[STATEMENT]
lemma sem\<^sub>e\<^sub>s\<^sub>t_c_decomp_rm\<^sub>e\<^sub>s\<^sub>t_deduct_aux:
  assumes "sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A" "t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>" "t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>"
  shows "ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
[PROOF STEP]
proof (induction M\<^sub>0 \<I> A arbitrary: t rule: sem\<^sub>e\<^sub>s\<^sub>t_c.induct)
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S ts t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; \<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 3. \<And>M\<^sub>0 \<I> S t ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 4. \<And>M\<^sub>0 \<I> S t t' a ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; Unifier \<I> t t'; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 5. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 6. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
case (Send M\<^sub>0 \<I> A t')
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
\<forall>t\<in>set t'. ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step (send\<langle>t'\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (send\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (6 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S ts t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; \<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 3. \<And>M\<^sub>0 \<I> S t ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 4. \<And>M\<^sub>0 \<I> S t t' a ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; Unifier \<I> t t'; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 5. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 6. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
\<forall>t\<in>set t'. ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step (send\<langle>t'\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (send\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (send\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
using decomp_rm\<^sub>e\<^sub>s\<^sub>t_append ik\<^sub>e\<^sub>s\<^sub>t_append
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
\<forall>t\<in>set t'. ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step (send\<langle>t'\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (send\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
decomp_rm\<^sub>e\<^sub>s\<^sub>t (?S @ ?S') = decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S @ decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S'
ik\<^sub>e\<^sub>s\<^sub>t (?A @ ?B) = ik\<^sub>e\<^sub>s\<^sub>t ?A \<union> ik\<^sub>e\<^sub>s\<^sub>t ?B

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (send\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (send\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t

goal (5 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 3. \<And>M\<^sub>0 \<I> S t t' a ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; Unifier \<I> t t'; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 4. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 5. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 3. \<And>M\<^sub>0 \<I> S t t' a ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; Unifier \<I> t t'; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 4. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 5. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
case (Receive M\<^sub>0 \<I> A t')
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step (receive\<langle>t'\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (receive\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (5 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 3. \<And>M\<^sub>0 \<I> S t t' a ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; Unifier \<I> t t'; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 4. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 5. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
hence "t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>" "t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>"
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step (receive\<langle>t'\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (receive\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> &&& t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
[PROOF STEP]
using decomp_rm\<^sub>e\<^sub>s\<^sub>t_append ik\<^sub>e\<^sub>s\<^sub>t_append
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step (receive\<langle>t'\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (receive\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
decomp_rm\<^sub>e\<^sub>s\<^sub>t (?S @ ?S') = decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S @ decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S'
ik\<^sub>e\<^sub>s\<^sub>t (?A @ ?B) = ik\<^sub>e\<^sub>s\<^sub>t ?A \<union> ik\<^sub>e\<^sub>s\<^sub>t ?B

goal (1 subgoal):
 1. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> &&& t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (5 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 3. \<And>M\<^sub>0 \<I> S t t' a ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; Unifier \<I> t t'; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 4. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 5. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
hence IH: "ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t"
[PROOF STATE]
proof (prove)
using this:
t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
[PROOF STEP]
using Receive.IH
[PROOF STATE]
proof (prove)
using this:
t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2

goal (1 subgoal):
 1. ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t

goal (5 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 3. \<And>M\<^sub>0 \<I> S t t' a ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; Unifier \<I> t t'; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 4. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 5. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (receive\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
using ideduct_mono[OF IH] decomp_rm\<^sub>e\<^sub>s\<^sub>t_append ik\<^sub>e\<^sub>s\<^sub>t_append
[PROOF STATE]
proof (prove)
using this:
ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<subseteq> ?M' \<Longrightarrow> ?M' \<turnstile> t
decomp_rm\<^sub>e\<^sub>s\<^sub>t (?S @ ?S') = decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S @ decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S'
ik\<^sub>e\<^sub>s\<^sub>t (?A @ ?B) = ik\<^sub>e\<^sub>s\<^sub>t ?A \<union> ik\<^sub>e\<^sub>s\<^sub>t ?B

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (receive\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
by (metis Un_subset_iff Un_upper1 Un_upper2 image_mono)
[PROOF STATE]
proof (state)
this:
intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step (receive\<langle>t'\<rangle>\<^sub>s\<^sub>t)])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t

goal (4 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t t' a ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; Unifier \<I> t t'; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 3. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 4. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t t' a ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; Unifier \<I> t t'; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 3. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 4. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
case (Equality M\<^sub>0 \<I> A t')
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
Unifier \<I> t' t'_
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<langle>a_: t' \<doteq> t'_\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<langle>a_: t' \<doteq> t'_\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (4 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t t' a ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; Unifier \<I> t t'; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
 3. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 4. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
Unifier \<I> t' t'_
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<langle>a_: t' \<doteq> t'_\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<langle>a_: t' \<doteq> t'_\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<langle>a_: t' \<doteq> t'_\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
using decomp_rm\<^sub>e\<^sub>s\<^sub>t_append ik\<^sub>e\<^sub>s\<^sub>t_append
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
Unifier \<I> t' t'_
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<langle>a_: t' \<doteq> t'_\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<langle>a_: t' \<doteq> t'_\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
decomp_rm\<^sub>e\<^sub>s\<^sub>t (?S @ ?S') = decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S @ decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S'
ik\<^sub>e\<^sub>s\<^sub>t (?A @ ?B) = ik\<^sub>e\<^sub>s\<^sub>t ?A \<union> ik\<^sub>e\<^sub>s\<^sub>t ?B

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<langle>a_: t' \<doteq> t'_\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<langle>a_: t' \<doteq> t'_\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t

goal (3 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 3. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 3. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
case (Inequality M\<^sub>0 \<I> A t')
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
ineq_model \<I> t' F_
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<forall>t'\<langle>\<or>\<noteq>: F_\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<forall>t'\<langle>\<or>\<noteq>: F_\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (3 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S X F t. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ineq_model \<I> X F; t \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 3. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
ineq_model \<I> t' F_
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<forall>t'\<langle>\<or>\<noteq>: F_\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<forall>t'\<langle>\<or>\<noteq>: F_\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<forall>t'\<langle>\<or>\<noteq>: F_\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
using decomp_rm\<^sub>e\<^sub>s\<^sub>t_append ik\<^sub>e\<^sub>s\<^sub>t_append
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
ineq_model \<I> t' F_
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<forall>t'\<langle>\<or>\<noteq>: F_\<rangle>\<^sub>s\<^sub>t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<forall>t'\<langle>\<or>\<noteq>: F_\<rangle>\<^sub>s\<^sub>t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
decomp_rm\<^sub>e\<^sub>s\<^sub>t (?S @ ?S') = decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S @ decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S'
ik\<^sub>e\<^sub>s\<^sub>t (?A @ ?B) = ik\<^sub>e\<^sub>s\<^sub>t ?A \<union> ik\<^sub>e\<^sub>s\<^sub>t ?B

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<forall>t'\<langle>\<or>\<noteq>: F_\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Step \<forall>t'\<langle>\<or>\<noteq>: F_\<rangle>\<^sub>s\<^sub>t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t

goal (2 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
case (Decompose M\<^sub>0 \<I> A t' K M t)
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t' \<cdot> \<I>
Ana t' = (K, M)
?k2 \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c ?k2 \<cdot> \<I>
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t']) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (2 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
have *: "ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t' \<cdot> \<I>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t' \<cdot> \<I>
[PROOF STEP]
using Decompose.hyps(2)
[PROOF STATE]
proof (prove)
using this:
ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t' \<cdot> \<I>

goal (1 subgoal):
 1. ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t' \<cdot> \<I>
[PROOF STEP]
proof (induction rule: intruder_synth_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
case (AxiomC t'')
[PROOF STATE]
proof (state)
this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
assume "t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>" "t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>"
[PROOF STATE]
proof (state)
this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
hence ?case
[PROOF STATE]
proof (prove)
using this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''
[PROOF STEP]
using Decompose.IH
[PROOF STATE]
proof (prove)
using this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
\<lbrakk>t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
\<lbrakk>t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''

goal (1 subgoal):
 1. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
qed simp
[PROOF STATE]
proof (state)
this:
ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t' \<cdot> \<I>

goal (2 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t' \<cdot> \<I>

goal (2 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
fix k
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
assume "k \<in> set K"
[PROOF STATE]
proof (state)
this:
k \<in> set K

goal (2 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
hence "ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>"
[PROOF STATE]
proof (prove)
using this:
k \<in> set K

goal (1 subgoal):
 1. ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>
[PROOF STEP]
using Decompose.hyps
[PROOF STATE]
proof (prove)
using this:
k \<in> set K
sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> A
ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t' \<cdot> \<I>
Ana t' = (K, M)
?k2 \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c ?k2 \<cdot> \<I>

goal (1 subgoal):
 1. ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>

goal (2 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
hence "ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> k \<cdot> \<I>"
[PROOF STATE]
proof (prove)
using this:
ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>

goal (1 subgoal):
 1. ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> k \<cdot> \<I>
[PROOF STEP]
proof (induction rule: intruder_synth_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
case (AxiomC t'')
[PROOF STATE]
proof (state)
this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
assume "t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>" "t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>"
[PROOF STATE]
proof (state)
this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
hence ?case
[PROOF STATE]
proof (prove)
using this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''
[PROOF STEP]
using Decompose.IH
[PROOF STATE]
proof (prove)
using this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<lbrakk>t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''

goal (2 subgoals):
 1. \<And>t. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
\<lbrakk>t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
\<lbrakk>t'' \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t'' \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t''

goal (1 subgoal):
 1. \<And>T f. \<lbrakk>length T = arity f; public f; \<And>t. t \<in> set T \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t A \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t; \<And>t. t \<in> set T \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) (Fun f T)
[PROOF STEP]
qed simp
[PROOF STATE]
proof (state)
this:
ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> k \<cdot> \<I>

goal (2 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
?k4 \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ?k4 \<cdot> \<I>

goal (2 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
hence **: "\<And>k. k \<in> set (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>) \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> k"
[PROOF STATE]
proof (prove)
using this:
?k4 \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ?k4 \<cdot> \<I>

goal (1 subgoal):
 1. \<And>k. k \<in> set (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>) \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> k
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?k2 \<in> set (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>) \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ?k2

goal (2 subgoals):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
 2. \<And>M\<^sub>0 \<I> S t K M ta. \<lbrakk>sem\<^sub>e\<^sub>s\<^sub>t_c M\<^sub>0 \<I> S; \<And>t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t S \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t S) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t; ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c t \<cdot> \<I>; Ana t = (K, M); \<And>k. k \<in> set K \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t S \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile>\<^sub>c k \<cdot> \<I>; ta \<in> ik\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t]) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ta \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (S @ [Decomp t])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> ta
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
proof (cases "t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (2 subgoals):
 1. t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
 2. t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
using Decompose.IH Decompose.prems(2) decomp_rm\<^sub>e\<^sub>s\<^sub>t_append
[PROOF STATE]
proof (prove)
using this:
t \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
\<lbrakk>?t2 \<in> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; ?t2 \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) ?t2
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
decomp_rm\<^sub>e\<^sub>s\<^sub>t (?S @ ?S') = decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S @ decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S'

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t

goal (1 subgoal):
 1. t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
hence "t \<in> ik\<^sub>s\<^sub>t (decomp t') \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>"
[PROOF STATE]
proof (prove)
using this:
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. t \<in> ik\<^sub>s\<^sub>t (decomp t') \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
[PROOF STEP]
using Decompose.prems(1) ik\<^sub>e\<^sub>s\<^sub>t_append
[PROOF STATE]
proof (prove)
using this:
t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
t \<in> ik\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t']) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
ik\<^sub>e\<^sub>s\<^sub>t (?A @ ?B) = ik\<^sub>e\<^sub>s\<^sub>t ?A \<union> ik\<^sub>e\<^sub>s\<^sub>t ?B

goal (1 subgoal):
 1. t \<in> ik\<^sub>s\<^sub>t (decomp t') \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t \<in> ik\<^sub>s\<^sub>t (decomp t') \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
hence ***: "t \<in> set (M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>)"
[PROOF STATE]
proof (prove)
using this:
t \<in> ik\<^sub>s\<^sub>t (decomp t') \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>

goal (1 subgoal):
 1. t \<in> set (M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>)
[PROOF STEP]
using Decompose.hyps(3) decomp_ik
[PROOF STATE]
proof (prove)
using this:
t \<in> ik\<^sub>s\<^sub>t (decomp t') \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>
Ana t' = (K, M)
Ana ?t = (?K, ?M) \<Longrightarrow> ik\<^sub>s\<^sub>t (decomp ?t) = set ?M

goal (1 subgoal):
 1. t \<in> set (M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
t \<in> set (M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>)

goal (1 subgoal):
 1. t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
hence "M \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
t \<in> set (M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>)

goal (1 subgoal):
 1. M \<noteq> []
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
M \<noteq> []

goal (1 subgoal):
 1. t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
hence ****: "Ana (t' \<cdot> \<I>) = (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>, M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>)"
[PROOF STATE]
proof (prove)
using this:
M \<noteq> []

goal (1 subgoal):
 1. Ana (t' \<cdot> \<I>) = (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>, M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>)
[PROOF STEP]
using Ana_subst[OF Decompose.hyps(3)]
[PROOF STATE]
proof (prove)
using this:
M \<noteq> []
K \<noteq> [] \<or> M \<noteq> [] \<Longrightarrow> Ana (t' \<cdot> ?\<delta>) = (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t ?\<delta>, M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t ?\<delta>)

goal (1 subgoal):
 1. Ana (t' \<cdot> \<I>) = (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>, M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Ana (t' \<cdot> \<I>) = (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>, M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<I>)

goal (1 subgoal):
 1. t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
have "ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
[PROOF STEP]
by (rule intruder_deduct.Decompose[OF * **** ** ***])
[PROOF STATE]
proof (state)
this:
ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t

goal (1 subgoal):
 1. t \<notin> ik\<^sub>e\<^sub>s\<^sub>t A \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<Longrightarrow> intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
using ideduct_mono decomp_rm\<^sub>e\<^sub>s\<^sub>t_append
[PROOF STATE]
proof (prove)
using this:
ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t A) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
\<lbrakk>?M \<turnstile> ?t; ?M \<subseteq> ?M'\<rbrakk> \<Longrightarrow> ?M' \<turnstile> ?t
decomp_rm\<^sub>e\<^sub>s\<^sub>t (?S @ ?S') = decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S @ decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S'

goal (1 subgoal):
 1. intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
intruder_deduct (ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t (A @ [Decomp t'])) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>) t

goal (1 subgoal):
 1. \<And>M\<^sub>0 \<I> t. \<lbrakk>t \<in> ik\<^sub>e\<^sub>s\<^sub>t [] \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>; t \<notin> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I>\<rbrakk> \<Longrightarrow> ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t []) \<union> M\<^sub>0 \<cdot>\<^sub>s\<^sub>e\<^sub>t \<I> \<turnstile> t
[PROOF STEP]
qed simp