[STATEMENT]
lemma "(\<lambda>x. x) = (\<lambda>x. y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. x) = (\<lambda>x. y)
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. x) = (\<lambda>x. y)
[PROOF STEP]
oops


[STATEMENT]
lemma "x = undefined"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = undefined
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = undefined
[PROOF STEP]
oops


[STATEMENT]
lemma "(SOME x. x=y) = z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (SOME x. x = y) = z
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (SOME x. x = y) = z
[PROOF STEP]
oops


[STATEMENT]
lemma "\<exists>x. f x y = f y x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>x. f x y = f y x
[PROOF STEP]
nitpick [expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>x. f x y = f y x
[PROOF STEP]
oops


[STATEMENT]
lemma PO_m2_inv1_keys_trans [iff]:
  "{m2_inv1_keys} trans m2 {> m2_inv1_keys}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {m2_inv1_keys} TS.trans m2 {> m2_inv1_keys}
[PROOF STEP]
apply (auto simp add: PO_hoare_defs m2_defs intro!: m2_inv1_keysI)
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<And>R xa xb xc xf xg. \<lbrakk>xa \<in> m2_inv1_keys; xf \<notin> dom (runs xa); Insec xb xc (Msg [aNon xg]) \<in> chan xa; R \<notin> dom (runs xa); aKey (sesK (R $ sk)) \<in> atoms (chan xa)\<rbrakk> \<Longrightarrow> R = xf
 2. \<And>xa xb xc xd xe xf. \<lbrakk>xa \<in> m2_inv1_keys; runs xa xf = Some (Serv, [xb, xc], [aNon (xd $ na)]); runs xa xd = Some (Init, [xb, xc], [aKey (sesK (xf $ sk)), aNon (xe $ nb)]); runs xa xe = Some (Resp, [xb, xc], [aKey (sesK (xf $ sk)), END])\<rbrakk> \<Longrightarrow> xf \<in> dom (runs xa)
 3. \<And>R xa xb xc xd xe xf. \<lbrakk>xa \<in> m2_inv1_keys; runs xa xf = Some (Serv, [xb, xc], [aNon (xd $ na)]); runs xa xd = Some (Init, [xb, xc], [aKey (sesK (xf $ sk)), aNon (xe $ nb)]); runs xa xe = Some (Resp, [xb, xc], [aKey (sesK (xf $ sk)), END]); aKey (sesK (R $ sk)) \<in> atoms (chan xa)\<rbrakk> \<Longrightarrow> R \<in> dom (runs xa)
 4. \<And>R xa a b xd. \<lbrakk>xa \<in> m2_inv1_keys; (sesK (R $ sk), a, b) \<in> m1_state.leak xa; xd \<notin> dom (runs xa); R \<notin> dom (runs xa)\<rbrakk> \<Longrightarrow> R = xd
 5. \<And>R xa a b xe. \<lbrakk>xa \<in> m2_inv1_keys; (sesK (R $ sk), a, b) \<in> m1_state.leak xa; xe \<notin> dom (runs xa); R \<notin> dom (runs xa)\<rbrakk> \<Longrightarrow> R = xe
 6. \<And>R xa a b xb xc xf xg. \<lbrakk>xa \<in> m2_inv1_keys; (sesK (R $ sk), a, b) \<in> m1_state.leak xa; xf \<notin> dom (runs xa); Insec xb xc (Msg [aNon xg]) \<in> chan xa; R \<notin> dom (runs xa)\<rbrakk> \<Longrightarrow> R = xf
 7. \<And>R xa a b xb xc xd xi. \<lbrakk>xa \<in> m2_inv1_keys; (sesK (R $ sk), a, b) \<in> m1_state.leak xa; runs xa xd = Some (Init, [xb, xc], []); StatCh secure Sv xb (Msg [aNon (xd $ na), aAgt xc, aKey xi]) \<in> chan xa; R \<notin> dom (runs xa)\<rbrakk> \<Longrightarrow> R = xd
 8. \<And>R xa a b xb xc xe xi. \<lbrakk>xa \<in> m2_inv1_keys; (sesK (R $ sk), a, b) \<in> m1_state.leak xa; runs xa xe = Some (Resp, [xb, xc], []); StatCh secure Sv xc (Msg [aKey xi, aAgt xb]) \<in> chan xa; R \<notin> dom (runs xa)\<rbrakk> \<Longrightarrow> R = xe
 9. \<And>R xa a b xb xc xd xh xi. \<lbrakk>xa \<in> m2_inv1_keys; (sesK (R $ sk), a, b) \<in> m1_state.leak xa; runs xa xd = Some (Init, [xb, xc], [aKey xi]); dAuth xi (Msg [aNon xh]) \<in> chan xa; R \<notin> dom (runs xa)\<rbrakk> \<Longrightarrow> R = xd
 10. \<And>R xa a b xb xc xe xi. \<lbrakk>xa \<in> m2_inv1_keys; (sesK (R $ sk), a, b) \<in> m1_state.leak xa; runs xa xe = Some (Resp, [xb, xc], [aKey xi]); dAuth xi (Msg [aNon (xe $ nb), aNon (xe $ nb)]) \<in> chan xa; R \<notin> dom (runs xa)\<rbrakk> \<Longrightarrow> R = xe
A total of 13 subgoals...
[PROOF STEP]
apply (auto dest!: m2_inv1_keysD dest: dom_lemmas)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma eqButPID_updateShared:
assumes "eqButPID s s1"
shows "eeqButPID_F ((sharedWith s) (pid := aID_b)) ((sharedWith s1) (pid := aID_b))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eeqButPID_F ((sharedWith s)(pid := aID_b)) ((sharedWith s1)(pid := aID_b))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
eqButPID s s1

goal (1 subgoal):
 1. eeqButPID_F ((sharedWith s)(pid := aID_b)) ((sharedWith s1)(pid := aID_b))
[PROOF STEP]
unfolding eqButPID_def
[PROOF STATE]
proof (prove)
using this:
admin s = admin s1 \<and> pendingUReqs s = pendingUReqs s1 \<and> userReq s = userReq s1 \<and> userIDs s = userIDs s1 \<and> user s = user s1 \<and> pass s = pass s1 \<and> pendingFReqs s = pendingFReqs s1 \<and> friendReq s = friendReq s1 \<and> friendIDs s = friendIDs s1 \<and> sentOuterFriendIDs s = sentOuterFriendIDs s1 \<and> recvOuterFriendIDs s = recvOuterFriendIDs s1 \<and> postIDs s = postIDs s1 \<and> admin s = admin s1 \<and> eeqButPID (post s) (post s1) \<and> owner s = owner s1 \<and> vis s = vis s1 \<and> pendingSApiReqs s = pendingSApiReqs s1 \<and> sApiReq s = sApiReq s1 \<and> serverApiIDs s = serverApiIDs s1 \<and> serverPass s = serverPass s1 \<and> outerPostIDs s = outerPostIDs s1 \<and> outerPost s = outerPost s1 \<and> outerOwner s = outerOwner s1 \<and> outerVis s = outerVis s1 \<and> pendingCApiReqs s = pendingCApiReqs s1 \<and> cApiReq s = cApiReq s1 \<and> clientApiIDs s = clientApiIDs s1 \<and> clientPass s = clientPass s1 \<and> eeqButPID_F (sharedWith s) (sharedWith s1)

goal (1 subgoal):
 1. eeqButPID_F ((sharedWith s)(pid := aID_b)) ((sharedWith s1)(pid := aID_b))
[PROOF STEP]
using eeqButPID_F_updateShared
[PROOF STATE]
proof (prove)
using this:
admin s = admin s1 \<and> pendingUReqs s = pendingUReqs s1 \<and> userReq s = userReq s1 \<and> userIDs s = userIDs s1 \<and> user s = user s1 \<and> pass s = pass s1 \<and> pendingFReqs s = pendingFReqs s1 \<and> friendReq s = friendReq s1 \<and> friendIDs s = friendIDs s1 \<and> sentOuterFriendIDs s = sentOuterFriendIDs s1 \<and> recvOuterFriendIDs s = recvOuterFriendIDs s1 \<and> postIDs s = postIDs s1 \<and> admin s = admin s1 \<and> eeqButPID (post s) (post s1) \<and> owner s = owner s1 \<and> vis s = vis s1 \<and> pendingSApiReqs s = pendingSApiReqs s1 \<and> sApiReq s = sApiReq s1 \<and> serverApiIDs s = serverApiIDs s1 \<and> serverPass s = serverPass s1 \<and> outerPostIDs s = outerPostIDs s1 \<and> outerPost s = outerPost s1 \<and> outerOwner s = outerOwner s1 \<and> outerVis s = outerVis s1 \<and> pendingCApiReqs s = pendingCApiReqs s1 \<and> cApiReq s = cApiReq s1 \<and> clientApiIDs s = clientApiIDs s1 \<and> clientPass s = clientPass s1 \<and> eeqButPID_F (sharedWith s) (sharedWith s1)
eeqButPID_F ?sw ?sw1.0 \<Longrightarrow> eeqButPID_F (?sw(?pid := ?aID_b)) (?sw1.0(?pid := ?aID_b))

goal (1 subgoal):
 1. eeqButPID_F ((sharedWith s)(pid := aID_b)) ((sharedWith s1)(pid := aID_b))
[PROOF STEP]
by auto