[STATEMENT]
theorem pan_confidentiality_signed:
 "[|Pan (pan C) \<in> analz(knows Spy evs);  C = Cardholder k;
    CardSecret k \<noteq> 0;  evs \<in> set_pur|]
  ==> \<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign.
      Says C M \<lbrace>\<lbrace>PIDualSign_1,
                   EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>,
       OIDualSign\<rbrace> \<in> set evs  \<and>  P \<in> bad"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Pan (pan C) \<in> analz (knows Spy evs); C = Cardholder k; CardSecret k \<noteq> 0; evs \<in> set_pur\<rbrakk> \<Longrightarrow> \<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evs \<and> P \<in> bad
[PROOF STEP]
apply (erule rev_mp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evs \<in> set_pur\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy evs) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evs \<and> P \<in> bad)
[PROOF STEP]
apply (erule set_pur.induct)
[PROOF STATE]
proof (prove)
goal (12 subgoals):
 1. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy []) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set [] \<and> P \<in> bad)
 2. \<And>evsf X B. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsf \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsf) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsf \<and> P \<in> bad); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Spy B X # evsf)) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Spy B X # evsf) \<and> P \<in> bad)
 3. \<And>evsr A B X. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsr \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsr) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsr \<and> P \<in> bad); Says A B X \<in> set evsr\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Gets B X # evsr)) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Gets B X # evsr) \<and> P \<in> bad)
 4. \<And>evsStart LID_M Ca ka M i P j Transaction OrderDesc PurchAmt. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsStart \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsStart) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsStart \<and> P \<in> bad); Number LID_M \<notin> used evsStart; Ca = Cardholder ka; M = Merchant i; P = PG j; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; LID_M \<notin> range CardSecret; LID_M \<notin> range PANSecret\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> # Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> # evsStart)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> # Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> # evsStart) \<and> Pa \<in> bad)
 5. \<And>evsPIReq Transaction M Ca OrderDesc PurchAmt Chall_C LID_M. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPIReq \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPIReq) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPIReq \<and> P \<in> bad); Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; Nonce Chall_C \<notin> used evsPIReq; Chall_C \<notin> range CardSecret; Chall_C \<notin> range PANSecret; Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> \<in> set evsPIReq\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> # evsPIReq)) \<longrightarrow> (\<exists>P Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> # evsPIReq) \<and> P \<in> bad)
 6. \<And>evsPIRes M LID_M Chall_C Transaction Ca OrderDesc PurchAmt P Chall_M XID. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPIRes \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPIRes) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPIRes \<and> P \<in> bad); Gets M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPIRes; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> \<in> set evsPIRes; Nonce Chall_M \<notin> used evsPIRes; Chall_M \<notin> range CardSecret; Chall_M \<notin> range PANSecret; Number XID \<notin> used evsPIRes; XID \<notin> range CardSecret; XID \<notin> range PANSecret\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) # evsPIRes)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) # evsPIRes) \<and> Pa \<in> bad)
 7. \<And>Ca ka KC1 Transaction M HOD OIData LID_M PIHead EKj Chall_C Chall_M OrderDesc P PurchAmt XID evsPReqU. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPReqU \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPReqU) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqU \<and> P \<in> bad); Ca = Cardholder ka; CardSecret ka = 0; Key KC1 \<notin> used evsPReqU; KC1 \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; PIHead = \<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent M\<rbrace>; Gets Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqU; Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqU; Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> \<in> set evsPReqU\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Ca M \<lbrace>EXHcrypt KC1 EKj \<lbrace>PIHead, Hash OIData\<rbrace> (Pan (pan Ca)), OIData, Hash \<lbrace>PIHead, Pan (pan Ca)\<rbrace>\<rbrace> # Notes Ca \<lbrace>Key KC1, Agent M\<rbrace> # evsPReqU)) \<longrightarrow> (\<exists>P Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Ca M \<lbrace>EXHcrypt KC1 EKj \<lbrace>PIHead, Hash OIData\<rbrace> (Pan (pan Ca)), OIData, Hash \<lbrace>PIHead, Pan (pan Ca)\<rbrace>\<rbrace> # Notes Ca \<lbrace>Key KC1, Agent M\<rbrace> # evsPReqU) \<and> P \<in> bad)
 8. \<And>Ca Chall_C Chall_M EKj HOD KC2 LID_M M OIData OIDualSigned OrderDesc P PANData PIData PIDualSigned PIHead PurchAmt Transaction XID evsPReqS ka. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPReqS \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS \<and> P \<in> bad); Ca = Cardholder ka; CardSecret ka \<noteq> 0; Key KC2 \<notin> used evsPReqS; KC2 \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; PIHead = \<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>; PANData = \<lbrace>Pan (pan Ca), Nonce (PANSecret ka)\<rbrace>; PIData = \<lbrace>PIHead, PANData\<rbrace>; PIDualSigned = \<lbrace>sign (priSK Ca) \<lbrace>Hash PIData, Hash OIData\<rbrace>, EXcrypt KC2 EKj \<lbrace>PIHead, Hash OIData\<rbrace> PANData\<rbrace>; OIDualSigned = \<lbrace>OIData, Hash PIData\<rbrace>; Gets Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqS; Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqS; Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> \<in> set evsPReqS\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Ca M \<lbrace>PIDualSigned, OIDualSigned\<rbrace> # Notes Ca \<lbrace>Key KC2, Agent M\<rbrace> # evsPReqS)) \<longrightarrow> (\<exists>P Ma KC2a PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2a (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Ca M \<lbrace>PIDualSigned, OIDualSigned\<rbrace> # Notes Ca \<lbrace>Key KC2, Agent M\<rbrace> # evsPReqS) \<and> P \<in> bad)
 9. \<And>evsAReq KM Transaction M Ca OrderDesc PurchAmt HOD OIData LID_M XID Chall_C Chall_M ka P_I HPIData encPANData P EKj. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsAReq \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsAReq) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsAReq \<and> P \<in> bad); Key KM \<notin> used evsAReq; KM \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; CardSecret ka \<noteq> 0 \<longrightarrow> P_I = \<lbrace>sign (priSK Ca) \<lbrace>HPIData, Hash OIData\<rbrace>, encPANData\<rbrace>; Gets M \<lbrace>P_I, OIData, HPIData\<rbrace> \<in> set evsAReq; Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsAReq; Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> \<in> set evsAReq\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says M P (EncB (priSK M) KM (pubEK P) \<lbrace>Number LID_M, Number XID, Hash OIData, HOD\<rbrace> P_I) # evsAReq)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says M P (EncB (priSK M) KM (pubEK P) \<lbrace>Number LID_M, Number XID, Hash OIData, HOD\<rbrace> P_I) # evsAReq) \<and> Pa \<in> bad)
 10. \<And>evsAResU Ca ka M i KP KC1 KM PIHead LID_M XID HOD PurchAmt P_I EKj HOIData P. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsAResU \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsAResU) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsAResU \<and> P \<in> bad); Ca = Cardholder ka; M = Merchant i; Key KP \<notin> used evsAResU; KP \<in> symKeys; CardSecret ka = 0; KC1 \<in> symKeys; KM \<in> symKeys; PIHead = \<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent M\<rbrace>; P_I = EXHcrypt KC1 EKj \<lbrace>PIHead, HOIData\<rbrace> (Pan (pan Ca)); Gets P (EncB (priSK M) KM (pubEK P) \<lbrace>Number LID_M, Number XID, HOIData, HOD\<rbrace> P_I) \<in> set evsAResU\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says P M (EncB (priSK P) KP (pubEK M) \<lbrace>Number LID_M, Number XID, Number PurchAmt\<rbrace> authCode) # evsAResU)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says P M (EncB (priSK P) KP (pubEK M) \<lbrace>Number LID_M, Number XID, Number PurchAmt\<rbrace> authCode) # evsAResU) \<and> Pa \<in> bad)
A total of 12 subgoals...
[PROOF STEP]
apply (frule_tac [9] AuthReq_msg_in_analz_spies) \<comment> \<open>AReq\<close>
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy []) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set [] \<and> P \<in> bad)
 2. \<And>evsf X B. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsf \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsf) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsf \<and> P \<in> bad); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Spy B X # evsf)) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Spy B X # evsf) \<and> P \<in> bad)
 3. \<And>evsr A B X. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsr \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsr) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsr \<and> P \<in> bad); Says A B X \<in> set evsr\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Gets B X # evsr)) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Gets B X # evsr) \<and> P \<in> bad)
 4. \<And>evsStart LID_M Ca ka M i P j Transaction OrderDesc PurchAmt. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsStart \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsStart) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsStart \<and> P \<in> bad); Number LID_M \<notin> used evsStart; Ca = Cardholder ka; M = Merchant i; P = PG j; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; LID_M \<notin> range CardSecret; LID_M \<notin> range PANSecret\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> # Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> # evsStart)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> # Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> # evsStart) \<and> Pa \<in> bad)
 5. \<And>evsPIReq Transaction M Ca OrderDesc PurchAmt Chall_C LID_M. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPIReq \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPIReq) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPIReq \<and> P \<in> bad); Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; Nonce Chall_C \<notin> used evsPIReq; Chall_C \<notin> range CardSecret; Chall_C \<notin> range PANSecret; Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> \<in> set evsPIReq\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> # evsPIReq)) \<longrightarrow> (\<exists>P Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> # evsPIReq) \<and> P \<in> bad)
 6. \<And>evsPIRes M LID_M Chall_C Transaction Ca OrderDesc PurchAmt P Chall_M XID. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPIRes \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPIRes) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPIRes \<and> P \<in> bad); Gets M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPIRes; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> \<in> set evsPIRes; Nonce Chall_M \<notin> used evsPIRes; Chall_M \<notin> range CardSecret; Chall_M \<notin> range PANSecret; Number XID \<notin> used evsPIRes; XID \<notin> range CardSecret; XID \<notin> range PANSecret\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) # evsPIRes)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) # evsPIRes) \<and> Pa \<in> bad)
 7. \<And>Ca ka KC1 Transaction M HOD OIData LID_M PIHead EKj Chall_C Chall_M OrderDesc P PurchAmt XID evsPReqU. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPReqU \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPReqU) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqU \<and> P \<in> bad); Ca = Cardholder ka; CardSecret ka = 0; Key KC1 \<notin> used evsPReqU; KC1 \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; PIHead = \<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent M\<rbrace>; Gets Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqU; Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqU; Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> \<in> set evsPReqU\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Ca M \<lbrace>EXHcrypt KC1 EKj \<lbrace>PIHead, Hash OIData\<rbrace> (Pan (pan Ca)), OIData, Hash \<lbrace>PIHead, Pan (pan Ca)\<rbrace>\<rbrace> # Notes Ca \<lbrace>Key KC1, Agent M\<rbrace> # evsPReqU)) \<longrightarrow> (\<exists>P Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Ca M \<lbrace>EXHcrypt KC1 EKj \<lbrace>PIHead, Hash OIData\<rbrace> (Pan (pan Ca)), OIData, Hash \<lbrace>PIHead, Pan (pan Ca)\<rbrace>\<rbrace> # Notes Ca \<lbrace>Key KC1, Agent M\<rbrace> # evsPReqU) \<and> P \<in> bad)
 8. \<And>Ca Chall_C Chall_M EKj HOD KC2 LID_M M OIData OIDualSigned OrderDesc P PANData PIData PIDualSigned PIHead PurchAmt Transaction XID evsPReqS ka. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPReqS \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS \<and> P \<in> bad); Ca = Cardholder ka; CardSecret ka \<noteq> 0; Key KC2 \<notin> used evsPReqS; KC2 \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; PIHead = \<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>; PANData = \<lbrace>Pan (pan Ca), Nonce (PANSecret ka)\<rbrace>; PIData = \<lbrace>PIHead, PANData\<rbrace>; PIDualSigned = \<lbrace>sign (priSK Ca) \<lbrace>Hash PIData, Hash OIData\<rbrace>, EXcrypt KC2 EKj \<lbrace>PIHead, Hash OIData\<rbrace> PANData\<rbrace>; OIDualSigned = \<lbrace>OIData, Hash PIData\<rbrace>; Gets Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqS; Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqS; Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> \<in> set evsPReqS\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Ca M \<lbrace>PIDualSigned, OIDualSigned\<rbrace> # Notes Ca \<lbrace>Key KC2, Agent M\<rbrace> # evsPReqS)) \<longrightarrow> (\<exists>P Ma KC2a PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2a (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Ca M \<lbrace>PIDualSigned, OIDualSigned\<rbrace> # Notes Ca \<lbrace>Key KC2, Agent M\<rbrace> # evsPReqS) \<and> P \<in> bad)
 9. \<And>evsAReq KM Transaction M Ca OrderDesc PurchAmt HOD OIData LID_M XID Chall_C Chall_M ka P_I HPIData encPANData P EKj. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsAReq \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsAReq) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsAReq \<and> P \<in> bad); Key KM \<notin> used evsAReq; KM \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; CardSecret ka \<noteq> 0 \<longrightarrow> P_I = \<lbrace>sign (priSK Ca) \<lbrace>HPIData, Hash OIData\<rbrace>, encPANData\<rbrace>; Gets M \<lbrace>P_I, OIData, HPIData\<rbrace> \<in> set evsAReq; Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsAReq; Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> \<in> set evsAReq\<rbrakk> \<Longrightarrow> evsAReq \<in> set_pur
 10. \<And>evsAReq KM Transaction M Ca OrderDesc PurchAmt HOD OIData LID_M XID Chall_C Chall_M ka P_I HPIData encPANData P EKj. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsAReq \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsAReq) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsAReq \<and> P \<in> bad); Key KM \<notin> used evsAReq; KM \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; CardSecret ka \<noteq> 0 \<longrightarrow> P_I = \<lbrace>sign (priSK Ca) \<lbrace>HPIData, Hash OIData\<rbrace>, encPANData\<rbrace>; Gets M \<lbrace>P_I, OIData, HPIData\<rbrace> \<in> set evsAReq; Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsAReq; Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> \<in> set evsAReq; P_I \<in> analz (knows Spy evsAReq)\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says M P (EncB (priSK M) KM (pubEK P) \<lbrace>Number LID_M, Number XID, Hash OIData, HOD\<rbrace> P_I) # evsAReq)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says M P (EncB (priSK M) KM (pubEK P) \<lbrace>Number LID_M, Number XID, Hash OIData, HOD\<rbrace> P_I) # evsAReq) \<and> Pa \<in> bad)
A total of 13 subgoals...
[PROOF STEP]
apply (valid_certificate_tac [8]) \<comment> \<open>PReqS\<close>
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy []) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set [] \<and> P \<in> bad)
 2. \<And>evsf X B. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsf \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsf) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsf \<and> P \<in> bad); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Spy B X # evsf)) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Spy B X # evsf) \<and> P \<in> bad)
 3. \<And>evsr A B X. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsr \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsr) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsr \<and> P \<in> bad); Says A B X \<in> set evsr\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Gets B X # evsr)) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Gets B X # evsr) \<and> P \<in> bad)
 4. \<And>evsStart LID_M Ca ka M i P j Transaction OrderDesc PurchAmt. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsStart \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsStart) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsStart \<and> P \<in> bad); Number LID_M \<notin> used evsStart; Ca = Cardholder ka; M = Merchant i; P = PG j; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; LID_M \<notin> range CardSecret; LID_M \<notin> range PANSecret\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> # Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> # evsStart)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> # Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> # evsStart) \<and> Pa \<in> bad)
 5. \<And>evsPIReq Transaction M Ca OrderDesc PurchAmt Chall_C LID_M. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPIReq \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPIReq) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPIReq \<and> P \<in> bad); Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; Nonce Chall_C \<notin> used evsPIReq; Chall_C \<notin> range CardSecret; Chall_C \<notin> range PANSecret; Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> \<in> set evsPIReq\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> # evsPIReq)) \<longrightarrow> (\<exists>P Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> # evsPIReq) \<and> P \<in> bad)
 6. \<And>evsPIRes M LID_M Chall_C Transaction Ca OrderDesc PurchAmt P Chall_M XID. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPIRes \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPIRes) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPIRes \<and> P \<in> bad); Gets M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPIRes; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> \<in> set evsPIRes; Nonce Chall_M \<notin> used evsPIRes; Chall_M \<notin> range CardSecret; Chall_M \<notin> range PANSecret; Number XID \<notin> used evsPIRes; XID \<notin> range CardSecret; XID \<notin> range PANSecret\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) # evsPIRes)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) # evsPIRes) \<and> Pa \<in> bad)
 7. \<And>Ca ka KC1 Transaction M HOD OIData LID_M PIHead EKj Chall_C Chall_M OrderDesc P PurchAmt XID evsPReqU. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPReqU \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPReqU) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqU \<and> P \<in> bad); Ca = Cardholder ka; CardSecret ka = 0; Key KC1 \<notin> used evsPReqU; KC1 \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; PIHead = \<lbrace>Number LID_M, Number XID, HOD, Number PurchAmt, Agent M\<rbrace>; Gets Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqU; Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqU; Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> \<in> set evsPReqU\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Ca M \<lbrace>EXHcrypt KC1 EKj \<lbrace>PIHead, Hash OIData\<rbrace> (Pan (pan Ca)), OIData, Hash \<lbrace>PIHead, Pan (pan Ca)\<rbrace>\<rbrace> # Notes Ca \<lbrace>Key KC1, Agent M\<rbrace> # evsPReqU)) \<longrightarrow> (\<exists>P Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Ca M \<lbrace>EXHcrypt KC1 EKj \<lbrace>PIHead, Hash OIData\<rbrace> (Pan (pan Ca)), OIData, Hash \<lbrace>PIHead, Pan (pan Ca)\<rbrace>\<rbrace> # Notes Ca \<lbrace>Key KC1, Agent M\<rbrace> # evsPReqU) \<and> P \<in> bad)
 8. \<And>Ca Chall_C Chall_M EKj HOD KC2 LID_M M OIData OIDualSigned OrderDesc P PANData PIData PIDualSigned PIHead PurchAmt Transaction XID evsPReqS ka. \<lbrakk>CardSecret k \<noteq> 0; evsPReqS \<in> set_pur; Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS \<and> P \<in> bad); CardSecret ka \<noteq> 0; Key KC2 \<notin> used evsPReqS; KC2 \<in> symKeys; Gets (Cardholder ka) (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqS; Says (Cardholder ka) M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqS; Notes (Cardholder ka) \<lbrace>Number LID_M, Agent M, Agent (Cardholder ka), Number OrderDesc, Number PurchAmt\<rbrace> \<in> set evsPReqS; C = Cardholder k\<rbrakk> \<Longrightarrow> Pan (pan (Cardholder k)) \<in> analz (knows Spy (Says (Cardholder ka) M \<lbrace>\<lbrace>sign (priSK (Cardholder ka)) \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>, EXcrypt KC2 (pubEK P) \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> \<lbrace>Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace>, \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace> # Notes (Cardholder ka) \<lbrace>Key KC2, Agent M\<rbrace> # evsPReqS)) \<longrightarrow> (\<exists>Pa Ma KC2a PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2a (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says (Cardholder ka) M \<lbrace>\<lbrace>sign (priSK (Cardholder ka)) \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>, EXcrypt KC2 (pubEK P) \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> \<lbrace>Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace>, \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace> # Notes (Cardholder ka) \<lbrace>Key KC2, Agent M\<rbrace> # evsPReqS) \<and> Pa \<in> bad)
 9. \<And>evsAReq KM Transaction M Ca OrderDesc PurchAmt HOD OIData LID_M XID Chall_C Chall_M ka P_I HPIData encPANData P EKj. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsAReq \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsAReq) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsAReq \<and> P \<in> bad); Key KM \<notin> used evsAReq; KM \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; CardSecret ka \<noteq> 0 \<longrightarrow> P_I = \<lbrace>sign (priSK Ca) \<lbrace>HPIData, Hash OIData\<rbrace>, encPANData\<rbrace>; Gets M \<lbrace>P_I, OIData, HPIData\<rbrace> \<in> set evsAReq; Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsAReq; Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> \<in> set evsAReq\<rbrakk> \<Longrightarrow> evsAReq \<in> set_pur
 10. \<And>evsAReq KM Transaction M Ca OrderDesc PurchAmt HOD OIData LID_M XID Chall_C Chall_M ka P_I HPIData encPANData P EKj. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsAReq \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsAReq) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsAReq \<and> P \<in> bad); Key KM \<notin> used evsAReq; KM \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; CardSecret ka \<noteq> 0 \<longrightarrow> P_I = \<lbrace>sign (priSK Ca) \<lbrace>HPIData, Hash OIData\<rbrace>, encPANData\<rbrace>; Gets M \<lbrace>P_I, OIData, HPIData\<rbrace> \<in> set evsAReq; Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsAReq; Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> \<in> set evsAReq; P_I \<in> analz (knows Spy evsAReq)\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says M P (EncB (priSK M) KM (pubEK P) \<lbrace>Number LID_M, Number XID, Hash OIData, HOD\<rbrace> P_I) # evsAReq)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says M P (EncB (priSK M) KM (pubEK P) \<lbrace>Number LID_M, Number XID, Hash OIData, HOD\<rbrace> P_I) # evsAReq) \<and> Pa \<in> bad)
A total of 13 subgoals...
[PROOF STEP]
apply (valid_certificate_tac [7]) \<comment> \<open>PReqUns\<close>
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy []) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set [] \<and> P \<in> bad)
 2. \<And>evsf X B. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsf \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsf) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsf \<and> P \<in> bad); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Spy B X # evsf)) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Spy B X # evsf) \<and> P \<in> bad)
 3. \<And>evsr A B X. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsr \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsr) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsr \<and> P \<in> bad); Says A B X \<in> set evsr\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Gets B X # evsr)) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Gets B X # evsr) \<and> P \<in> bad)
 4. \<And>evsStart LID_M Ca ka M i P j Transaction OrderDesc PurchAmt. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsStart \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsStart) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsStart \<and> P \<in> bad); Number LID_M \<notin> used evsStart; Ca = Cardholder ka; M = Merchant i; P = PG j; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; LID_M \<notin> range CardSecret; LID_M \<notin> range PANSecret\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> # Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> # evsStart)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> # Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> # evsStart) \<and> Pa \<in> bad)
 5. \<And>evsPIReq Transaction M Ca OrderDesc PurchAmt Chall_C LID_M. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPIReq \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPIReq) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPIReq \<and> P \<in> bad); Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; Nonce Chall_C \<notin> used evsPIReq; Chall_C \<notin> range CardSecret; Chall_C \<notin> range PANSecret; Notes Ca \<lbrace>Number LID_M, Transaction\<rbrace> \<in> set evsPIReq\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> # evsPIReq)) \<longrightarrow> (\<exists>P Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says Ca M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> # evsPIReq) \<and> P \<in> bad)
 6. \<And>evsPIRes M LID_M Chall_C Transaction Ca OrderDesc PurchAmt P Chall_M XID. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsPIRes \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsPIRes) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPIRes \<and> P \<in> bad); Gets M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPIRes; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> \<in> set evsPIRes; Nonce Chall_M \<notin> used evsPIRes; Chall_M \<notin> range CardSecret; Chall_M \<notin> range PANSecret; Number XID \<notin> used evsPIRes; XID \<notin> range CardSecret; XID \<notin> range PANSecret\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) # evsPIRes)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) # evsPIRes) \<and> Pa \<in> bad)
 7. \<And>Ca ka KC1 Transaction M HOD OIData LID_M PIHead EKj Chall_C Chall_M OrderDesc P PurchAmt XID evsPReqU. \<lbrakk>CardSecret k \<noteq> 0; evsPReqU \<in> set_pur; Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqU) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqU \<and> P \<in> bad); CardSecret ka = 0; Key KC1 \<notin> used evsPReqU; KC1 \<in> symKeys; Gets (Cardholder ka) (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqU; Says (Cardholder ka) M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqU; Notes (Cardholder ka) \<lbrace>Number LID_M, Agent M, Agent (Cardholder ka), Number OrderDesc, Number PurchAmt\<rbrace> \<in> set evsPReqU; C = Cardholder k\<rbrakk> \<Longrightarrow> Pan (pan (Cardholder k)) \<in> analz (knows Spy (Says (Cardholder ka) M \<lbrace>EXHcrypt KC1 (pubEK P) \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> (Pan (pan (Cardholder ka))), \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M\<rbrace>, Pan (pan (Cardholder ka))\<rbrace>\<rbrace> # Notes (Cardholder ka) \<lbrace>Key KC1, Agent M\<rbrace> # evsPReqU)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says (Cardholder ka) M \<lbrace>EXHcrypt KC1 (pubEK P) \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> (Pan (pan (Cardholder ka))), \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M\<rbrace>, Pan (pan (Cardholder ka))\<rbrace>\<rbrace> # Notes (Cardholder ka) \<lbrace>Key KC1, Agent M\<rbrace> # evsPReqU) \<and> Pa \<in> bad)
 8. \<And>Ca Chall_C Chall_M EKj HOD KC2 LID_M M OIData OIDualSigned OrderDesc P PANData PIData PIDualSigned PIHead PurchAmt Transaction XID evsPReqS ka. \<lbrakk>CardSecret k \<noteq> 0; evsPReqS \<in> set_pur; Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS \<and> P \<in> bad); CardSecret ka \<noteq> 0; Key KC2 \<notin> used evsPReqS; KC2 \<in> symKeys; Gets (Cardholder ka) (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqS; Says (Cardholder ka) M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqS; Notes (Cardholder ka) \<lbrace>Number LID_M, Agent M, Agent (Cardholder ka), Number OrderDesc, Number PurchAmt\<rbrace> \<in> set evsPReqS; C = Cardholder k\<rbrakk> \<Longrightarrow> Pan (pan (Cardholder k)) \<in> analz (knows Spy (Says (Cardholder ka) M \<lbrace>\<lbrace>sign (priSK (Cardholder ka)) \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>, EXcrypt KC2 (pubEK P) \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> \<lbrace>Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace>, \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace> # Notes (Cardholder ka) \<lbrace>Key KC2, Agent M\<rbrace> # evsPReqS)) \<longrightarrow> (\<exists>Pa Ma KC2a PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2a (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says (Cardholder ka) M \<lbrace>\<lbrace>sign (priSK (Cardholder ka)) \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>, EXcrypt KC2 (pubEK P) \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> \<lbrace>Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace>, \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace> # Notes (Cardholder ka) \<lbrace>Key KC2, Agent M\<rbrace> # evsPReqS) \<and> Pa \<in> bad)
 9. \<And>evsAReq KM Transaction M Ca OrderDesc PurchAmt HOD OIData LID_M XID Chall_C Chall_M ka P_I HPIData encPANData P EKj. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsAReq \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsAReq) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsAReq \<and> P \<in> bad); Key KM \<notin> used evsAReq; KM \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; CardSecret ka \<noteq> 0 \<longrightarrow> P_I = \<lbrace>sign (priSK Ca) \<lbrace>HPIData, Hash OIData\<rbrace>, encPANData\<rbrace>; Gets M \<lbrace>P_I, OIData, HPIData\<rbrace> \<in> set evsAReq; Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsAReq; Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> \<in> set evsAReq\<rbrakk> \<Longrightarrow> evsAReq \<in> set_pur
 10. \<And>evsAReq KM Transaction M Ca OrderDesc PurchAmt HOD OIData LID_M XID Chall_C Chall_M ka P_I HPIData encPANData P EKj. \<lbrakk>C = Cardholder k; CardSecret k \<noteq> 0; evsAReq \<in> set_pur; Pan (pan C) \<in> analz (knows Spy evsAReq) \<longrightarrow> (\<exists>P M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsAReq \<and> P \<in> bad); Key KM \<notin> used evsAReq; KM \<in> symKeys; Transaction = \<lbrace>Agent M, Agent Ca, Number OrderDesc, Number PurchAmt\<rbrace>; HOD = Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>; OIData = \<lbrace>Number LID_M, Number XID, Nonce Chall_C, HOD, Nonce Chall_M\<rbrace>; CardSecret ka \<noteq> 0 \<longrightarrow> P_I = \<lbrace>sign (priSK Ca) \<lbrace>HPIData, Hash OIData\<rbrace>, encPANData\<rbrace>; Gets M \<lbrace>P_I, OIData, HPIData\<rbrace> \<in> set evsAReq; Says M Ca (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P EKj onlyEnc (priSK RCA)\<rbrace>) \<in> set evsAReq; Notes M \<lbrace>Number LID_M, Agent P, Transaction\<rbrace> \<in> set evsAReq; P_I \<in> analz (knows Spy evsAReq)\<rbrakk> \<Longrightarrow> Pan (pan C) \<in> analz (knows Spy (Says M P (EncB (priSK M) KM (pubEK P) \<lbrace>Number LID_M, Number XID, Hash OIData, HOD\<rbrace> P_I) # evsAReq)) \<longrightarrow> (\<exists>Pa Ma KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says C Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan C), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set (Says M P (EncB (priSK M) KM (pubEK P) \<lbrace>Number LID_M, Number XID, Hash OIData, HOD\<rbrace> P_I) # evsAReq) \<and> Pa \<in> bad)
A total of 13 subgoals...
[PROOF STEP]
apply (simp_all
         del: image_insert image_Un imp_disjL
         add: analz_image_keys_simps analz_insert_pan analz_image_pan
              notin_image_iff
              analz_insert_simps analz_image_priEK)
  \<comment> \<open>3 seconds on a 1.6GHz machine\<close>
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>evsf X. \<lbrakk>C = Cardholder k; 0 < CardSecret k; evsf \<in> set_pur; Pan (pan (Cardholder k)) \<in> analz (knows Spy evsf) \<longrightarrow> (\<exists>P. (\<exists>M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsf) \<and> P \<in> bad); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> Pan (pan (Cardholder k)) \<in> analz (insert X (knows Spy evsf)) \<longrightarrow> (\<exists>P. (\<exists>M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsf) \<and> P \<in> bad)
 2. \<And>ka KC1 M LID_M Chall_C Chall_M OrderDesc P PurchAmt XID evsPReqU. \<lbrakk>0 < CardSecret k; evsPReqU \<in> set_pur; Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqU) \<longrightarrow> (\<exists>P. (\<exists>M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqU) \<and> P \<in> bad); CardSecret ka = 0; Key KC1 \<notin> used evsPReqU; KC1 \<in> symKeys; Gets (Cardholder ka) (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqU; Says (Cardholder ka) M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqU; Notes (Cardholder ka) \<lbrace>Number LID_M, Agent M, Agent (Cardholder ka), Number OrderDesc, Number PurchAmt\<rbrace> \<in> set evsPReqU; C = Cardholder k\<rbrakk> \<Longrightarrow> P \<in> bad \<longrightarrow> k = ka \<or> Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqU) \<longrightarrow> (\<exists>P. (\<exists>M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqU) \<and> P \<in> bad)
 3. \<And>Chall_C Chall_M KC2 LID_M M OrderDesc P PurchAmt XID evsPReqS ka. \<lbrakk>0 < CardSecret k; evsPReqS \<in> set_pur; Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>P. (\<exists>M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS) \<and> P \<in> bad); 0 < CardSecret ka; Key KC2 \<notin> used evsPReqS; KC2 \<in> symKeys; Gets (Cardholder ka) (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqS; Says (Cardholder ka) M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqS; Notes (Cardholder ka) \<lbrace>Number LID_M, Agent M, Agent (Cardholder ka), Number OrderDesc, Number PurchAmt\<rbrace> \<in> set evsPReqS; C = Cardholder k\<rbrakk> \<Longrightarrow> (P \<in> bad \<longrightarrow> k = ka \<or> Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>Pa. (\<exists>Ma KC2a PIDualSign_1 PIDualSign_2 other OIDualSign. k = ka \<and> Ma = M \<and> PIDualSign_1 = \<lbrace>\<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>, Crypt (priSK (Cardholder ka)) (Hash \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>)\<rbrace> \<and> KC2a = KC2 \<and> PIDualSign_2 = \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> Pa = P \<and> KC2a = KC2 \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> OIDualSign = \<lbrace>\<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace> \<or> Says (Cardholder k) Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2a (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS) \<and> Pa \<in> bad)) \<and> (P \<notin> bad \<longrightarrow> Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>Pa. (\<exists>Ma KC2a PIDualSign_1 PIDualSign_2 other OIDualSign. k = ka \<and> Ma = M \<and> PIDualSign_1 = \<lbrace>\<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>, Crypt (priSK (Cardholder ka)) (Hash \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>)\<rbrace> \<and> KC2a = KC2 \<and> PIDualSign_2 = \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> Pa = P \<and> KC2a = KC2 \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> OIDualSign = \<lbrace>\<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace> \<or> Says (Cardholder k) Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2a (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS) \<and> Pa \<in> bad))
[PROOF STEP]
apply spy_analz \<comment> \<open>Fake\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ka KC1 M LID_M Chall_C Chall_M OrderDesc P PurchAmt XID evsPReqU. \<lbrakk>0 < CardSecret k; evsPReqU \<in> set_pur; Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqU) \<longrightarrow> (\<exists>P. (\<exists>M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqU) \<and> P \<in> bad); CardSecret ka = 0; Key KC1 \<notin> used evsPReqU; KC1 \<in> symKeys; Gets (Cardholder ka) (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqU; Says (Cardholder ka) M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqU; Notes (Cardholder ka) \<lbrace>Number LID_M, Agent M, Agent (Cardholder ka), Number OrderDesc, Number PurchAmt\<rbrace> \<in> set evsPReqU; C = Cardholder k\<rbrakk> \<Longrightarrow> P \<in> bad \<longrightarrow> k = ka \<or> Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqU) \<longrightarrow> (\<exists>P. (\<exists>M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqU) \<and> P \<in> bad)
 2. \<And>Chall_C Chall_M KC2 LID_M M OrderDesc P PurchAmt XID evsPReqS ka. \<lbrakk>0 < CardSecret k; evsPReqS \<in> set_pur; Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>P. (\<exists>M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS) \<and> P \<in> bad); 0 < CardSecret ka; Key KC2 \<notin> used evsPReqS; KC2 \<in> symKeys; Gets (Cardholder ka) (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqS; Says (Cardholder ka) M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqS; Notes (Cardholder ka) \<lbrace>Number LID_M, Agent M, Agent (Cardholder ka), Number OrderDesc, Number PurchAmt\<rbrace> \<in> set evsPReqS; C = Cardholder k\<rbrakk> \<Longrightarrow> (P \<in> bad \<longrightarrow> k = ka \<or> Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>Pa. (\<exists>Ma KC2a PIDualSign_1 PIDualSign_2 other OIDualSign. k = ka \<and> Ma = M \<and> PIDualSign_1 = \<lbrace>\<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>, Crypt (priSK (Cardholder ka)) (Hash \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>)\<rbrace> \<and> KC2a = KC2 \<and> PIDualSign_2 = \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> Pa = P \<and> KC2a = KC2 \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> OIDualSign = \<lbrace>\<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace> \<or> Says (Cardholder k) Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2a (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS) \<and> Pa \<in> bad)) \<and> (P \<notin> bad \<longrightarrow> Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>Pa. (\<exists>Ma KC2a PIDualSign_1 PIDualSign_2 other OIDualSign. k = ka \<and> Ma = M \<and> PIDualSign_1 = \<lbrace>\<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>, Crypt (priSK (Cardholder ka)) (Hash \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>)\<rbrace> \<and> KC2a = KC2 \<and> PIDualSign_2 = \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> Pa = P \<and> KC2a = KC2 \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> OIDualSign = \<lbrace>\<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace> \<or> Says (Cardholder k) Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2a (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS) \<and> Pa \<in> bad))
[PROOF STEP]
apply force \<comment> \<open>PReqUns: unsigned\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Chall_C Chall_M KC2 LID_M M OrderDesc P PurchAmt XID evsPReqS ka. \<lbrakk>0 < CardSecret k; evsPReqS \<in> set_pur; Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>P. (\<exists>M KC2 PIDualSign_1 PIDualSign_2 other OIDualSign. Says (Cardholder k) M \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2 (pubEK P) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS) \<and> P \<in> bad); 0 < CardSecret ka; Key KC2 \<notin> used evsPReqS; KC2 \<in> symKeys; Gets (Cardholder ka) (sign (priSK M) \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Nonce Chall_M, cert P (pubEK P) onlyEnc (priSK RCA)\<rbrace>) \<in> set evsPReqS; Says (Cardholder ka) M \<lbrace>Number LID_M, Nonce Chall_C\<rbrace> \<in> set evsPReqS; Notes (Cardholder ka) \<lbrace>Number LID_M, Agent M, Agent (Cardholder ka), Number OrderDesc, Number PurchAmt\<rbrace> \<in> set evsPReqS; C = Cardholder k\<rbrakk> \<Longrightarrow> (P \<in> bad \<longrightarrow> k = ka \<or> Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>Pa. (\<exists>Ma KC2a PIDualSign_1 PIDualSign_2 other OIDualSign. k = ka \<and> Ma = M \<and> PIDualSign_1 = \<lbrace>\<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>, Crypt (priSK (Cardholder ka)) (Hash \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>)\<rbrace> \<and> KC2a = KC2 \<and> PIDualSign_2 = \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> Pa = P \<and> KC2a = KC2 \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> OIDualSign = \<lbrace>\<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace> \<or> Says (Cardholder k) Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2a (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS) \<and> Pa \<in> bad)) \<and> (P \<notin> bad \<longrightarrow> Pan (pan (Cardholder k)) \<in> analz (knows Spy evsPReqS) \<longrightarrow> (\<exists>Pa. (\<exists>Ma KC2a PIDualSign_1 PIDualSign_2 other OIDualSign. k = ka \<and> Ma = M \<and> PIDualSign_1 = \<lbrace>\<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>, Crypt (priSK (Cardholder ka)) (Hash \<lbrace>Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace>)\<rbrace> \<and> KC2a = KC2 \<and> PIDualSign_2 = \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Hash \<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>\<rbrace> \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> Pa = P \<and> KC2a = KC2 \<and> k = ka \<and> other = Nonce (PANSecret ka) \<and> OIDualSign = \<lbrace>\<lbrace>Number LID_M, Number XID, Nonce Chall_C, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Nonce Chall_M\<rbrace>, Hash \<lbrace>\<lbrace>Number LID_M, Number XID, Hash \<lbrace>Number OrderDesc, Number PurchAmt\<rbrace>, Number PurchAmt, Agent M, Hash \<lbrace>Number XID, Nonce (CardSecret ka)\<rbrace>\<rbrace>, Pan (pan (Cardholder ka)), Nonce (PANSecret ka)\<rbrace>\<rbrace> \<or> Says (Cardholder k) Ma \<lbrace>\<lbrace>PIDualSign_1, EXcrypt KC2a (pubEK Pa) PIDualSign_2 \<lbrace>Pan (pan (Cardholder k)), other\<rbrace>\<rbrace>, OIDualSign\<rbrace> \<in> set evsPReqS) \<and> Pa \<in> bad))
[PROOF STEP]
apply blast \<comment> \<open>PReqS: signed\<close>
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma marked_insertions_store_ins[simp]:
  "\<lbrakk> marked_insertions s; (\<exists>r'. opt_r' = Some r') \<longrightarrow> marked (the opt_r') s \<rbrakk>
     \<Longrightarrow> marked_insertions
               (s(mutator m := s (mutator m)\<lparr>ghost_honorary_root := {}\<rparr>,
                   sys := s sys
                     \<lparr>mem_store_buffers := (mem_store_buffers (s sys))(mutator m := sys_mem_store_buffers (mutator m) s @ [mw_Mutate r f opt_r'])\<rparr>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>marked_insertions s; (\<exists>r'. opt_r' = Some r') \<longrightarrow> marked (the opt_r') s\<rbrakk> \<Longrightarrow> marked_insertions (s(mutator m := s (mutator m)\<lparr>ghost_honorary_root := {}\<rparr>, sys := s sys\<lparr>mem_store_buffers := (mem_store_buffers (s sys))(mutator m := sys_mem_store_buffers (mutator m) s @ [mw_Mutate r f opt_r'])\<rparr>))
[PROOF STEP]
by (auto simp: marked_insertions_def
        split: mem_store_action.splits option.splits)