <= N suchthat defined(x_O_3[ri_12, ri_13], r_3[ri_12, ri_13]) && (x_O_4 = x_O_3[ri_12, ri_13]) then r_3[u_16, u_17] orfind u_15 = ri_11 <= Qh suchthat defined(x_O_4[ri_11], r_4[ri_11]) && (x_O_4 = x_O_4[ri_11]) then r_4[u_15] else r_4 <-R eae_output_t; r_4))
        else
          return((x_O_5: eae_input_t <- x1; find [unique] u_4 = ri <= Qh suchthat defined(x_O_5[ri], r_5[ri]) && (x_O_5 = x_O_5[ri]) then r_5[u_4] else r_5 <-R eae_output_t; r_5))
      ))


Applying expand [probability (#Ochall^2 + 2 * #OAEncap^2 + #OAEncap * N + N^2) * PCollKey]
  - Expand if/find/let
    - Remove branch 2 in find at 573
    - Remove branch 2 in find at 403
    - Remove branch 1 in find at 403
    - Remove branch 1 in find at 261
    - Remove branch 1 in find at 98
yields

Game 23 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          x_O: eae_input_t <- eae_input(lbytes_empty, key, info);
          find [unique] u_56 = ri_52 <= Qdperuser, u_57 = ri_53 <= N suchthat defined(x_O_3[ri_52, ri_53], r_3[ri_52, ri_53]) && (x_O = x_O_3[ri_52, ri_53]) then
            zz_3: eae_output_t <- r_3[u_56, u_57];
            return(AuthEncap_tuple(zz_3, enc_2))
          orfind u_55 = ri_51 <= Qh suchthat defined(x_O_4[ri_51], r_4[ri_51]) && (x_O = x_O_4[ri_51]) then
            zz_3: eae_output_t <- r_4[u_55];
            return(AuthEncap_tuple(zz_3, enc_2))
          else
            r <-R eae_output_t;
            zz_3: eae_output_t <- r;
            return(AuthEncap_tuple(zz_3, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            kemContext_12: GGG_t <- concatContext(pkE_12, pk_R, pkS_1);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_12);
            x_O_2: eae_input_t <- eae_input(lbytes_empty, key_6, info_6);
            find [unique] u_46 = ri_42 <= Qdperuser, u_47 = ri_43 <= N suchthat defined(x_O_3[ri_42, ri_43], r_3[ri_42, ri_43]) && (x_O_2 = x_O_3[ri_42, ri_43]) then
              zz_12: eae_output_t <- r_3[u_46, u_47];
              return(AuthEncap_tuple(zz_12, enc_9))
            orfind u_45 = ri_41 <= Qh suchthat defined(x_O_4[ri_41], r_4[ri_41]) && (x_O_2 = x_O_4[ri_41]) then
              zz_12: eae_output_t <- r_4[u_45];
              return(AuthEncap_tuple(zz_12, enc_9))
            else
              r_2 <-R eae_output_t;
              zz_12: eae_output_t <- r_2;
              return(AuthEncap_tuple(zz_12, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            kemContext_13: GGG_t <- concatContext(pkE_13, pk_R, pkS_1);
            key_7: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_7: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_13);
            x_O_1: eae_input_t <- eae_input(lbytes_empty, key_7, info_7);
            find [unique] u_35 = ri_31 <= Qh suchthat defined(x_O_4[ri_31], r_4[ri_31]) && (x_O_1 = x_O_4[ri_31]) then
              zz_13: eae_output_t <- r_4[u_35];
              return(AuthEncap_tuple(zz_13, enc_10))
            else
              r_1 <-R eae_output_t;
              zz_13: eae_output_t <- r_1;
              return(AuthEncap_tuple(zz_13, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              x_O_3: eae_input_t <- eae_input(lbytes_empty, key_2, info_2);
              find [unique] u_32 = ri_28 <= Qcperuser, u_33 = ri_29 <= N suchthat defined(x_O[ri_28, ri_29], r[ri_28, ri_29]) && (x_O_3 = x_O[ri_28, ri_29]) then
                zz_5: eae_output_t <- r[u_32, u_33];
                return(AuthDecap_Some(zz_5))
              orfind u_28 = ri_24 <= Qeperuser, u_29 = ri_25 <= N suchthat defined(x_O_2[ri_24, ri_25], r_2[ri_24, ri_25]) && (x_O_3 = x_O_2[ri_24, ri_25]) then
                zz_5: eae_output_t <- r_2[u_28, u_29];
                return(AuthDecap_Some(zz_5))
              orfind u_26 = ri_22 <= Qdperuser, u_27 = ri_23 <= N suchthat defined(x_O_3[ri_22, ri_23], r_3[ri_22, ri_23]) && (x_O_3 = x_O_3[ri_22, ri_23]) then
                zz_5: eae_output_t <- r_3[u_26, u_27];
                return(AuthDecap_Some(zz_5))
              orfind u_25 = ri_21 <= Qh suchthat defined(x_O_4[ri_21], r_4[ri_21]) && (x_O_3 = x_O_4[ri_21]) then
                zz_5: eae_output_t <- r_4[u_25];
                return(AuthDecap_Some(zz_5))
              else
                r_3 <-R eae_output_t;
                zz_5: eae_output_t <- r_3;
                return(AuthDecap_Some(zz_5))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          x_O_4: eae_input_t <- x1;
          find [unique] u_22 = ri_18 <= Qcperuser, u_23 = ri_19 <= N suchthat defined(x_O[ri_18, ri_19], r[ri_18, ri_19]) && (x_O_4 = x_O[ri_18, ri_19]) then
            return(r[u_22, u_23])
          orfind u_20 = ri_16 <= Qeperuser, u_21 = ri_17 <= N suchthat defined(x_O_1[ri_16, ri_17], r_1[ri_16, ri_17]) && (x_O_4 = x_O_1[ri_16, ri_17]) then
            return(r_1[u_20, u_21])
          orfind u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(x_O_2[ri_14, ri_15], r_2[ri_14, ri_15]) && (x_O_4 = x_O_2[ri_14, ri_15]) then
            return(r_2[u_18, u_19])
          orfind u_16 = ri_12 <= Qdperuser, u_17 = ri_13 <= N suchthat defined(x_O_3[ri_12, ri_13], r_3[ri_12, ri_13]) && (x_O_4 = x_O_3[ri_12, ri_13]) then
            return(r_3[u_16, u_17])
          orfind u_15 = ri_11 <= Qh suchthat defined(x_O_4[ri_11], r_4[ri_11]) && (x_O_4 = x_O_4[ri_11]) then
            return(r_4[u_15])
          else
            r_4 <-R eae_output_t;
            return(r_4)
        else
          x_O_5: eae_input_t <- x1;
          find [unique] u_4 = ri <= Qh suchthat defined(x_O_5[ri], r_5[ri]) && (x_O_5 = x_O_5[ri]) then
            return(r_5[u_4])
          else
            r_5 <-R eae_output_t;
            return(r_5)
      ))


Applying remove assignments of findcond
  - Remove assignments on x_O_5 (definition point kept, all usages removed)
  - Remove assignments on x_O_4 (definition point kept, all usages removed)
  - Remove assignments on zz_5 (definition removed, all usages removed)
  - Remove assignments on zz_5 (definition removed, all usages removed)
  - Remove assignments on zz_5 (definition removed, all usages removed)
  - Remove assignments on zz_5 (definition removed, all usages removed)
  - Remove assignments on zz_5 (definition removed, all usages removed)
  - Remove assignments on zz_13 (definition removed, all usages removed)
  - Remove assignments on zz_13 (definition removed, all usages removed)
  - Remove assignments on zz_12 (definition removed, all usages removed)
  - Remove assignments on zz_12 (definition removed, all usages removed)
  - Remove assignments on zz_12 (definition removed, all usages removed)
  - Remove assignments on zz_3 (definition kept, array references kept)
  - Remove assignments on zz_3 (definition kept, array references kept)
  - Remove assignments on zz_3 (definition kept, array references kept)
yields

Game 24 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          x_O: eae_input_t <- eae_input(lbytes_empty, key, info);
  {97}    find [unique] u_56 = ri_52 <= Qdperuser, u_57 = ri_53 <= N suchthat defined(x_O_3[ri_52, ri_53], r_3[ri_52, ri_53]) && {102}(x_O = x_O_3[ri_52, ri_53]) then
            zz_3: eae_output_t <- r_3[u_56, u_57];
            return(AuthEncap_tuple(r_3[u_56, u_57], enc_2))
          orfind u_55 = ri_51 <= Qh suchthat defined(x1[ri_51], x_O_4[ri_51], r_4[ri_51]) && {135}(x_O = x1[ri_51]) then
            zz_3: eae_output_t <- r_4[u_55];
            return(AuthEncap_tuple(r_4[u_55], enc_2))
          else
            r <-R eae_output_t;
            zz_3: eae_output_t <- r;
            return(AuthEncap_tuple(r, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            kemContext_12: GGG_t <- concatContext(pkE_12, pk_R, pkS_1);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_12);
            x_O_2: eae_input_t <- eae_input(lbytes_empty, key_6, info_6);
 {273}      find [unique] u_46 = ri_42 <= Qdperuser, u_47 = ri_43 <= N suchthat defined(x_O_3[ri_42, ri_43], r_3[ri_42, ri_43]) && {278}(x_O_2 = x_O_3[ri_42, ri_43]) then
              return(AuthEncap_tuple(r_3[u_46, u_47], enc_9))
            orfind u_45 = ri_41 <= Qh suchthat defined(x1[ri_41], x_O_4[ri_41], r_4[ri_41]) && {302}(x_O_2 = x1[ri_41]) then
              return(AuthEncap_tuple(r_4[u_45], enc_9))
            else
              r_2 <-R eae_output_t;
              return(AuthEncap_tuple(r_2, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            kemContext_13: GGG_t <- concatContext(pkE_13, pk_R, pkS_1);
            key_7: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_7: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_13);
            x_O_1: eae_input_t <- eae_input(lbytes_empty, key_7, info_7);
 {408}      find [unique] u_35 = ri_31 <= Qh suchthat defined(x1[ri_31], x_O_4[ri_31], r_4[ri_31]) && {412}(x_O_1 = x1[ri_31]) then
              return(AuthEncap_tuple(r_4[u_35], enc_10))
            else
              r_1 <-R eae_output_t;
              return(AuthEncap_tuple(r_1, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              x_O_3: eae_input_t <- eae_input(lbytes_empty, key_2, info_2);
 {546}        find [unique] u_32 = ri_28 <= Qcperuser, u_33 = ri_29 <= N suchthat defined(x_O[ri_28, ri_29], r[ri_28, ri_29]) && {551}(x_O_3 = x_O[ri_28, ri_29]) then
                return(AuthDecap_Some(r[u_32, u_33]))
              orfind u_28 = ri_24 <= Qeperuser, u_29 = ri_25 <= N suchthat defined(x_O_2[ri_24, ri_25], r_2[ri_24, ri_25]) && {573}(x_O_3 = x_O_2[ri_24, ri_25]) then
                return(AuthDecap_Some(r_2[u_28, u_29]))
              orfind u_26 = ri_22 <= Qdperuser, u_27 = ri_23 <= N suchthat defined(x_O_3[ri_22, ri_23], r_3[ri_22, ri_23]) && {595}(x_O_3 = x_O_3[ri_22, ri_23]) then
                return(AuthDecap_Some(r_3[u_26, u_27]))
              orfind u_25 = ri_21 <= Qh suchthat defined(x1[ri_21], x_O_4[ri_21], r_4[ri_21]) && {616}(x_O_3 = x1[ri_21]) then
                return(AuthDecap_Some(r_4[u_25]))
              else
                r_3 <-R eae_output_t;
                return(AuthDecap_Some(r_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          x_O_4: eae_input_t <- cst_eae_input_t;
 {665}    find [unique] u_22 = ri_18 <= Qcperuser, u_23 = ri_19 <= N suchthat defined(x_O[ri_18, ri_19], r[ri_18, ri_19]) && {670}(x1 = x_O[ri_18, ri_19]) then
            return(r[u_22, u_23])
          orfind u_20 = ri_16 <= Qeperuser, u_21 = ri_17 <= N suchthat defined(x_O_1[ri_16, ri_17], r_1[ri_16, ri_17]) && {688}(x1 = x_O_1[ri_16, ri_17]) then
            return(r_1[u_20, u_21])
          orfind u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(x_O_2[ri_14, ri_15], r_2[ri_14, ri_15]) && {706}(x1 = x_O_2[ri_14, ri_15]) then
            return(r_2[u_18, u_19])
          orfind u_16 = ri_12 <= Qdperuser, u_17 = ri_13 <= N suchthat defined(x_O_3[ri_12, ri_13], r_3[ri_12, ri_13]) && {724}(x1 = x_O_3[ri_12, ri_13]) then
            return(r_3[u_16, u_17])
          orfind u_15 = ri_11 <= Qh suchthat defined(x1[ri_11], x_O_4[ri_11], r_4[ri_11]) && {741}(x1 = x1[ri_11]) then
            return(r_4[u_15])
          else
            r_4 <-R eae_output_t;
            return(r_4)
        else
          x_O_5: eae_input_t <- cst_eae_input_t;
 {761}    find [unique] u_4 = ri <= Qh suchthat defined(x1[ri], x_O_5[ri], r_5[ri]) && (x1 = x1[ri]) then
            return(r_5[u_4])
          else
            r_5 <-R eae_output_t;
            return(r_5)
      ))


Applying simplify [probability N^2 * PCollKey]
  - Simplification pass
    - Replaced defined condition x1[ri], x_O_5[ri], r_5[ri] with r_5[ri], x1[ri] in find at 761
    - Replaced (x1 = x1[ri_11]) with ((pkS' = pkS'[ri_11]) && (pkR' = pkR'[ri_11]) && (pkE' = pkE'[ri_11]) && (label2 = label2[ri_11]) && (suite2 = suite2[ri_11]) && (protocol2 = protocol2[ri_11]) && (l = l[ri_11]) && (dh2 = dh2[ri_11]) && (dh1 = dh1[ri_11]) && (label1 = label1[ri_11]) && (suite1 = suite1[ri_11]) && (protocol1 = protocol1[ri_11]) && (salt = salt[ri_11])) at 741
    - Replaced defined condition x1[ri_11], x_O_4[ri_11], r_4[ri_11] with r_4[ri_11], salt[ri_11], protocol1[ri_11], suite1[ri_11], label1[ri_11], dh1[ri_11], dh2[ri_11], l[ri_11], protocol2[ri_11], suite2[ri_11], label2[ri_11], pkE'[ri_11], pkR'[ri_11], pkS'[ri_11] in find at 665
    - Replaced (x1 = x_O_3[ri_12, ri_13]) with ((pkS' = pk_S[ri_12, ri_13]) && (pkR' = pkR_2[ri_12, ri_13]) && (pkE' = pkE_5[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_12, ri_13], sk[ri_13])) && (dh1 = exp(pkE_5[ri_12, ri_13], sk[ri_13])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty)) at 724
    - Replaced defined condition x_O_3[ri_12, ri_13], r_3[ri_12, ri_13] with r_3[ri_12, ri_13], sk[ri_13], pkE_5[ri_12, ri_13], pkR_2[ri_12, ri_13], pk_S[ri_12, ri_13] in find at 665
    - Replaced (x1 = x_O_2[ri_14, ri_15]) with ((pkS' = pkS_1[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_12[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[i1[ri_14, ri_15]], sk[ri_15]))) && (dh1 = exp(g, mult(sk[i1[ri_14, ri_15]], z_6[ri_14, ri_15]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty)) at 706
    - Replaced defined condition x_O_2[ri_14, ri_15], r_2[ri_14, ri_15] with r_2[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], sk[i1[ri_14, ri_15]], pkE_12[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_1[ri_14, ri_15] in find at 665
    - Replaced (x1 = x_O_1[ri_16, ri_17]) with ((pkS' = pkS_1[ri_16, ri_17]) && (pkR' = pk_R[ri_16, ri_17]) && (pkE' = pkE_13[ri_16, ri_17]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_16, ri_17], sk[ri_17])) && (dh1 = exp(pk_R[ri_16, ri_17], z_7[ri_16, ri_17])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty)) at 688
    - Replaced defined condition x_O_1[ri_16, ri_17], r_1[ri_16, ri_17] with r_1[ri_16, ri_17], z_7[ri_16, ri_17], sk[ri_17], pkE_13[ri_16, ri_17], pk_R[ri_16, ri_17], pkS_1[ri_16, ri_17] in find at 665
    - Replaced (x1 = x_O[ri_18, ri_19]) with ((pkS' = pkS[ri_18, ri_19]) && (pkR' = pkR_1[ri_18, ri_19]) && (pkE' = pkE_3[ri_18, ri_19]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[ri_19], sk'[ri_18, ri_19]))) && (dh1 = exp(g, mult(sk[ri_19], z_1[ri_18, ri_19]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty)) at 670
    - Replaced defined condition x_O[ri_18, ri_19], r[ri_18, ri_19] with r[ri_18, ri_19], z_1[ri_18, ri_19], sk'[ri_18, ri_19], sk[ri_19], pkE_3[ri_18, ri_19], pkR_1[ri_18, ri_19], pkS[ri_18, ri_19] in find at 665
    - Replaced (x_O_3 = x1[ri_21]) with ((pk_S = pkS'[ri_21]) && (pkR_2 = pkR'[ri_21]) && (pkE_5 = pkE'[ri_21]) && (label_shared_secret = label2[ri_21]) && (suite_id = suite2[ri_21]) && (RFCXXXX = protocol2[ri_21]) && (I2OSP2(Nsecret) = l[ri_21]) && (exp(pk_S, sk) = dh2[ri_21]) && (exp(pkE_5, sk) = dh1[ri_21]) && (label_eae_prk = label1[ri_21]) && (suite_id = suite1[ri_21]) && (RFCXXXX = protocol1[ri_21]) && (lbytes_empty = salt[ri_21])) at 616
    - Replaced defined condition x1[ri_21], x_O_4[ri_21], r_4[ri_21] with r_4[ri_21], salt[ri_21], protocol1[ri_21], suite1[ri_21], label1[ri_21], dh1[ri_21], dh2[ri_21], l[ri_21], protocol2[ri_21], suite2[ri_21], label2[ri_21], pkE'[ri_21], pkR'[ri_21], pkS'[ri_21] in find at 546
    - Replaced (x_O_3 = x_O_3[ri_22, ri_23]) with ((pk_S = pk_S[ri_22, ri_23]) && (i = ri_23) && (pkE_5 = pkE_5[ri_22, ri_23])) at 595
    - In branch 3 of find at 546, substituting u_27 with i
    - Replaced defined condition x_O_3[ri_22, ri_23], r_3[ri_22, ri_23] with r_3[ri_22], pkE_5[ri_22], pk_S[ri_22] in find at 546
    - Replaced (x_O_3 = x_O_2[ri_24, ri_25]) with ((pk_S = pkS_1[ri_24, ri_25]) && (i = i1[ri_24, ri_25]) && (pkE_5 = pkE_12[ri_24, ri_25])) at 573
    - Replaced defined condition x_O_2[ri_24, ri_25], r_2[ri_24, ri_25] with r_2[ri_24, ri_25], pkE_12[ri_24, ri_25], i1[ri_24, ri_25], pkS_1[ri_24, ri_25] in find at 546
    - Replaced (x_O_3 = x_O[ri_28, ri_29]) with ((pk_S = pkS[ri_28, ri_29]) && (i = ri_29) && (pkE_5 = pkE_3[ri_28, ri_29])) at 551
    - Remove branch 1 in find at 546
    - Replaced (x_O_1 = x1[ri_31]) with ((pkS_1 = pkS'[ri_31]) && (pk_R = pkR'[ri_31]) && (pkE_13 = pkE'[ri_31]) && (label_shared_secret = label2[ri_31]) && (suite_id = suite2[ri_31]) && (RFCXXXX = protocol2[ri_31]) && (I2OSP2(Nsecret) = l[ri_31]) && (exp(pk_R, sk) = dh2[ri_31]) && (exp(pk_R, z_7) = dh1[ri_31]) && (label_eae_prk = label1[ri_31]) && (suite_id = suite1[ri_31]) && (RFCXXXX = protocol1[ri_31]) && (lbytes_empty = salt[ri_31])) at 412
    - Replaced defined condition x1[ri_31], x_O_4[ri_31], r_4[ri_31] with r_4[ri_31], salt[ri_31], protocol1[ri_31], suite1[ri_31], label1[ri_31], dh1[ri_31], dh2[ri_31], l[ri_31], protocol2[ri_31], suite2[ri_31], label2[ri_31], pkE'[ri_31], pkR'[ri_31], pkS'[ri_31] in find at 408
    - Replaced (x_O_2 = x1[ri_41]) with ((pkS_1 = pkS'[ri_41]) && (pk_R = pkR'[ri_41]) && (pkE_12 = pkE'[ri_41]) && (label_shared_secret = label2[ri_41]) && (suite_id = suite2[ri_41]) && (RFCXXXX = protocol2[ri_41]) && (I2OSP2(Nsecret) = l[ri_41]) && (exp(g, mult(sk[i1], sk)) = dh2[ri_41]) && (exp(g, mult(sk[i1], z_6)) = dh1[ri_41]) && (label_eae_prk = label1[ri_41]) && (suite_id = suite1[ri_41]) && (RFCXXXX = protocol1[ri_41]) && (lbytes_empty = salt[ri_41])) at 302
    - Replaced defined condition x1[ri_41], x_O_4[ri_41], r_4[ri_41] with r_4[ri_41], salt[ri_41], protocol1[ri_41], suite1[ri_41], label1[ri_41], dh1[ri_41], dh2[ri_41], l[ri_41], protocol2[ri_41], suite2[ri_41], label2[ri_41], pkE'[ri_41], pkR'[ri_41], pkS'[ri_41] in find at 273
    - Replaced (x_O_2 = x_O_3[ri_42, ri_43]) with ((pkS_1 = pk_S[ri_42, ri_43]) && (i1 = ri_43) && (pkE_12 = pkE_5[ri_42, ri_43])) at 278
    - In branch 1 of find at 273, substituting u_47 with i1
    - Replaced defined condition x_O_3[ri_42, ri_43], r_3[ri_42, ri_43] with r_3[ri_42, i1], pkE_5[ri_42, i1], pk_S[ri_42, i1] in find at 273
    - Replaced (x_O = x1[ri_51]) with ((pkS = pkS'[ri_51]) && (pkR_1 = pkR'[ri_51]) && (pkE_3 = pkE'[ri_51]) && (label_shared_secret = label2[ri_51]) && (suite_id = suite2[ri_51]) && (RFCXXXX = protocol2[ri_51]) && (I2OSP2(Nsecret) = l[ri_51]) && (exp(g, mult(sk, sk')) = dh2[ri_51]) && (exp(g, mult(sk, z_1)) = dh1[ri_51]) && (label_eae_prk = label1[ri_51]) && (suite_id = suite1[ri_51]) && (RFCXXXX = protocol1[ri_51]) && (lbytes_empty = salt[ri_51])) at 135
    - Replaced defined condition x1[ri_51], x_O_4[ri_51], r_4[ri_51] with r_4[ri_51], salt[ri_51], protocol1[ri_51], suite1[ri_51], label1[ri_51], dh1[ri_51], dh2[ri_51], l[ri_51], protocol2[ri_51], suite2[ri_51], label2[ri_51], pkE'[ri_51], pkR'[ri_51], pkS'[ri_51] in find at 97
    - Replaced (x_O = x_O_3[ri_52, ri_53]) with ((pkS = pk_S[ri_52, ri_53]) && (i = ri_53) && (pkE_3 = pkE_5[ri_52, ri_53])) at 102
    - In branch 1 of find at 97, substituting u_57 with i
    - Replaced defined condition x_O_3[ri_52, ri_53], r_3[ri_52, ri_53] with r_3[ri_52], pkE_5[ri_52], pk_S[ri_52] in find at 97
yields

Game 25 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          x_O: eae_input_t <- eae_input(lbytes_empty, key, info);
  {97}    find [unique] u_56 = ri_52 <= Qdperuser suchthat defined(r_3[ri_52], pkE_5[ri_52], pk_S[ri_52]) && {104}((pkS = pk_S[ri_52]) && (i = i) && (pkE_3 = pkE_5[ri_52])) then
            u_57 <= N <- i;
            zz_3: eae_output_t <- r_3[u_56];
            return(AuthEncap_tuple(r_3[u_56], enc_2))
          orfind u_55 = ri_51 <= Qh suchthat defined(r_4[ri_51], salt[ri_51], protocol1[ri_51], suite1[ri_51], label1[ri_51], dh1[ri_51], dh2[ri_51], l[ri_51], protocol2[ri_51], suite2[ri_51], label2[ri_51], pkE'[ri_51], pkR'[ri_51], pkS'[ri_51]) && (pkS = pkS'[ri_51]) && (pkR_1 = pkR'[ri_51]) && (pkE_3 = pkE'[ri_51]) && (label_shared_secret = label2[ri_51]) && (suite_id = suite2[ri_51]) && (RFCXXXX = protocol2[ri_51]) && (I2OSP2(Nsecret) = l[ri_51]) && (exp(g, mult(sk, sk')) = dh2[ri_51]) && (exp(g, mult(sk, z_1)) = dh1[ri_51]) && (label_eae_prk = label1[ri_51]) && (suite_id = suite1[ri_51]) && (RFCXXXX = protocol1[ri_51]) && (lbytes_empty = salt[ri_51]) then
            zz_3: eae_output_t <- r_4[u_55];
            return(AuthEncap_tuple(r_4[u_55], enc_2))
          else
            r <-R eae_output_t;
            zz_3: eae_output_t <- r;
            return(AuthEncap_tuple(r, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            kemContext_12: GGG_t <- concatContext(pkE_12, pk_R, pkS_1);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_12);
            x_O_2: eae_input_t <- eae_input(lbytes_empty, key_6, info_6);
            find [unique] u_46 = ri_42 <= Qdperuser suchthat defined(r_3[ri_42, i1], pkE_5[ri_42, i1], pk_S[ri_42, i1]) && {389}((pkS_1 = pk_S[ri_42, i1]) && (i1 = i1) && (pkE_12 = pkE_5[ri_42, i1])) then
              u_47 <= N <- i1;
              return(AuthEncap_tuple(r_3[u_46, i1], enc_9))
            orfind u_45 = ri_41 <= Qh suchthat defined(r_4[ri_41], salt[ri_41], protocol1[ri_41], suite1[ri_41], label1[ri_41], dh1[ri_41], dh2[ri_41], l[ri_41], protocol2[ri_41], suite2[ri_41], label2[ri_41], pkE'[ri_41], pkR'[ri_41], pkS'[ri_41]) && (pkS_1 = pkS'[ri_41]) && (pk_R = pkR'[ri_41]) && (pkE_12 = pkE'[ri_41]) && (label_shared_secret = label2[ri_41]) && (suite_id = suite2[ri_41]) && (RFCXXXX = protocol2[ri_41]) && (I2OSP2(Nsecret) = l[ri_41]) && (exp(g, mult(sk[i1], sk)) = dh2[ri_41]) && (exp(g, mult(sk[i1], z_6)) = dh1[ri_41]) && (label_eae_prk = label1[ri_41]) && (suite_id = suite1[ri_41]) && (RFCXXXX = protocol1[ri_41]) && (lbytes_empty = salt[ri_41]) then
              return(AuthEncap_tuple(r_4[u_45], enc_9))
            else
              r_2 <-R eae_output_t;
              return(AuthEncap_tuple(r_2, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            kemContext_13: GGG_t <- concatContext(pkE_13, pk_R, pkS_1);
            key_7: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_7: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_13);
            x_O_1: eae_input_t <- eae_input(lbytes_empty, key_7, info_7);
            find [unique] u_35 = ri_31 <= Qh suchthat defined(r_4[ri_31], salt[ri_31], protocol1[ri_31], suite1[ri_31], label1[ri_31], dh1[ri_31], dh2[ri_31], l[ri_31], protocol2[ri_31], suite2[ri_31], label2[ri_31], pkE'[ri_31], pkR'[ri_31], pkS'[ri_31]) && (pkS_1 = pkS'[ri_31]) && (pk_R = pkR'[ri_31]) && (pkE_13 = pkE'[ri_31]) && (label_shared_secret = label2[ri_31]) && (suite_id = suite2[ri_31]) && (RFCXXXX = protocol2[ri_31]) && (I2OSP2(Nsecret) = l[ri_31]) && (exp(pk_R, sk) = dh2[ri_31]) && (exp(pk_R, z_7) = dh1[ri_31]) && (label_eae_prk = label1[ri_31]) && (suite_id = suite1[ri_31]) && (RFCXXXX = protocol1[ri_31]) && (lbytes_empty = salt[ri_31]) then
              return(AuthEncap_tuple(r_4[u_35], enc_10))
            else
              r_1 <-R eae_output_t;
              return(AuthEncap_tuple(r_1, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              x_O_3: eae_input_t <- eae_input(lbytes_empty, key_2, info_2);
              find [unique] u_28 = ri_24 <= Qeperuser, u_29 = ri_25 <= N suchthat defined(r_2[ri_24, ri_25], pkE_12[ri_24, ri_25], i1[ri_24, ri_25], pkS_1[ri_24, ri_25]) && (pk_S = pkS_1[ri_24, ri_25]) && (i = i1[ri_24, ri_25]) && (pkE_5 = pkE_12[ri_24, ri_25]) then
                return(AuthDecap_Some(r_2[u_28, u_29]))
              orfind u_26 = ri_22 <= Qdperuser suchthat defined(r_3[ri_22], pkE_5[ri_22], pk_S[ri_22]) && {909}((pk_S = pk_S[ri_22]) && (i = i) && (pkE_5 = pkE_5[ri_22])) then
                u_27 <= N <- i;
                return(AuthDecap_Some(r_3[u_26]))
              orfind u_25 = ri_21 <= Qh suchthat defined(r_4[ri_21], salt[ri_21], protocol1[ri_21], suite1[ri_21], label1[ri_21], dh1[ri_21], dh2[ri_21], l[ri_21], protocol2[ri_21], suite2[ri_21], label2[ri_21], pkE'[ri_21], pkR'[ri_21], pkS'[ri_21]) && (pk_S = pkS'[ri_21]) && (pkR_2 = pkR'[ri_21]) && (pkE_5 = pkE'[ri_21]) && (label_shared_secret = label2[ri_21]) && (suite_id = suite2[ri_21]) && (RFCXXXX = protocol2[ri_21]) && (I2OSP2(Nsecret) = l[ri_21]) && (exp(pk_S, sk) = dh2[ri_21]) && (exp(pkE_5, sk) = dh1[ri_21]) && (label_eae_prk = label1[ri_21]) && (suite_id = suite1[ri_21]) && (RFCXXXX = protocol1[ri_21]) && (lbytes_empty = salt[ri_21]) then
                return(AuthDecap_Some(r_4[u_25]))
              else
                r_3 <-R eae_output_t;
                return(AuthDecap_Some(r_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          x_O_4: eae_input_t <- cst_eae_input_t;
          find [unique] u_22 = ri_18 <= Qcperuser, u_23 = ri_19 <= N suchthat defined(r[ri_18, ri_19], z_1[ri_18, ri_19], sk'[ri_18, ri_19], sk[ri_19], pkE_3[ri_18, ri_19], pkR_1[ri_18, ri_19], pkS[ri_18, ri_19]) && (pkS' = pkS[ri_18, ri_19]) && (pkR' = pkR_1[ri_18, ri_19]) && (pkE' = pkE_3[ri_18, ri_19]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[ri_19], sk'[ri_18, ri_19]))) && (dh1 = exp(g, mult(sk[ri_19], z_1[ri_18, ri_19]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r[u_22, u_23])
          orfind u_20 = ri_16 <= Qeperuser, u_21 = ri_17 <= N suchthat defined(r_1[ri_16, ri_17], z_7[ri_16, ri_17], sk[ri_17], pkE_13[ri_16, ri_17], pk_R[ri_16, ri_17], pkS_1[ri_16, ri_17]) && (pkS' = pkS_1[ri_16, ri_17]) && (pkR' = pk_R[ri_16, ri_17]) && (pkE' = pkE_13[ri_16, ri_17]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_16, ri_17], sk[ri_17])) && (dh1 = exp(pk_R[ri_16, ri_17], z_7[ri_16, ri_17])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_1[u_20, u_21])
          orfind u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r_2[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], sk[i1[ri_14, ri_15]], pkE_12[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_1[ri_14, ri_15]) && (pkS' = pkS_1[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_12[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[i1[ri_14, ri_15]], sk[ri_15]))) && (dh1 = exp(g, mult(sk[i1[ri_14, ri_15]], z_6[ri_14, ri_15]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_18, u_19])
          orfind u_16 = ri_12 <= Qdperuser, u_17 = ri_13 <= N suchthat defined(r_3[ri_12, ri_13], sk[ri_13], pkE_5[ri_12, ri_13], pkR_2[ri_12, ri_13], pk_S[ri_12, ri_13]) && (pkS' = pk_S[ri_12, ri_13]) && (pkR' = pkR_2[ri_12, ri_13]) && (pkE' = pkE_5[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_12, ri_13], sk[ri_13])) && (dh1 = exp(pkE_5[ri_12, ri_13], sk[ri_13])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_3[u_16, u_17])
          orfind u_15 = ri_11 <= Qh suchthat defined(r_4[ri_11], salt[ri_11], protocol1[ri_11], suite1[ri_11], label1[ri_11], dh1[ri_11], dh2[ri_11], l[ri_11], protocol2[ri_11], suite2[ri_11], label2[ri_11], pkE'[ri_11], pkR'[ri_11], pkS'[ri_11]) && (pkS' = pkS'[ri_11]) && (pkR' = pkR'[ri_11]) && (pkE' = pkE'[ri_11]) && (label2 = label2[ri_11]) && (suite2 = suite2[ri_11]) && (protocol2 = protocol2[ri_11]) && (l = l[ri_11]) && (dh2 = dh2[ri_11]) && (dh1 = dh1[ri_11]) && (label1 = label1[ri_11]) && (suite1 = suite1[ri_11]) && (protocol1 = protocol1[ri_11]) && (salt = salt[ri_11]) then
            return(r_4[u_15])
          else
            r_4 <-R eae_output_t;
            return(r_4)
        else
          x_O_5: eae_input_t <- cst_eae_input_t;
          find [unique] u_4 = ri <= Qh suchthat defined(r_5[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_5[u_4])
          else
            r_5 <-R eae_output_t;
            return(r_5)
      ))


Applying simplify [probability #OADecap * Qcperuser * PCollKey]
  - Simplification pass
    - Replaced ((pk_S = pk_S[ri_22]) && (i = i) && (pkE_5 = pkE_5[ri_22])) with ((pk_S = pk_S[ri_22]) && (pkE_5 = pkE_5[ri_22])) at 909
    - Replaced ((pkS_1 = pk_S[ri_42, i1]) && (i1 = i1) && (pkE_12 = pkE_5[ri_42, i1])) with ((pkS_1 = pk_S[ri_42, i1]) && (pkE_12 = pkE_5[ri_42, i1])) at 389
    - Replaced ((pkS = pk_S[ri_52]) && (i = i) && (pkE_3 = pkE_5[ri_52])) with false at 104
    - Remove branch 1 in find at 97
yields

Game 26 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          kemContext_3: GGG_t <- concatContext(pkE_3, pkR_1, pkS);
          key: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_3);
          info: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_3);
          x_O: eae_input_t <- eae_input(lbytes_empty, key, info);
          find [unique] u_55 = ri_51 <= Qh suchthat defined(r_4[ri_51], salt[ri_51], protocol1[ri_51], suite1[ri_51], label1[ri_51], dh1[ri_51], dh2[ri_51], l[ri_51], protocol2[ri_51], suite2[ri_51], label2[ri_51], pkE'[ri_51], pkR'[ri_51], pkS'[ri_51]) && (pkS = pkS'[ri_51]) && (pkR_1 = pkR'[ri_51]) && (pkE_3 = pkE'[ri_51]) && (label_shared_secret = label2[ri_51]) && (suite_id = suite2[ri_51]) && (RFCXXXX = protocol2[ri_51]) && (I2OSP2(Nsecret) = l[ri_51]) && (exp(g, mult(sk, sk')) = dh2[ri_51]) && (exp(g, mult(sk, z_1)) = dh1[ri_51]) && (label_eae_prk = label1[ri_51]) && (suite_id = suite1[ri_51]) && (RFCXXXX = protocol1[ri_51]) && (lbytes_empty = salt[ri_51]) then
            zz_3: eae_output_t <- r_4[u_55];
            return(AuthEncap_tuple(r_4[u_55], enc_2))
          else
            r <-R eae_output_t;
            zz_3: eae_output_t <- r;
            return(AuthEncap_tuple(r, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            kemContext_12: GGG_t <- concatContext(pkE_12, pk_R, pkS_1);
            key_6: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_12);
            info_6: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_12);
            x_O_2: eae_input_t <- eae_input(lbytes_empty, key_6, info_6);
            find [unique] u_46 = ri_42 <= Qdperuser suchthat defined(r_3[ri_42, i1], pkE_5[ri_42, i1], pk_S[ri_42, i1]) && (pkS_1 = pk_S[ri_42, i1]) && (pkE_12 = pkE_5[ri_42, i1]) then
              u_47 <= N <- i1;
              return(AuthEncap_tuple(r_3[u_46, i1], enc_9))
            orfind u_45 = ri_41 <= Qh suchthat defined(r_4[ri_41], salt[ri_41], protocol1[ri_41], suite1[ri_41], label1[ri_41], dh1[ri_41], dh2[ri_41], l[ri_41], protocol2[ri_41], suite2[ri_41], label2[ri_41], pkE'[ri_41], pkR'[ri_41], pkS'[ri_41]) && (pkS_1 = pkS'[ri_41]) && (pk_R = pkR'[ri_41]) && (pkE_12 = pkE'[ri_41]) && (label_shared_secret = label2[ri_41]) && (suite_id = suite2[ri_41]) && (RFCXXXX = protocol2[ri_41]) && (I2OSP2(Nsecret) = l[ri_41]) && (exp(g, mult(sk[i1], sk)) = dh2[ri_41]) && (exp(g, mult(sk[i1], z_6)) = dh1[ri_41]) && (label_eae_prk = label1[ri_41]) && (suite_id = suite1[ri_41]) && (RFCXXXX = protocol1[ri_41]) && (lbytes_empty = salt[ri_41]) then
              return(AuthEncap_tuple(r_4[u_45], enc_9))
            else
              r_2 <-R eae_output_t;
              return(AuthEncap_tuple(r_2, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            kemContext_13: GGG_t <- concatContext(pkE_13, pk_R, pkS_1);
            key_7: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_13);
            info_7: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_13);
            x_O_1: eae_input_t <- eae_input(lbytes_empty, key_7, info_7);
            find [unique] u_35 = ri_31 <= Qh suchthat defined(r_4[ri_31], salt[ri_31], protocol1[ri_31], suite1[ri_31], label1[ri_31], dh1[ri_31], dh2[ri_31], l[ri_31], protocol2[ri_31], suite2[ri_31], label2[ri_31], pkE'[ri_31], pkR'[ri_31], pkS'[ri_31]) && (pkS_1 = pkS'[ri_31]) && (pk_R = pkR'[ri_31]) && (pkE_13 = pkE'[ri_31]) && (label_shared_secret = label2[ri_31]) && (suite_id = suite2[ri_31]) && (RFCXXXX = protocol2[ri_31]) && (I2OSP2(Nsecret) = l[ri_31]) && (exp(pk_R, sk) = dh2[ri_31]) && (exp(pk_R, z_7) = dh1[ri_31]) && (label_eae_prk = label1[ri_31]) && (suite_id = suite1[ri_31]) && (RFCXXXX = protocol1[ri_31]) && (lbytes_empty = salt[ri_31]) then
              return(AuthEncap_tuple(r_4[u_35], enc_10))
            else
              r_1 <-R eae_output_t;
              return(AuthEncap_tuple(r_1, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              kemContext_5: GGG_t <- concatContext(pkE_5, pkR_2, pk_S);
              key_2: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_5);
              info_2: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_5);
              x_O_3: eae_input_t <- eae_input(lbytes_empty, key_2, info_2);
              find [unique] u_28 = ri_24 <= Qeperuser, u_29 = ri_25 <= N suchthat defined(r_2[ri_24, ri_25], pkE_12[ri_24, ri_25], i1[ri_24, ri_25], pkS_1[ri_24, ri_25]) && (pk_S = pkS_1[ri_24, ri_25]) && (i = i1[ri_24, ri_25]) && (pkE_5 = pkE_12[ri_24, ri_25]) then
                return(AuthDecap_Some(r_2[u_28, u_29]))
              orfind u_26 = ri_22 <= Qdperuser suchthat defined(r_3[ri_22], pkE_5[ri_22], pk_S[ri_22]) && (pk_S = pk_S[ri_22]) && (pkE_5 = pkE_5[ri_22]) then
                u_27 <= N <- i;
                return(AuthDecap_Some(r_3[u_26]))
              orfind u_25 = ri_21 <= Qh suchthat defined(r_4[ri_21], salt[ri_21], protocol1[ri_21], suite1[ri_21], label1[ri_21], dh1[ri_21], dh2[ri_21], l[ri_21], protocol2[ri_21], suite2[ri_21], label2[ri_21], pkE'[ri_21], pkR'[ri_21], pkS'[ri_21]) && (pk_S = pkS'[ri_21]) && (pkR_2 = pkR'[ri_21]) && (pkE_5 = pkE'[ri_21]) && (label_shared_secret = label2[ri_21]) && (suite_id = suite2[ri_21]) && (RFCXXXX = protocol2[ri_21]) && (I2OSP2(Nsecret) = l[ri_21]) && (exp(pk_S, sk) = dh2[ri_21]) && (exp(pkE_5, sk) = dh1[ri_21]) && (label_eae_prk = label1[ri_21]) && (suite_id = suite1[ri_21]) && (RFCXXXX = protocol1[ri_21]) && (lbytes_empty = salt[ri_21]) then
                return(AuthDecap_Some(r_4[u_25]))
              else
                r_3 <-R eae_output_t;
                return(AuthDecap_Some(r_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          x_O_4: eae_input_t <- cst_eae_input_t;
          find [unique] u_22 = ri_18 <= Qcperuser, u_23 = ri_19 <= N suchthat defined(r[ri_18, ri_19], z_1[ri_18, ri_19], sk'[ri_18, ri_19], sk[ri_19], pkE_3[ri_18, ri_19], pkR_1[ri_18, ri_19], pkS[ri_18, ri_19]) && (pkS' = pkS[ri_18, ri_19]) && (pkR' = pkR_1[ri_18, ri_19]) && (pkE' = pkE_3[ri_18, ri_19]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[ri_19], sk'[ri_18, ri_19]))) && (dh1 = exp(g, mult(sk[ri_19], z_1[ri_18, ri_19]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r[u_22, u_23])
          orfind u_20 = ri_16 <= Qeperuser, u_21 = ri_17 <= N suchthat defined(r_1[ri_16, ri_17], z_7[ri_16, ri_17], sk[ri_17], pkE_13[ri_16, ri_17], pk_R[ri_16, ri_17], pkS_1[ri_16, ri_17]) && (pkS' = pkS_1[ri_16, ri_17]) && (pkR' = pk_R[ri_16, ri_17]) && (pkE' = pkE_13[ri_16, ri_17]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_16, ri_17], sk[ri_17])) && (dh1 = exp(pk_R[ri_16, ri_17], z_7[ri_16, ri_17])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_1[u_20, u_21])
          orfind u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r_2[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], sk[i1[ri_14, ri_15]], pkE_12[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_1[ri_14, ri_15]) && (pkS' = pkS_1[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_12[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[i1[ri_14, ri_15]], sk[ri_15]))) && (dh1 = exp(g, mult(sk[i1[ri_14, ri_15]], z_6[ri_14, ri_15]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_18, u_19])
          orfind u_16 = ri_12 <= Qdperuser, u_17 = ri_13 <= N suchthat defined(r_3[ri_12, ri_13], sk[ri_13], pkE_5[ri_12, ri_13], pkR_2[ri_12, ri_13], pk_S[ri_12, ri_13]) && (pkS' = pk_S[ri_12, ri_13]) && (pkR' = pkR_2[ri_12, ri_13]) && (pkE' = pkE_5[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_12, ri_13], sk[ri_13])) && (dh1 = exp(pkE_5[ri_12, ri_13], sk[ri_13])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_3[u_16, u_17])
          orfind u_15 = ri_11 <= Qh suchthat defined(r_4[ri_11], salt[ri_11], protocol1[ri_11], suite1[ri_11], label1[ri_11], dh1[ri_11], dh2[ri_11], l[ri_11], protocol2[ri_11], suite2[ri_11], label2[ri_11], pkE'[ri_11], pkR'[ri_11], pkS'[ri_11]) && (pkS' = pkS'[ri_11]) && (pkR' = pkR'[ri_11]) && (pkE' = pkE'[ri_11]) && (label2 = label2[ri_11]) && (suite2 = suite2[ri_11]) && (protocol2 = protocol2[ri_11]) && (l = l[ri_11]) && (dh2 = dh2[ri_11]) && (dh1 = dh1[ri_11]) && (label1 = label1[ri_11]) && (suite1 = suite1[ri_11]) && (protocol1 = protocol1[ri_11]) && (salt = salt[ri_11]) then
            return(r_4[u_15])
          else
            r_4 <-R eae_output_t;
            return(r_4)
        else
          x_O_5: eae_input_t <- cst_eae_input_t;
          find [unique] u_4 = ri <= Qh suchthat defined(r_5[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_5[u_4])
          else
            r_5 <-R eae_output_t;
            return(r_5)
      ))


Applying move all binders
  - Move assignment to x_O_5
  - Move assignment to x_O_4
  - Move assignment to x_O_3
  - Move assignment to info_2
  - Move assignment to key_2
  - Move assignment to kemContext_5
  - Move assignment to x_O_1
  - Move assignment to info_7
  - Move assignment to key_7
  - Move assignment to kemContext_13
  - Move assignment to x_O_2
  - Move assignment to info_6
  - Move assignment to key_6
  - Move assignment to kemContext_12
  - Move assignment to x_O
  - Move assignment to info
  - Move assignment to key
  - Move assignment to kemContext_3
yields

Game 27 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          dh_3: GG_t <- concatDH(exp(g, mult(sk, z_1)), exp(g, mult(sk, sk')));
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          find [unique] u_55 = ri_51 <= Qh suchthat defined(r_4[ri_51], salt[ri_51], protocol1[ri_51], suite1[ri_51], label1[ri_51], dh1[ri_51], dh2[ri_51], l[ri_51], protocol2[ri_51], suite2[ri_51], label2[ri_51], pkE'[ri_51], pkR'[ri_51], pkS'[ri_51]) && (pkS = pkS'[ri_51]) && (pkR_1 = pkR'[ri_51]) && (pkE_3 = pkE'[ri_51]) && (label_shared_secret = label2[ri_51]) && (suite_id = suite2[ri_51]) && (RFCXXXX = protocol2[ri_51]) && (I2OSP2(Nsecret) = l[ri_51]) && (exp(g, mult(sk, sk')) = dh2[ri_51]) && (exp(g, mult(sk, z_1)) = dh1[ri_51]) && (label_eae_prk = label1[ri_51]) && (suite_id = suite1[ri_51]) && (RFCXXXX = protocol1[ri_51]) && (lbytes_empty = salt[ri_51]) then
            zz_3: eae_output_t <- r_4[u_55];
            return(AuthEncap_tuple(r_4[u_55], enc_2))
          else
            r <-R eae_output_t;
            zz_3: eae_output_t <- r;
            return(AuthEncap_tuple(r, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            dh_12: GG_t <- concatDH(exp(g, mult(sk[i1], z_6)), exp(g, mult(sk[i1], sk)));
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            find [unique] u_46 = ri_42 <= Qdperuser suchthat defined(r_3[ri_42, i1], pkE_5[ri_42, i1], pk_S[ri_42, i1]) && (pkS_1 = pk_S[ri_42, i1]) && (pkE_12 = pkE_5[ri_42, i1]) then
              u_47 <= N <- i1;
              return(AuthEncap_tuple(r_3[u_46, i1], enc_9))
            orfind u_45 = ri_41 <= Qh suchthat defined(r_4[ri_41], salt[ri_41], protocol1[ri_41], suite1[ri_41], label1[ri_41], dh1[ri_41], dh2[ri_41], l[ri_41], protocol2[ri_41], suite2[ri_41], label2[ri_41], pkE'[ri_41], pkR'[ri_41], pkS'[ri_41]) && (pkS_1 = pkS'[ri_41]) && (pk_R = pkR'[ri_41]) && (pkE_12 = pkE'[ri_41]) && (label_shared_secret = label2[ri_41]) && (suite_id = suite2[ri_41]) && (RFCXXXX = protocol2[ri_41]) && (I2OSP2(Nsecret) = l[ri_41]) && (exp(g, mult(sk[i1], sk)) = dh2[ri_41]) && (exp(g, mult(sk[i1], z_6)) = dh1[ri_41]) && (label_eae_prk = label1[ri_41]) && (suite_id = suite1[ri_41]) && (RFCXXXX = protocol1[ri_41]) && (lbytes_empty = salt[ri_41]) then
              return(AuthEncap_tuple(r_4[u_45], enc_9))
            else
              r_2 <-R eae_output_t;
              return(AuthEncap_tuple(r_2, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            dh_13: GG_t <- concatDH(exp(pk_R, z_7), exp(pk_R, sk));
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            find [unique] u_35 = ri_31 <= Qh suchthat defined(r_4[ri_31], salt[ri_31], protocol1[ri_31], suite1[ri_31], label1[ri_31], dh1[ri_31], dh2[ri_31], l[ri_31], protocol2[ri_31], suite2[ri_31], label2[ri_31], pkE'[ri_31], pkR'[ri_31], pkS'[ri_31]) && (pkS_1 = pkS'[ri_31]) && (pk_R = pkR'[ri_31]) && (pkE_13 = pkE'[ri_31]) && (label_shared_secret = label2[ri_31]) && (suite_id = suite2[ri_31]) && (RFCXXXX = protocol2[ri_31]) && (I2OSP2(Nsecret) = l[ri_31]) && (exp(pk_R, sk) = dh2[ri_31]) && (exp(pk_R, z_7) = dh1[ri_31]) && (label_eae_prk = label1[ri_31]) && (suite_id = suite1[ri_31]) && (RFCXXXX = protocol1[ri_31]) && (lbytes_empty = salt[ri_31]) then
              return(AuthEncap_tuple(r_4[u_35], enc_10))
            else
              r_1 <-R eae_output_t;
              return(AuthEncap_tuple(r_1, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              dh_5: GG_t <- concatDH(exp(pkE_5, sk), exp(pk_S, sk));
              pkR_2: G_t <- exp(g, sk);
              find [unique] u_28 = ri_24 <= Qeperuser, u_29 = ri_25 <= N suchthat defined(r_2[ri_24, ri_25], pkE_12[ri_24, ri_25], i1[ri_24, ri_25], pkS_1[ri_24, ri_25]) && (pk_S = pkS_1[ri_24, ri_25]) && (i = i1[ri_24, ri_25]) && (pkE_5 = pkE_12[ri_24, ri_25]) then
                return(AuthDecap_Some(r_2[u_28, u_29]))
              orfind u_26 = ri_22 <= Qdperuser suchthat defined(r_3[ri_22], pkE_5[ri_22], pk_S[ri_22]) && (pk_S = pk_S[ri_22]) && (pkE_5 = pkE_5[ri_22]) then
                u_27 <= N <- i;
                return(AuthDecap_Some(r_3[u_26]))
              orfind u_25 = ri_21 <= Qh suchthat defined(r_4[ri_21], salt[ri_21], protocol1[ri_21], suite1[ri_21], label1[ri_21], dh1[ri_21], dh2[ri_21], l[ri_21], protocol2[ri_21], suite2[ri_21], label2[ri_21], pkE'[ri_21], pkR'[ri_21], pkS'[ri_21]) && (pk_S = pkS'[ri_21]) && (pkR_2 = pkR'[ri_21]) && (pkE_5 = pkE'[ri_21]) && (label_shared_secret = label2[ri_21]) && (suite_id = suite2[ri_21]) && (RFCXXXX = protocol2[ri_21]) && (I2OSP2(Nsecret) = l[ri_21]) && (exp(pk_S, sk) = dh2[ri_21]) && (exp(pkE_5, sk) = dh1[ri_21]) && (label_eae_prk = label1[ri_21]) && (suite_id = suite1[ri_21]) && (RFCXXXX = protocol1[ri_21]) && (lbytes_empty = salt[ri_21]) then
                return(AuthDecap_Some(r_4[u_25]))
              else
                r_3 <-R eae_output_t;
                return(AuthDecap_Some(r_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          find [unique] u_22 = ri_18 <= Qcperuser, u_23 = ri_19 <= N suchthat defined(r[ri_18, ri_19], z_1[ri_18, ri_19], sk'[ri_18, ri_19], sk[ri_19], pkE_3[ri_18, ri_19], pkR_1[ri_18, ri_19], pkS[ri_18, ri_19]) && (pkS' = pkS[ri_18, ri_19]) && (pkR' = pkR_1[ri_18, ri_19]) && (pkE' = pkE_3[ri_18, ri_19]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[ri_19], sk'[ri_18, ri_19]))) && (dh1 = exp(g, mult(sk[ri_19], z_1[ri_18, ri_19]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r[u_22, u_23])
          orfind u_20 = ri_16 <= Qeperuser, u_21 = ri_17 <= N suchthat defined(r_1[ri_16, ri_17], z_7[ri_16, ri_17], sk[ri_17], pkE_13[ri_16, ri_17], pk_R[ri_16, ri_17], pkS_1[ri_16, ri_17]) && (pkS' = pkS_1[ri_16, ri_17]) && (pkR' = pk_R[ri_16, ri_17]) && (pkE' = pkE_13[ri_16, ri_17]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_16, ri_17], sk[ri_17])) && (dh1 = exp(pk_R[ri_16, ri_17], z_7[ri_16, ri_17])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_1[u_20, u_21])
          orfind u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r_2[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], sk[i1[ri_14, ri_15]], pkE_12[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_1[ri_14, ri_15]) && (pkS' = pkS_1[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_12[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[i1[ri_14, ri_15]], sk[ri_15]))) && (dh1 = exp(g, mult(sk[i1[ri_14, ri_15]], z_6[ri_14, ri_15]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_18, u_19])
          orfind u_16 = ri_12 <= Qdperuser, u_17 = ri_13 <= N suchthat defined(r_3[ri_12, ri_13], sk[ri_13], pkE_5[ri_12, ri_13], pkR_2[ri_12, ri_13], pk_S[ri_12, ri_13]) && (pkS' = pk_S[ri_12, ri_13]) && (pkR' = pkR_2[ri_12, ri_13]) && (pkE' = pkE_5[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_12, ri_13], sk[ri_13])) && (dh1 = exp(pkE_5[ri_12, ri_13], sk[ri_13])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_3[u_16, u_17])
          orfind u_15 = ri_11 <= Qh suchthat defined(r_4[ri_11], salt[ri_11], protocol1[ri_11], suite1[ri_11], label1[ri_11], dh1[ri_11], dh2[ri_11], l[ri_11], protocol2[ri_11], suite2[ri_11], label2[ri_11], pkE'[ri_11], pkR'[ri_11], pkS'[ri_11]) && (pkS' = pkS'[ri_11]) && (pkR' = pkR'[ri_11]) && (pkE' = pkE'[ri_11]) && (label2 = label2[ri_11]) && (suite2 = suite2[ri_11]) && (protocol2 = protocol2[ri_11]) && (l = l[ri_11]) && (dh2 = dh2[ri_11]) && (dh1 = dh1[ri_11]) && (label1 = label1[ri_11]) && (suite1 = suite1[ri_11]) && (protocol1 = protocol1[ri_11]) && (salt = salt[ri_11]) then
            return(r_4[u_15])
          else
            r_4 <-R eae_output_t;
            return(r_4)
        else
          find [unique] u_4 = ri <= Qh suchthat defined(r_5[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_5[u_4])
          else
            r_5 <-R eae_output_t;
            return(r_5)
      ))


Applying remove assignments of findcond
  - Remove assignments on dh_5 (definition removed, all usages removed)
  - Remove assignments on u_27 (definition removed, all usages removed)
  - Remove assignments on dh_13 (definition removed, all usages removed)
  - Remove assignments on dh_12 (definition removed, all usages removed)
  - Remove assignments on u_47 (definition removed, all usages removed)
  - Remove assignments on dh_3 (definition removed, all usages removed)
yields

Game 28 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          find [unique] u_55 = ri_51 <= Qh suchthat defined(r_4[ri_51], salt[ri_51], protocol1[ri_51], suite1[ri_51], label1[ri_51], dh1[ri_51], dh2[ri_51], l[ri_51], protocol2[ri_51], suite2[ri_51], label2[ri_51], pkE'[ri_51], pkR'[ri_51], pkS'[ri_51]) && (pkS = pkS'[ri_51]) && (pkR_1 = pkR'[ri_51]) && (pkE_3 = pkE'[ri_51]) && (label_shared_secret = label2[ri_51]) && (suite_id = suite2[ri_51]) && (RFCXXXX = protocol2[ri_51]) && (I2OSP2(Nsecret) = l[ri_51]) && (exp(g, mult(sk, sk')) = dh2[ri_51]) && (exp(g, mult(sk, z_1)) = dh1[ri_51]) && (label_eae_prk = label1[ri_51]) && (suite_id = suite1[ri_51]) && (RFCXXXX = protocol1[ri_51]) && (lbytes_empty = salt[ri_51]) then
            zz_3: eae_output_t <- r_4[u_55];
            return(AuthEncap_tuple(r_4[u_55], enc_2))
          else
            r <-R eae_output_t;
            zz_3: eae_output_t <- r;
            return(AuthEncap_tuple(r, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            find [unique] u_46 = ri_42 <= Qdperuser suchthat defined(r_3[ri_42, i1], pkE_5[ri_42, i1], pk_S[ri_42, i1]) && (pkS_1 = pk_S[ri_42, i1]) && (pkE_12 = pkE_5[ri_42, i1]) then
              return(AuthEncap_tuple(r_3[u_46, i1], enc_9))
            orfind u_45 = ri_41 <= Qh suchthat defined(r_4[ri_41], salt[ri_41], protocol1[ri_41], suite1[ri_41], label1[ri_41], dh1[ri_41], dh2[ri_41], l[ri_41], protocol2[ri_41], suite2[ri_41], label2[ri_41], pkE'[ri_41], pkR'[ri_41], pkS'[ri_41]) && (pkS_1 = pkS'[ri_41]) && (pk_R = pkR'[ri_41]) && (pkE_12 = pkE'[ri_41]) && (label_shared_secret = label2[ri_41]) && (suite_id = suite2[ri_41]) && (RFCXXXX = protocol2[ri_41]) && (I2OSP2(Nsecret) = l[ri_41]) && (exp(g, mult(sk[i1], sk)) = dh2[ri_41]) && (exp(g, mult(sk[i1], z_6)) = dh1[ri_41]) && (label_eae_prk = label1[ri_41]) && (suite_id = suite1[ri_41]) && (RFCXXXX = protocol1[ri_41]) && (lbytes_empty = salt[ri_41]) then
              return(AuthEncap_tuple(r_4[u_45], enc_9))
            else
              r_2 <-R eae_output_t;
              return(AuthEncap_tuple(r_2, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            find [unique] u_35 = ri_31 <= Qh suchthat defined(r_4[ri_31], salt[ri_31], protocol1[ri_31], suite1[ri_31], label1[ri_31], dh1[ri_31], dh2[ri_31], l[ri_31], protocol2[ri_31], suite2[ri_31], label2[ri_31], pkE'[ri_31], pkR'[ri_31], pkS'[ri_31]) && (pkS_1 = pkS'[ri_31]) && (pk_R = pkR'[ri_31]) && (pkE_13 = pkE'[ri_31]) && (label_shared_secret = label2[ri_31]) && (suite_id = suite2[ri_31]) && (RFCXXXX = protocol2[ri_31]) && (I2OSP2(Nsecret) = l[ri_31]) && (exp(pk_R, sk) = dh2[ri_31]) && (exp(pk_R, z_7) = dh1[ri_31]) && (label_eae_prk = label1[ri_31]) && (suite_id = suite1[ri_31]) && (RFCXXXX = protocol1[ri_31]) && (lbytes_empty = salt[ri_31]) then
              return(AuthEncap_tuple(r_4[u_35], enc_10))
            else
              r_1 <-R eae_output_t;
              return(AuthEncap_tuple(r_1, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              pkR_2: G_t <- exp(g, sk);
              find [unique] u_28 = ri_24 <= Qeperuser, u_29 = ri_25 <= N suchthat defined(r_2[ri_24, ri_25], pkE_12[ri_24, ri_25], i1[ri_24, ri_25], pkS_1[ri_24, ri_25]) && (pk_S = pkS_1[ri_24, ri_25]) && (i = i1[ri_24, ri_25]) && (pkE_5 = pkE_12[ri_24, ri_25]) then
                return(AuthDecap_Some(r_2[u_28, u_29]))
              orfind u_26 = ri_22 <= Qdperuser suchthat defined(r_3[ri_22], pkE_5[ri_22], pk_S[ri_22]) && (pk_S = pk_S[ri_22]) && (pkE_5 = pkE_5[ri_22]) then
                return(AuthDecap_Some(r_3[u_26]))
              orfind u_25 = ri_21 <= Qh suchthat defined(r_4[ri_21], salt[ri_21], protocol1[ri_21], suite1[ri_21], label1[ri_21], dh1[ri_21], dh2[ri_21], l[ri_21], protocol2[ri_21], suite2[ri_21], label2[ri_21], pkE'[ri_21], pkR'[ri_21], pkS'[ri_21]) && (pk_S = pkS'[ri_21]) && (pkR_2 = pkR'[ri_21]) && (pkE_5 = pkE'[ri_21]) && (label_shared_secret = label2[ri_21]) && (suite_id = suite2[ri_21]) && (RFCXXXX = protocol2[ri_21]) && (I2OSP2(Nsecret) = l[ri_21]) && (exp(pk_S, sk) = dh2[ri_21]) && (exp(pkE_5, sk) = dh1[ri_21]) && (label_eae_prk = label1[ri_21]) && (suite_id = suite1[ri_21]) && (RFCXXXX = protocol1[ri_21]) && (lbytes_empty = salt[ri_21]) then
                return(AuthDecap_Some(r_4[u_25]))
              else
                r_3 <-R eae_output_t;
                return(AuthDecap_Some(r_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          find [unique] u_22 = ri_18 <= Qcperuser, u_23 = ri_19 <= N suchthat defined(r[ri_18, ri_19], z_1[ri_18, ri_19], sk'[ri_18, ri_19], sk[ri_19], pkE_3[ri_18, ri_19], pkR_1[ri_18, ri_19], pkS[ri_18, ri_19]) && (pkS' = pkS[ri_18, ri_19]) && (pkR' = pkR_1[ri_18, ri_19]) && (pkE' = pkE_3[ri_18, ri_19]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[ri_19], sk'[ri_18, ri_19]))) && (dh1 = exp(g, mult(sk[ri_19], z_1[ri_18, ri_19]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r[u_22, u_23])
          orfind u_20 = ri_16 <= Qeperuser, u_21 = ri_17 <= N suchthat defined(r_1[ri_16, ri_17], z_7[ri_16, ri_17], sk[ri_17], pkE_13[ri_16, ri_17], pk_R[ri_16, ri_17], pkS_1[ri_16, ri_17]) && (pkS' = pkS_1[ri_16, ri_17]) && (pkR' = pk_R[ri_16, ri_17]) && (pkE' = pkE_13[ri_16, ri_17]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_16, ri_17], sk[ri_17])) && (dh1 = exp(pk_R[ri_16, ri_17], z_7[ri_16, ri_17])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_1[u_20, u_21])
          orfind u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r_2[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], sk[i1[ri_14, ri_15]], pkE_12[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_1[ri_14, ri_15]) && (pkS' = pkS_1[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_12[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[i1[ri_14, ri_15]], sk[ri_15]))) && (dh1 = exp(g, mult(sk[i1[ri_14, ri_15]], z_6[ri_14, ri_15]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_18, u_19])
          orfind u_16 = ri_12 <= Qdperuser, u_17 = ri_13 <= N suchthat defined(r_3[ri_12, ri_13], sk[ri_13], pkE_5[ri_12, ri_13], pkR_2[ri_12, ri_13], pk_S[ri_12, ri_13]) && (pkS' = pk_S[ri_12, ri_13]) && (pkR' = pkR_2[ri_12, ri_13]) && (pkE' = pkE_5[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_12, ri_13], sk[ri_13])) && (dh1 = exp(pkE_5[ri_12, ri_13], sk[ri_13])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_3[u_16, u_17])
          orfind u_15 = ri_11 <= Qh suchthat defined(r_4[ri_11], salt[ri_11], protocol1[ri_11], suite1[ri_11], label1[ri_11], dh1[ri_11], dh2[ri_11], l[ri_11], protocol2[ri_11], suite2[ri_11], label2[ri_11], pkE'[ri_11], pkR'[ri_11], pkS'[ri_11]) && (pkS' = pkS'[ri_11]) && (pkR' = pkR'[ri_11]) && (pkE' = pkE'[ri_11]) && (label2 = label2[ri_11]) && (suite2 = suite2[ri_11]) && (protocol2 = protocol2[ri_11]) && (l = l[ri_11]) && (dh2 = dh2[ri_11]) && (dh1 = dh1[ri_11]) && (label1 = label1[ri_11]) && (suite1 = suite1[ri_11]) && (protocol1 = protocol1[ri_11]) && (salt = salt[ri_11]) then
            return(r_4[u_15])
          else
            r_4 <-R eae_output_t;
            return(r_4)
        else
          find [unique] u_4 = ri <= Qh suchthat defined(r_5[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_5[u_4])
          else
            r_5 <-R eae_output_t;
            return(r_5)
      ))


Applying equivalence gdh(exp) with variables: sk -> a, z_1 -> b. [probability Adv_GDH(time_1, 5 * Qh) + (#Ochall + N) * PDistRerandom + (#Ochall^2 + 2 * #OAEncap^2 + N^2) * PCollKey]
  - Equivalence gdh(exp) with variables: sk -> a, z_1 -> b.
yields

Game 29 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
  {41}    find [unique] u_55 = ri_51 <= Qh suchthat defined(r_4[ri_51], salt[ri_51], protocol1[ri_51], suite1[ri_51], label1[ri_51], dh1[ri_51], dh2[ri_51], l[ri_51], protocol2[ri_51], suite2[ri_51], label2[ri_51], pkE'[ri_51], pkR'[ri_51], pkS'[ri_51]) && (pkS = pkS'[ri_51]) && (pkR_1 = pkR'[ri_51]) && (pkE_3 = pkE'[ri_51]) && (label_shared_secret = label2[ri_51]) && (suite_id = suite2[ri_51]) && (RFCXXXX = protocol2[ri_51]) && (I2OSP2(Nsecret) = l[ri_51]) && ((x: Z_t <- sk'; exp(g, mult(sk, x))) = dh2[ri_51]) && (m_3: G_t <- dh1[ri_51]; false) && (label_eae_prk = label1[ri_51]) && (suite_id = suite1[ri_51]) && (RFCXXXX = protocol1[ri_51]) && (lbytes_empty = salt[ri_51]) then
            zz_3: eae_output_t <- r_4[u_55];
            return(AuthEncap_tuple(r_4[u_55], enc_2))
          else
            r <-R eae_output_t;
            zz_3: eae_output_t <- r;
            return(AuthEncap_tuple(r, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (m_5: G_t <- pk_R; (m_5 = exp(g, sk[i1_1]))) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            find [unique] u_46 = ri_42 <= Qdperuser suchthat defined(r_3[ri_42, i1], pkE_5[ri_42, i1], pk_S[ri_42, i1]) && (pkS_1 = pk_S[ri_42, i1]) && (pkE_12 = pkE_5[ri_42, i1]) then
              return(AuthEncap_tuple(r_3[u_46, i1], enc_9))
            orfind u_45 = ri_41 <= Qh suchthat defined(r_4[ri_41], salt[ri_41], protocol1[ri_41], suite1[ri_41], label1[ri_41], dh1[ri_41], dh2[ri_41], l[ri_41], protocol2[ri_41], suite2[ri_41], label2[ri_41], pkE'[ri_41], pkR'[ri_41], pkS'[ri_41]) && (pkS_1 = pkS'[ri_41]) && (pk_R = pkR'[ri_41]) && (pkE_12 = pkE'[ri_41]) && (label_shared_secret = label2[ri_41]) && (suite_id = suite2[ri_41]) && (RFCXXXX = protocol2[ri_41]) && (I2OSP2(Nsecret) = l[ri_41]) && (m_10: G_t <- dh2[ri_41]; (m_10 = exp(g, mult(sk[i1], sk)))) && ((x_1: Z_t <- z_6; exp(g, mult(sk[i1], x_1))) = dh1[ri_41]) && (label_eae_prk = label1[ri_41]) && (suite_id = suite1[ri_41]) && (RFCXXXX = protocol1[ri_41]) && (lbytes_empty = salt[ri_41]) then
              return(AuthEncap_tuple(r_4[u_45], enc_9))
            else
              r_2 <-R eae_output_t;
              return(AuthEncap_tuple(r_2, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            find [unique] u_35 = ri_31 <= Qh suchthat defined(r_4[ri_31], salt[ri_31], protocol1[ri_31], suite1[ri_31], label1[ri_31], dh1[ri_31], dh2[ri_31], l[ri_31], protocol2[ri_31], suite2[ri_31], label2[ri_31], pkE'[ri_31], pkR'[ri_31], pkS'[ri_31]) && (pkS_1 = pkS'[ri_31]) && (pk_R = pkR'[ri_31]) && (pkE_13 = pkE'[ri_31]) && (label_shared_secret = label2[ri_31]) && (suite_id = suite2[ri_31]) && (RFCXXXX = protocol2[ri_31]) && (I2OSP2(Nsecret) = l[ri_31]) && (m_4: G_t <- dh2[ri_31]; m'_1: G_t <- pk_R; (m_4 = exp(m'_1, sk))) && (exp(pk_R, z_7) = dh1[ri_31]) && (label_eae_prk = label1[ri_31]) && (suite_id = suite1[ri_31]) && (RFCXXXX = protocol1[ri_31]) && (lbytes_empty = salt[ri_31]) then
              return(AuthEncap_tuple(r_4[u_35], enc_10))
            else
              r_1 <-R eae_output_t;
              return(AuthEncap_tuple(r_1, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              pkR_2: G_t <- exp(g, sk);
              find [unique] u_28 = ri_24 <= Qeperuser, u_29 = ri_25 <= N suchthat defined(r_2[ri_24, ri_25], pkE_12[ri_24, ri_25], i1[ri_24, ri_25], pkS_1[ri_24, ri_25]) && (pk_S = pkS_1[ri_24, ri_25]) && (i = i1[ri_24, ri_25]) && (pkE_5 = pkE_12[ri_24, ri_25]) then
                return(AuthDecap_Some(r_2[u_28, u_29]))
              orfind u_26 = ri_22 <= Qdperuser suchthat defined(r_3[ri_22], pkE_5[ri_22], pk_S[ri_22]) && (pk_S = pk_S[ri_22]) && (pkE_5 = pkE_5[ri_22]) then
                return(AuthDecap_Some(r_3[u_26]))
              orfind u_25 = ri_21 <= Qh suchthat defined(r_4[ri_21], salt[ri_21], protocol1[ri_21], suite1[ri_21], label1[ri_21], dh1[ri_21], dh2[ri_21], l[ri_21], protocol2[ri_21], suite2[ri_21], label2[ri_21], pkE'[ri_21], pkR'[ri_21], pkS'[ri_21]) && (pk_S = pkS'[ri_21]) && (pkR_2 = pkR'[ri_21]) && (pkE_5 = pkE'[ri_21]) && (label_shared_secret = label2[ri_21]) && (suite_id = suite2[ri_21]) && (RFCXXXX = protocol2[ri_21]) && (I2OSP2(Nsecret) = l[ri_21]) && (m_12: G_t <- dh2[ri_21]; m'_3: G_t <- pk_S; (m_12 = exp(m'_3, sk))) && (m_11: G_t <- dh1[ri_21]; m'_2: G_t <- pkE_5; (m_11 = exp(m'_2, sk))) && (label_eae_prk = label1[ri_21]) && (suite_id = suite1[ri_21]) && (RFCXXXX = protocol1[ri_21]) && (lbytes_empty = salt[ri_21]) then
                return(AuthDecap_Some(r_4[u_25]))
              else
                r_3 <-R eae_output_t;
                return(AuthDecap_Some(r_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
 {812}    find [unique] u_22 = ri_18 <= Qcperuser, u_23 = ri_19 <= N suchthat defined(r[ri_18, ri_19], sk[ri_19], sk'[ri_18, ri_19], pkE_3[ri_18, ri_19], pkR_1[ri_18, ri_19], pkS[ri_18, ri_19]) && (pkS' = pkS[ri_18, ri_19]) && (pkR' = pkR_1[ri_18, ri_19]) && (pkE' = pkE_3[ri_18, ri_19]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = (x_2: Z_t <- sk'[ri_18, ri_19]; exp(g, mult(sk[ri_19], x_2)))) && (m_14: G_t <- dh1; false) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r[u_22, u_23])
          orfind u_20 = ri_16 <= Qeperuser, u_21 = ri_17 <= N suchthat defined(r_1[ri_16, ri_17], z_7[ri_16, ri_17], sk[ri_17], pkE_13[ri_16, ri_17], pk_R[ri_16, ri_17], pkS_1[ri_16, ri_17]) && (pkS' = pkS_1[ri_16, ri_17]) && (pkR' = pk_R[ri_16, ri_17]) && (pkE' = pkE_13[ri_16, ri_17]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (m_15: G_t <- dh2; m'_4: G_t <- pk_R[ri_16, ri_17]; (m_15 = exp(m'_4, sk[ri_17]))) && (dh1 = exp(pk_R[ri_16, ri_17], z_7[ri_16, ri_17])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_1[u_20, u_21])
          orfind u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r_2[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], sk[i1[ri_14, ri_15]], pkE_12[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_1[ri_14, ri_15]) && (pkS' = pkS_1[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_12[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (m_20: G_t <- dh2; (m_20 = exp(g, mult(sk[i1[ri_14, ri_15]], sk[ri_15])))) && (dh1 = (x_3: Z_t <- z_6[ri_14, ri_15]; exp(g, mult(sk[i1[ri_14, ri_15]], x_3)))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_18, u_19])
          orfind u_16 = ri_12 <= Qdperuser, u_17 = ri_13 <= N suchthat defined(r_3[ri_12, ri_13], sk[ri_13], pkE_5[ri_12, ri_13], pkR_2[ri_12, ri_13], pk_S[ri_12, ri_13]) && (pkS' = pk_S[ri_12, ri_13]) && (pkR' = pkR_2[ri_12, ri_13]) && (pkE' = pkE_5[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (m_22: G_t <- dh2; m'_6: G_t <- pk_S[ri_12, ri_13]; (m_22 = exp(m'_6, sk[ri_13]))) && (m_21: G_t <- dh1; m'_5: G_t <- pkE_5[ri_12, ri_13]; (m_21 = exp(m'_5, sk[ri_13]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_3[u_16, u_17])
          orfind u_15 = ri_11 <= Qh suchthat defined(r_4[ri_11], salt[ri_11], protocol1[ri_11], suite1[ri_11], label1[ri_11], dh1[ri_11], dh2[ri_11], l[ri_11], protocol2[ri_11], suite2[ri_11], label2[ri_11], pkE'[ri_11], pkR'[ri_11], pkS'[ri_11]) && (pkS' = pkS'[ri_11]) && (pkR' = pkR'[ri_11]) && (pkE' = pkE'[ri_11]) && (label2 = label2[ri_11]) && (suite2 = suite2[ri_11]) && (protocol2 = protocol2[ri_11]) && (l = l[ri_11]) && (dh2 = dh2[ri_11]) && (dh1 = dh1[ri_11]) && (label1 = label1[ri_11]) && (suite1 = suite1[ri_11]) && (protocol1 = protocol1[ri_11]) && (salt = salt[ri_11]) then
            return(r_4[u_15])
          else
            r_4 <-R eae_output_t;
            return(r_4)
        else
          find [unique] u_4 = ri <= Qh suchthat defined(r_5[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_5[u_4])
          else
            r_5 <-R eae_output_t;
            return(r_5)
      ))


Applying expand
  - Expand if/find/let
    - Remove branch 1 in find at 812
    - Remove branch 1 in find at 41
    - Find at 41 removed (else branch kept if any)
yields

Game 30 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          pkR_1: G_t <- exp(g, sk);
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          enc_2: bitstring <- Serialize(pkE_3);
          pkS: G_t <- exp(g, sk');
          r <-R eae_output_t;
          zz_3: eae_output_t <- r;
          return(AuthEncap_tuple(r, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (m_5: G_t <- pk_R; (m_5 = exp(g, sk[i1_1]))) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            find [unique] u_46 = ri_42 <= Qdperuser suchthat defined(r_3[ri_42, i1], pkE_5[ri_42, i1], pk_S[ri_42, i1]) && (pkS_1 = pk_S[ri_42, i1]) && (pkE_12 = pkE_5[ri_42, i1]) then
              return(AuthEncap_tuple(r_3[u_46, i1], enc_9))
            orfind u_45 = ri_41 <= Qh suchthat defined(r_4[ri_41], salt[ri_41], protocol1[ri_41], suite1[ri_41], label1[ri_41], dh1[ri_41], dh2[ri_41], l[ri_41], protocol2[ri_41], suite2[ri_41], label2[ri_41], pkE'[ri_41], pkR'[ri_41], pkS'[ri_41]) && (m_10: G_t <- dh2[ri_41]; x_1: Z_t <- z_6; ((pkS_1 = pkS'[ri_41]) && (pk_R = pkR'[ri_41]) && (pkE_12 = pkE'[ri_41]) && (label_shared_secret = label2[ri_41]) && (suite_id = suite2[ri_41]) && (RFCXXXX = protocol2[ri_41]) && (I2OSP2(Nsecret) = l[ri_41]) && (m_10 = exp(g, mult(sk[i1], sk))) && (exp(g, mult(sk[i1], x_1)) = dh1[ri_41]) && (label_eae_prk = label1[ri_41]) && (suite_id = suite1[ri_41]) && (RFCXXXX = protocol1[ri_41]) && (lbytes_empty = salt[ri_41]))) then
              return(AuthEncap_tuple(r_4[u_45], enc_9))
            else
              r_2 <-R eae_output_t;
              return(AuthEncap_tuple(r_2, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            find [unique] u_35 = ri_31 <= Qh suchthat defined(r_4[ri_31], salt[ri_31], protocol1[ri_31], suite1[ri_31], label1[ri_31], dh1[ri_31], dh2[ri_31], l[ri_31], protocol2[ri_31], suite2[ri_31], label2[ri_31], pkE'[ri_31], pkR'[ri_31], pkS'[ri_31]) && (m_4: G_t <- dh2[ri_31]; m'_1: G_t <- pk_R; ((pkS_1 = pkS'[ri_31]) && (pk_R = pkR'[ri_31]) && (pkE_13 = pkE'[ri_31]) && (label_shared_secret = label2[ri_31]) && (suite_id = suite2[ri_31]) && (RFCXXXX = protocol2[ri_31]) && (I2OSP2(Nsecret) = l[ri_31]) && (m_4 = exp(m'_1, sk)) && (exp(pk_R, z_7) = dh1[ri_31]) && (label_eae_prk = label1[ri_31]) && (suite_id = suite1[ri_31]) && (RFCXXXX = protocol1[ri_31]) && (lbytes_empty = salt[ri_31]))) then
              return(AuthEncap_tuple(r_4[u_35], enc_10))
            else
              r_1 <-R eae_output_t;
              return(AuthEncap_tuple(r_1, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(zz_3[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(zz_3[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              pkR_2: G_t <- exp(g, sk);
              find [unique] u_28 = ri_24 <= Qeperuser, u_29 = ri_25 <= N suchthat defined(r_2[ri_24, ri_25], pkE_12[ri_24, ri_25], i1[ri_24, ri_25], pkS_1[ri_24, ri_25]) && (pk_S = pkS_1[ri_24, ri_25]) && (i = i1[ri_24, ri_25]) && (pkE_5 = pkE_12[ri_24, ri_25]) then
                return(AuthDecap_Some(r_2[u_28, u_29]))
              orfind u_26 = ri_22 <= Qdperuser suchthat defined(r_3[ri_22], pkE_5[ri_22], pk_S[ri_22]) && (pk_S = pk_S[ri_22]) && (pkE_5 = pkE_5[ri_22]) then
                return(AuthDecap_Some(r_3[u_26]))
              orfind u_25 = ri_21 <= Qh suchthat defined(r_4[ri_21], salt[ri_21], protocol1[ri_21], suite1[ri_21], label1[ri_21], dh1[ri_21], dh2[ri_21], l[ri_21], protocol2[ri_21], suite2[ri_21], label2[ri_21], pkE'[ri_21], pkR'[ri_21], pkS'[ri_21]) && (m_12: G_t <- dh2[ri_21]; m'_3: G_t <- pk_S; m_11: G_t <- dh1[ri_21]; m'_2: G_t <- pkE_5; ((pk_S = pkS'[ri_21]) && (pkR_2 = pkR'[ri_21]) && (pkE_5 = pkE'[ri_21]) && (label_shared_secret = label2[ri_21]) && (suite_id = suite2[ri_21]) && (RFCXXXX = protocol2[ri_21]) && (I2OSP2(Nsecret) = l[ri_21]) && (m_12 = exp(m'_3, sk)) && (m_11 = exp(m'_2, sk)) && (label_eae_prk = label1[ri_21]) && (suite_id = suite1[ri_21]) && (RFCXXXX = protocol1[ri_21]) && (lbytes_empty = salt[ri_21]))) then
                return(AuthDecap_Some(r_4[u_25]))
              else
                r_3 <-R eae_output_t;
                return(AuthDecap_Some(r_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          find [unique] u_20 = ri_16 <= Qeperuser, u_21 = ri_17 <= N suchthat defined(r_1[ri_16, ri_17], z_7[ri_16, ri_17], sk[ri_17], pkE_13[ri_16, ri_17], pk_R[ri_16, ri_17], pkS_1[ri_16, ri_17]) && (m_15: G_t <- dh2; m'_4: G_t <- pk_R[ri_16, ri_17]; ((pkS' = pkS_1[ri_16, ri_17]) && (pkR' = pk_R[ri_16, ri_17]) && (pkE' = pkE_13[ri_16, ri_17]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (m_15 = exp(m'_4, sk[ri_17])) && (dh1 = exp(pk_R[ri_16, ri_17], z_7[ri_16, ri_17])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty))) then
            return(r_1[u_20, u_21])
          orfind u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r_2[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], sk[i1[ri_14, ri_15]], pkE_12[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_1[ri_14, ri_15]) && (m_20: G_t <- dh2; x_3: Z_t <- z_6[ri_14, ri_15]; ((pkS' = pkS_1[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_12[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (m_20 = exp(g, mult(sk[i1[ri_14, ri_15]], sk[ri_15]))) && (dh1 = exp(g, mult(sk[i1[ri_14, ri_15]], x_3))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty))) then
            return(r_2[u_18, u_19])
          orfind u_16 = ri_12 <= Qdperuser, u_17 = ri_13 <= N suchthat defined(r_3[ri_12, ri_13], sk[ri_13], pkE_5[ri_12, ri_13], pkR_2[ri_12, ri_13], pk_S[ri_12, ri_13]) && (m_22: G_t <- dh2; m'_6: G_t <- pk_S[ri_12, ri_13]; m_21: G_t <- dh1; m'_5: G_t <- pkE_5[ri_12, ri_13]; ((pkS' = pk_S[ri_12, ri_13]) && (pkR' = pkR_2[ri_12, ri_13]) && (pkE' = pkE_5[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (m_22 = exp(m'_6, sk[ri_13])) && (m_21 = exp(m'_5, sk[ri_13])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty))) then
            return(r_3[u_16, u_17])
          orfind u_15 = ri_11 <= Qh suchthat defined(r_4[ri_11], salt[ri_11], protocol1[ri_11], suite1[ri_11], label1[ri_11], dh1[ri_11], dh2[ri_11], l[ri_11], protocol2[ri_11], suite2[ri_11], label2[ri_11], pkE'[ri_11], pkR'[ri_11], pkS'[ri_11]) && (pkS' = pkS'[ri_11]) && (pkR' = pkR'[ri_11]) && (pkE' = pkE'[ri_11]) && (label2 = label2[ri_11]) && (suite2 = suite2[ri_11]) && (protocol2 = protocol2[ri_11]) && (l = l[ri_11]) && (dh2 = dh2[ri_11]) && (dh1 = dh1[ri_11]) && (label1 = label1[ri_11]) && (suite1 = suite1[ri_11]) && (protocol1 = protocol1[ri_11]) && (salt = salt[ri_11]) then
            return(r_4[u_15])
          else
            r_4 <-R eae_output_t;
            return(r_4)
        else
          find [unique] u_4 = ri <= Qh suchthat defined(r_5[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_5[u_4])
          else
            r_5 <-R eae_output_t;
            return(r_5)
      ))


Applying remove assignments of findcond
  - Remove assignments on m_15 (definition removed, all usages removed)
  - Remove assignments on m'_4 (definition removed, all usages removed)
  - Remove assignments on m_20 (definition removed, all usages removed)
  - Remove assignments on x_3 (definition removed, all usages removed)
  - Remove assignments on m_22 (definition removed, all usages removed)
  - Remove assignments on m'_6 (definition removed, all usages removed)
  - Remove assignments on m_21 (definition removed, all usages removed)
  - Remove assignments on m'_5 (definition removed, all usages removed)
  - Remove assignments on m_12 (definition removed, all usages removed)
  - Remove assignments on m'_3 (definition removed, all usages removed)
  - Remove assignments on m_11 (definition removed, all usages removed)
  - Remove assignments on m'_2 (definition removed, all usages removed)
  - Remove assignments on m_4 (definition removed, all usages removed)
  - Remove assignments on m'_1 (definition removed, all usages removed)
  - Remove assignments on m_10 (definition removed, all usages removed)
  - Remove assignments on x_1 (definition removed, all usages removed)
  - Remove assignments on m_5 (definition removed, all usages removed)
  - Remove assignments on pkR_1 (definition removed, all usages removed)
  - Remove assignments on pkS (definition removed, all usages removed)
  - Remove assignments on zz_3 (definition removed, all usages removed)
yields

Game 31 is
      Ostart() :=
      return();
      ((
        foreach i <= N do
        Osetup() :=
        sk <-R Z_t;
        return();
        ((
          foreach ic <= Qcperuser do
          Ochall(sk': Z_t) :=
          z_1 <-R Z_t;
          pkE_3: G_t <- exp(g, z_1);
          enc_2: bitstring <- Serialize(pkE_3);
          r <-R eae_output_t;
          return(AuthEncap_tuple(r, enc_2))
        ) | (
          foreach ie <= Qeperuser do
          OAEncap(pk_R: G_t) :=
          find i1 = i1_1 <= N suchthat defined(sk[i1_1]) && (pk_R = exp(g, sk[i1_1])) then
            z_6 <-R Z_t;
            pkE_12: G_t <- exp(g, z_6);
            enc_9: bitstring <- Serialize(pkE_12);
            pkS_1: G_t <- exp(g, sk);
            find [unique] u_46 = ri_42 <= Qdperuser suchthat defined(r_3[ri_42, i1], pkE_5[ri_42, i1], pk_S[ri_42, i1]) && (pkS_1 = pk_S[ri_42, i1]) && (pkE_12 = pkE_5[ri_42, i1]) then
              return(AuthEncap_tuple(r_3[u_46, i1], enc_9))
            orfind u_45 = ri_41 <= Qh suchthat defined(r_4[ri_41], salt[ri_41], protocol1[ri_41], suite1[ri_41], label1[ri_41], dh1[ri_41], dh2[ri_41], l[ri_41], protocol2[ri_41], suite2[ri_41], label2[ri_41], pkE'[ri_41], pkR'[ri_41], pkS'[ri_41]) && (pkS_1 = pkS'[ri_41]) && (pk_R = pkR'[ri_41]) && (pkE_12 = pkE'[ri_41]) && (label_shared_secret = label2[ri_41]) && (suite_id = suite2[ri_41]) && (RFCXXXX = protocol2[ri_41]) && (I2OSP2(Nsecret) = l[ri_41]) && (dh2[ri_41] = exp(g, mult(sk[i1], sk))) && (exp(g, mult(sk[i1], z_6)) = dh1[ri_41]) && (label_eae_prk = label1[ri_41]) && (suite_id = suite1[ri_41]) && (RFCXXXX = protocol1[ri_41]) && (lbytes_empty = salt[ri_41]) then
              return(AuthEncap_tuple(r_4[u_45], enc_9))
            else
              r_2 <-R eae_output_t;
              return(AuthEncap_tuple(r_2, enc_9))
          else
            z_7 <-R Z_t;
            pkE_13: G_t <- exp(g, z_7);
            enc_10: bitstring <- Serialize(pkE_13);
            pkS_1: G_t <- exp(g, sk);
            find [unique] u_35 = ri_31 <= Qh suchthat defined(r_4[ri_31], salt[ri_31], protocol1[ri_31], suite1[ri_31], label1[ri_31], dh1[ri_31], dh2[ri_31], l[ri_31], protocol2[ri_31], suite2[ri_31], label2[ri_31], pkE'[ri_31], pkR'[ri_31], pkS'[ri_31]) && (pkS_1 = pkS'[ri_31]) && (pk_R = pkR'[ri_31]) && (pkE_13 = pkE'[ri_31]) && (label_shared_secret = label2[ri_31]) && (suite_id = suite2[ri_31]) && (RFCXXXX = protocol2[ri_31]) && (I2OSP2(Nsecret) = l[ri_31]) && (dh2[ri_31] = exp(pk_R, sk)) && (exp(pk_R, z_7) = dh1[ri_31]) && (label_eae_prk = label1[ri_31]) && (suite_id = suite1[ri_31]) && (RFCXXXX = protocol1[ri_31]) && (lbytes_empty = salt[ri_31]) then
              return(AuthEncap_tuple(r_4[u_35], enc_10))
            else
              r_1 <-R eae_output_t;
              return(AuthEncap_tuple(r_1, enc_10))
        ) | (
          foreach id <= Qdperuser do
          OADecap(pk_S: G_t, cd: bitstring) :=
          find ic_2 = ic_3 <= Qcperuser suchthat defined(r[ic_3], sk'[ic_3], enc_2[ic_3]) && (enc_2[ic_3] = cd) && (exp(g, sk'[ic_3]) = pk_S) then
            return(AuthDecap_Some(r[ic_2]))
          else
            let Serialize(pkE_5: G_t) = cd in
              pkR_2: G_t <- exp(g, sk);
              find [unique] u_28 = ri_24 <= Qeperuser, u_29 = ri_25 <= N suchthat defined(r_2[ri_24, ri_25], pkE_12[ri_24, ri_25], i1[ri_24, ri_25], pkS_1[ri_24, ri_25]) && (pk_S = pkS_1[ri_24, ri_25]) && (i = i1[ri_24, ri_25]) && (pkE_5 = pkE_12[ri_24, ri_25]) then
                return(AuthDecap_Some(r_2[u_28, u_29]))
              orfind u_26 = ri_22 <= Qdperuser suchthat defined(r_3[ri_22], pkE_5[ri_22], pk_S[ri_22]) && (pk_S = pk_S[ri_22]) && (pkE_5 = pkE_5[ri_22]) then
                return(AuthDecap_Some(r_3[u_26]))
              orfind u_25 = ri_21 <= Qh suchthat defined(r_4[ri_21], salt[ri_21], protocol1[ri_21], suite1[ri_21], label1[ri_21], dh1[ri_21], dh2[ri_21], l[ri_21], protocol2[ri_21], suite2[ri_21], label2[ri_21], pkE'[ri_21], pkR'[ri_21], pkS'[ri_21]) && (pk_S = pkS'[ri_21]) && (pkR_2 = pkR'[ri_21]) && (pkE_5 = pkE'[ri_21]) && (label_shared_secret = label2[ri_21]) && (suite_id = suite2[ri_21]) && (RFCXXXX = protocol2[ri_21]) && (I2OSP2(Nsecret) = l[ri_21]) && (dh2[ri_21] = exp(pk_S, sk)) && (dh1[ri_21] = exp(pkE_5, sk)) && (label_eae_prk = label1[ri_21]) && (suite_id = suite1[ri_21]) && (RFCXXXX = protocol1[ri_21]) && (lbytes_empty = salt[ri_21]) then
                return(AuthDecap_Some(r_4[u_25]))
              else
                r_3 <-R eae_output_t;
                return(AuthDecap_Some(r_3))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk))
        ))
      ) | (
        foreach iH <= Qh do
        OH(x1: eae_input_t) :=
        let eae_input(salt: extract_salt_t, concatExtract(protocol1: label_protocol_t, suite1: suite_id_t, label1: label_extract_t, concatDH(dh1: G_t, dh2: G_t)), concatExpand(l: two_byte_t, protocol2: label_protocol_t, suite2: suite_id_t, label2: label_expand_t, concatContext(pkE': G_t, pkR': G_t, pkS': G_t))) = x1 in
          find [unique] u_20 = ri_16 <= Qeperuser, u_21 = ri_17 <= N suchthat defined(r_1[ri_16, ri_17], z_7[ri_16, ri_17], sk[ri_17], pkE_13[ri_16, ri_17], pk_R[ri_16, ri_17], pkS_1[ri_16, ri_17]) && (pkS' = pkS_1[ri_16, ri_17]) && (pkR' = pk_R[ri_16, ri_17]) && (pkE' = pkE_13[ri_16, ri_17]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_R[ri_16, ri_17], sk[ri_17])) && (dh1 = exp(pk_R[ri_16, ri_17], z_7[ri_16, ri_17])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_1[u_20, u_21])
          orfind u_18 = ri_14 <= Qeperuser, u_19 = ri_15 <= N suchthat defined(r_2[ri_14, ri_15], z_6[ri_14, ri_15], sk[ri_15], sk[i1[ri_14, ri_15]], pkE_12[ri_14, ri_15], pk_R[ri_14, ri_15], pkS_1[ri_14, ri_15]) && (pkS' = pkS_1[ri_14, ri_15]) && (pkR' = pk_R[ri_14, ri_15]) && (pkE' = pkE_12[ri_14, ri_15]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(g, mult(sk[i1[ri_14, ri_15]], sk[ri_15]))) && (dh1 = exp(g, mult(sk[i1[ri_14, ri_15]], z_6[ri_14, ri_15]))) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_2[u_18, u_19])
          orfind u_16 = ri_12 <= Qdperuser, u_17 = ri_13 <= N suchthat defined(r_3[ri_12, ri_13], sk[ri_13], pkE_5[ri_12, ri_13], pkR_2[ri_12, ri_13], pk_S[ri_12, ri_13]) && (pkS' = pk_S[ri_12, ri_13]) && (pkR' = pkR_2[ri_12, ri_13]) && (pkE' = pkE_5[ri_12, ri_13]) && (label2 = label_shared_secret) && (suite2 = suite_id) && (protocol2 = RFCXXXX) && (l = I2OSP2(Nsecret)) && (dh2 = exp(pk_S[ri_12, ri_13], sk[ri_13])) && (dh1 = exp(pkE_5[ri_12, ri_13], sk[ri_13])) && (label1 = label_eae_prk) && (suite1 = suite_id) && (protocol1 = RFCXXXX) && (salt = lbytes_empty) then
            return(r_3[u_16, u_17])
          orfind u_15 = ri_11 <= Qh suchthat defined(r_4[ri_11], salt[ri_11], protocol1[ri_11], suite1[ri_11], label1[ri_11], dh1[ri_11], dh2[ri_11], l[ri_11], protocol2[ri_11], suite2[ri_11], label2[ri_11], pkE'[ri_11], pkR'[ri_11], pkS'[ri_11]) && (pkS' = pkS'[ri_11]) && (pkR' = pkR'[ri_11]) && (pkE' = pkE'[ri_11]) && (label2 = label2[ri_11]) && (suite2 = suite2[ri_11]) && (protocol2 = protocol2[ri_11]) && (l = l[ri_11]) && (dh2 = dh2[ri_11]) && (dh1 = dh1[ri_11]) && (label1 = label1[ri_11]) && (suite1 = suite1[ri_11]) && (protocol1 = protocol1[ri_11]) && (salt = salt[ri_11]) then
            return(r_4[u_15])
          else
            r_4 <-R eae_output_t;
            return(r_4)
        else
          find [unique] u_4 = ri <= Qh suchthat defined(r_5[ri], x1[ri]) && (x1 = x1[ri]) then
            return(r_5[u_4])
          else
            r_5 <-R eae_output_t;
            return(r_5)
      ))

Initial state
Game 32 is
      Ostart() :=
      key_extr_10 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          let AuthEncap_tuple(k: eae_output_t, ce: bitstring) = (pkR_4: G_t <- exp(g, sk_1); let (skE_6: Z_t, pkE_9: G_t) = (z_4 <-R Z_t; (z_4, exp(g, z_4))) in dh_9: GG_t <- concatDH(exp(pkR_4, skE_6), exp(pkR_4, sk'_1)); enc_7: bitstring <- Serialize(pkE_9); pkS_3: G_t <- exp(g, sk'_1); kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pkS_3); zz_9: eae_output_t <- (key_3: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9); info_3: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9); ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_3, info_3))); AuthEncap_tuple(zz_9, enc_7) else AuthEncap_None) in
            k' <-R eae_output_t;
            insert E(exp(g, sk'_1), exp(g, sk_1), ce, k');
            return(AuthEncap_tuple(k', ce))
          else
            return(AuthEncap_None)
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          return((let (skE_7: Z_t, pkE_10: G_t) = (z_5 <-R Z_t; (z_5, exp(g, z_5))) in dh_10: GG_t <- concatDH(exp(pk_R_1, skE_7), exp(pk_R_1, sk_1)); enc_8: bitstring <- Serialize(pkE_10); pkS_4: G_t <- exp(g, sk_1); kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4); zz_10: eae_output_t <- (key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10); info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10); ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_4, info_4))); AuthEncap_tuple(zz_10, enc_8) else AuthEncap_None))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          get E(=pk_S_1, =exp(g, sk_1), =cd_1, k'': eae_output_t) in
            return(AuthDecap_Some(k''))
          else
            return((skR_1: Z_t <- sk_1; let Serialize(pkE_11: G_t) = cd_1 in dh_11: GG_t <- concatDH(exp(pkE_11, skR_1), exp(pk_S_1, skR_1)); pkR_5: G_t <- exp(g, skR_1); kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1); zz_11: eae_output_t <- (key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11); info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11); ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_5, info_5))); AuthDecap_Some(zz_11) else AuthDecap_None))
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_10, x1_1))
      ))


Applying expand get, insert and prove unique annotations
  - Expand get/insert for table E
yields

Game 33 is
      Ostart() :=
      key_extr_10 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
  {19}    let AuthEncap_tuple(k: eae_output_t, ce: bitstring) = (pkR_4: G_t <- exp(g, sk_1); {25}let (skE_6: Z_t, pkE_9: G_t) = (z_4 <-R Z_t; (z_4, exp(g, z_4))) in dh_9: GG_t <- concatDH(exp(pkR_4, skE_6), exp(pkR_4, sk'_1)); enc_7: bitstring <- Serialize(pkE_9); pkS_3: G_t <- exp(g, sk'_1); kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pkS_3); zz_9: eae_output_t <- (key_3: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9); info_3: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9); ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_3, info_3))); AuthEncap_tuple(zz_9, enc_7) else AuthEncap_None) in
            k' <-R eae_output_t;
            E_1: G_t <- exp(g, sk'_1);
            E_2: G_t <- exp(g, sk_1);
            E_3: bitstring <- ce;
            E_4: eae_output_t <- k';
            return(AuthEncap_tuple(k', ce))
          else
            return(AuthEncap_None)
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          return({155}(let (skE_7: Z_t, pkE_10: G_t) = (z_5 <-R Z_t; (z_5, exp(g, z_5))) in dh_10: GG_t <- concatDH(exp(pk_R_1, skE_7), exp(pk_R_1, sk_1)); enc_8: bitstring <- Serialize(pkE_10); pkS_4: G_t <- exp(g, sk_1); kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4); zz_10: eae_output_t <- (key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10); info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10); ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_4, info_4))); AuthEncap_tuple(zz_10, enc_8) else AuthEncap_None))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser, u_1 = u_3 <= N suchthat defined(E_1[u_2, u_3], E_2[u_2, u_3], E_3[u_2, u_3], E_4[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (E_2[u_2, u_3] = exp(g, sk_1)) && (E_3[u_2, u_3] = cd_1) then
            return(AuthDecap_Some(E_4[u, u_1]))
          else
            return((skR_1: Z_t <- sk_1; let Serialize(pkE_11: G_t) = cd_1 in dh_11: GG_t <- concatDH(exp(pkE_11, skR_1), exp(pk_S_1, skR_1)); pkR_5: G_t <- exp(g, skR_1); kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1); zz_11: eae_output_t <- (key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11); info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11); ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_5, info_5))); AuthDecap_Some(zz_11) else AuthDecap_None))
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_10, x1_1))
      ))


Applying expand [probability N^2 * PCollKey]
  - Expand if/find/let
    - Simplify pattern (skE_7: Z_t, pkE_10: G_t) (tuple expanded) at 155
    - Remove else branch of let at 155
    - Simplify pattern (skE_6: Z_t, pkE_9: G_t) (tuple expanded) at 25
    - Remove else branch of let at 25
    - Simplify pattern AuthEncap_tuple(k: eae_output_t, ce: bitstring) (tuple expanded) at 19
    - Remove else branch of let at 19
yields

Game 34 is
      Ostart() :=
      key_extr_10 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          pkR_4: G_t <- exp(g, sk_1);
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          skE_6: Z_t <- z_4;
          dh_9: GG_t <- concatDH(exp(pkR_4, skE_6), exp(pkR_4, sk'_1));
          enc_7: bitstring <- Serialize(pkE_9);
          pkS_3: G_t <- exp(g, sk'_1);
          kemContext_9: GGG_t <- concatContext(pkE_9, pkR_4, pkS_3);
          key_3: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_9);
          info_3: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_9);
          zz_9: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_3, info_3));
          ce: bitstring <- enc_7;
          k: eae_output_t <- zz_9;
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          E_2: G_t <- exp(g, sk_1);
          E_3: bitstring <- ce;
          E_4: eae_output_t <- k';
          return(AuthEncap_tuple(k', ce))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          z_5 <-R Z_t;
          pkE_10: G_t <- exp(g, z_5);
          skE_7: Z_t <- z_5;
          dh_10: GG_t <- concatDH(exp(pk_R_1, skE_7), exp(pk_R_1, sk_1));
          enc_8: bitstring <- Serialize(pkE_10);
          pkS_4: G_t <- exp(g, sk_1);
          kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
          key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
          info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
          zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_4, info_4));
          return(AuthEncap_tuple(zz_10, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser, u_1 = u_3 <= N suchthat defined(E_1[u_2, u_3], E_2[u_2, u_3], E_3[u_2, u_3], E_4[u_2, u_3]) && (E_1[u_2, u_3] = pk_S_1) && (E_2[u_2, u_3] = exp(g, sk_1)) && (E_3[u_2, u_3] = cd_1) then
            return(AuthDecap_Some(E_4[u, u_1]))
          else
            skR_1: Z_t <- sk_1;
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, skR_1), exp(pk_S_1, skR_1));
              pkR_5: G_t <- exp(g, skR_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_5, info_5));
              return(AuthDecap_Some(zz_11))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_10, x1_1))
      ))


Applying remove assignments of findcond
  - Remove assignments on skR_1 (definition removed, all usages removed)
  - Remove assignments on skE_7 (definition removed, all usages removed)
  - Remove assignments on skE_6 (definition removed, all usages removed)
  - Remove assignments on ce (definition removed, all usages removed)
  - Remove assignments on k (definition removed, all usages removed)
  - Remove assignments on E_3 (definition removed, all usages removed)
  - Remove assignments on E_4 (definition removed, all usages removed)
  - Remove assignments on zz_9 (definition removed, all usages removed)
  - Remove assignments on key_3 (definition removed, all usages removed)
  - Remove assignments on info_3 (definition removed, all usages removed)
  - Remove assignments on dh_9 (definition removed, all usages removed)
  - Remove assignments on kemContext_9 (definition removed, all usages removed)
  - Remove assignments on pkR_4 (definition removed, all usages removed)
  - Remove assignments on pkS_3 (definition removed, all usages removed)
yields

Game 35 is
      Ostart() :=
      key_extr_10 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          E_2: G_t <- exp(g, sk_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          z_5 <-R Z_t;
          pkE_10: G_t <- exp(g, z_5);
          dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
          enc_8: bitstring <- Serialize(pkE_10);
          pkS_4: G_t <- exp(g, sk_1);
          kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
          key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
          info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
          zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_4, info_4));
          return(AuthEncap_tuple(zz_10, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
 {155}    find u = u_2 <= Qcperuser, u_1 = u_3 <= N suchthat defined(enc_7[u_2, u_3], k'[u_2, u_3], E_1[u_2, u_3], E_2[u_2, u_3]) && {164}((E_1[u_2, u_3] = pk_S_1) && (E_2[u_2, u_3] = exp(g, sk_1)) && (enc_7[u_2, u_3] = cd_1)) then
            return(AuthDecap_Some(k'[u, u_1]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_5, info_5));
              return(AuthDecap_Some(zz_11))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_10, x1_1))
      ))


Applying simplify [probability N^2 * PCollKey]
  - Simplification pass
    - Replaced ((E_1[u_2, u_3] = pk_S_1) && (E_2[u_2, u_3] = exp(g, sk_1)) && (enc_7[u_2, u_3] = cd_1)) with ((E_1[u_2, u_3] = pk_S_1) && (u_3 = i_1) && (enc_7[u_2, u_3] = cd_1)) at 164
    - In branch 1 of find at 155, substituting u_1 with i_1
    - Replaced defined condition enc_7[u_2, u_3], k'[u_2, u_3], E_1[u_2, u_3], E_2[u_2, u_3] with enc_7[u_2], k'[u_2], E_1[u_2], E_2[u_2] in find at 155
yields

Game 36 is
      Ostart() :=
      key_extr_10 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          E_2: G_t <- exp(g, sk_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          z_5 <-R Z_t;
          pkE_10: G_t <- exp(g, z_5);
          dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
          enc_8: bitstring <- Serialize(pkE_10);
          pkS_4: G_t <- exp(g, sk_1);
          kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
          key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
          info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
          zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_4, info_4));
          return(AuthEncap_tuple(zz_10, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2], E_2[u_2]) && {164}((E_1[u_2] = pk_S_1) && (i_1 = i_1) && (enc_7[u_2] = cd_1)) then
            u_1 <= N <- i_1;
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_5, info_5));
              return(AuthDecap_Some(zz_11))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_10, x1_1))
      ))


Applying simplify
  - Simplification pass
    - Replaced ((E_1[u_2] = pk_S_1) && (i_1 = i_1) && (enc_7[u_2] = cd_1)) with ((E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1)) at 164
yields

Game 37 is
      Ostart() :=
      key_extr_10 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          E_2: G_t <- exp(g, sk_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          z_5 <-R Z_t;
          pkE_10: G_t <- exp(g, z_5);
          dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
          enc_8: bitstring <- Serialize(pkE_10);
          pkS_4: G_t <- exp(g, sk_1);
          kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
          key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
          info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
          zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_4, info_4));
          return(AuthEncap_tuple(zz_10, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2], E_2[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            u_1 <= N <- i_1;
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_5, info_5));
              return(AuthDecap_Some(zz_11))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_10, x1_1))
      ))


Applying remove assignments of findcond
  - Remove assignments on u_1 (definition removed, all usages removed)
  - Remove assignments on E_2 (definition removed, all usages removed)
yields

Game 38 is
      Ostart() :=
      key_extr_10 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
  {55}    z_5 <-R Z_t;
          pkE_10: G_t <- exp(g, z_5);
          dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
          enc_8: bitstring <- Serialize(pkE_10);
          pkS_4: G_t <- exp(g, sk_1);
          kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
          key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
          info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
          zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_4, info_4));
          return(AuthEncap_tuple(zz_10, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_5, info_5));
              return(AuthDecap_Some(zz_11))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        return(ExtractAndExpand_inner(key_extr_10, x1_1))
      ))


Applying insert instruction find i2 <= N suchthat
      defined(sk_1[i2])
      && pk_R_1 = exp(g, sk_1[i2]) then at occurrence 55
yields

Game 39 is
      Ostart() :=
      key_extr_10 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_4, info_4));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_4, info_4));
            return(AuthEncap_tuple(zz_10, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_5, info_5));
              return(AuthDecap_Some(zz_11))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
 {372}  return(ExtractAndExpand_inner(key_extr_10, x1_1))
      ))


Applying insert instruction let eae_input(
      salt: extract_salt_t,
      concatExtract(
        protocol1: label_protocol_t,
        suite1: suite_id_t,
        label1: label_extract_t,
        concatDH(dh1: G_t, dh2: G_t)),
      concatExpand(l: two_byte_t,
        protocol2: label_protocol_t,
        suite2: suite_id_t,
        label2: label_expand_t,
        concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in at occurrence 372
yields

Game 40 is
      Ostart() :=
      key_extr_10 <-R hash_key_t;
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_4, info_4));
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_4, info_4));
            return(AuthEncap_tuple(zz_10, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              zz_11: eae_output_t <- ExtractAndExpand_inner(key_extr_10, eae_input(lbytes_empty, key_5, info_5));
              return(AuthDecap_Some(zz_11))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          return(ExtractAndExpand_inner(key_extr_10, x1_1))
        else
          return(ExtractAndExpand_inner(key_extr_10, x1_1))
      ))


Applying equivalence rom(ExtractAndExpand_inner)
  - Equivalence rom(ExtractAndExpand_inner) with variables: key_extr_10 -> hk
yields

Game 41 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- (x_O_7: eae_input_t <- eae_input(lbytes_empty, key_4, info_4); {135}find [unique] u_102 = ri_98 <= Qeperuser, u_103 = ri_99 <= N suchthat defined(x_O_6[ri_98, ri_99], r_6[ri_98, ri_99]) && (x_O_7 = x_O_6[ri_98, ri_99]) then r_6[u_102, u_103] orfind u_100 = ri_96 <= Qeperuser, u_101 = ri_97 <= N suchthat defined(x_O_7[ri_96, ri_97], r_7[ri_96, ri_97]) && (x_O_7 = x_O_7[ri_96, ri_97]) then r_7[u_100, u_101] orfind u_98 = ri_94 <= Qdperuser, u_99 = ri_95 <= N suchthat defined(x_O_8[ri_94, ri_95], r_8[ri_94, ri_95]) && (x_O_7 = x_O_8[ri_94, ri_95]) then r_8[u_98, u_99] orfind u_97 = ri_93 <= Qh suchthat defined(x_O_9[ri_93], r_9[ri_93]) && (x_O_7 = x_O_9[ri_93]) then r_9[u_97] orfind u_96 = ri_92 <= Qh suchthat defined(x_O_10[ri_92], r_10[ri_92]) && {204}(x_O_7 = x_O_10[ri_92]) then r_10[u_96] else r_7 <-R eae_output_t; r_7);
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- (x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4); {307}find [unique] u_94 = ri_90 <= Qeperuser, u_95 = ri_91 <= N suchthat defined(x_O_6[ri_90, ri_91], r_6[ri_90, ri_91]) && (x_O_6 = x_O_6[ri_90, ri_91]) then r_6[u_94, u_95] orfind u_92 = ri_88 <= Qeperuser, u_93 = ri_89 <= N suchthat defined(x_O_7[ri_88, ri_89], r_7[ri_88, ri_89]) && (x_O_6 = x_O_7[ri_88, ri_89]) then r_7[u_92, u_93] orfind u_90 = ri_86 <= Qdperuser, u_91 = ri_87 <= N suchthat defined(x_O_8[ri_86, ri_87], r_8[ri_86, ri_87]) && (x_O_6 = x_O_8[ri_86, ri_87]) then r_8[u_90, u_91] orfind u_89 = ri_85 <= Qh suchthat defined(x_O_9[ri_85], r_9[ri_85]) && (x_O_6 = x_O_9[ri_85]) then r_9[u_89] orfind u_88 = ri_84 <= Qh suchthat defined(x_O_10[ri_84], r_10[ri_84]) && {376}(x_O_6 = x_O_10[ri_84]) then r_10[u_88] else r_6 <-R eae_output_t; r_6);
            return(AuthEncap_tuple(zz_10, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              zz_11: eae_output_t <- (x_O_8: eae_input_t <- eae_input(lbytes_empty, key_5, info_5); {505}find [unique] u_86 = ri_82 <= Qeperuser, u_87 = ri_83 <= N suchthat defined(x_O_6[ri_82, ri_83], r_6[ri_82, ri_83]) && (x_O_8 = x_O_6[ri_82, ri_83]) then r_6[u_86, u_87] orfind u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(x_O_7[ri_80, ri_81], r_7[ri_80, ri_81]) && (x_O_8 = x_O_7[ri_80, ri_81]) then r_7[u_84, u_85] orfind u_82 = ri_78 <= Qdperuser, u_83 = ri_79 <= N suchthat defined(x_O_8[ri_78, ri_79], r_8[ri_78, ri_79]) && (x_O_8 = x_O_8[ri_78, ri_79]) then r_8[u_82, u_83] orfind u_81 = ri_77 <= Qh suchthat defined(x_O_9[ri_77], r_9[ri_77]) && (x_O_8 = x_O_9[ri_77]) then r_9[u_81] orfind u_80 = ri_76 <= Qh suchthat defined(x_O_10[ri_76], r_10[ri_76]) && {574}(x_O_8 = x_O_10[ri_76]) then r_10[u_80] else r_8 <-R eae_output_t; r_8);
              return(AuthDecap_Some(zz_11))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          return((x_O_9: eae_input_t <- x1_1; {625}find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(x_O_6[ri_74, ri_75], r_6[ri_74, ri_75]) && (x_O_9 = x_O_6[ri_74, ri_75]) then r_6[u_78, u_79] orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(x_O_7[ri_72, ri_73], r_7[ri_72, ri_73]) && (x_O_9 = x_O_7[ri_72, ri_73]) then r_7[u_76, u_77] orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(x_O_8[ri_70, ri_71], r_8[ri_70, ri_71]) && (x_O_9 = x_O_8[ri_70, ri_71]) then r_8[u_74, u_75] orfind u_73 = ri_69 <= Qh suchthat defined(x_O_9[ri_69], r_9[ri_69]) && (x_O_9 = x_O_9[ri_69]) then r_9[u_73] orfind u_72 = ri_68 <= Qh suchthat defined(x_O_10[ri_68], r_10[ri_68]) && {683}(x_O_9 = x_O_10[ri_68]) then r_10[u_72] else r_9 <-R eae_output_t; r_9))
        else
          return((x_O_10: eae_input_t <- x1_1; {700}find [unique] u_70 = ri_66 <= Qeperuser, u_71 = ri_67 <= N suchthat defined(x_O_6[ri_66, ri_67], r_6[ri_66, ri_67]) && {705}(x_O_10 = x_O_6[ri_66, ri_67]) then r_6[u_70, u_71] orfind u_68 = ri_64 <= Qeperuser, u_69 = ri_65 <= N suchthat defined(x_O_7[ri_64, ri_65], r_7[ri_64, ri_65]) && {720}(x_O_10 = x_O_7[ri_64, ri_65]) then r_7[u_68, u_69] orfind u_66 = ri_62 <= Qdperuser, u_67 = ri_63 <= N suchthat defined(x_O_8[ri_62, ri_63], r_8[ri_62, ri_63]) && {735}(x_O_10 = x_O_8[ri_62, ri_63]) then r_8[u_66, u_67] orfind u_65 = ri_61 <= Qh suchthat defined(x_O_9[ri_61], r_9[ri_61]) && {748}(x_O_10 = x_O_9[ri_61]) then r_9[u_65] orfind u_64 = ri_60 <= Qh suchthat defined(x_O_10[ri_60], r_10[ri_60]) && (x_O_10 = x_O_10[ri_60]) then r_10[u_64] else r_10 <-R eae_output_t; r_10))
      ))


Applying simplify (non-expanded game) [probability (#OAEncap^2 + N^2) * PCollKey]
  - Simplification pass
    - Replaced (x_O_7 = x_O_10[ri_92]) with false at 204
    - Remove branch 5 in find at 135
    - Replaced (x_O_6 = x_O_10[ri_84]) with false at 376
    - Remove branch 5 in find at 307
    - Replaced (x_O_8 = x_O_10[ri_76]) with false at 574
    - Remove branch 5 in find at 505
    - Replaced (x_O_9 = x_O_10[ri_68]) with false at 683
    - Remove branch 5 in find at 625
    - Replaced (x_O_10 = x_O_9[ri_61]) with false at 748
    - Remove branch 4 in find at 700
    - Replaced (x_O_10 = x_O_8[ri_62, ri_63]) with false at 735
    - Remove branch 3 in find at 700
    - Replaced (x_O_10 = x_O_7[ri_64, ri_65]) with false at 720
    - Remove branch 2 in find at 700
    - Replaced (x_O_10 = x_O_6[ri_66, ri_67]) with false at 705
    - Remove branch 1 in find at 700
yields

Game 42 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- (x_O_7: eae_input_t <- eae_input(lbytes_empty, key_4, info_4); {135}find [unique] u_102 = ri_98 <= Qeperuser, u_103 = ri_99 <= N suchthat defined(x_O_6[ri_98, ri_99], r_6[ri_98, ri_99]) && (x_O_7 = x_O_6[ri_98, ri_99]) then r_6[u_102, u_103] orfind u_100 = ri_96 <= Qeperuser, u_101 = ri_97 <= N suchthat defined(x_O_7[ri_96, ri_97], r_7[ri_96, ri_97]) && (x_O_7 = x_O_7[ri_96, ri_97]) then r_7[u_100, u_101] orfind u_98 = ri_94 <= Qdperuser, u_99 = ri_95 <= N suchthat defined(x_O_8[ri_94, ri_95], r_8[ri_94, ri_95]) && (x_O_7 = x_O_8[ri_94, ri_95]) then r_8[u_98, u_99] orfind u_97 = ri_93 <= Qh suchthat defined(x_O_9[ri_93], r_9[ri_93]) && (x_O_7 = x_O_9[ri_93]) then r_9[u_97] else r_7 <-R eae_output_t; r_7);
            return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            zz_10: eae_output_t <- (x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4); {295}find [unique] u_94 = ri_90 <= Qeperuser, u_95 = ri_91 <= N suchthat defined(x_O_6[ri_90, ri_91], r_6[ri_90, ri_91]) && (x_O_6 = x_O_6[ri_90, ri_91]) then r_6[u_94, u_95] orfind u_92 = ri_88 <= Qeperuser, u_93 = ri_89 <= N suchthat defined(x_O_7[ri_88, ri_89], r_7[ri_88, ri_89]) && (x_O_6 = x_O_7[ri_88, ri_89]) then r_7[u_92, u_93] orfind u_90 = ri_86 <= Qdperuser, u_91 = ri_87 <= N suchthat defined(x_O_8[ri_86, ri_87], r_8[ri_86, ri_87]) && (x_O_6 = x_O_8[ri_86, ri_87]) then r_8[u_90, u_91] orfind u_89 = ri_85 <= Qh suchthat defined(x_O_9[ri_85], r_9[ri_85]) && (x_O_6 = x_O_9[ri_85]) then r_9[u_89] else r_6 <-R eae_output_t; r_6);
            return(AuthEncap_tuple(zz_10, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              zz_11: eae_output_t <- (x_O_8: eae_input_t <- eae_input(lbytes_empty, key_5, info_5); {481}find [unique] u_86 = ri_82 <= Qeperuser, u_87 = ri_83 <= N suchthat defined(x_O_6[ri_82, ri_83], r_6[ri_82, ri_83]) && (x_O_8 = x_O_6[ri_82, ri_83]) then r_6[u_86, u_87] orfind u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(x_O_7[ri_80, ri_81], r_7[ri_80, ri_81]) && (x_O_8 = x_O_7[ri_80, ri_81]) then r_7[u_84, u_85] orfind u_82 = ri_78 <= Qdperuser, u_83 = ri_79 <= N suchthat defined(x_O_8[ri_78, ri_79], r_8[ri_78, ri_79]) && (x_O_8 = x_O_8[ri_78, ri_79]) then r_8[u_82, u_83] orfind u_81 = ri_77 <= Qh suchthat defined(x_O_9[ri_77], r_9[ri_77]) && (x_O_8 = x_O_9[ri_77]) then r_9[u_81] else r_8 <-R eae_output_t; r_8);
              return(AuthDecap_Some(zz_11))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          return((x_O_9: eae_input_t <- x1_1; find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(x_O_6[ri_74, ri_75], r_6[ri_74, ri_75]) && (x_O_9 = x_O_6[ri_74, ri_75]) then r_6[u_78, u_79] orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(x_O_7[ri_72, ri_73], r_7[ri_72, ri_73]) && (x_O_9 = x_O_7[ri_72, ri_73]) then r_7[u_76, u_77] orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(x_O_8[ri_70, ri_71], r_8[ri_70, ri_71]) && (x_O_9 = x_O_8[ri_70, ri_71]) then r_8[u_74, u_75] orfind u_73 = ri_69 <= Qh suchthat defined(x_O_9[ri_69], r_9[ri_69]) && (x_O_9 = x_O_9[ri_69]) then r_9[u_73] else r_9 <-R eae_output_t; r_9))
        else
          return((x_O_10: eae_input_t <- x1_1; find [unique] u_64 = ri_60 <= Qh suchthat defined(x_O_10[ri_60], r_10[ri_60]) && (x_O_10 = x_O_10[ri_60]) then r_10[u_64] else r_10 <-R eae_output_t; r_10))
      ))


Applying expand [probability (#OAEncap^2 + #OAEncap * N + N^2) * PCollKey]
  - Expand if/find/let
    - Remove branch 1 in find at 481
    - Remove branch 3 in find at 295
    - Remove branch 2 in find at 295
    - Remove branch 1 in find at 295
    - Remove branch 2 in find at 135
    - Remove branch 1 in find at 135
yields

Game 43 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_7: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
            find [unique] u_98 = ri_94 <= Qdperuser, u_99 = ri_95 <= N suchthat defined(x_O_8[ri_94, ri_95], r_8[ri_94, ri_95]) && (x_O_7 = x_O_8[ri_94, ri_95]) then
              zz_10: eae_output_t <- r_8[u_98, u_99];
              return(AuthEncap_tuple(zz_10, enc_8))
            orfind u_97 = ri_93 <= Qh suchthat defined(x_O_9[ri_93], r_9[ri_93]) && (x_O_7 = x_O_9[ri_93]) then
              zz_10: eae_output_t <- r_9[u_97];
              return(AuthEncap_tuple(zz_10, enc_8))
            else
              r_7 <-R eae_output_t;
              zz_10: eae_output_t <- r_7;
              return(AuthEncap_tuple(zz_10, enc_8))
          else
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
            find [unique] u_89 = ri_85 <= Qh suchthat defined(x_O_9[ri_85], r_9[ri_85]) && (x_O_6 = x_O_9[ri_85]) then
              zz_10: eae_output_t <- r_9[u_89];
              return(AuthEncap_tuple(zz_10, enc_8))
            else
              r_6 <-R eae_output_t;
              zz_10: eae_output_t <- r_6;
              return(AuthEncap_tuple(zz_10, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              x_O_8: eae_input_t <- eae_input(lbytes_empty, key_5, info_5);
              find [unique] u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(x_O_7[ri_80, ri_81], r_7[ri_80, ri_81]) && (x_O_8 = x_O_7[ri_80, ri_81]) then
                zz_11: eae_output_t <- r_7[u_84, u_85];
                return(AuthDecap_Some(zz_11))
              orfind u_82 = ri_78 <= Qdperuser, u_83 = ri_79 <= N suchthat defined(x_O_8[ri_78, ri_79], r_8[ri_78, ri_79]) && (x_O_8 = x_O_8[ri_78, ri_79]) then
                zz_11: eae_output_t <- r_8[u_82, u_83];
                return(AuthDecap_Some(zz_11))
              orfind u_81 = ri_77 <= Qh suchthat defined(x_O_9[ri_77], r_9[ri_77]) && (x_O_8 = x_O_9[ri_77]) then
                zz_11: eae_output_t <- r_9[u_81];
                return(AuthDecap_Some(zz_11))
              else
                r_8 <-R eae_output_t;
                zz_11: eae_output_t <- r_8;
                return(AuthDecap_Some(zz_11))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          x_O_9: eae_input_t <- x1_1;
          find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(x_O_6[ri_74, ri_75], r_6[ri_74, ri_75]) && (x_O_9 = x_O_6[ri_74, ri_75]) then
            return(r_6[u_78, u_79])
          orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(x_O_7[ri_72, ri_73], r_7[ri_72, ri_73]) && (x_O_9 = x_O_7[ri_72, ri_73]) then
            return(r_7[u_76, u_77])
          orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(x_O_8[ri_70, ri_71], r_8[ri_70, ri_71]) && (x_O_9 = x_O_8[ri_70, ri_71]) then
            return(r_8[u_74, u_75])
          orfind u_73 = ri_69 <= Qh suchthat defined(x_O_9[ri_69], r_9[ri_69]) && (x_O_9 = x_O_9[ri_69]) then
            return(r_9[u_73])
          else
            r_9 <-R eae_output_t;
            return(r_9)
        else
          x_O_10: eae_input_t <- x1_1;
          find [unique] u_64 = ri_60 <= Qh suchthat defined(x_O_10[ri_60], r_10[ri_60]) && (x_O_10 = x_O_10[ri_60]) then
            return(r_10[u_64])
          else
            r_10 <-R eae_output_t;
            return(r_10)
      ))


Applying remove assignments of findcond
  - Remove assignments on x_O_10 (definition point kept, all usages removed)
  - Remove assignments on x_O_9 (definition point kept, all usages removed)
  - Remove assignments on zz_11 (definition removed, all usages removed)
  - Remove assignments on zz_11 (definition removed, all usages removed)
  - Remove assignments on zz_11 (definition removed, all usages removed)
  - Remove assignments on zz_11 (definition removed, all usages removed)
  - Remove assignments on zz_10 (definition removed, all usages removed)
  - Remove assignments on zz_10 (definition removed, all usages removed)
  - Remove assignments on zz_10 (definition removed, all usages removed)
  - Remove assignments on zz_10 (definition removed, all usages removed)
  - Remove assignments on zz_10 (definition removed, all usages removed)
yields

Game 44 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- {72}concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_7: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
 {134}      find [unique] u_98 = ri_94 <= Qdperuser, u_99 = ri_95 <= N suchthat defined(x_O_8[ri_94, ri_95], r_8[ri_94, ri_95]) && {139}(x_O_7 = x_O_8[ri_94, ri_95]) then
              return(AuthEncap_tuple(r_8[u_98, u_99], enc_8))
            orfind u_97 = ri_93 <= Qh suchthat defined(x1_1[ri_93], x_O_9[ri_93], r_9[ri_93]) && {163}(x_O_7 = x1_1[ri_93]) then
              return(AuthEncap_tuple(r_9[u_97], enc_8))
            else
              r_7 <-R eae_output_t;
              return(AuthEncap_tuple(r_7, enc_8))
          else
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
 {269}      find [unique] u_89 = ri_85 <= Qh suchthat defined(x1_1[ri_85], x_O_9[ri_85], r_9[ri_85]) && {273}(x_O_6 = x1_1[ri_85]) then
              return(AuthEncap_tuple(r_9[u_89], enc_8))
            else
              r_6 <-R eae_output_t;
              return(AuthEncap_tuple(r_6, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              x_O_8: eae_input_t <- eae_input(lbytes_empty, key_5, info_5);
 {405}        find [unique] u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(x_O_7[ri_80, ri_81], r_7[ri_80, ri_81]) && {410}(x_O_8 = x_O_7[ri_80, ri_81]) then
                return(AuthDecap_Some(r_7[u_84, u_85]))
              orfind u_82 = ri_78 <= Qdperuser, u_83 = ri_79 <= N suchthat defined(x_O_8[ri_78, ri_79], r_8[ri_78, ri_79]) && {432}(x_O_8 = x_O_8[ri_78, ri_79]) then
                return(AuthDecap_Some(r_8[u_82, u_83]))
              orfind u_81 = ri_77 <= Qh suchthat defined(x1_1[ri_77], x_O_9[ri_77], r_9[ri_77]) && {453}(x_O_8 = x1_1[ri_77]) then
                return(AuthDecap_Some(r_9[u_81]))
              else
                r_8 <-R eae_output_t;
                return(AuthDecap_Some(r_8))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          x_O_9: eae_input_t <- cst_eae_input_t;
 {502}    find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(x_O_6[ri_74, ri_75], r_6[ri_74, ri_75]) && {507}(x1_1 = x_O_6[ri_74, ri_75]) then
            return(r_6[u_78, u_79])
          orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(x_O_7[ri_72, ri_73], r_7[ri_72, ri_73]) && {525}(x1_1 = x_O_7[ri_72, ri_73]) then
            return(r_7[u_76, u_77])
          orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(x_O_8[ri_70, ri_71], r_8[ri_70, ri_71]) && {543}(x1_1 = x_O_8[ri_70, ri_71]) then
            return(r_8[u_74, u_75])
          orfind u_73 = ri_69 <= Qh suchthat defined(x1_1[ri_69], x_O_9[ri_69], r_9[ri_69]) && {560}(x1_1 = x1_1[ri_69]) then
            return(r_9[u_73])
          else
            r_9 <-R eae_output_t;
            return(r_9)
        else
          x_O_10: eae_input_t <- cst_eae_input_t;
 {580}    find [unique] u_64 = ri_60 <= Qh suchthat defined(x1_1[ri_60], x_O_10[ri_60], r_10[ri_60]) && (x1_1 = x1_1[ri_60]) then
            return(r_10[u_64])
          else
            r_10 <-R eae_output_t;
            return(r_10)
      ))


Applying simplify [probability N^2 * PCollKey]
  - Simplification pass
    - Replaced defined condition x1_1[ri_60], x_O_10[ri_60], r_10[ri_60] with r_10[ri_60], x1_1[ri_60] in find at 580
    - Replaced (x1_1 = x1_1[ri_69]) with ((pkS'' = pkS''[ri_69]) && (pkR'' = pkR''[ri_69]) && (pkE'' = pkE''[ri_69]) && (label2_1 = label2_1[ri_69]) && (suite2_1 = suite2_1[ri_69]) && (protocol2_1 = protocol2_1[ri_69]) && (l_1 = l_1[ri_69]) && (dh2_1 = dh2_1[ri_69]) && (dh1_1 = dh1_1[ri_69]) && (label1_1 = label1_1[ri_69]) && (suite1_1 = suite1_1[ri_69]) && (protocol1_1 = protocol1_1[ri_69]) && (salt_1 = salt_1[ri_69])) at 560
    - Replaced defined condition x1_1[ri_69], x_O_9[ri_69], r_9[ri_69] with r_9[ri_69], salt_1[ri_69], protocol1_1[ri_69], suite1_1[ri_69], label1_1[ri_69], dh1_1[ri_69], dh2_1[ri_69], l_1[ri_69], protocol2_1[ri_69], suite2_1[ri_69], label2_1[ri_69], pkE''[ri_69], pkR''[ri_69], pkS''[ri_69] in find at 502
    - Replaced (x1_1 = x_O_8[ri_70, ri_71]) with ((pkS'' = pk_S_1[ri_70, ri_71]) && (pkR'' = pkR_5[ri_70, ri_71]) && (pkE'' = pkE_11[ri_70, ri_71]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_70, ri_71], sk_1[ri_71])) && (dh1_1 = exp(pkE_11[ri_70, ri_71], sk_1[ri_71])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty)) at 543
    - Replaced defined condition x_O_8[ri_70, ri_71], r_8[ri_70, ri_71] with r_8[ri_70, ri_71], sk_1[ri_71], pkE_11[ri_70, ri_71], pkR_5[ri_70, ri_71], pk_S_1[ri_70, ri_71] in find at 502
    - Replaced (x1_1 = x_O_7[ri_72, ri_73]) with ((pkS'' = pkS_4[ri_72, ri_73]) && (pkR'' = pk_R_1[ri_72, ri_73]) && (pkE'' = pkE_10[ri_72, ri_73]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], sk_1[ri_73]))) && (dh1_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], z_5[ri_72, ri_73]))) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty)) at 525
    - Replaced defined condition x_O_7[ri_72, ri_73], r_7[ri_72, ri_73] with r_7[ri_72, ri_73], z_5[ri_72, ri_73], sk_1[ri_73], sk_1[i2_952[ri_72, ri_73]], pkE_10[ri_72, ri_73], pk_R_1[ri_72, ri_73], pkS_4[ri_72, ri_73] in find at 502
    - Replaced (x1_1 = x_O_6[ri_74, ri_75]) with ((pkS'' = pkS_4[ri_74, ri_75]) && (pkR'' = pk_R_1[ri_74, ri_75]) && (pkE'' = pkE_10[ri_74, ri_75]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_74, ri_75], sk_1[ri_75])) && (dh1_1 = exp(pk_R_1[ri_74, ri_75], z_5[ri_74, ri_75])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty)) at 507
    - Replaced defined condition x_O_6[ri_74, ri_75], r_6[ri_74, ri_75] with r_6[ri_74, ri_75], z_5[ri_74, ri_75], sk_1[ri_75], pkE_10[ri_74, ri_75], pk_R_1[ri_74, ri_75], pkS_4[ri_74, ri_75] in find at 502
    - Replaced (x_O_8 = x1_1[ri_77]) with ((pk_S_1 = pkS''[ri_77]) && (pkR_5 = pkR''[ri_77]) && (pkE_11 = pkE''[ri_77]) && (label_shared_secret = label2_1[ri_77]) && (suite_id = suite2_1[ri_77]) && (RFCXXXX = protocol2_1[ri_77]) && (I2OSP2(Nsecret) = l_1[ri_77]) && (exp(pk_S_1, sk_1) = dh2_1[ri_77]) && (exp(pkE_11, sk_1) = dh1_1[ri_77]) && (label_eae_prk = label1_1[ri_77]) && (suite_id = suite1_1[ri_77]) && (RFCXXXX = protocol1_1[ri_77]) && (lbytes_empty = salt_1[ri_77])) at 453
    - Replaced defined condition x1_1[ri_77], x_O_9[ri_77], r_9[ri_77] with r_9[ri_77], salt_1[ri_77], protocol1_1[ri_77], suite1_1[ri_77], label1_1[ri_77], dh1_1[ri_77], dh2_1[ri_77], l_1[ri_77], protocol2_1[ri_77], suite2_1[ri_77], label2_1[ri_77], pkE''[ri_77], pkR''[ri_77], pkS''[ri_77] in find at 405
    - Replaced (x_O_8 = x_O_8[ri_78, ri_79]) with ((pk_S_1 = pk_S_1[ri_78, ri_79]) && (i_1 = ri_79) && (pkE_11 = pkE_11[ri_78, ri_79])) at 432
    - In branch 2 of find at 405, substituting u_83 with i_1
    - Replaced defined condition x_O_8[ri_78, ri_79], r_8[ri_78, ri_79] with r_8[ri_78], pkE_11[ri_78], pk_S_1[ri_78] in find at 405
    - Replaced (x_O_8 = x_O_7[ri_80, ri_81]) with ((pk_S_1 = pkS_4[ri_80, ri_81]) && (i_1 = i2_952[ri_80, ri_81]) && (pkE_11 = pkE_10[ri_80, ri_81])) at 410
    - Replaced defined condition x_O_7[ri_80, ri_81], r_7[ri_80, ri_81] with r_7[ri_80, ri_81], pkE_10[ri_80, ri_81], i2_952[ri_80, ri_81], pkS_4[ri_80, ri_81] in find at 405
    - Replaced (x_O_6 = x1_1[ri_85]) with ((pkS_4 = pkS''[ri_85]) && (pk_R_1 = pkR''[ri_85]) && (pkE_10 = pkE''[ri_85]) && (label_shared_secret = label2_1[ri_85]) && (suite_id = suite2_1[ri_85]) && (RFCXXXX = protocol2_1[ri_85]) && (I2OSP2(Nsecret) = l_1[ri_85]) && (exp(pk_R_1, sk_1) = dh2_1[ri_85]) && (exp(pk_R_1, z_5) = dh1_1[ri_85]) && (label_eae_prk = label1_1[ri_85]) && (suite_id = suite1_1[ri_85]) && (RFCXXXX = protocol1_1[ri_85]) && (lbytes_empty = salt_1[ri_85])) at 273
    - Replaced defined condition x1_1[ri_85], x_O_9[ri_85], r_9[ri_85] with r_9[ri_85], salt_1[ri_85], protocol1_1[ri_85], suite1_1[ri_85], label1_1[ri_85], dh1_1[ri_85], dh2_1[ri_85], l_1[ri_85], protocol2_1[ri_85], suite2_1[ri_85], label2_1[ri_85], pkE''[ri_85], pkR''[ri_85], pkS''[ri_85] in find at 269
    - Replaced concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1)) with concatDH(exp(g, mult(sk_1[i2_952], z_5)), exp(g, mult(sk_1[i2_952], sk_1))) at 72
    - Replaced (x_O_7 = x1_1[ri_93]) with ((pkS_4 = pkS''[ri_93]) && (pk_R_1 = pkR''[ri_93]) && (pkE_10 = pkE''[ri_93]) && (label_shared_secret = label2_1[ri_93]) && (suite_id = suite2_1[ri_93]) && (RFCXXXX = protocol2_1[ri_93]) && (I2OSP2(Nsecret) = l_1[ri_93]) && (exp(g, mult(sk_1[i2_952], sk_1)) = dh2_1[ri_93]) && (exp(g, mult(sk_1[i2_952], z_5)) = dh1_1[ri_93]) && (label_eae_prk = label1_1[ri_93]) && (suite_id = suite1_1[ri_93]) && (RFCXXXX = protocol1_1[ri_93]) && (lbytes_empty = salt_1[ri_93])) at 163
    - Replaced defined condition x1_1[ri_93], x_O_9[ri_93], r_9[ri_93] with r_9[ri_93], salt_1[ri_93], protocol1_1[ri_93], suite1_1[ri_93], label1_1[ri_93], dh1_1[ri_93], dh2_1[ri_93], l_1[ri_93], protocol2_1[ri_93], suite2_1[ri_93], label2_1[ri_93], pkE''[ri_93], pkR''[ri_93], pkS''[ri_93] in find at 134
    - Replaced (x_O_7 = x_O_8[ri_94, ri_95]) with ((pkS_4 = pk_S_1[ri_94, ri_95]) && (i2_952 = ri_95) && (pkE_10 = pkE_11[ri_94, ri_95])) at 139
    - In branch 1 of find at 134, substituting u_99 with i2_952
    - Replaced defined condition x_O_8[ri_94, ri_95], r_8[ri_94, ri_95] with r_8[ri_94, i2_952], pkE_11[ri_94, i2_952], pk_S_1[ri_94, i2_952] in find at 134
yields

Game 45 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk_1[i2_952], z_5)), exp(g, mult(sk_1[i2_952], sk_1)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_7: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
            find [unique] u_98 = ri_94 <= Qdperuser suchthat defined(r_8[ri_94, i2_952], pkE_11[ri_94, i2_952], pk_S_1[ri_94, i2_952]) && {153}((pkS_4 = pk_S_1[ri_94, i2_952]) && (i2_952 = i2_952) && (pkE_10 = pkE_11[ri_94, i2_952])) then
              u_99 <= N <- i2_952;
              return(AuthEncap_tuple(r_8[u_98, i2_952], enc_8))
            orfind u_97 = ri_93 <= Qh suchthat defined(r_9[ri_93], salt_1[ri_93], protocol1_1[ri_93], suite1_1[ri_93], label1_1[ri_93], dh1_1[ri_93], dh2_1[ri_93], l_1[ri_93], protocol2_1[ri_93], suite2_1[ri_93], label2_1[ri_93], pkE''[ri_93], pkR''[ri_93], pkS''[ri_93]) && (pkS_4 = pkS''[ri_93]) && (pk_R_1 = pkR''[ri_93]) && (pkE_10 = pkE''[ri_93]) && (label_shared_secret = label2_1[ri_93]) && (suite_id = suite2_1[ri_93]) && (RFCXXXX = protocol2_1[ri_93]) && (I2OSP2(Nsecret) = l_1[ri_93]) && (exp(g, mult(sk_1[i2_952], sk_1)) = dh2_1[ri_93]) && (exp(g, mult(sk_1[i2_952], z_5)) = dh1_1[ri_93]) && (label_eae_prk = label1_1[ri_93]) && (suite_id = suite1_1[ri_93]) && (RFCXXXX = protocol1_1[ri_93]) && (lbytes_empty = salt_1[ri_93]) then
              return(AuthEncap_tuple(r_9[u_97], enc_8))
            else
              r_7 <-R eae_output_t;
              return(AuthEncap_tuple(r_7, enc_8))
          else
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
            find [unique] u_89 = ri_85 <= Qh suchthat defined(r_9[ri_85], salt_1[ri_85], protocol1_1[ri_85], suite1_1[ri_85], label1_1[ri_85], dh1_1[ri_85], dh2_1[ri_85], l_1[ri_85], protocol2_1[ri_85], suite2_1[ri_85], label2_1[ri_85], pkE''[ri_85], pkR''[ri_85], pkS''[ri_85]) && (pkS_4 = pkS''[ri_85]) && (pk_R_1 = pkR''[ri_85]) && (pkE_10 = pkE''[ri_85]) && (label_shared_secret = label2_1[ri_85]) && (suite_id = suite2_1[ri_85]) && (RFCXXXX = protocol2_1[ri_85]) && (I2OSP2(Nsecret) = l_1[ri_85]) && (exp(pk_R_1, sk_1) = dh2_1[ri_85]) && (exp(pk_R_1, z_5) = dh1_1[ri_85]) && (label_eae_prk = label1_1[ri_85]) && (suite_id = suite1_1[ri_85]) && (RFCXXXX = protocol1_1[ri_85]) && (lbytes_empty = salt_1[ri_85]) then
              return(AuthEncap_tuple(r_9[u_89], enc_8))
            else
              r_6 <-R eae_output_t;
              return(AuthEncap_tuple(r_6, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              x_O_8: eae_input_t <- eae_input(lbytes_empty, key_5, info_5);
              find [unique] u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(r_7[ri_80, ri_81], pkE_10[ri_80, ri_81], i2_952[ri_80, ri_81], pkS_4[ri_80, ri_81]) && (pk_S_1 = pkS_4[ri_80, ri_81]) && (i_1 = i2_952[ri_80, ri_81]) && (pkE_11 = pkE_10[ri_80, ri_81]) then
                return(AuthDecap_Some(r_7[u_84, u_85]))
              orfind u_82 = ri_78 <= Qdperuser suchthat defined(r_8[ri_78], pkE_11[ri_78], pk_S_1[ri_78]) && {671}((pk_S_1 = pk_S_1[ri_78]) && (i_1 = i_1) && (pkE_11 = pkE_11[ri_78])) then
                u_83 <= N <- i_1;
                return(AuthDecap_Some(r_8[u_82]))
              orfind u_81 = ri_77 <= Qh suchthat defined(r_9[ri_77], salt_1[ri_77], protocol1_1[ri_77], suite1_1[ri_77], label1_1[ri_77], dh1_1[ri_77], dh2_1[ri_77], l_1[ri_77], protocol2_1[ri_77], suite2_1[ri_77], label2_1[ri_77], pkE''[ri_77], pkR''[ri_77], pkS''[ri_77]) && (pk_S_1 = pkS''[ri_77]) && (pkR_5 = pkR''[ri_77]) && (pkE_11 = pkE''[ri_77]) && (label_shared_secret = label2_1[ri_77]) && (suite_id = suite2_1[ri_77]) && (RFCXXXX = protocol2_1[ri_77]) && (I2OSP2(Nsecret) = l_1[ri_77]) && (exp(pk_S_1, sk_1) = dh2_1[ri_77]) && (exp(pkE_11, sk_1) = dh1_1[ri_77]) && (label_eae_prk = label1_1[ri_77]) && (suite_id = suite1_1[ri_77]) && (RFCXXXX = protocol1_1[ri_77]) && (lbytes_empty = salt_1[ri_77]) then
                return(AuthDecap_Some(r_9[u_81]))
              else
                r_8 <-R eae_output_t;
                return(AuthDecap_Some(r_8))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          x_O_9: eae_input_t <- cst_eae_input_t;
          find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(r_6[ri_74, ri_75], z_5[ri_74, ri_75], sk_1[ri_75], pkE_10[ri_74, ri_75], pk_R_1[ri_74, ri_75], pkS_4[ri_74, ri_75]) && (pkS'' = pkS_4[ri_74, ri_75]) && (pkR'' = pk_R_1[ri_74, ri_75]) && (pkE'' = pkE_10[ri_74, ri_75]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_74, ri_75], sk_1[ri_75])) && (dh1_1 = exp(pk_R_1[ri_74, ri_75], z_5[ri_74, ri_75])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_78, u_79])
          orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(r_7[ri_72, ri_73], z_5[ri_72, ri_73], sk_1[ri_73], sk_1[i2_952[ri_72, ri_73]], pkE_10[ri_72, ri_73], pk_R_1[ri_72, ri_73], pkS_4[ri_72, ri_73]) && (pkS'' = pkS_4[ri_72, ri_73]) && (pkR'' = pk_R_1[ri_72, ri_73]) && (pkE'' = pkE_10[ri_72, ri_73]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], sk_1[ri_73]))) && (dh1_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], z_5[ri_72, ri_73]))) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_7[u_76, u_77])
          orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(r_8[ri_70, ri_71], sk_1[ri_71], pkE_11[ri_70, ri_71], pkR_5[ri_70, ri_71], pk_S_1[ri_70, ri_71]) && (pkS'' = pk_S_1[ri_70, ri_71]) && (pkR'' = pkR_5[ri_70, ri_71]) && (pkE'' = pkE_11[ri_70, ri_71]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_70, ri_71], sk_1[ri_71])) && (dh1_1 = exp(pkE_11[ri_70, ri_71], sk_1[ri_71])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_8[u_74, u_75])
          orfind u_73 = ri_69 <= Qh suchthat defined(r_9[ri_69], salt_1[ri_69], protocol1_1[ri_69], suite1_1[ri_69], label1_1[ri_69], dh1_1[ri_69], dh2_1[ri_69], l_1[ri_69], protocol2_1[ri_69], suite2_1[ri_69], label2_1[ri_69], pkE''[ri_69], pkR''[ri_69], pkS''[ri_69]) && (pkS'' = pkS''[ri_69]) && (pkR'' = pkR''[ri_69]) && (pkE'' = pkE''[ri_69]) && (label2_1 = label2_1[ri_69]) && (suite2_1 = suite2_1[ri_69]) && (protocol2_1 = protocol2_1[ri_69]) && (l_1 = l_1[ri_69]) && (dh2_1 = dh2_1[ri_69]) && (dh1_1 = dh1_1[ri_69]) && (label1_1 = label1_1[ri_69]) && (suite1_1 = suite1_1[ri_69]) && (protocol1_1 = protocol1_1[ri_69]) && (salt_1 = salt_1[ri_69]) then
            return(r_9[u_73])
          else
            r_9 <-R eae_output_t;
            return(r_9)
        else
          x_O_10: eae_input_t <- cst_eae_input_t;
          find [unique] u_64 = ri_60 <= Qh suchthat defined(r_10[ri_60], x1_1[ri_60]) && (x1_1 = x1_1[ri_60]) then
            return(r_10[u_64])
          else
            r_10 <-R eae_output_t;
            return(r_10)
      ))


Applying simplify
  - Simplification pass
    - Replaced ((pk_S_1 = pk_S_1[ri_78]) && (i_1 = i_1) && (pkE_11 = pkE_11[ri_78])) with ((pk_S_1 = pk_S_1[ri_78]) && (pkE_11 = pkE_11[ri_78])) at 671
    - Replaced ((pkS_4 = pk_S_1[ri_94, i2_952]) && (i2_952 = i2_952) && (pkE_10 = pkE_11[ri_94, i2_952])) with ((pkS_4 = pk_S_1[ri_94, i2_952]) && (pkE_10 = pkE_11[ri_94, i2_952])) at 153
yields

Game 46 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk_1[i2_952], z_5)), exp(g, mult(sk_1[i2_952], sk_1)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_7: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
            find [unique] u_98 = ri_94 <= Qdperuser suchthat defined(r_8[ri_94, i2_952], pkE_11[ri_94, i2_952], pk_S_1[ri_94, i2_952]) && (pkS_4 = pk_S_1[ri_94, i2_952]) && (pkE_10 = pkE_11[ri_94, i2_952]) then
              u_99 <= N <- i2_952;
              return(AuthEncap_tuple(r_8[u_98, i2_952], enc_8))
            orfind u_97 = ri_93 <= Qh suchthat defined(r_9[ri_93], salt_1[ri_93], protocol1_1[ri_93], suite1_1[ri_93], label1_1[ri_93], dh1_1[ri_93], dh2_1[ri_93], l_1[ri_93], protocol2_1[ri_93], suite2_1[ri_93], label2_1[ri_93], pkE''[ri_93], pkR''[ri_93], pkS''[ri_93]) && (pkS_4 = pkS''[ri_93]) && (pk_R_1 = pkR''[ri_93]) && (pkE_10 = pkE''[ri_93]) && (label_shared_secret = label2_1[ri_93]) && (suite_id = suite2_1[ri_93]) && (RFCXXXX = protocol2_1[ri_93]) && (I2OSP2(Nsecret) = l_1[ri_93]) && (exp(g, mult(sk_1[i2_952], sk_1)) = dh2_1[ri_93]) && (exp(g, mult(sk_1[i2_952], z_5)) = dh1_1[ri_93]) && (label_eae_prk = label1_1[ri_93]) && (suite_id = suite1_1[ri_93]) && (RFCXXXX = protocol1_1[ri_93]) && (lbytes_empty = salt_1[ri_93]) then
              return(AuthEncap_tuple(r_9[u_97], enc_8))
            else
              r_7 <-R eae_output_t;
              return(AuthEncap_tuple(r_7, enc_8))
          else
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            kemContext_10: GGG_t <- concatContext(pkE_10, pk_R_1, pkS_4);
            key_4: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_10);
            info_4: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_10);
            x_O_6: eae_input_t <- eae_input(lbytes_empty, key_4, info_4);
            find [unique] u_89 = ri_85 <= Qh suchthat defined(r_9[ri_85], salt_1[ri_85], protocol1_1[ri_85], suite1_1[ri_85], label1_1[ri_85], dh1_1[ri_85], dh2_1[ri_85], l_1[ri_85], protocol2_1[ri_85], suite2_1[ri_85], label2_1[ri_85], pkE''[ri_85], pkR''[ri_85], pkS''[ri_85]) && (pkS_4 = pkS''[ri_85]) && (pk_R_1 = pkR''[ri_85]) && (pkE_10 = pkE''[ri_85]) && (label_shared_secret = label2_1[ri_85]) && (suite_id = suite2_1[ri_85]) && (RFCXXXX = protocol2_1[ri_85]) && (I2OSP2(Nsecret) = l_1[ri_85]) && (exp(pk_R_1, sk_1) = dh2_1[ri_85]) && (exp(pk_R_1, z_5) = dh1_1[ri_85]) && (label_eae_prk = label1_1[ri_85]) && (suite_id = suite1_1[ri_85]) && (RFCXXXX = protocol1_1[ri_85]) && (lbytes_empty = salt_1[ri_85]) then
              return(AuthEncap_tuple(r_9[u_89], enc_8))
            else
              r_6 <-R eae_output_t;
              return(AuthEncap_tuple(r_6, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              kemContext_11: GGG_t <- concatContext(pkE_11, pkR_5, pk_S_1);
              key_5: extract_key_t <- concatExtract(RFCXXXX, suite_id, label_eae_prk, dh_11);
              info_5: expand_info_t <- concatExpand(I2OSP2(Nsecret), RFCXXXX, suite_id, label_shared_secret, kemContext_11);
              x_O_8: eae_input_t <- eae_input(lbytes_empty, key_5, info_5);
              find [unique] u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(r_7[ri_80, ri_81], pkE_10[ri_80, ri_81], i2_952[ri_80, ri_81], pkS_4[ri_80, ri_81]) && (pk_S_1 = pkS_4[ri_80, ri_81]) && (i_1 = i2_952[ri_80, ri_81]) && (pkE_11 = pkE_10[ri_80, ri_81]) then
                return(AuthDecap_Some(r_7[u_84, u_85]))
              orfind u_82 = ri_78 <= Qdperuser suchthat defined(r_8[ri_78], pkE_11[ri_78], pk_S_1[ri_78]) && (pk_S_1 = pk_S_1[ri_78]) && (pkE_11 = pkE_11[ri_78]) then
                u_83 <= N <- i_1;
                return(AuthDecap_Some(r_8[u_82]))
              orfind u_81 = ri_77 <= Qh suchthat defined(r_9[ri_77], salt_1[ri_77], protocol1_1[ri_77], suite1_1[ri_77], label1_1[ri_77], dh1_1[ri_77], dh2_1[ri_77], l_1[ri_77], protocol2_1[ri_77], suite2_1[ri_77], label2_1[ri_77], pkE''[ri_77], pkR''[ri_77], pkS''[ri_77]) && (pk_S_1 = pkS''[ri_77]) && (pkR_5 = pkR''[ri_77]) && (pkE_11 = pkE''[ri_77]) && (label_shared_secret = label2_1[ri_77]) && (suite_id = suite2_1[ri_77]) && (RFCXXXX = protocol2_1[ri_77]) && (I2OSP2(Nsecret) = l_1[ri_77]) && (exp(pk_S_1, sk_1) = dh2_1[ri_77]) && (exp(pkE_11, sk_1) = dh1_1[ri_77]) && (label_eae_prk = label1_1[ri_77]) && (suite_id = suite1_1[ri_77]) && (RFCXXXX = protocol1_1[ri_77]) && (lbytes_empty = salt_1[ri_77]) then
                return(AuthDecap_Some(r_9[u_81]))
              else
                r_8 <-R eae_output_t;
                return(AuthDecap_Some(r_8))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          x_O_9: eae_input_t <- cst_eae_input_t;
          find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(r_6[ri_74, ri_75], z_5[ri_74, ri_75], sk_1[ri_75], pkE_10[ri_74, ri_75], pk_R_1[ri_74, ri_75], pkS_4[ri_74, ri_75]) && (pkS'' = pkS_4[ri_74, ri_75]) && (pkR'' = pk_R_1[ri_74, ri_75]) && (pkE'' = pkE_10[ri_74, ri_75]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_74, ri_75], sk_1[ri_75])) && (dh1_1 = exp(pk_R_1[ri_74, ri_75], z_5[ri_74, ri_75])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_78, u_79])
          orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(r_7[ri_72, ri_73], z_5[ri_72, ri_73], sk_1[ri_73], sk_1[i2_952[ri_72, ri_73]], pkE_10[ri_72, ri_73], pk_R_1[ri_72, ri_73], pkS_4[ri_72, ri_73]) && (pkS'' = pkS_4[ri_72, ri_73]) && (pkR'' = pk_R_1[ri_72, ri_73]) && (pkE'' = pkE_10[ri_72, ri_73]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], sk_1[ri_73]))) && (dh1_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], z_5[ri_72, ri_73]))) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_7[u_76, u_77])
          orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(r_8[ri_70, ri_71], sk_1[ri_71], pkE_11[ri_70, ri_71], pkR_5[ri_70, ri_71], pk_S_1[ri_70, ri_71]) && (pkS'' = pk_S_1[ri_70, ri_71]) && (pkR'' = pkR_5[ri_70, ri_71]) && (pkE'' = pkE_11[ri_70, ri_71]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_70, ri_71], sk_1[ri_71])) && (dh1_1 = exp(pkE_11[ri_70, ri_71], sk_1[ri_71])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_8[u_74, u_75])
          orfind u_73 = ri_69 <= Qh suchthat defined(r_9[ri_69], salt_1[ri_69], protocol1_1[ri_69], suite1_1[ri_69], label1_1[ri_69], dh1_1[ri_69], dh2_1[ri_69], l_1[ri_69], protocol2_1[ri_69], suite2_1[ri_69], label2_1[ri_69], pkE''[ri_69], pkR''[ri_69], pkS''[ri_69]) && (pkS'' = pkS''[ri_69]) && (pkR'' = pkR''[ri_69]) && (pkE'' = pkE''[ri_69]) && (label2_1 = label2_1[ri_69]) && (suite2_1 = suite2_1[ri_69]) && (protocol2_1 = protocol2_1[ri_69]) && (l_1 = l_1[ri_69]) && (dh2_1 = dh2_1[ri_69]) && (dh1_1 = dh1_1[ri_69]) && (label1_1 = label1_1[ri_69]) && (suite1_1 = suite1_1[ri_69]) && (protocol1_1 = protocol1_1[ri_69]) && (salt_1 = salt_1[ri_69]) then
            return(r_9[u_73])
          else
            r_9 <-R eae_output_t;
            return(r_9)
        else
          x_O_10: eae_input_t <- cst_eae_input_t;
          find [unique] u_64 = ri_60 <= Qh suchthat defined(r_10[ri_60], x1_1[ri_60]) && (x1_1 = x1_1[ri_60]) then
            return(r_10[u_64])
          else
            r_10 <-R eae_output_t;
            return(r_10)
      ))


Applying move all binders
  - Move assignment to x_O_10
  - Move assignment to x_O_9
  - Move assignment to x_O_8
  - Move assignment to info_5
  - Move assignment to key_5
  - Move assignment to kemContext_11
  - Move assignment to x_O_6
  - Move assignment to info_4
  - Move assignment to key_4
  - Move assignment to kemContext_10
  - Move assignment to x_O_7
  - Move assignment to info_4
  - Move assignment to key_4
  - Move assignment to kemContext_10
yields

Game 47 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(g, mult(sk_1[i2_952], z_5)), exp(g, mult(sk_1[i2_952], sk_1)));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_98 = ri_94 <= Qdperuser suchthat defined(r_8[ri_94, i2_952], pkE_11[ri_94, i2_952], pk_S_1[ri_94, i2_952]) && (pkS_4 = pk_S_1[ri_94, i2_952]) && (pkE_10 = pkE_11[ri_94, i2_952]) then
              u_99 <= N <- i2_952;
              return(AuthEncap_tuple(r_8[u_98, i2_952], enc_8))
            orfind u_97 = ri_93 <= Qh suchthat defined(r_9[ri_93], salt_1[ri_93], protocol1_1[ri_93], suite1_1[ri_93], label1_1[ri_93], dh1_1[ri_93], dh2_1[ri_93], l_1[ri_93], protocol2_1[ri_93], suite2_1[ri_93], label2_1[ri_93], pkE''[ri_93], pkR''[ri_93], pkS''[ri_93]) && (pkS_4 = pkS''[ri_93]) && (pk_R_1 = pkR''[ri_93]) && (pkE_10 = pkE''[ri_93]) && (label_shared_secret = label2_1[ri_93]) && (suite_id = suite2_1[ri_93]) && (RFCXXXX = protocol2_1[ri_93]) && (I2OSP2(Nsecret) = l_1[ri_93]) && (exp(g, mult(sk_1[i2_952], sk_1)) = dh2_1[ri_93]) && (exp(g, mult(sk_1[i2_952], z_5)) = dh1_1[ri_93]) && (label_eae_prk = label1_1[ri_93]) && (suite_id = suite1_1[ri_93]) && (RFCXXXX = protocol1_1[ri_93]) && (lbytes_empty = salt_1[ri_93]) then
              return(AuthEncap_tuple(r_9[u_97], enc_8))
            else
              r_7 <-R eae_output_t;
              return(AuthEncap_tuple(r_7, enc_8))
          else
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            dh_10: GG_t <- concatDH(exp(pk_R_1, z_5), exp(pk_R_1, sk_1));
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_89 = ri_85 <= Qh suchthat defined(r_9[ri_85], salt_1[ri_85], protocol1_1[ri_85], suite1_1[ri_85], label1_1[ri_85], dh1_1[ri_85], dh2_1[ri_85], l_1[ri_85], protocol2_1[ri_85], suite2_1[ri_85], label2_1[ri_85], pkE''[ri_85], pkR''[ri_85], pkS''[ri_85]) && (pkS_4 = pkS''[ri_85]) && (pk_R_1 = pkR''[ri_85]) && (pkE_10 = pkE''[ri_85]) && (label_shared_secret = label2_1[ri_85]) && (suite_id = suite2_1[ri_85]) && (RFCXXXX = protocol2_1[ri_85]) && (I2OSP2(Nsecret) = l_1[ri_85]) && (exp(pk_R_1, sk_1) = dh2_1[ri_85]) && (exp(pk_R_1, z_5) = dh1_1[ri_85]) && (label_eae_prk = label1_1[ri_85]) && (suite_id = suite1_1[ri_85]) && (RFCXXXX = protocol1_1[ri_85]) && (lbytes_empty = salt_1[ri_85]) then
              return(AuthEncap_tuple(r_9[u_89], enc_8))
            else
              r_6 <-R eae_output_t;
              return(AuthEncap_tuple(r_6, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              dh_11: GG_t <- concatDH(exp(pkE_11, sk_1), exp(pk_S_1, sk_1));
              pkR_5: G_t <- exp(g, sk_1);
              find [unique] u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(r_7[ri_80, ri_81], pkE_10[ri_80, ri_81], i2_952[ri_80, ri_81], pkS_4[ri_80, ri_81]) && (pk_S_1 = pkS_4[ri_80, ri_81]) && (i_1 = i2_952[ri_80, ri_81]) && (pkE_11 = pkE_10[ri_80, ri_81]) then
                return(AuthDecap_Some(r_7[u_84, u_85]))
              orfind u_82 = ri_78 <= Qdperuser suchthat defined(r_8[ri_78], pkE_11[ri_78], pk_S_1[ri_78]) && (pk_S_1 = pk_S_1[ri_78]) && (pkE_11 = pkE_11[ri_78]) then
                u_83 <= N <- i_1;
                return(AuthDecap_Some(r_8[u_82]))
              orfind u_81 = ri_77 <= Qh suchthat defined(r_9[ri_77], salt_1[ri_77], protocol1_1[ri_77], suite1_1[ri_77], label1_1[ri_77], dh1_1[ri_77], dh2_1[ri_77], l_1[ri_77], protocol2_1[ri_77], suite2_1[ri_77], label2_1[ri_77], pkE''[ri_77], pkR''[ri_77], pkS''[ri_77]) && (pk_S_1 = pkS''[ri_77]) && (pkR_5 = pkR''[ri_77]) && (pkE_11 = pkE''[ri_77]) && (label_shared_secret = label2_1[ri_77]) && (suite_id = suite2_1[ri_77]) && (RFCXXXX = protocol2_1[ri_77]) && (I2OSP2(Nsecret) = l_1[ri_77]) && (exp(pk_S_1, sk_1) = dh2_1[ri_77]) && (exp(pkE_11, sk_1) = dh1_1[ri_77]) && (label_eae_prk = label1_1[ri_77]) && (suite_id = suite1_1[ri_77]) && (RFCXXXX = protocol1_1[ri_77]) && (lbytes_empty = salt_1[ri_77]) then
                return(AuthDecap_Some(r_9[u_81]))
              else
                r_8 <-R eae_output_t;
                return(AuthDecap_Some(r_8))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(r_6[ri_74, ri_75], z_5[ri_74, ri_75], sk_1[ri_75], pkE_10[ri_74, ri_75], pk_R_1[ri_74, ri_75], pkS_4[ri_74, ri_75]) && (pkS'' = pkS_4[ri_74, ri_75]) && (pkR'' = pk_R_1[ri_74, ri_75]) && (pkE'' = pkE_10[ri_74, ri_75]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_74, ri_75], sk_1[ri_75])) && (dh1_1 = exp(pk_R_1[ri_74, ri_75], z_5[ri_74, ri_75])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_78, u_79])
          orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(r_7[ri_72, ri_73], z_5[ri_72, ri_73], sk_1[ri_73], sk_1[i2_952[ri_72, ri_73]], pkE_10[ri_72, ri_73], pk_R_1[ri_72, ri_73], pkS_4[ri_72, ri_73]) && (pkS'' = pkS_4[ri_72, ri_73]) && (pkR'' = pk_R_1[ri_72, ri_73]) && (pkE'' = pkE_10[ri_72, ri_73]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], sk_1[ri_73]))) && (dh1_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], z_5[ri_72, ri_73]))) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_7[u_76, u_77])
          orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(r_8[ri_70, ri_71], sk_1[ri_71], pkE_11[ri_70, ri_71], pkR_5[ri_70, ri_71], pk_S_1[ri_70, ri_71]) && (pkS'' = pk_S_1[ri_70, ri_71]) && (pkR'' = pkR_5[ri_70, ri_71]) && (pkE'' = pkE_11[ri_70, ri_71]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_70, ri_71], sk_1[ri_71])) && (dh1_1 = exp(pkE_11[ri_70, ri_71], sk_1[ri_71])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_8[u_74, u_75])
          orfind u_73 = ri_69 <= Qh suchthat defined(r_9[ri_69], salt_1[ri_69], protocol1_1[ri_69], suite1_1[ri_69], label1_1[ri_69], dh1_1[ri_69], dh2_1[ri_69], l_1[ri_69], protocol2_1[ri_69], suite2_1[ri_69], label2_1[ri_69], pkE''[ri_69], pkR''[ri_69], pkS''[ri_69]) && (pkS'' = pkS''[ri_69]) && (pkR'' = pkR''[ri_69]) && (pkE'' = pkE''[ri_69]) && (label2_1 = label2_1[ri_69]) && (suite2_1 = suite2_1[ri_69]) && (protocol2_1 = protocol2_1[ri_69]) && (l_1 = l_1[ri_69]) && (dh2_1 = dh2_1[ri_69]) && (dh1_1 = dh1_1[ri_69]) && (label1_1 = label1_1[ri_69]) && (suite1_1 = suite1_1[ri_69]) && (protocol1_1 = protocol1_1[ri_69]) && (salt_1 = salt_1[ri_69]) then
            return(r_9[u_73])
          else
            r_9 <-R eae_output_t;
            return(r_9)
        else
          find [unique] u_64 = ri_60 <= Qh suchthat defined(r_10[ri_60], x1_1[ri_60]) && (x1_1 = x1_1[ri_60]) then
            return(r_10[u_64])
          else
            r_10 <-R eae_output_t;
            return(r_10)
      ))


Applying remove assignments of findcond
  - Remove assignments on dh_11 (definition removed, all usages removed)
  - Remove assignments on u_83 (definition removed, all usages removed)
  - Remove assignments on dh_10 (definition removed, all usages removed)
  - Remove assignments on dh_10 (definition removed, all usages removed)
  - Remove assignments on u_99 (definition removed, all usages removed)
yields

Game 48 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_98 = ri_94 <= Qdperuser suchthat defined(r_8[ri_94, i2_952], pkE_11[ri_94, i2_952], pk_S_1[ri_94, i2_952]) && (pkS_4 = pk_S_1[ri_94, i2_952]) && (pkE_10 = pkE_11[ri_94, i2_952]) then
              return(AuthEncap_tuple(r_8[u_98, i2_952], enc_8))
            orfind u_97 = ri_93 <= Qh suchthat defined(r_9[ri_93], salt_1[ri_93], protocol1_1[ri_93], suite1_1[ri_93], label1_1[ri_93], dh1_1[ri_93], dh2_1[ri_93], l_1[ri_93], protocol2_1[ri_93], suite2_1[ri_93], label2_1[ri_93], pkE''[ri_93], pkR''[ri_93], pkS''[ri_93]) && (pkS_4 = pkS''[ri_93]) && (pk_R_1 = pkR''[ri_93]) && (pkE_10 = pkE''[ri_93]) && (label_shared_secret = label2_1[ri_93]) && (suite_id = suite2_1[ri_93]) && (RFCXXXX = protocol2_1[ri_93]) && (I2OSP2(Nsecret) = l_1[ri_93]) && (exp(g, mult(sk_1[i2_952], sk_1)) = dh2_1[ri_93]) && (exp(g, mult(sk_1[i2_952], z_5)) = dh1_1[ri_93]) && (label_eae_prk = label1_1[ri_93]) && (suite_id = suite1_1[ri_93]) && (RFCXXXX = protocol1_1[ri_93]) && (lbytes_empty = salt_1[ri_93]) then
              return(AuthEncap_tuple(r_9[u_97], enc_8))
            else
              r_7 <-R eae_output_t;
              return(AuthEncap_tuple(r_7, enc_8))
          else
            z_5 <-R Z_t;
            pkE_10: G_t <- exp(g, z_5);
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_89 = ri_85 <= Qh suchthat defined(r_9[ri_85], salt_1[ri_85], protocol1_1[ri_85], suite1_1[ri_85], label1_1[ri_85], dh1_1[ri_85], dh2_1[ri_85], l_1[ri_85], protocol2_1[ri_85], suite2_1[ri_85], label2_1[ri_85], pkE''[ri_85], pkR''[ri_85], pkS''[ri_85]) && (pkS_4 = pkS''[ri_85]) && (pk_R_1 = pkR''[ri_85]) && (pkE_10 = pkE''[ri_85]) && (label_shared_secret = label2_1[ri_85]) && (suite_id = suite2_1[ri_85]) && (RFCXXXX = protocol2_1[ri_85]) && (I2OSP2(Nsecret) = l_1[ri_85]) && (exp(pk_R_1, sk_1) = dh2_1[ri_85]) && (exp(pk_R_1, z_5) = dh1_1[ri_85]) && (label_eae_prk = label1_1[ri_85]) && (suite_id = suite1_1[ri_85]) && (RFCXXXX = protocol1_1[ri_85]) && (lbytes_empty = salt_1[ri_85]) then
              return(AuthEncap_tuple(r_9[u_89], enc_8))
            else
              r_6 <-R eae_output_t;
              return(AuthEncap_tuple(r_6, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              pkR_5: G_t <- exp(g, sk_1);
              find [unique] u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(r_7[ri_80, ri_81], pkE_10[ri_80, ri_81], i2_952[ri_80, ri_81], pkS_4[ri_80, ri_81]) && (pk_S_1 = pkS_4[ri_80, ri_81]) && (i_1 = i2_952[ri_80, ri_81]) && (pkE_11 = pkE_10[ri_80, ri_81]) then
                return(AuthDecap_Some(r_7[u_84, u_85]))
              orfind u_82 = ri_78 <= Qdperuser suchthat defined(r_8[ri_78], pkE_11[ri_78], pk_S_1[ri_78]) && (pk_S_1 = pk_S_1[ri_78]) && (pkE_11 = pkE_11[ri_78]) then
                return(AuthDecap_Some(r_8[u_82]))
              orfind u_81 = ri_77 <= Qh suchthat defined(r_9[ri_77], salt_1[ri_77], protocol1_1[ri_77], suite1_1[ri_77], label1_1[ri_77], dh1_1[ri_77], dh2_1[ri_77], l_1[ri_77], protocol2_1[ri_77], suite2_1[ri_77], label2_1[ri_77], pkE''[ri_77], pkR''[ri_77], pkS''[ri_77]) && (pk_S_1 = pkS''[ri_77]) && (pkR_5 = pkR''[ri_77]) && (pkE_11 = pkE''[ri_77]) && (label_shared_secret = label2_1[ri_77]) && (suite_id = suite2_1[ri_77]) && (RFCXXXX = protocol2_1[ri_77]) && (I2OSP2(Nsecret) = l_1[ri_77]) && (exp(pk_S_1, sk_1) = dh2_1[ri_77]) && (exp(pkE_11, sk_1) = dh1_1[ri_77]) && (label_eae_prk = label1_1[ri_77]) && (suite_id = suite1_1[ri_77]) && (RFCXXXX = protocol1_1[ri_77]) && (lbytes_empty = salt_1[ri_77]) then
                return(AuthDecap_Some(r_9[u_81]))
              else
                r_8 <-R eae_output_t;
                return(AuthDecap_Some(r_8))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(r_6[ri_74, ri_75], z_5[ri_74, ri_75], sk_1[ri_75], pkE_10[ri_74, ri_75], pk_R_1[ri_74, ri_75], pkS_4[ri_74, ri_75]) && (pkS'' = pkS_4[ri_74, ri_75]) && (pkR'' = pk_R_1[ri_74, ri_75]) && (pkE'' = pkE_10[ri_74, ri_75]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_74, ri_75], sk_1[ri_75])) && (dh1_1 = exp(pk_R_1[ri_74, ri_75], z_5[ri_74, ri_75])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_78, u_79])
          orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(r_7[ri_72, ri_73], z_5[ri_72, ri_73], sk_1[ri_73], sk_1[i2_952[ri_72, ri_73]], pkE_10[ri_72, ri_73], pk_R_1[ri_72, ri_73], pkS_4[ri_72, ri_73]) && (pkS'' = pkS_4[ri_72, ri_73]) && (pkR'' = pk_R_1[ri_72, ri_73]) && (pkE'' = pkE_10[ri_72, ri_73]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], sk_1[ri_73]))) && (dh1_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], z_5[ri_72, ri_73]))) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_7[u_76, u_77])
          orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(r_8[ri_70, ri_71], sk_1[ri_71], pkE_11[ri_70, ri_71], pkR_5[ri_70, ri_71], pk_S_1[ri_70, ri_71]) && (pkS'' = pk_S_1[ri_70, ri_71]) && (pkR'' = pkR_5[ri_70, ri_71]) && (pkE'' = pkE_11[ri_70, ri_71]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_70, ri_71], sk_1[ri_71])) && (dh1_1 = exp(pkE_11[ri_70, ri_71], sk_1[ri_71])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_8[u_74, u_75])
          orfind u_73 = ri_69 <= Qh suchthat defined(r_9[ri_69], salt_1[ri_69], protocol1_1[ri_69], suite1_1[ri_69], label1_1[ri_69], dh1_1[ri_69], dh2_1[ri_69], l_1[ri_69], protocol2_1[ri_69], suite2_1[ri_69], label2_1[ri_69], pkE''[ri_69], pkR''[ri_69], pkS''[ri_69]) && (pkS'' = pkS''[ri_69]) && (pkR'' = pkR''[ri_69]) && (pkE'' = pkE''[ri_69]) && (label2_1 = label2_1[ri_69]) && (suite2_1 = suite2_1[ri_69]) && (protocol2_1 = protocol2_1[ri_69]) && (l_1 = l_1[ri_69]) && (dh2_1 = dh2_1[ri_69]) && (dh1_1 = dh1_1[ri_69]) && (label1_1 = label1_1[ri_69]) && (suite1_1 = suite1_1[ri_69]) && (protocol1_1 = protocol1_1[ri_69]) && (salt_1 = salt_1[ri_69]) then
            return(r_9[u_73])
          else
            r_9 <-R eae_output_t;
            return(r_9)
        else
          find [unique] u_64 = ri_60 <= Qh suchthat defined(r_10[ri_60], x1_1[ri_60]) && (x1_1 = x1_1[ri_60]) then
            return(r_10[u_64])
          else
            r_10 <-R eae_output_t;
            return(r_10)
      ))


Applying SA rename z_5
  - Rename variable z_5 into z_9, z_8
yields

Game 49 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_8 <-R Z_t;
            pkE_10: G_t <- exp(g, z_8);
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_98 = ri_94 <= Qdperuser suchthat defined(r_8[ri_94, i2_952], pkE_11[ri_94, i2_952], pk_S_1[ri_94, i2_952]) && (pkS_4 = pk_S_1[ri_94, i2_952]) && (pkE_10 = pkE_11[ri_94, i2_952]) then
              return(AuthEncap_tuple(r_8[u_98, i2_952], enc_8))
            orfind u_97 = ri_93 <= Qh suchthat defined(r_9[ri_93], salt_1[ri_93], protocol1_1[ri_93], suite1_1[ri_93], label1_1[ri_93], dh1_1[ri_93], dh2_1[ri_93], l_1[ri_93], protocol2_1[ri_93], suite2_1[ri_93], label2_1[ri_93], pkE''[ri_93], pkR''[ri_93], pkS''[ri_93]) && (pkS_4 = pkS''[ri_93]) && (pk_R_1 = pkR''[ri_93]) && (pkE_10 = pkE''[ri_93]) && (label_shared_secret = label2_1[ri_93]) && (suite_id = suite2_1[ri_93]) && (RFCXXXX = protocol2_1[ri_93]) && (I2OSP2(Nsecret) = l_1[ri_93]) && (exp(g, mult(sk_1[i2_952], sk_1)) = dh2_1[ri_93]) && (exp(g, mult(sk_1[i2_952], z_8)) = dh1_1[ri_93]) && (label_eae_prk = label1_1[ri_93]) && (suite_id = suite1_1[ri_93]) && (RFCXXXX = protocol1_1[ri_93]) && (lbytes_empty = salt_1[ri_93]) then
              return(AuthEncap_tuple(r_9[u_97], enc_8))
            else
              r_7 <-R eae_output_t;
              return(AuthEncap_tuple(r_7, enc_8))
          else
            z_9 <-R Z_t;
            pkE_10: G_t <- exp(g, z_9);
            enc_8: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_89 = ri_85 <= Qh suchthat defined(r_9[ri_85], salt_1[ri_85], protocol1_1[ri_85], suite1_1[ri_85], label1_1[ri_85], dh1_1[ri_85], dh2_1[ri_85], l_1[ri_85], protocol2_1[ri_85], suite2_1[ri_85], label2_1[ri_85], pkE''[ri_85], pkR''[ri_85], pkS''[ri_85]) && (pkS_4 = pkS''[ri_85]) && (pk_R_1 = pkR''[ri_85]) && (pkE_10 = pkE''[ri_85]) && (label_shared_secret = label2_1[ri_85]) && (suite_id = suite2_1[ri_85]) && (RFCXXXX = protocol2_1[ri_85]) && (I2OSP2(Nsecret) = l_1[ri_85]) && (exp(pk_R_1, sk_1) = dh2_1[ri_85]) && (exp(pk_R_1, z_9) = dh1_1[ri_85]) && (label_eae_prk = label1_1[ri_85]) && (suite_id = suite1_1[ri_85]) && (RFCXXXX = protocol1_1[ri_85]) && (lbytes_empty = salt_1[ri_85]) then
              return(AuthEncap_tuple(r_9[u_89], enc_8))
            else
              r_6 <-R eae_output_t;
              return(AuthEncap_tuple(r_6, enc_8))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              pkR_5: G_t <- exp(g, sk_1);
              find [unique] u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(r_7[ri_80, ri_81], pkE_10[ri_80, ri_81], i2_952[ri_80, ri_81], pkS_4[ri_80, ri_81]) && (pk_S_1 = pkS_4[ri_80, ri_81]) && (i_1 = i2_952[ri_80, ri_81]) && (pkE_11 = pkE_10[ri_80, ri_81]) then
                return(AuthDecap_Some(r_7[u_84, u_85]))
              orfind u_82 = ri_78 <= Qdperuser suchthat defined(r_8[ri_78], pkE_11[ri_78], pk_S_1[ri_78]) && (pk_S_1 = pk_S_1[ri_78]) && (pkE_11 = pkE_11[ri_78]) then
                return(AuthDecap_Some(r_8[u_82]))
              orfind u_81 = ri_77 <= Qh suchthat defined(r_9[ri_77], salt_1[ri_77], protocol1_1[ri_77], suite1_1[ri_77], label1_1[ri_77], dh1_1[ri_77], dh2_1[ri_77], l_1[ri_77], protocol2_1[ri_77], suite2_1[ri_77], label2_1[ri_77], pkE''[ri_77], pkR''[ri_77], pkS''[ri_77]) && (pk_S_1 = pkS''[ri_77]) && (pkR_5 = pkR''[ri_77]) && (pkE_11 = pkE''[ri_77]) && (label_shared_secret = label2_1[ri_77]) && (suite_id = suite2_1[ri_77]) && (RFCXXXX = protocol2_1[ri_77]) && (I2OSP2(Nsecret) = l_1[ri_77]) && (exp(pk_S_1, sk_1) = dh2_1[ri_77]) && (exp(pkE_11, sk_1) = dh1_1[ri_77]) && (label_eae_prk = label1_1[ri_77]) && (suite_id = suite1_1[ri_77]) && (RFCXXXX = protocol1_1[ri_77]) && (lbytes_empty = salt_1[ri_77]) then
                return(AuthDecap_Some(r_9[u_81]))
              else
                r_8 <-R eae_output_t;
                return(AuthDecap_Some(r_8))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(r_6[ri_74, ri_75], z_9[ri_74, ri_75], sk_1[ri_75], pkE_10[ri_74, ri_75], pk_R_1[ri_74, ri_75], pkS_4[ri_74, ri_75]) && (pkS'' = pkS_4[ri_74, ri_75]) && (pkR'' = pk_R_1[ri_74, ri_75]) && (pkE'' = pkE_10[ri_74, ri_75]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_74, ri_75], sk_1[ri_75])) && (dh1_1 = exp(pk_R_1[ri_74, ri_75], z_9[ri_74, ri_75])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_78, u_79])
          orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(r_7[ri_72, ri_73], z_8[ri_72, ri_73], sk_1[ri_73], sk_1[i2_952[ri_72, ri_73]], pkE_10[ri_72, ri_73], pk_R_1[ri_72, ri_73], pkS_4[ri_72, ri_73]) && (pkS'' = pkS_4[ri_72, ri_73]) && (pkR'' = pk_R_1[ri_72, ri_73]) && (pkE'' = pkE_10[ri_72, ri_73]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], sk_1[ri_73]))) && (dh1_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], z_8[ri_72, ri_73]))) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_7[u_76, u_77])
          orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(r_8[ri_70, ri_71], sk_1[ri_71], pkE_11[ri_70, ri_71], pkR_5[ri_70, ri_71], pk_S_1[ri_70, ri_71]) && (pkS'' = pk_S_1[ri_70, ri_71]) && (pkR'' = pkR_5[ri_70, ri_71]) && (pkE'' = pkE_11[ri_70, ri_71]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_70, ri_71], sk_1[ri_71])) && (dh1_1 = exp(pkE_11[ri_70, ri_71], sk_1[ri_71])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_8[u_74, u_75])
          orfind u_73 = ri_69 <= Qh suchthat defined(r_9[ri_69], salt_1[ri_69], protocol1_1[ri_69], suite1_1[ri_69], label1_1[ri_69], dh1_1[ri_69], dh2_1[ri_69], l_1[ri_69], protocol2_1[ri_69], suite2_1[ri_69], label2_1[ri_69], pkE''[ri_69], pkR''[ri_69], pkS''[ri_69]) && (pkS'' = pkS''[ri_69]) && (pkR'' = pkR''[ri_69]) && (pkE'' = pkE''[ri_69]) && (label2_1 = label2_1[ri_69]) && (suite2_1 = suite2_1[ri_69]) && (protocol2_1 = protocol2_1[ri_69]) && (l_1 = l_1[ri_69]) && (dh2_1 = dh2_1[ri_69]) && (dh1_1 = dh1_1[ri_69]) && (label1_1 = label1_1[ri_69]) && (suite1_1 = suite1_1[ri_69]) && (protocol1_1 = protocol1_1[ri_69]) && (salt_1 = salt_1[ri_69]) then
            return(r_9[u_73])
          else
            r_9 <-R eae_output_t;
            return(r_9)
        else
          find [unique] u_64 = ri_60 <= Qh suchthat defined(r_10[ri_60], x1_1[ri_60]) && (x1_1 = x1_1[ri_60]) then
            return(r_10[u_64])
          else
            r_10 <-R eae_output_t;
            return(r_10)
      ))


Applying SA rename enc_8
  - Rename variable enc_8 into enc_12, enc_11
yields

Game 50 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_8 <-R Z_t;
            pkE_10: G_t <- exp(g, z_8);
            enc_11: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_98 = ri_94 <= Qdperuser suchthat defined(r_8[ri_94, i2_952], pkE_11[ri_94, i2_952], pk_S_1[ri_94, i2_952]) && (pkS_4 = pk_S_1[ri_94, i2_952]) && (pkE_10 = pkE_11[ri_94, i2_952]) then
              return(AuthEncap_tuple(r_8[u_98, i2_952], enc_11))
            orfind u_97 = ri_93 <= Qh suchthat defined(r_9[ri_93], salt_1[ri_93], protocol1_1[ri_93], suite1_1[ri_93], label1_1[ri_93], dh1_1[ri_93], dh2_1[ri_93], l_1[ri_93], protocol2_1[ri_93], suite2_1[ri_93], label2_1[ri_93], pkE''[ri_93], pkR''[ri_93], pkS''[ri_93]) && (pkS_4 = pkS''[ri_93]) && (pk_R_1 = pkR''[ri_93]) && (pkE_10 = pkE''[ri_93]) && (label_shared_secret = label2_1[ri_93]) && (suite_id = suite2_1[ri_93]) && (RFCXXXX = protocol2_1[ri_93]) && (I2OSP2(Nsecret) = l_1[ri_93]) && (exp(g, mult(sk_1[i2_952], sk_1)) = dh2_1[ri_93]) && (exp(g, mult(sk_1[i2_952], z_8)) = dh1_1[ri_93]) && (label_eae_prk = label1_1[ri_93]) && (suite_id = suite1_1[ri_93]) && (RFCXXXX = protocol1_1[ri_93]) && (lbytes_empty = salt_1[ri_93]) then
              return(AuthEncap_tuple(r_9[u_97], enc_11))
            else
              r_7 <-R eae_output_t;
              return(AuthEncap_tuple(r_7, enc_11))
          else
            z_9 <-R Z_t;
            pkE_10: G_t <- exp(g, z_9);
            enc_12: bitstring <- Serialize(pkE_10);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_89 = ri_85 <= Qh suchthat defined(r_9[ri_85], salt_1[ri_85], protocol1_1[ri_85], suite1_1[ri_85], label1_1[ri_85], dh1_1[ri_85], dh2_1[ri_85], l_1[ri_85], protocol2_1[ri_85], suite2_1[ri_85], label2_1[ri_85], pkE''[ri_85], pkR''[ri_85], pkS''[ri_85]) && (pkS_4 = pkS''[ri_85]) && (pk_R_1 = pkR''[ri_85]) && (pkE_10 = pkE''[ri_85]) && (label_shared_secret = label2_1[ri_85]) && (suite_id = suite2_1[ri_85]) && (RFCXXXX = protocol2_1[ri_85]) && (I2OSP2(Nsecret) = l_1[ri_85]) && (exp(pk_R_1, sk_1) = dh2_1[ri_85]) && (exp(pk_R_1, z_9) = dh1_1[ri_85]) && (label_eae_prk = label1_1[ri_85]) && (suite_id = suite1_1[ri_85]) && (RFCXXXX = protocol1_1[ri_85]) && (lbytes_empty = salt_1[ri_85]) then
              return(AuthEncap_tuple(r_9[u_89], enc_12))
            else
              r_6 <-R eae_output_t;
              return(AuthEncap_tuple(r_6, enc_12))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              pkR_5: G_t <- exp(g, sk_1);
              find [unique] u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(r_7[ri_80, ri_81], pkE_10[ri_80, ri_81], i2_952[ri_80, ri_81], pkS_4[ri_80, ri_81]) && (pk_S_1 = pkS_4[ri_80, ri_81]) && (i_1 = i2_952[ri_80, ri_81]) && (pkE_11 = pkE_10[ri_80, ri_81]) then
                return(AuthDecap_Some(r_7[u_84, u_85]))
              orfind u_82 = ri_78 <= Qdperuser suchthat defined(r_8[ri_78], pkE_11[ri_78], pk_S_1[ri_78]) && (pk_S_1 = pk_S_1[ri_78]) && (pkE_11 = pkE_11[ri_78]) then
                return(AuthDecap_Some(r_8[u_82]))
              orfind u_81 = ri_77 <= Qh suchthat defined(r_9[ri_77], salt_1[ri_77], protocol1_1[ri_77], suite1_1[ri_77], label1_1[ri_77], dh1_1[ri_77], dh2_1[ri_77], l_1[ri_77], protocol2_1[ri_77], suite2_1[ri_77], label2_1[ri_77], pkE''[ri_77], pkR''[ri_77], pkS''[ri_77]) && (pk_S_1 = pkS''[ri_77]) && (pkR_5 = pkR''[ri_77]) && (pkE_11 = pkE''[ri_77]) && (label_shared_secret = label2_1[ri_77]) && (suite_id = suite2_1[ri_77]) && (RFCXXXX = protocol2_1[ri_77]) && (I2OSP2(Nsecret) = l_1[ri_77]) && (exp(pk_S_1, sk_1) = dh2_1[ri_77]) && (exp(pkE_11, sk_1) = dh1_1[ri_77]) && (label_eae_prk = label1_1[ri_77]) && (suite_id = suite1_1[ri_77]) && (RFCXXXX = protocol1_1[ri_77]) && (lbytes_empty = salt_1[ri_77]) then
                return(AuthDecap_Some(r_9[u_81]))
              else
                r_8 <-R eae_output_t;
                return(AuthDecap_Some(r_8))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(r_6[ri_74, ri_75], z_9[ri_74, ri_75], sk_1[ri_75], pkE_10[ri_74, ri_75], pk_R_1[ri_74, ri_75], pkS_4[ri_74, ri_75]) && (pkS'' = pkS_4[ri_74, ri_75]) && (pkR'' = pk_R_1[ri_74, ri_75]) && (pkE'' = pkE_10[ri_74, ri_75]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_74, ri_75], sk_1[ri_75])) && (dh1_1 = exp(pk_R_1[ri_74, ri_75], z_9[ri_74, ri_75])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_78, u_79])
          orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(r_7[ri_72, ri_73], z_8[ri_72, ri_73], sk_1[ri_73], sk_1[i2_952[ri_72, ri_73]], pkE_10[ri_72, ri_73], pk_R_1[ri_72, ri_73], pkS_4[ri_72, ri_73]) && (pkS'' = pkS_4[ri_72, ri_73]) && (pkR'' = pk_R_1[ri_72, ri_73]) && (pkE'' = pkE_10[ri_72, ri_73]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], sk_1[ri_73]))) && (dh1_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], z_8[ri_72, ri_73]))) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_7[u_76, u_77])
          orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(r_8[ri_70, ri_71], sk_1[ri_71], pkE_11[ri_70, ri_71], pkR_5[ri_70, ri_71], pk_S_1[ri_70, ri_71]) && (pkS'' = pk_S_1[ri_70, ri_71]) && (pkR'' = pkR_5[ri_70, ri_71]) && (pkE'' = pkE_11[ri_70, ri_71]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_70, ri_71], sk_1[ri_71])) && (dh1_1 = exp(pkE_11[ri_70, ri_71], sk_1[ri_71])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_8[u_74, u_75])
          orfind u_73 = ri_69 <= Qh suchthat defined(r_9[ri_69], salt_1[ri_69], protocol1_1[ri_69], suite1_1[ri_69], label1_1[ri_69], dh1_1[ri_69], dh2_1[ri_69], l_1[ri_69], protocol2_1[ri_69], suite2_1[ri_69], label2_1[ri_69], pkE''[ri_69], pkR''[ri_69], pkS''[ri_69]) && (pkS'' = pkS''[ri_69]) && (pkR'' = pkR''[ri_69]) && (pkE'' = pkE''[ri_69]) && (label2_1 = label2_1[ri_69]) && (suite2_1 = suite2_1[ri_69]) && (protocol2_1 = protocol2_1[ri_69]) && (l_1 = l_1[ri_69]) && (dh2_1 = dh2_1[ri_69]) && (dh1_1 = dh1_1[ri_69]) && (label1_1 = label1_1[ri_69]) && (suite1_1 = suite1_1[ri_69]) && (protocol1_1 = protocol1_1[ri_69]) && (salt_1 = salt_1[ri_69]) then
            return(r_9[u_73])
          else
            r_9 <-R eae_output_t;
            return(r_9)
        else
          find [unique] u_64 = ri_60 <= Qh suchthat defined(r_10[ri_60], x1_1[ri_60]) && (x1_1 = x1_1[ri_60]) then
            return(r_10[u_64])
          else
            r_10 <-R eae_output_t;
            return(r_10)
      ))


Applying SA rename pkE_10
  - Rename variable pkE_10 into pkE_15, pkE_14
yields

Game 51 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          E_1: G_t <- exp(g, sk'_1);
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_8 <-R Z_t;
            pkE_14: G_t <- exp(g, z_8);
            enc_11: bitstring <- Serialize(pkE_14);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_98 = ri_94 <= Qdperuser suchthat defined(r_8[ri_94, i2_952], pkE_11[ri_94, i2_952], pk_S_1[ri_94, i2_952]) && (pkS_4 = pk_S_1[ri_94, i2_952]) && (pkE_14 = pkE_11[ri_94, i2_952]) then
              return(AuthEncap_tuple(r_8[u_98, i2_952], enc_11))
            orfind u_97 = ri_93 <= Qh suchthat defined(r_9[ri_93], salt_1[ri_93], protocol1_1[ri_93], suite1_1[ri_93], label1_1[ri_93], dh1_1[ri_93], dh2_1[ri_93], l_1[ri_93], protocol2_1[ri_93], suite2_1[ri_93], label2_1[ri_93], pkE''[ri_93], pkR''[ri_93], pkS''[ri_93]) && (pkS_4 = pkS''[ri_93]) && (pk_R_1 = pkR''[ri_93]) && (pkE_14 = pkE''[ri_93]) && (label_shared_secret = label2_1[ri_93]) && (suite_id = suite2_1[ri_93]) && (RFCXXXX = protocol2_1[ri_93]) && (I2OSP2(Nsecret) = l_1[ri_93]) && (exp(g, mult(sk_1[i2_952], sk_1)) = dh2_1[ri_93]) && (exp(g, mult(sk_1[i2_952], z_8)) = dh1_1[ri_93]) && (label_eae_prk = label1_1[ri_93]) && (suite_id = suite1_1[ri_93]) && (RFCXXXX = protocol1_1[ri_93]) && (lbytes_empty = salt_1[ri_93]) then
              return(AuthEncap_tuple(r_9[u_97], enc_11))
            else
              r_7 <-R eae_output_t;
              return(AuthEncap_tuple(r_7, enc_11))
          else
            z_9 <-R Z_t;
            pkE_15: G_t <- exp(g, z_9);
            enc_12: bitstring <- Serialize(pkE_15);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_89 = ri_85 <= Qh suchthat defined(r_9[ri_85], salt_1[ri_85], protocol1_1[ri_85], suite1_1[ri_85], label1_1[ri_85], dh1_1[ri_85], dh2_1[ri_85], l_1[ri_85], protocol2_1[ri_85], suite2_1[ri_85], label2_1[ri_85], pkE''[ri_85], pkR''[ri_85], pkS''[ri_85]) && (pkS_4 = pkS''[ri_85]) && (pk_R_1 = pkR''[ri_85]) && (pkE_15 = pkE''[ri_85]) && (label_shared_secret = label2_1[ri_85]) && (suite_id = suite2_1[ri_85]) && (RFCXXXX = protocol2_1[ri_85]) && (I2OSP2(Nsecret) = l_1[ri_85]) && (exp(pk_R_1, sk_1) = dh2_1[ri_85]) && (exp(pk_R_1, z_9) = dh1_1[ri_85]) && (label_eae_prk = label1_1[ri_85]) && (suite_id = suite1_1[ri_85]) && (RFCXXXX = protocol1_1[ri_85]) && (lbytes_empty = salt_1[ri_85]) then
              return(AuthEncap_tuple(r_9[u_89], enc_12))
            else
              r_6 <-R eae_output_t;
              return(AuthEncap_tuple(r_6, enc_12))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(enc_7[u_2], k'[u_2], E_1[u_2]) && (E_1[u_2] = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              pkR_5: G_t <- exp(g, sk_1);
              find [unique] u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(r_7[ri_80, ri_81], pkE_14[ri_80, ri_81], i2_952[ri_80, ri_81], pkS_4[ri_80, ri_81]) && (pk_S_1 = pkS_4[ri_80, ri_81]) && (i_1 = i2_952[ri_80, ri_81]) && (pkE_11 = pkE_14[ri_80, ri_81]) then
                return(AuthDecap_Some(r_7[u_84, u_85]))
              orfind u_82 = ri_78 <= Qdperuser suchthat defined(r_8[ri_78], pkE_11[ri_78], pk_S_1[ri_78]) && (pk_S_1 = pk_S_1[ri_78]) && (pkE_11 = pkE_11[ri_78]) then
                return(AuthDecap_Some(r_8[u_82]))
              orfind u_81 = ri_77 <= Qh suchthat defined(r_9[ri_77], salt_1[ri_77], protocol1_1[ri_77], suite1_1[ri_77], label1_1[ri_77], dh1_1[ri_77], dh2_1[ri_77], l_1[ri_77], protocol2_1[ri_77], suite2_1[ri_77], label2_1[ri_77], pkE''[ri_77], pkR''[ri_77], pkS''[ri_77]) && (pk_S_1 = pkS''[ri_77]) && (pkR_5 = pkR''[ri_77]) && (pkE_11 = pkE''[ri_77]) && (label_shared_secret = label2_1[ri_77]) && (suite_id = suite2_1[ri_77]) && (RFCXXXX = protocol2_1[ri_77]) && (I2OSP2(Nsecret) = l_1[ri_77]) && (exp(pk_S_1, sk_1) = dh2_1[ri_77]) && (exp(pkE_11, sk_1) = dh1_1[ri_77]) && (label_eae_prk = label1_1[ri_77]) && (suite_id = suite1_1[ri_77]) && (RFCXXXX = protocol1_1[ri_77]) && (lbytes_empty = salt_1[ri_77]) then
                return(AuthDecap_Some(r_9[u_81]))
              else
                r_8 <-R eae_output_t;
                return(AuthDecap_Some(r_8))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(r_6[ri_74, ri_75], z_9[ri_74, ri_75], sk_1[ri_75], pkE_15[ri_74, ri_75], pk_R_1[ri_74, ri_75], pkS_4[ri_74, ri_75]) && (pkS'' = pkS_4[ri_74, ri_75]) && (pkR'' = pk_R_1[ri_74, ri_75]) && (pkE'' = pkE_15[ri_74, ri_75]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_74, ri_75], sk_1[ri_75])) && (dh1_1 = exp(pk_R_1[ri_74, ri_75], z_9[ri_74, ri_75])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_78, u_79])
          orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(r_7[ri_72, ri_73], z_8[ri_72, ri_73], sk_1[ri_73], sk_1[i2_952[ri_72, ri_73]], pkE_14[ri_72, ri_73], pk_R_1[ri_72, ri_73], pkS_4[ri_72, ri_73]) && (pkS'' = pkS_4[ri_72, ri_73]) && (pkR'' = pk_R_1[ri_72, ri_73]) && (pkE'' = pkE_14[ri_72, ri_73]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], sk_1[ri_73]))) && (dh1_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], z_8[ri_72, ri_73]))) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_7[u_76, u_77])
          orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(r_8[ri_70, ri_71], sk_1[ri_71], pkE_11[ri_70, ri_71], pkR_5[ri_70, ri_71], pk_S_1[ri_70, ri_71]) && (pkS'' = pk_S_1[ri_70, ri_71]) && (pkR'' = pkR_5[ri_70, ri_71]) && (pkE'' = pkE_11[ri_70, ri_71]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_70, ri_71], sk_1[ri_71])) && (dh1_1 = exp(pkE_11[ri_70, ri_71], sk_1[ri_71])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_8[u_74, u_75])
          orfind u_73 = ri_69 <= Qh suchthat defined(r_9[ri_69], salt_1[ri_69], protocol1_1[ri_69], suite1_1[ri_69], label1_1[ri_69], dh1_1[ri_69], dh2_1[ri_69], l_1[ri_69], protocol2_1[ri_69], suite2_1[ri_69], label2_1[ri_69], pkE''[ri_69], pkR''[ri_69], pkS''[ri_69]) && (pkS'' = pkS''[ri_69]) && (pkR'' = pkR''[ri_69]) && (pkE'' = pkE''[ri_69]) && (label2_1 = label2_1[ri_69]) && (suite2_1 = suite2_1[ri_69]) && (protocol2_1 = protocol2_1[ri_69]) && (l_1 = l_1[ri_69]) && (dh2_1 = dh2_1[ri_69]) && (dh1_1 = dh1_1[ri_69]) && (label1_1 = label1_1[ri_69]) && (suite1_1 = suite1_1[ri_69]) && (protocol1_1 = protocol1_1[ri_69]) && (salt_1 = salt_1[ri_69]) then
            return(r_9[u_73])
          else
            r_9 <-R eae_output_t;
            return(r_9)
        else
          find [unique] u_64 = ri_60 <= Qh suchthat defined(r_10[ri_60], x1_1[ri_60]) && (x1_1 = x1_1[ri_60]) then
            return(r_10[u_64])
          else
            r_10 <-R eae_output_t;
            return(r_10)
      ))


Applying remove assignments of binder E_1
  - Remove assignments on E_1 (definition removed, all usages removed)
yields

Game 52 is
      Ostart() :=
      return();
      ((
        foreach i_1 <= N do
        Osetup() :=
        sk_1 <-R Z_t;
        return();
        ((
          foreach ic_1 <= Qcperuser do
          Ochall(sk'_1: Z_t) :=
          z_4 <-R Z_t;
          pkE_9: G_t <- exp(g, z_4);
          enc_7: bitstring <- Serialize(pkE_9);
          k' <-R eae_output_t;
          return(AuthEncap_tuple(k', enc_7))
        ) | (
          foreach ie_1 <= Qeperuser do
          OAEncap(pk_R_1: G_t) :=
          find i2_952 = i2_953 <= N suchthat defined(sk_1[i2_953]) && (pk_R_1 = exp(g, sk_1[i2_953])) then
            z_8 <-R Z_t;
            pkE_14: G_t <- exp(g, z_8);
            enc_11: bitstring <- Serialize(pkE_14);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_98 = ri_94 <= Qdperuser suchthat defined(r_8[ri_94, i2_952], pkE_11[ri_94, i2_952], pk_S_1[ri_94, i2_952]) && (pkS_4 = pk_S_1[ri_94, i2_952]) && (pkE_14 = pkE_11[ri_94, i2_952]) then
              return(AuthEncap_tuple(r_8[u_98, i2_952], enc_11))
            orfind u_97 = ri_93 <= Qh suchthat defined(r_9[ri_93], salt_1[ri_93], protocol1_1[ri_93], suite1_1[ri_93], label1_1[ri_93], dh1_1[ri_93], dh2_1[ri_93], l_1[ri_93], protocol2_1[ri_93], suite2_1[ri_93], label2_1[ri_93], pkE''[ri_93], pkR''[ri_93], pkS''[ri_93]) && (pkS_4 = pkS''[ri_93]) && (pk_R_1 = pkR''[ri_93]) && (pkE_14 = pkE''[ri_93]) && (label_shared_secret = label2_1[ri_93]) && (suite_id = suite2_1[ri_93]) && (RFCXXXX = protocol2_1[ri_93]) && (I2OSP2(Nsecret) = l_1[ri_93]) && (exp(g, mult(sk_1[i2_952], sk_1)) = dh2_1[ri_93]) && (exp(g, mult(sk_1[i2_952], z_8)) = dh1_1[ri_93]) && (label_eae_prk = label1_1[ri_93]) && (suite_id = suite1_1[ri_93]) && (RFCXXXX = protocol1_1[ri_93]) && (lbytes_empty = salt_1[ri_93]) then
              return(AuthEncap_tuple(r_9[u_97], enc_11))
            else
              r_7 <-R eae_output_t;
              return(AuthEncap_tuple(r_7, enc_11))
          else
            z_9 <-R Z_t;
            pkE_15: G_t <- exp(g, z_9);
            enc_12: bitstring <- Serialize(pkE_15);
            pkS_4: G_t <- exp(g, sk_1);
            find [unique] u_89 = ri_85 <= Qh suchthat defined(r_9[ri_85], salt_1[ri_85], protocol1_1[ri_85], suite1_1[ri_85], label1_1[ri_85], dh1_1[ri_85], dh2_1[ri_85], l_1[ri_85], protocol2_1[ri_85], suite2_1[ri_85], label2_1[ri_85], pkE''[ri_85], pkR''[ri_85], pkS''[ri_85]) && (pkS_4 = pkS''[ri_85]) && (pk_R_1 = pkR''[ri_85]) && (pkE_15 = pkE''[ri_85]) && (label_shared_secret = label2_1[ri_85]) && (suite_id = suite2_1[ri_85]) && (RFCXXXX = protocol2_1[ri_85]) && (I2OSP2(Nsecret) = l_1[ri_85]) && (exp(pk_R_1, sk_1) = dh2_1[ri_85]) && (exp(pk_R_1, z_9) = dh1_1[ri_85]) && (label_eae_prk = label1_1[ri_85]) && (suite_id = suite1_1[ri_85]) && (RFCXXXX = protocol1_1[ri_85]) && (lbytes_empty = salt_1[ri_85]) then
              return(AuthEncap_tuple(r_9[u_89], enc_12))
            else
              r_6 <-R eae_output_t;
              return(AuthEncap_tuple(r_6, enc_12))
        ) | (
          foreach id_1 <= Qdperuser do
          OADecap(pk_S_1: G_t, cd_1: bitstring) :=
          find u = u_2 <= Qcperuser suchthat defined(sk'_1[u_2], enc_7[u_2], k'[u_2]) && (exp(g, sk'_1[u_2]) = pk_S_1) && (enc_7[u_2] = cd_1) then
            return(AuthDecap_Some(k'[u]))
          else
            let Serialize(pkE_11: G_t) = cd_1 in
              pkR_5: G_t <- exp(g, sk_1);
              find [unique] u_84 = ri_80 <= Qeperuser, u_85 = ri_81 <= N suchthat defined(r_7[ri_80, ri_81], pkE_14[ri_80, ri_81], i2_952[ri_80, ri_81], pkS_4[ri_80, ri_81]) && (pk_S_1 = pkS_4[ri_80, ri_81]) && (i_1 = i2_952[ri_80, ri_81]) && (pkE_11 = pkE_14[ri_80, ri_81]) then
                return(AuthDecap_Some(r_7[u_84, u_85]))
              orfind u_82 = ri_78 <= Qdperuser suchthat defined(r_8[ri_78], pkE_11[ri_78], pk_S_1[ri_78]) && (pk_S_1 = pk_S_1[ri_78]) && (pkE_11 = pkE_11[ri_78]) then
                return(AuthDecap_Some(r_8[u_82]))
              orfind u_81 = ri_77 <= Qh suchthat defined(r_9[ri_77], salt_1[ri_77], protocol1_1[ri_77], suite1_1[ri_77], label1_1[ri_77], dh1_1[ri_77], dh2_1[ri_77], l_1[ri_77], protocol2_1[ri_77], suite2_1[ri_77], label2_1[ri_77], pkE''[ri_77], pkR''[ri_77], pkS''[ri_77]) && (pk_S_1 = pkS''[ri_77]) && (pkR_5 = pkR''[ri_77]) && (pkE_11 = pkE''[ri_77]) && (label_shared_secret = label2_1[ri_77]) && (suite_id = suite2_1[ri_77]) && (RFCXXXX = protocol2_1[ri_77]) && (I2OSP2(Nsecret) = l_1[ri_77]) && (exp(pk_S_1, sk_1) = dh2_1[ri_77]) && (exp(pkE_11, sk_1) = dh1_1[ri_77]) && (label_eae_prk = label1_1[ri_77]) && (suite_id = suite1_1[ri_77]) && (RFCXXXX = protocol1_1[ri_77]) && (lbytes_empty = salt_1[ri_77]) then
                return(AuthDecap_Some(r_9[u_81]))
              else
                r_8 <-R eae_output_t;
                return(AuthDecap_Some(r_8))
            else
              return(AuthDecap_None)
        ) | (
          Opk() :=
          return(exp(g, sk_1))
        ))
      ) | (
        foreach iH_1 <= Qh do
        OH(x1_1: eae_input_t) :=
        let eae_input(salt_1: extract_salt_t, concatExtract(protocol1_1: label_protocol_t, suite1_1: suite_id_t, label1_1: label_extract_t, concatDH(dh1_1: G_t, dh2_1: G_t)), concatExpand(l_1: two_byte_t, protocol2_1: label_protocol_t, suite2_1: suite_id_t, label2_1: label_expand_t, concatContext(pkE'': G_t, pkR'': G_t, pkS'': G_t))) = x1_1 in
          find [unique] u_78 = ri_74 <= Qeperuser, u_79 = ri_75 <= N suchthat defined(r_6[ri_74, ri_75], z_9[ri_74, ri_75], sk_1[ri_75], pkE_15[ri_74, ri_75], pk_R_1[ri_74, ri_75], pkS_4[ri_74, ri_75]) && (pkS'' = pkS_4[ri_74, ri_75]) && (pkR'' = pk_R_1[ri_74, ri_75]) && (pkE'' = pkE_15[ri_74, ri_75]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_R_1[ri_74, ri_75], sk_1[ri_75])) && (dh1_1 = exp(pk_R_1[ri_74, ri_75], z_9[ri_74, ri_75])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_6[u_78, u_79])
          orfind u_76 = ri_72 <= Qeperuser, u_77 = ri_73 <= N suchthat defined(r_7[ri_72, ri_73], z_8[ri_72, ri_73], sk_1[ri_73], sk_1[i2_952[ri_72, ri_73]], pkE_14[ri_72, ri_73], pk_R_1[ri_72, ri_73], pkS_4[ri_72, ri_73]) && (pkS'' = pkS_4[ri_72, ri_73]) && (pkR'' = pk_R_1[ri_72, ri_73]) && (pkE'' = pkE_14[ri_72, ri_73]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], sk_1[ri_73]))) && (dh1_1 = exp(g, mult(sk_1[i2_952[ri_72, ri_73]], z_8[ri_72, ri_73]))) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_7[u_76, u_77])
          orfind u_74 = ri_70 <= Qdperuser, u_75 = ri_71 <= N suchthat defined(r_8[ri_70, ri_71], sk_1[ri_71], pkE_11[ri_70, ri_71], pkR_5[ri_70, ri_71], pk_S_1[ri_70, ri_71]) && (pkS'' = pk_S_1[ri_70, ri_71]) && (pkR'' = pkR_5[ri_70, ri_71]) && (pkE'' = pkE_11[ri_70, ri_71]) && (label2_1 = label_shared_secret) && (suite2_1 = suite_id) && (protocol2_1 = RFCXXXX) && (l_1 = I2OSP2(Nsecret)) && (dh2_1 = exp(pk_S_1[ri_70, ri_71], sk_1[ri_71])) && (dh1_1 = exp(pkE_11[ri_70, ri_71], sk_1[ri_71])) && (label1_1 = label_eae_prk) && (suite1_1 = suite_id) && (protocol1_1 = RFCXXXX) && (salt_1 = lbytes_empty) then
            return(r_8[u_74, u_75])
          orfind u_73 = ri_69 <= Qh suchthat defined(r_9[ri_69], salt_1[ri_69], protocol1_1[ri_69], suite1_1[ri_69], label1_1[ri_69], dh1_1[ri_69], dh2_1[ri_69], l_1[ri_69], protocol2_1[ri_69], suite2_1[ri_69], label2_1[ri_69], pkE''[ri_69], pkR''[ri_69], pkS''[ri_69]) && (pkS'' = pkS''[ri_69]) && (pkR'' = pkR''[ri_69]) && (pkE'' = pkE''[ri_69]) && (label2_1 = label2_1[ri_69]) && (suite2_1 = suite2_1[ri_69]) && (protocol2_1 = protocol2_1[ri_69]) && (l_1 = l_1[ri_69]) && (dh2_1 = dh2_1[ri_69]) && (dh1_1 = dh1_1[ri_69]) && (label1_1 = label1_1[ri_69]) && (suite1_1 = suite1_1[ri_69]) && (protocol1_1 = protocol1_1[ri_69]) && (salt_1 = salt_1[ri_69]) then
            return(r_9[u_73])
          else
            r_9 <-R eae_output_t;
            return(r_9)
        else
          find [unique] u_64 = ri_60 <= Qh suchthat defined(r_10[ri_60], x1_1[ri_60]) && (x1_1 = x1_1[ri_60]) then
            return(r_10[u_64])
          else
            r_10 <-R eae_output_t;
            return(r_10)
      ))


Proved indistinguishability between game 52 and game 1
Game 52 is the same as game 31.
Adv[Game 1: indistinguishability from game 31] <= Adv_GDH(time_1, 5 * Qh) + (N + #Ochall) * PDistRerandom + (#OADecap * Qcperuser + #OAEncap * N + 4 * N^2 + 4 * #Ochall * #OAEncap + 3 * #Ochall^2 + 8 * #OAEncap^2) * PCollKey + Adv[Game 31: indistinguishability from game 31]
Adv[Game 32: indistinguishability from game 52] <= (#OAEncap * N + 2 * #OAEncap^2 + 5 * N^2) * PCollKey + Adv[Game 52: indistinguishability from game 52]
RESULT Proved indistinguishability between game 32 and game 1 up to probability Adv_GDH(time_1, 5 * Qh) + (N + #Ochall) * PDistRerandom + (#OADecap * Qcperuser + 2 * #OAEncap * N + 9 * N^2 + 4 * #Ochall * #OAEncap + 3 * #Ochall^2 + 10 * #OAEncap^2) * PCollKey
RESULT time_1 = (#Ochall + #OAEncap) * time(Serialize) + #Ochall * time(AuthEncap_tuple, maxlength(game 28: enc_2)) + #OAEncap * time(AuthEncap_tuple, maxlength(game 28: enc_9)) + #OAEncap * time(AuthEncap_tuple, maxlength(game 28: enc_10)) + #OADecap * Qcperuser * time(= bitstring, maxlength(game 28: enc_2), maxlength(game 28: cd)) + (#OADecap * Qcperuser + 2 * Qh * #OAEncap + 3 * #Ochall + 2 * #OAEncap + 1 + N) * time(exp) + #OADecap * time(let Serialize) + #OADecap * time(AuthDecap_Some) + Qh * time(let eae_input) + Qh * time(let concatExpand) + Qh * time(let concatContext) + Qh * time(let concatExtract) + Qh * time(let concatDH) + (2 * Qh * #Ochall + 3 * Qh * #OAEncap + 2 * Qh * #OADecap) * time(I2OSP2) + time
All queries proved.