[STATEMENT]
lemma new_character_data_get_tag_name_is_l_new_character_data_get_tag_name [instances]:
  "l_new_character_data_get_tag_name get_tag_name_locs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_new_character_data_get_tag_name get_tag_name_locs
[PROOF STEP]
unfolding l_new_character_data_get_tag_name_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>h new_character_data_ptr h' r ptr'. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> r \<in> get_tag_name_locs ptr' \<longrightarrow> r h h'
[PROOF STEP]
unfolding get_tag_name_locs_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>h new_character_data_ptr h' r ptr'. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> r \<in> {preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr' tag_name)} \<longrightarrow> r h h'
[PROOF STEP]
using new_character_data_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?h \<turnstile> new_character_data \<rightarrow>\<^sub>h ?h'; ?h \<turnstile> new_character_data \<rightarrow>\<^sub>r ?new_character_data_ptr\<rbrakk> \<Longrightarrow> preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ?ptr ?getter) ?h ?h'

goal (1 subgoal):
 1. \<forall>h new_character_data_ptr h' r ptr'. h \<turnstile> new_character_data \<rightarrow>\<^sub>r new_character_data_ptr \<longrightarrow> h \<turnstile> new_character_data \<rightarrow>\<^sub>h h' \<longrightarrow> r \<in> {preserved (get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr' tag_name)} \<longrightarrow> r h h'
[PROOF STEP]
by blast


[STATEMENT]
lemma PO_m2_inv2_keys_for_trans [iff]:
  "{m2_inv2_keys_for \<inter> m2_inv1_keys} trans m2 {> m2_inv2_keys_for}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {m2_inv2_keys_for \<inter> m2_inv1_keys} TS.trans m2 {> m2_inv2_keys_for}
[PROOF STEP]
apply (auto simp add: PO_hoare_defs m2_defs intro!: m2_inv2_keys_forI)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>R xa xb xc xe. \<lbrakk>xa \<in> m2_inv2_keys_for; xa \<in> m2_inv1_keys; runs xa xe = Some (Resp, [xb, xc], []); StatCh secure Sv xc (Msg [aKey (sesK (R $ sk)), aAgt xb]) \<in> chan xa; R \<notin> dom (runs xa)\<rbrakk> \<Longrightarrow> R = xe
 2. \<And>R xa xb xc xe xi. \<lbrakk>xa \<in> m2_inv2_keys_for; xa \<in> m2_inv1_keys; runs xa xe = Some (Resp, [xb, xc], []); StatCh secure Sv xc (Msg [aKey xi, aAgt xb]) \<in> chan xa; R \<notin> dom (runs xa); sesK (R $ sk) \<in> keys_for (chan xa)\<rbrakk> \<Longrightarrow> R = xe
 3. \<And>R xa xb xc xd xh. \<lbrakk>xa \<in> m2_inv2_keys_for; xa \<in> m2_inv1_keys; runs xa xd = Some (Init, [xb, xc], [aKey (sesK (R $ sk))]); dAuth (sesK (R $ sk)) (Msg [aNon xh]) \<in> chan xa; R \<notin> dom (runs xa)\<rbrakk> \<Longrightarrow> R = xd
 4. \<And>R xa xb xc xd xh xi. \<lbrakk>xa \<in> m2_inv2_keys_for; xa \<in> m2_inv1_keys; runs xa xd = Some (Init, [xb, xc], [aKey xi]); dAuth xi (Msg [aNon xh]) \<in> chan xa; R \<notin> dom (runs xa); sesK (R $ sk) \<in> keys_for (chan xa)\<rbrakk> \<Longrightarrow> R = xd
 5. \<And>R xa. \<lbrakk>sesK (R $ sk) \<in> keys_for (fake ik0 (dom (runs xa)) (chan xa)); xa \<in> m2_inv2_keys_for; xa \<in> m2_inv1_keys\<rbrakk> \<Longrightarrow> R \<in> dom (runs xa)
[PROOF STEP]
apply (auto dest!: m2_inv2_keys_forD dest: m2_inv1_keysD dest: dom_lemmas)
\<comment> \<open>2 subgoals, from step 4 and fake\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>R xa xb xc xe. \<lbrakk>xa \<in> m2_inv2_keys_for; xa \<in> m2_inv1_keys; runs xa xe = Some (Resp, [xb, xc], []); StatCh secure Sv xc (Msg [aKey (sesK (R $ sk)), aAgt xb]) \<in> chan xa; R \<notin> dom (runs xa)\<rbrakk> \<Longrightarrow> R = xe
 2. \<And>R xa. \<lbrakk>sesK (R $ sk) \<in> keys_for (fake ik0 (dom (runs xa)) (chan xa)); xa \<in> m2_inv2_keys_for; xa \<in> m2_inv1_keys\<rbrakk> \<Longrightarrow> R \<in> dom (runs xa)
[PROOF STEP]
apply (rename_tac R xa xb xc xe)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>R xa xb xc xe. \<lbrakk>xa \<in> m2_inv2_keys_for; xa \<in> m2_inv1_keys; runs xa xe = Some (Resp, [xb, xc], []); StatCh secure Sv xc (Msg [aKey (sesK (R $ sk)), aAgt xb]) \<in> chan xa; R \<notin> dom (runs xa)\<rbrakk> \<Longrightarrow> R = xe
 2. \<And>R xa. \<lbrakk>sesK (R $ sk) \<in> keys_for (fake ik0 (dom (runs xa)) (chan xa)); xa \<in> m2_inv2_keys_for; xa \<in> m2_inv1_keys\<rbrakk> \<Longrightarrow> R \<in> dom (runs xa)
[PROOF STEP]
apply (subgoal_tac "aKey (sesK (R$sk)) \<in> atoms (chan xa)",
       auto dest!: m2_inv1_keysD dest: dom_lemmas)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>R xa. \<lbrakk>sesK (R $ sk) \<in> keys_for (fake ik0 (dom (runs xa)) (chan xa)); xa \<in> m2_inv2_keys_for; xa \<in> m2_inv1_keys\<rbrakk> \<Longrightarrow> R \<in> dom (runs xa)
[PROOF STEP]
apply (auto simp add: keys_for_def, erule fake.cases, fastforce+)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma dghm_tdghm_comp_is_tdghm:
  assumes "\<HH> : \<BB> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>" and "\<NN> : \<FF> \<mapsto>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<BB>"
  shows "\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN> : \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF> \<mapsto>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN> : \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF> \<mapsto>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN> : \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF> \<mapsto>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
[PROOF STEP]
interpret \<HH>: is_dghm \<alpha> \<BB> \<CC> \<HH>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<HH> : \<BB> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
[PROOF STEP]
by (rule assms(1))
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN> : \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF> \<mapsto>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
[PROOF STEP]
interpret \<NN>: is_tdghm \<alpha> \<AA> \<BB> \<FF> \<GG> \<NN>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<NN> : \<FF> \<mapsto>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<BB>
[PROOF STEP]
by (rule assms(2))
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN> : \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF> \<mapsto>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN> : \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF> \<mapsto>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
[PROOF STEP]
proof(rule is_tdghmI)
[PROOF STATE]
proof (state)
goal (12 subgoals):
 1. \<Z> \<alpha>
 2. vfsequence (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)
 3. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
 4. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
 5. vcard (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>) = 5\<^sub>\<nat>
 6. vsv ((\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>)
 7. \<D>\<^sub>\<circ> ((\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>) = \<AA>\<lparr>Obj\<rparr>
 8. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTDom\<rparr> = \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF>
 9. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTCod\<rparr> = \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG>
 10. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTDGDom\<rparr> = \<AA>
A total of 12 subgoals...
[PROOF STEP]
show "vfsequence (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vfsequence (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)
[PROOF STEP]
unfolding dghm_tdghm_comp_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vfsequence [\<lambda>a\<in>\<^sub>\<circ>\<NN>\<lparr>NTDGDom\<rparr>\<lparr>Obj\<rparr>. \<HH>\<lparr>ArrMap\<rparr>\<lparr>\<NN>\<lparr>NTMap\<rparr>\<lparr>a\<rparr>\<rparr>, \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>\<lparr>NTDom\<rparr>, \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>\<lparr>NTCod\<rparr>, \<NN>\<lparr>NTDGDom\<rparr>, \<HH>\<lparr>HomCod\<rparr>]\<^sub>\<circ>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
vfsequence (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)

goal (11 subgoals):
 1. \<Z> \<alpha>
 2. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
 3. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
 4. vcard (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>) = 5\<^sub>\<nat>
 5. vsv ((\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>)
 6. \<D>\<^sub>\<circ> ((\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>) = \<AA>\<lparr>Obj\<rparr>
 7. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTDom\<rparr> = \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF>
 8. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTCod\<rparr> = \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG>
 9. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTDGDom\<rparr> = \<AA>
 10. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTDGCod\<rparr> = \<CC>
A total of 11 subgoals...
[PROOF STEP]
show "vcard (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>) = 5\<^sub>\<nat>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vcard (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>) = 5\<^sub>\<nat>
[PROOF STEP]
unfolding dghm_tdghm_comp_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vcard [\<lambda>a\<in>\<^sub>\<circ>\<NN>\<lparr>NTDGDom\<rparr>\<lparr>Obj\<rparr>. \<HH>\<lparr>ArrMap\<rparr>\<lparr>\<NN>\<lparr>NTMap\<rparr>\<lparr>a\<rparr>\<rparr>, \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>\<lparr>NTDom\<rparr>, \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>\<lparr>NTCod\<rparr>, \<NN>\<lparr>NTDGDom\<rparr>, \<HH>\<lparr>HomCod\<rparr>]\<^sub>\<circ> = 5\<^sub>\<nat>
[PROOF STEP]
by (simp add: nat_omega_simps)
[PROOF STATE]
proof (state)
this:
vcard (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>) = 5\<^sub>\<nat>

goal (10 subgoals):
 1. \<Z> \<alpha>
 2. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
 3. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
 4. vsv ((\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>)
 5. \<D>\<^sub>\<circ> ((\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>) = \<AA>\<lparr>Obj\<rparr>
 6. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTDom\<rparr> = \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF>
 7. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTCod\<rparr> = \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG>
 8. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTDGDom\<rparr> = \<AA>
 9. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTDGCod\<rparr> = \<CC>
 10. \<And>a. a \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr> \<Longrightarrow> (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>\<lparr>a\<rparr> : (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF>)\<lparr>ObjMap\<rparr>\<lparr>a\<rparr> \<mapsto>\<^bsub>\<CC>\<^esub> (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG>)\<lparr>ObjMap\<rparr>\<lparr>a\<rparr>
[PROOF STEP]
show "(\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>\<lparr>a\<rparr> :
      (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF>)\<lparr>ObjMap\<rparr>\<lparr>a\<rparr> \<mapsto>\<^bsub>\<CC>\<^esub> (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG>)\<lparr>ObjMap\<rparr>\<lparr>a\<rparr>"
      if "a \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>" for a
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>\<lparr>a\<rparr> : (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF>)\<lparr>ObjMap\<rparr>\<lparr>a\<rparr> \<mapsto>\<^bsub>\<CC>\<^esub> (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG>)\<lparr>ObjMap\<rparr>\<lparr>a\<rparr>
[PROOF STEP]
by (use that in \<open>cs_concl cs_simp: dg_cs_simps cs_intro: dg_cs_intros\<close>)
[PROOF STATE]
proof (state)
this:
?a \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr> \<Longrightarrow> (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>\<lparr>?a\<rparr> : (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF>)\<lparr>ObjMap\<rparr>\<lparr>?a\<rparr> \<mapsto>\<^bsub>\<CC>\<^esub> (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG>)\<lparr>ObjMap\<rparr>\<lparr>?a\<rparr>

goal (9 subgoals):
 1. \<Z> \<alpha>
 2. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
 3. \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>
 4. vsv ((\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>)
 5. \<D>\<^sub>\<circ> ((\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTMap\<rparr>) = \<AA>\<lparr>Obj\<rparr>
 6. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTDom\<rparr> = \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF>
 7. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTCod\<rparr> = \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG>
 8. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTDGDom\<rparr> = \<AA>
 9. (\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN>)\<lparr>NTDGCod\<rparr> = \<CC>
[PROOF STEP]
qed (cs_concl cs_simp: dg_cs_simps cs_intro: dg_cs_intros)+
[PROOF STATE]
proof (state)
this:
\<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<NN> : \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<FF> \<mapsto>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<HH> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M \<GG> : \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<CC>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Pairkey_certificate_authentic:
    "\<lbrakk> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs);
         Card A \<notin> cloned; evs \<in> sr \<rbrakk>
     \<Longrightarrow> Pk = Pairkey(A,B) \<and>
         Says Server A \<lbrace>Nonce Pk,
                        Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace>
           \<in> set evs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs); Card A \<notin> cloned; evs \<in> sr\<rbrakk> \<Longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs
[PROOF STEP]
apply (erule rev_mp, erule sr.induct)
[PROOF STATE]
proof (prove)
goal (20 subgoals):
 1. Card A \<notin> cloned \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy []) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set []
 2. \<And>evsF X Ba Aa. \<lbrakk>Card A \<notin> cloned; evsF \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evsF) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evsF; X \<in> synth (analz (knows Spy evsF)); illegalUse (Card Ba)\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Says Spy Aa X # Inputs Spy (Card Ba) X # evsF)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Says Spy Aa X # Inputs Spy (Card Ba) X # evsF)
 3. \<And>evsFo Nb Aa Ba. \<lbrakk>Card A \<notin> cloned; evsFo \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evsFo) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evsFo; Nonce Nb \<in> analz (knows Spy evsFo); Key (pairK (Aa, Ba)) \<in> knows Spy evsFo\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Notes Spy (Key (sesK (Nb, pairK (Aa, Ba)))) # evsFo)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Notes Spy (Key (sesK (Nb, pairK (Aa, Ba)))) # evsFo)
 4. \<And>evsR Aa Ba X. \<lbrakk>Card A \<notin> cloned; evsR \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evsR) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evsR; Says Aa Ba X \<in> set evsR\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Gets Ba X # evsR)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Gets Ba X # evsR)
 5. \<And>evs1 Aa Ba. \<lbrakk>Card A \<notin> cloned; evs1 \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs1; Aa \<noteq> Server\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1)
 6. \<And>evs2 Aa Ba. \<lbrakk>Card A \<notin> cloned; evs2 \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs2; Gets Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Says Server Aa \<lbrace>Nonce (Pairkey (Aa, Ba)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, Ba)), Agent Ba\<rbrace>\<rbrace> # evs2)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Says Server Aa \<lbrace>Nonce (Pairkey (Aa, Ba)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, Ba)), Agent Ba\<rbrace>\<rbrace> # evs2)
 7. \<And>evs3 Aa Ba Pka Certificate. \<lbrakk>Card A \<notin> cloned; evs3 \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs3; legalUse Card Aa; Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs3; Gets Aa \<lbrace>Nonce Pka, Certificate\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Inputs Aa (Card Aa) (Agent Aa) # evs3)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Inputs Aa (Card Aa) (Agent Aa) # evs3)
 8. \<And>evs4 Aa Na. \<lbrakk>Card A \<notin> cloned; evs4 \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs4; Aa \<noteq> Server; Nonce Na \<notin> used evs4; legalUse Card Aa; Inputs Aa (Card Aa) (Agent Aa) \<in> set evs4\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Outpts (Card Aa) Aa \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Outpts (Card Aa) Aa \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4)
 9. \<And>evs4F Na Aa. \<lbrakk>Card A \<notin> cloned; evs4F \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs4F) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs4F; Nonce Na \<notin> used evs4F; illegalUse (Card Aa); Inputs Spy (Card Aa) (Agent Aa) \<in> set evs4F\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Outpts (Card Aa) Spy \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4F)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Outpts (Card Aa) Spy \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4F)
 10. \<And>evs5 Aa Na Certificate Ba. \<lbrakk>Card A \<notin> cloned; evs5 \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs5) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs5; Outpts (Card Aa) Aa \<lbrace>Nonce Na, Certificate\<rbrace> \<in> set evs5; \<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Says Aa Ba \<lbrace>Agent Aa, Nonce Na\<rbrace> # evs5)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Says Aa Ba \<lbrace>Agent Aa, Nonce Na\<rbrace> # evs5)
A total of 20 subgoals...
[PROOF STEP]
apply parts_prepare
[PROOF STATE]
proof (prove)
goal (27 subgoals):
 1. \<And>evsF X Ba Aa. \<lbrakk>Card A \<notin> cloned; evsF \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evsF) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evsF; X \<in> synth (analz (knows Spy evsF)); illegalUse (Card Ba)\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Says Spy Aa X # Inputs Spy (Card Ba) X # evsF)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Says Spy Aa X # Inputs Spy (Card Ba) X # evsF)
 2. \<And>evsFo Nb Aa Ba. \<lbrakk>Card A \<notin> cloned; evsFo \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evsFo) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evsFo; Nonce Nb \<in> analz (knows Spy evsFo); Key (pairK (Aa, Ba)) \<in> knows Spy evsFo\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Notes Spy (Key (sesK (Nb, pairK (Aa, Ba)))) # evsFo)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Notes Spy (Key (sesK (Nb, pairK (Aa, Ba)))) # evsFo)
 3. \<And>evsR Aa Ba X. \<lbrakk>Card A \<notin> cloned; evsR \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evsR) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evsR; Says Aa Ba X \<in> set evsR\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Gets Ba X # evsR)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Gets Ba X # evsR)
 4. \<And>evs1 Aa Ba. \<lbrakk>Card A \<notin> cloned; evs1 \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs1) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs1; Aa \<noteq> Server\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> # evs1)
 5. \<And>evs2 Aa Ba. \<lbrakk>Card A \<notin> cloned; evs2 \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs2) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs2; Gets Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Says Server Aa \<lbrace>Nonce (Pairkey (Aa, Ba)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, Ba)), Agent Ba\<rbrace>\<rbrace> # evs2)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Says Server Aa \<lbrace>Nonce (Pairkey (Aa, Ba)), Crypt (shrK Aa) \<lbrace>Nonce (Pairkey (Aa, Ba)), Agent Ba\<rbrace>\<rbrace> # evs2)
 6. \<And>evs3 Aa Ba Pka Certificate. \<lbrakk>Card A \<notin> cloned; evs3 \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs3) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs3; legalUse Card Aa; Says Aa Server \<lbrace>Agent Aa, Agent Ba\<rbrace> \<in> set evs3; Gets Aa \<lbrace>Nonce Pka, Certificate\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Inputs Aa (Card Aa) (Agent Aa) # evs3)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Inputs Aa (Card Aa) (Agent Aa) # evs3)
 7. \<And>evs4 Aa Na. \<lbrakk>Card A \<notin> cloned; evs4 \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs4) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs4; Aa \<noteq> Server; Nonce Na \<notin> used evs4; legalUse Card Aa; Inputs Aa (Card Aa) (Agent Aa) \<in> set evs4\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Outpts (Card Aa) Aa \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Outpts (Card Aa) Aa \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4)
 8. \<And>evs4F Na Aa. \<lbrakk>Card A \<notin> cloned; evs4F \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs4F) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs4F; Nonce Na \<notin> used evs4F; illegalUse (Card Aa); Inputs Spy (Card Aa) (Agent Aa) \<in> set evs4F\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Outpts (Card Aa) Spy \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4F)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Outpts (Card Aa) Spy \<lbrace>Nonce Na, Crypt (crdK (Card Aa)) (Nonce Na)\<rbrace> # evs4F)
 9. \<And>evs5 Aa Na Certificate Ba. \<lbrakk>Card A \<notin> cloned; evs5 \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs5) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs5; Outpts (Card Aa) Aa \<lbrace>Nonce Na, Certificate\<rbrace> \<in> set evs5; \<forall>p q. Certificate \<noteq> \<lbrace>p, q\<rbrace>\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Says Aa Ba \<lbrace>Agent Aa, Nonce Na\<rbrace> # evs5)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Says Aa Ba \<lbrace>Agent Aa, Nonce Na\<rbrace> # evs5)
 10. \<And>evs6 Ba Aa Na. \<lbrakk>Card A \<notin> cloned; evs6 \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evs6) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evs6; legalUse Card Ba; Gets Ba \<lbrace>Agent Aa, Nonce Na\<rbrace> \<in> set evs6\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy (Inputs Ba (Card Ba) \<lbrace>Agent Aa, Nonce Na\<rbrace> # evs6)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set (Inputs Ba (Card Ba) \<lbrace>Agent Aa, Nonce Na\<rbrace> # evs6)
A total of 27 subgoals...
[PROOF STEP]
apply (simp_all (no_asm_simp))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evsF X Ba. \<lbrakk>Card A \<notin> cloned; evsF \<in> sr; Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (knows Spy evsF) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evsF; X \<in> synth (analz (knows Spy evsF)); illegalUse (Card Ba)\<rbrakk> \<Longrightarrow> Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace> \<in> parts (insert X (knows Spy evsF)) \<longrightarrow> Pk = Pairkey (A, B) \<and> Says Server A \<lbrace>Nonce Pk, Crypt (shrK A) \<lbrace>Nonce Pk, Agent B\<rbrace>\<rbrace> \<in> set evsF
[PROOF STEP]
apply spy_analz
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma Person_allInstances_generic_oclIsKindOf\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n:
"\<tau> \<Turnstile> ((OclAllInstances_generic pre_post Person)->forAll\<^sub>S\<^sub>e\<^sub>t(X|X .oclIsKindOf(Person)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<tau> \<Turnstile> UML_Set.OclForall (OclAllInstances_generic pre_post Person) OclIsKindOf\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n
[PROOF STEP]
apply(simp add: OclValid_def del: OclAllInstances_generic_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. UML_Set.OclForall (OclAllInstances_generic pre_post OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA>) OclIsKindOf\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n \<tau> = true \<tau>
[PROOF STEP]
apply(simp only: UML_Set.OclForall_def refl if_True
                  OclAllInstances_generic_defined[simplified OclValid_def])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> \<tau>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = false \<tau> then false \<tau> else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> \<tau>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = invalid \<tau> then invalid \<tau> else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (OclAllInstances_generic pre_post OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> \<tau>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = null \<tau> then null \<tau> else true \<tau>) = true \<tau>
[PROOF STEP]
apply(simp only: OclAllInstances_generic_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = false \<tau> then false \<tau> else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = invalid \<tau> then invalid \<tau> else if \<exists>x\<in>\<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e (Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e \<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>)\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = null \<tau> then null \<tau> else true \<tau>) = true \<tau>
[PROOF STEP]
apply(subst (1 2 3) Abs_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e_inverse, simp add: bot_option_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = false \<tau> then false \<tau> else if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = invalid \<tau> then invalid \<tau> else if \<exists>x\<in>\<lceil>\<lceil>\<lfloor>\<lfloor>Some ` (OclAsType\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_\<AA> ` ran (heap (pre_post \<tau>)) - {\<bottom>})\<rfloor>\<rfloor>\<rceil>\<rceil>. \<lambda>_. x.oclIsKindOf(Person) \<tau> = null \<tau> then null \<tau> else true \<tau>) = true \<tau>
[PROOF STEP]
by(simp add: OclIsKindOf\<^sub>P\<^sub>e\<^sub>r\<^sub>s\<^sub>o\<^sub>n_Person)


[STATEMENT]
lemma matches_iiface_constrain:
       "normalized_nnf_match m \<Longrightarrow> ipassmt_sanity_nowildcards ipassmt \<Longrightarrow>
        (\<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)) \<Longrightarrow>
        matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p \<longleftrightarrow> matches (common_matcher, \<alpha>) m a p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>normalized_nnf_match m; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p
[PROOF STEP]
proof(induction m)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>x. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>m. \<lbrakk>\<lbrakk>normalized_nnf_match m; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p; normalized_nnf_match (MatchNot m); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchNot m)) a p = matches (common_matcher, \<alpha>) (MatchNot m) a p
 3. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
 4. \<lbrakk>normalized_nnf_match MatchAny; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt MatchAny) a p = matches (common_matcher, \<alpha>) MatchAny a p
[PROOF STEP]
case MatchAny
[PROOF STATE]
proof (state)
this:
normalized_nnf_match MatchAny
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)

goal (4 subgoals):
 1. \<And>x. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>m. \<lbrakk>\<lbrakk>normalized_nnf_match m; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p; normalized_nnf_match (MatchNot m); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchNot m)) a p = matches (common_matcher, \<alpha>) (MatchNot m) a p
 3. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
 4. \<lbrakk>normalized_nnf_match MatchAny; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt MatchAny) a p = matches (common_matcher, \<alpha>) MatchAny a p
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
normalized_nnf_match MatchAny
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)

goal (1 subgoal):
 1. matches (common_matcher, \<alpha>) (iiface_constrain ipassmt MatchAny) a p = matches (common_matcher, \<alpha>) MatchAny a p
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
matches (common_matcher, \<alpha>) (iiface_constrain ipassmt MatchAny) a p = matches (common_matcher, \<alpha>) MatchAny a p

goal (3 subgoals):
 1. \<And>x. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>m. \<lbrakk>\<lbrakk>normalized_nnf_match m; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p; normalized_nnf_match (MatchNot m); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchNot m)) a p = matches (common_matcher, \<alpha>) (MatchNot m) a p
 3. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>m. \<lbrakk>\<lbrakk>normalized_nnf_match m; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p; normalized_nnf_match (MatchNot m); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchNot m)) a p = matches (common_matcher, \<alpha>) (MatchNot m) a p
 3. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
[PROOF STEP]
case (MatchNot m)
[PROOF STATE]
proof (state)
this:
\<lbrakk>normalized_nnf_match m; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p
normalized_nnf_match (MatchNot m)
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)

goal (3 subgoals):
 1. \<And>x. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>m. \<lbrakk>\<lbrakk>normalized_nnf_match m; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p; normalized_nnf_match (MatchNot m); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchNot m)) a p = matches (common_matcher, \<alpha>) (MatchNot m) a p
 3. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
[PROOF STEP]
hence IH: "normalized_nnf_match m \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>normalized_nnf_match m; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p
normalized_nnf_match (MatchNot m)
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)

goal (1 subgoal):
 1. normalized_nnf_match m \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
normalized_nnf_match m \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p

goal (3 subgoals):
 1. \<And>x. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>m. \<lbrakk>\<lbrakk>normalized_nnf_match m; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p; normalized_nnf_match (MatchNot m); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchNot m)) a p = matches (common_matcher, \<alpha>) (MatchNot m) a p
 3. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
[PROOF STEP]
with MatchNot.prems IH
[PROOF STATE]
proof (chain)
picking this:
normalized_nnf_match (MatchNot m)
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)
normalized_nnf_match m \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p
normalized_nnf_match m \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
normalized_nnf_match (MatchNot m)
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)
normalized_nnf_match m \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p
normalized_nnf_match m \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m) a p = matches (common_matcher, \<alpha>) m a p

goal (1 subgoal):
 1. matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchNot m)) a p = matches (common_matcher, \<alpha>) (MatchNot m) a p
[PROOF STEP]
by(induction m) (simp_all add: iiface_constrain_matches_Primitive)
[PROOF STATE]
proof (state)
this:
matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchNot m)) a p = matches (common_matcher, \<alpha>) (MatchNot m) a p

goal (2 subgoals):
 1. \<And>x. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
[PROOF STEP]
case(Match x)
[PROOF STATE]
proof (state)
this:
normalized_nnf_match (Match x)
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)

goal (2 subgoals):
 1. \<And>x. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
normalized_nnf_match (Match x)
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)

goal (1 subgoal):
 1. matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
[PROOF STEP]
proof(cases x)
[PROOF STATE]
proof (state)
goal (11 subgoals):
 1. \<And>x1. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Src x1\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>x2. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Dst x2\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 3. \<And>x3. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = IIface x3\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 4. \<And>x4. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = OIface x4\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 5. \<And>x5. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Prot x5\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 6. \<And>x6. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Src_Ports x6\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 7. \<And>x7. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Dst_Ports x7\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 8. \<And>x8. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = MultiportPorts x8\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 9. \<And>x9. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = L4_Flags x9\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 10. \<And>x10. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = CT_State x10\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
A total of 11 subgoals...
[PROOF STEP]
case (IIface ifce)
[PROOF STATE]
proof (state)
this:
x = IIface ifce

goal (11 subgoals):
 1. \<And>x1. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Src x1\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>x2. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Dst x2\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 3. \<And>x3. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = IIface x3\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 4. \<And>x4. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = OIface x4\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 5. \<And>x5. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Prot x5\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 6. \<And>x6. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Src_Ports x6\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 7. \<And>x7. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Dst_Ports x7\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 8. \<And>x8. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = MultiportPorts x8\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 9. \<And>x9. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = L4_Flags x9\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 10. \<And>x10. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = CT_State x10\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
A total of 11 subgoals...
[PROOF STEP]
with Match
[PROOF STATE]
proof (chain)
picking this:
normalized_nnf_match (Match x)
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)
x = IIface ifce
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
normalized_nnf_match (Match x)
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)
x = IIface ifce

goal (1 subgoal):
 1. matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
[PROOF STEP]
using matches_ipassmt_iface_constrain_srcip_mexpr_case_Iface
[PROOF STATE]
proof (prove)
using this:
normalized_nnf_match (Match x)
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)
x = IIface ifce
\<lbrakk>ipassmt_sanity_nowildcards ?ipassmt; \<And>ips. ?ipassmt (Iface (p_iiface ?p)) = Some ips \<Longrightarrow> p_src ?p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, ?\<alpha>) (ipassmt_iface_constrain_srcip_mexpr ?ipassmt ?ifce) ?a ?p = matches (common_matcher, ?\<alpha>) (Match (IIface ?ifce)) ?a ?p

goal (1 subgoal):
 1. matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p

goal (10 subgoals):
 1. \<And>x1. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Src x1\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 2. \<And>x2. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Dst x2\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 3. \<And>x4. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = OIface x4\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 4. \<And>x5. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Prot x5\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 5. \<And>x6. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Src_Ports x6\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 6. \<And>x7. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Dst_Ports x7\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 7. \<And>x8. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = MultiportPorts x8\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 8. \<And>x9. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = L4_Flags x9\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 9. \<And>x10. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = CT_State x10\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
 10. \<And>x11. \<lbrakk>normalized_nnf_match (Match x); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips); x = Extra x11\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p
[PROOF STEP]
qed(simp_all)
[PROOF STATE]
proof (state)
this:
matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (Match x)) a p = matches (common_matcher, \<alpha>) (Match x) a p

goal (1 subgoal):
 1. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
[PROOF STEP]
case (MatchAnd m1 m2)
[PROOF STATE]
proof (state)
this:
\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p
\<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p
normalized_nnf_match (MatchAnd m1 m2)
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)

goal (1 subgoal):
 1. \<And>m1 m2. \<lbrakk>\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p; \<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p; normalized_nnf_match (MatchAnd m1 m2); ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>normalized_nnf_match m1; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m1) a p = matches (common_matcher, \<alpha>) m1 a p
\<lbrakk>normalized_nnf_match m2; ipassmt_sanity_nowildcards ipassmt; \<And>ips. ipassmt (Iface (p_iiface p)) = Some ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ips)\<rbrakk> \<Longrightarrow> matches (common_matcher, \<alpha>) (iiface_constrain ipassmt m2) a p = matches (common_matcher, \<alpha>) m2 a p
normalized_nnf_match (MatchAnd m1 m2)
ipassmt_sanity_nowildcards ipassmt
ipassmt (Iface (p_iiface p)) = Some ?ips \<Longrightarrow> p_src p \<in> ipcidr_union_set (set ?ips)

goal (1 subgoal):
 1. matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p
[PROOF STEP]
by(simp add: bunch_of_lemmata_about_matches)
[PROOF STATE]
proof (state)
this:
matches (common_matcher, \<alpha>) (iiface_constrain ipassmt (MatchAnd m1 m2)) a p = matches (common_matcher, \<alpha>) (MatchAnd m1 m2) a p

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma wf_prog_compPI:
assumes lift:
  "\<And>C M Ts T m.
    \<lbrakk> P \<turnstile> C sees M:Ts\<rightarrow>T = \<lfloor>m\<rfloor> in C; wf_mdecl wf\<^sub>1 P C (M,Ts,T,\<lfloor>m\<rfloor>) \<rbrakk>
    \<Longrightarrow> wf_mdecl wf\<^sub>2 (compP f P) C (M,Ts,T, \<lfloor>f C M Ts T m\<rfloor>)"
and wf: "wf_prog wf\<^sub>1 P"
shows "wf_prog wf\<^sub>2 (compP f P)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf_prog wf\<^sub>2 (compP f P)
[PROOF STEP]
using wf
[PROOF STATE]
proof (prove)
using this:
wf_prog wf\<^sub>1 P

goal (1 subgoal):
 1. wf_prog wf\<^sub>2 (compP f P)
[PROOF STEP]
apply (clarsimp simp add:wf_prog_def2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>C a aa b ab ac ba. \<lbrakk>wf_syscls P; \<forall>C a aa b. class P C = \<lfloor>(a, aa, b)\<rfloor> \<longrightarrow> wf_cdecl wf\<^sub>1 P (C, a, aa, b); distinct_fst (classes P); class P C = \<lfloor>(ab, ac, ba)\<rfloor>; snd (compC f (C, ab, ac, ba)) = (a, aa, b)\<rbrakk> \<Longrightarrow> wf_cdecl wf\<^sub>2 (compP f P) (C, a, aa, b)
[PROOF STEP]
apply(rule wf_cdecl_compPI[OF lift], assumption+)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>C a aa b ab ac ba. \<lbrakk>wf_syscls P; \<forall>C a aa b. class P C = \<lfloor>(a, aa, b)\<rfloor> \<longrightarrow> wf_cdecl wf\<^sub>1 P (C, a, aa, b); distinct_fst (classes P); class P C = \<lfloor>(ab, ac, ba)\<rfloor>; snd (compC f (C, ab, ac, ba)) = (a, aa, b)\<rbrakk> \<Longrightarrow> \<forall>C rest. class P C = \<lfloor>rest\<rfloor> \<longrightarrow> wf_cdecl wf\<^sub>1 P (C, rest)
 2. \<And>C a aa b ab ac ba. \<lbrakk>wf_syscls P; \<forall>C a aa b. class P C = \<lfloor>(a, aa, b)\<rfloor> \<longrightarrow> wf_cdecl wf\<^sub>1 P (C, a, aa, b); distinct_fst (classes P); class P C = \<lfloor>(ab, ac, ba)\<rfloor>; snd (compC f (C, ab, ac, ba)) = (a, aa, b)\<rbrakk> \<Longrightarrow> class (compP f P) C = \<lfloor>(a, aa, b)\<rfloor>
 3. \<And>C a aa b ab ac ba. \<lbrakk>wf_syscls P; \<forall>C a aa b. class P C = \<lfloor>(a, aa, b)\<rfloor> \<longrightarrow> wf_cdecl wf\<^sub>1 P (C, a, aa, b); distinct_fst (classes P); class P C = \<lfloor>(ab, ac, ba)\<rfloor>; snd (compC f (C, ab, ac, ba)) = (a, aa, b)\<rbrakk> \<Longrightarrow> wf_prog (?p14 C a aa b ab ac ba) P
[PROOF STEP]
apply(auto intro: wf)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma lift_into_qmsg:
  assumes "A \<Turnstile> (otherwith S {i} (orecvmsg R), other U {i} \<rightarrow>) global P"
      and "\<And>\<xi>. U \<xi> \<xi>"
      and "\<And>\<xi> \<xi>'. S \<xi> \<xi>' \<Longrightarrow> U \<xi> \<xi>'"
      and "\<And>\<sigma> \<sigma>' m. \<lbrakk> \<forall>j. U (\<sigma> j) (\<sigma>' j); R \<sigma> m \<rbrakk> \<Longrightarrow> R \<sigma>' m"
      and "A \<Turnstile>\<^sub>A (otherwith S {i} (orecvmsg R), other U {i} \<rightarrow>)
                 globala (\<lambda>(\<sigma>, _, \<sigma>'). U (\<sigma> i) (\<sigma>' i))"
    shows "A \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile> (otherwith S {i} (orecvmsg R), other U {i} \<rightarrow>) global P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile> (otherwith S {i} (orecvmsg R), other U {i} \<rightarrow>) global P
[PROOF STEP]
proof (rule oinvariant_oreachableI)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<sigma> s. (\<sigma>, s) \<in> oreachable (A \<langle>\<langle>\<^bsub>i\<^esub> qmsg) (otherwith S {i} (orecvmsg R)) (other U {i}) \<Longrightarrow> global P (\<sigma>, s)
[PROOF STEP]
fix \<sigma> \<zeta>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<sigma> s. (\<sigma>, s) \<in> oreachable (A \<langle>\<langle>\<^bsub>i\<^esub> qmsg) (otherwith S {i} (orecvmsg R)) (other U {i}) \<Longrightarrow> global P (\<sigma>, s)
[PROOF STEP]
assume "(\<sigma>, \<zeta>) \<in> oreachable (A \<langle>\<langle>\<^bsub>i\<^esub> qmsg) (otherwith S {i} (orecvmsg R)) (other U {i})"
[PROOF STATE]
proof (state)
this:
(\<sigma>, \<zeta>) \<in> oreachable (A \<langle>\<langle>\<^bsub>i\<^esub> qmsg) (otherwith S {i} (orecvmsg R)) (other U {i})

goal (1 subgoal):
 1. \<And>\<sigma> s. (\<sigma>, s) \<in> oreachable (A \<langle>\<langle>\<^bsub>i\<^esub> qmsg) (otherwith S {i} (orecvmsg R)) (other U {i}) \<Longrightarrow> global P (\<sigma>, s)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<sigma>, \<zeta>) \<in> oreachable (A \<langle>\<langle>\<^bsub>i\<^esub> qmsg) (otherwith S {i} (orecvmsg R)) (other U {i})
[PROOF STEP]
obtain s where "(\<sigma>, s) \<in> oreachable A (otherwith S {i} (orecvmsg R)) (other U {i})"
[PROOF STATE]
proof (prove)
using this:
(\<sigma>, \<zeta>) \<in> oreachable (A \<langle>\<langle>\<^bsub>i\<^esub> qmsg) (otherwith S {i} (orecvmsg R)) (other U {i})

goal (1 subgoal):
 1. (\<And>s. (\<sigma>, s) \<in> oreachable A (otherwith S {i} (orecvmsg R)) (other U {i}) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (auto dest!: par_qmsg_oreachable [OF _ assms(5,2-4)])
[PROOF STATE]
proof (state)
this:
(\<sigma>, s) \<in> oreachable A (otherwith S {i} (orecvmsg R)) (other U {i})

goal (1 subgoal):
 1. \<And>\<sigma> s. (\<sigma>, s) \<in> oreachable (A \<langle>\<langle>\<^bsub>i\<^esub> qmsg) (otherwith S {i} (orecvmsg R)) (other U {i}) \<Longrightarrow> global P (\<sigma>, s)
[PROOF STEP]
with assms(1)
[PROOF STATE]
proof (chain)
picking this:
A \<Turnstile> (otherwith S {i} (orecvmsg R), other U {i} \<rightarrow>) global P
(\<sigma>, s) \<in> oreachable A (otherwith S {i} (orecvmsg R)) (other U {i})
[PROOF STEP]
show "global P (\<sigma>, \<zeta>)"
[PROOF STATE]
proof (prove)
using this:
A \<Turnstile> (otherwith S {i} (orecvmsg R), other U {i} \<rightarrow>) global P
(\<sigma>, s) \<in> oreachable A (otherwith S {i} (orecvmsg R)) (other U {i})

goal (1 subgoal):
 1. global P (\<sigma>, \<zeta>)
[PROOF STEP]
by (auto dest: oinvariant_weakenD [OF assms(1)])
[PROOF STATE]
proof (state)
this:
global P (\<sigma>, \<zeta>)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "\<FF> \<F> \<Longrightarrow> lCoPw(\<^bold>\<rightarrow>)(\<^bold>\<not>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<FF> \<F> \<Longrightarrow> lCoPw (\<^bold>\<rightarrow>) \<^bold>\<not>
[PROOF STEP]
nitpick
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<FF> \<F> \<Longrightarrow> lCoPw (\<^bold>\<rightarrow>) \<^bold>\<not>
[PROOF STEP]
oops


[STATEMENT]
lemma delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M_ptr_in_heap:
  assumes "h \<turnstile> delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M shadow_root_ptr \<rightarrow>\<^sub>h h'"
  shows "shadow_root_ptr |\<in>| shadow_root_ptr_kinds h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. shadow_root_ptr |\<in>| shadow_root_ptr_kinds h
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
h \<turnstile> delete_M shadow_root_ptr \<rightarrow>\<^sub>h h'

goal (1 subgoal):
 1. shadow_root_ptr |\<in>| shadow_root_ptr_kinds h
[PROOF STEP]
by(auto simp add: delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M_def delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def split: if_splits)


[STATEMENT]
lemma stat_overrides_commonD:
"\<lbrakk>G\<turnstile>new overrides\<^sub>S old\<rbrakk> \<Longrightarrow>
  declclass new \<noteq> Object \<and> \<not> is_static new \<and> msig new = msig old \<and>
  G\<turnstile>(declclass new) \<prec>\<^sub>C (declclass old) \<and>
  G\<turnstile>Method new declared_in (declclass new) \<and>
  G\<turnstile>Method old declared_in (declclass old)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. G \<turnstile> new overrides\<^sub>S old \<Longrightarrow> declclass new \<noteq> Object \<and> \<not> is_static new \<and> msig new = msig old \<and> G\<turnstile>declclass new\<prec>\<^sub>C declclass old \<and> G\<turnstile>Method new declared_in declclass new \<and> G\<turnstile>Method old declared_in declclass old
[PROOF STEP]
apply (induct set: stat_overridesR)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>new old superNew. \<lbrakk>\<not> is_static new; msig new = msig old; G\<turnstile>Method new declared_in declclass new; G\<turnstile>Method old declared_in declclass old; G \<turnstile>Method old inheritable_in pid (declclass new) ; G\<turnstile>declclass new\<prec>\<^sub>C1superNew; G \<turnstile>Method old member_of superNew\<rbrakk> \<Longrightarrow> declclass new \<noteq> Object \<and> \<not> is_static new \<and> msig new = msig old \<and> G\<turnstile>declclass new\<prec>\<^sub>C declclass old \<and> G\<turnstile>Method new declared_in declclass new \<and> G\<turnstile>Method old declared_in declclass old
 2. \<And>new intr old. \<lbrakk>G \<turnstile> new overrides\<^sub>S intr; declclass new \<noteq> Object \<and> \<not> is_static new \<and> msig new = msig intr \<and> G\<turnstile>declclass new\<prec>\<^sub>C declclass intr \<and> G\<turnstile>Method new declared_in declclass new \<and> G\<turnstile>Method intr declared_in declclass intr; G \<turnstile> intr overrides\<^sub>S old; declclass intr \<noteq> Object \<and> \<not> is_static intr \<and> msig intr = msig old \<and> G\<turnstile>declclass intr\<prec>\<^sub>C declclass old \<and> G\<turnstile>Method intr declared_in declclass intr \<and> G\<turnstile>Method old declared_in declclass old\<rbrakk> \<Longrightarrow> declclass new \<noteq> Object \<and> \<not> is_static new \<and> msig new = msig old \<and> G\<turnstile>declclass new\<prec>\<^sub>C declclass old \<and> G\<turnstile>Method new declared_in declclass new \<and> G\<turnstile>Method old declared_in declclass old
[PROOF STEP]
apply (frule (1) stat_override_declclasses_relation)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>new old superNew. \<lbrakk>\<not> is_static new; msig new = msig old; G\<turnstile>Method new declared_in declclass new; G\<turnstile>Method old declared_in declclass old; G \<turnstile>Method old inheritable_in pid (declclass new) ; G\<turnstile>declclass new\<prec>\<^sub>C1superNew; G \<turnstile>Method old member_of superNew; G\<turnstile>declclass new\<prec>\<^sub>C declclass old\<rbrakk> \<Longrightarrow> declclass new \<noteq> Object \<and> \<not> is_static new \<and> msig new = msig old \<and> G\<turnstile>declclass new\<prec>\<^sub>C declclass old \<and> G\<turnstile>Method new declared_in declclass new \<and> G\<turnstile>Method old declared_in declclass old
 2. \<And>new intr old. \<lbrakk>G \<turnstile> new overrides\<^sub>S intr; declclass new \<noteq> Object \<and> \<not> is_static new \<and> msig new = msig intr \<and> G\<turnstile>declclass new\<prec>\<^sub>C declclass intr \<and> G\<turnstile>Method new declared_in declclass new \<and> G\<turnstile>Method intr declared_in declclass intr; G \<turnstile> intr overrides\<^sub>S old; declclass intr \<noteq> Object \<and> \<not> is_static intr \<and> msig intr = msig old \<and> G\<turnstile>declclass intr\<prec>\<^sub>C declclass old \<and> G\<turnstile>Method intr declared_in declclass intr \<and> G\<turnstile>Method old declared_in declclass old\<rbrakk> \<Longrightarrow> declclass new \<noteq> Object \<and> \<not> is_static new \<and> msig new = msig old \<and> G\<turnstile>declclass new\<prec>\<^sub>C declclass old \<and> G\<turnstile>Method new declared_in declclass new \<and> G\<turnstile>Method old declared_in declclass old
[PROOF STEP]
apply (auto intro: trancl_trans)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma lossless_WT_gpv_induct_strong [consumes 2, case_names lossless_gpv]:
  assumes lossless: "lossless_gpv \<I> gpv"
  and WT: "\<I> \<turnstile>g gpv \<surd>"
  and step: "\<And>p. \<lbrakk> lossless_spmf p;
       \<And>out c. IO out c \<in> set_spmf p \<Longrightarrow> out \<in> outs_\<I> \<I>;
       \<And>gpv. gpv \<in> sub_gpvs \<I> (GPV p) \<Longrightarrow> lossless_gpv \<I> gpv;
       \<And>gpv. gpv \<in> sub_gpvs \<I> (GPV p) \<Longrightarrow> \<I> \<turnstile>g gpv \<surd>;
       \<And>gpv. gpv \<in> sub_gpvs \<I> (GPV p) \<Longrightarrow> P gpv \<rbrakk>
      \<Longrightarrow> P (GPV p)"
  shows "P gpv"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P gpv
[PROOF STEP]
using lossless WT
[PROOF STATE]
proof (prove)
using this:
lossless_gpv \<I> gpv
\<I> \<turnstile>g gpv \<surd>

goal (1 subgoal):
 1. P gpv
[PROOF STEP]
apply(induction rule: lossless_gpv_induct_strong)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>p. \<lbrakk>lossless_spmf p; \<And>gpv. gpv \<in> sub_gpvs \<I> (GPV p) \<Longrightarrow> lossless_gpv \<I> gpv; \<And>gpv. \<lbrakk>gpv \<in> sub_gpvs \<I> (GPV p); \<I> \<turnstile>g gpv \<surd>\<rbrakk> \<Longrightarrow> P gpv; \<I> \<turnstile>g GPV p \<surd>\<rbrakk> \<Longrightarrow> P (GPV p)
[PROOF STEP]
apply(erule step)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>p out c. \<lbrakk>\<And>gpv. gpv \<in> sub_gpvs \<I> (GPV p) \<Longrightarrow> lossless_gpv \<I> gpv; \<And>gpv. \<lbrakk>gpv \<in> sub_gpvs \<I> (GPV p); \<I> \<turnstile>g gpv \<surd>\<rbrakk> \<Longrightarrow> P gpv; \<I> \<turnstile>g GPV p \<surd>; IO out c \<in> set_spmf p\<rbrakk> \<Longrightarrow> out \<in> outs_\<I> \<I>
 2. \<And>p gpv. \<lbrakk>\<And>gpv. gpv \<in> sub_gpvs \<I> (GPV p) \<Longrightarrow> lossless_gpv \<I> gpv; \<And>gpv. \<lbrakk>gpv \<in> sub_gpvs \<I> (GPV p); \<I> \<turnstile>g gpv \<surd>\<rbrakk> \<Longrightarrow> P gpv; \<I> \<turnstile>g GPV p \<surd>; gpv \<in> sub_gpvs \<I> (GPV p)\<rbrakk> \<Longrightarrow> lossless_gpv \<I> gpv
 3. \<And>p gpv. \<lbrakk>\<And>gpv. gpv \<in> sub_gpvs \<I> (GPV p) \<Longrightarrow> lossless_gpv \<I> gpv; \<And>gpv. \<lbrakk>gpv \<in> sub_gpvs \<I> (GPV p); \<I> \<turnstile>g gpv \<surd>\<rbrakk> \<Longrightarrow> P gpv; \<I> \<turnstile>g GPV p \<surd>; gpv \<in> sub_gpvs \<I> (GPV p)\<rbrakk> \<Longrightarrow> \<I> \<turnstile>g gpv \<surd>
 4. \<And>p gpv. \<lbrakk>\<And>gpv. gpv \<in> sub_gpvs \<I> (GPV p) \<Longrightarrow> lossless_gpv \<I> gpv; \<And>gpv. \<lbrakk>gpv \<in> sub_gpvs \<I> (GPV p); \<I> \<turnstile>g gpv \<surd>\<rbrakk> \<Longrightarrow> P gpv; \<I> \<turnstile>g GPV p \<surd>; gpv \<in> sub_gpvs \<I> (GPV p)\<rbrakk> \<Longrightarrow> P gpv
[PROOF STEP]
apply(auto elim: WT_gpvD dest: WT_sub_gpvsD)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "(x \<parallel> y) \<cdot> d z = (x \<cdot> d z) \<parallel> (y \<cdot> d z)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<parallel> y \<cdot> d z = x \<cdot> d z \<parallel> (y \<cdot> d z)
[PROOF STEP]
nitpick
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<parallel> y \<cdot> d z = x \<cdot> d z \<parallel> (y \<cdot> d z)
[PROOF STEP]
oops