Security analyses of systems usually begin with a model of the attacker, and we follow the Dolev-Yao model which is a standard attack model against messages exchanged over a network. This powerful model has reasonably realistic set of assumptions on adversary. The adversary in this model can listen to any message exchanged through the network. Also, messages can be intercepted and altered and the attacker can only encrypt, decrypt, sign messages or perform other cryptographic operations if he has the relevant key. Also, cryptographic primitives are assumed to work perfectly. We assume that the protocol is executed in the presence of the Dolev-Yao attacker that is compatible with ProVerif tool. A particular predicate attacker(M) is used in these clauses to represent the fact that an attacker knows the term M. Another predicate mess(c, M) is employed to represent the fact that a message M has been sent by a process over the network