Downgrade Resilience in Key-Exchange Protocols
The Scyther Tool: Verification, Falsification, and Analysis of Security Protocols