[STATEMENT]
lemma analz_image_freshK [rule_format]:
 "evs \<in> otway ==>
   \<forall>K KK. KK \<subseteq> -(range shrK) \<longrightarrow>
          (Key K \<in> analz (Key`KK \<union> (knows Spy evs))) =
          (K \<in> KK | Key K \<in> analz (knows Spy evs))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. evs \<in> otway \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs))
[PROOF STEP]
apply (erule otway.induct)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy [])) = (K \<in> KK \<or> Key K \<in> analz (knows Spy []))
 2. \<And>evsf X B. \<lbrakk>evsf \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evsf)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evsf)); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says Spy B X # evsf))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says Spy B X # evsf)))
 3. \<And>evsr A B X. \<lbrakk>evsr \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evsr)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evsr)); Says A B X \<in> set evsr\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Gets B X # evsr))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Gets B X # evsr)))
 4. \<And>evs1 NA A B. \<lbrakk>evs1 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs1)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs1)); Nonce NA \<notin> used evs1\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says A B \<lbrace>Nonce NA, Agent A, Agent B, Crypt (shrK A) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs1))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says A B \<lbrace>Nonce NA, Agent A, Agent B, Crypt (shrK A) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs1)))
 5. \<And>evs2 NB B NA A X. \<lbrakk>evs2 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs2)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs2)); Nonce NB \<notin> used evs2; Gets B \<lbrace>Nonce NA, Agent A, Agent B, X\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says B Server \<lbrace>Nonce NA, Agent A, Agent B, X, Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs2))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says B Server \<lbrace>Nonce NA, Agent A, Agent B, X, Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs2)))
 6. \<And>evs3 KAB NA A B NB. \<lbrakk>evs3 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs3)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs3)); Key KAB \<notin> used evs3; Gets Server \<lbrace>Nonce NA, Agent A, Agent B, Crypt (shrK A) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>, Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says Server B \<lbrace>Nonce NA, Crypt (shrK A) \<lbrace>Nonce NA, Key KAB\<rbrace>, Crypt (shrK B) \<lbrace>Nonce NB, Key KAB\<rbrace>\<rbrace> # evs3))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says Server B \<lbrace>Nonce NA, Crypt (shrK A) \<lbrace>Nonce NA, Key KAB\<rbrace>, Crypt (shrK B) \<lbrace>Nonce NB, Key KAB\<rbrace>\<rbrace> # evs3)))
 7. \<And>evs4 B NA A X' NB X K. \<lbrakk>evs4 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs4)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs4)); B \<noteq> Server; Says B Server \<lbrace>Nonce NA, Agent A, Agent B, X', Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> \<in> set evs4; Gets B \<lbrace>Nonce NA, X, Crypt (shrK B) \<lbrace>Nonce NB, Key K\<rbrace>\<rbrace> \<in> set evs4\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says B A \<lbrace>Nonce NA, X\<rbrace> # evs4))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says B A \<lbrace>Nonce NA, X\<rbrace> # evs4)))
 8. \<And>evso B NA X NB K. \<lbrakk>evso \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evso)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evso)); Says Server B \<lbrace>Nonce NA, X, Crypt (shrK B) \<lbrace>Nonce NB, Key K\<rbrace>\<rbrace> \<in> set evso\<rbrakk> \<Longrightarrow> \<forall>Ka KK. KK \<subseteq> - range shrK \<longrightarrow> (Key Ka \<in> analz (Key ` KK \<union> knows Spy (Notes Spy \<lbrace>Nonce NA, Nonce NB, Key K\<rbrace> # evso))) = (Ka \<in> KK \<or> Key Ka \<in> analz (knows Spy (Notes Spy \<lbrace>Nonce NA, Nonce NB, Key K\<rbrace> # evso)))
[PROOF STEP]
apply (frule_tac [8] Says_Server_message_form)
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy [])) = (K \<in> KK \<or> Key K \<in> analz (knows Spy []))
 2. \<And>evsf X B. \<lbrakk>evsf \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evsf)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evsf)); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says Spy B X # evsf))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says Spy B X # evsf)))
 3. \<And>evsr A B X. \<lbrakk>evsr \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evsr)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evsr)); Says A B X \<in> set evsr\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Gets B X # evsr))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Gets B X # evsr)))
 4. \<And>evs1 NA A B. \<lbrakk>evs1 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs1)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs1)); Nonce NA \<notin> used evs1\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says A B \<lbrace>Nonce NA, Agent A, Agent B, Crypt (shrK A) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs1))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says A B \<lbrace>Nonce NA, Agent A, Agent B, Crypt (shrK A) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs1)))
 5. \<And>evs2 NB B NA A X. \<lbrakk>evs2 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs2)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs2)); Nonce NB \<notin> used evs2; Gets B \<lbrace>Nonce NA, Agent A, Agent B, X\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says B Server \<lbrace>Nonce NA, Agent A, Agent B, X, Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs2))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says B Server \<lbrace>Nonce NA, Agent A, Agent B, X, Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs2)))
 6. \<And>evs3 KAB NA A B NB. \<lbrakk>evs3 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs3)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs3)); Key KAB \<notin> used evs3; Gets Server \<lbrace>Nonce NA, Agent A, Agent B, Crypt (shrK A) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>, Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says Server B \<lbrace>Nonce NA, Crypt (shrK A) \<lbrace>Nonce NA, Key KAB\<rbrace>, Crypt (shrK B) \<lbrace>Nonce NB, Key KAB\<rbrace>\<rbrace> # evs3))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says Server B \<lbrace>Nonce NA, Crypt (shrK A) \<lbrace>Nonce NA, Key KAB\<rbrace>, Crypt (shrK B) \<lbrace>Nonce NB, Key KAB\<rbrace>\<rbrace> # evs3)))
 7. \<And>evs4 B NA A X' NB X K. \<lbrakk>evs4 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs4)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs4)); B \<noteq> Server; Says B Server \<lbrace>Nonce NA, Agent A, Agent B, X', Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> \<in> set evs4; Gets B \<lbrace>Nonce NA, X, Crypt (shrK B) \<lbrace>Nonce NB, Key K\<rbrace>\<rbrace> \<in> set evs4\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says B A \<lbrace>Nonce NA, X\<rbrace> # evs4))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says B A \<lbrace>Nonce NA, X\<rbrace> # evs4)))
 8. \<And>evso B NA X NB K. \<lbrakk>evso \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evso)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evso)); Says Server B \<lbrace>Nonce NA, X, Crypt (shrK B) \<lbrace>Nonce NB, Key K\<rbrace>\<rbrace> \<in> set evso\<rbrakk> \<Longrightarrow> evso \<in> otway
 9. \<And>evso B NA X NB K. \<lbrakk>evso \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evso)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evso)); Says Server B \<lbrace>Nonce NA, X, Crypt (shrK B) \<lbrace>Nonce NB, Key K\<rbrace>\<rbrace> \<in> set evso; K \<notin> range shrK \<and> (\<exists>i. Nonce NA = Nonce i) \<and> (\<exists>j. Nonce NB = Nonce j)\<rbrakk> \<Longrightarrow> \<forall>Ka KK. KK \<subseteq> - range shrK \<longrightarrow> (Key Ka \<in> analz (Key ` KK \<union> knows Spy (Notes Spy \<lbrace>Nonce NA, Nonce NB, Key K\<rbrace> # evso))) = (Ka \<in> KK \<or> Key Ka \<in> analz (knows Spy (Notes Spy \<lbrace>Nonce NA, Nonce NB, Key K\<rbrace> # evso)))
[PROOF STEP]
apply (drule_tac [7] OR4_analz_knows_Spy)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy [])) = (K \<in> KK \<or> Key K \<in> analz (knows Spy []))
 2. \<And>evsf X B. \<lbrakk>evsf \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evsf)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evsf)); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says Spy B X # evsf))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says Spy B X # evsf)))
 3. \<And>evsr A B X. \<lbrakk>evsr \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evsr)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evsr)); Says A B X \<in> set evsr\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Gets B X # evsr))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Gets B X # evsr)))
 4. \<And>evs1 NA A B. \<lbrakk>evs1 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs1)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs1)); Nonce NA \<notin> used evs1\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says A B \<lbrace>Nonce NA, Agent A, Agent B, Crypt (shrK A) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs1))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says A B \<lbrace>Nonce NA, Agent A, Agent B, Crypt (shrK A) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs1)))
 5. \<And>evs2 NB B NA A X. \<lbrakk>evs2 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs2)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs2)); Nonce NB \<notin> used evs2; Gets B \<lbrace>Nonce NA, Agent A, Agent B, X\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says B Server \<lbrace>Nonce NA, Agent A, Agent B, X, Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs2))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says B Server \<lbrace>Nonce NA, Agent A, Agent B, X, Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> # evs2)))
 6. \<And>evs3 KAB NA A B NB. \<lbrakk>evs3 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs3)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs3)); Key KAB \<notin> used evs3; Gets Server \<lbrace>Nonce NA, Agent A, Agent B, Crypt (shrK A) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>, Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says Server B \<lbrace>Nonce NA, Crypt (shrK A) \<lbrace>Nonce NA, Key KAB\<rbrace>, Crypt (shrK B) \<lbrace>Nonce NB, Key KAB\<rbrace>\<rbrace> # evs3))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says Server B \<lbrace>Nonce NA, Crypt (shrK A) \<lbrace>Nonce NA, Key KAB\<rbrace>, Crypt (shrK B) \<lbrace>Nonce NB, Key KAB\<rbrace>\<rbrace> # evs3)))
 7. \<And>evs4 B NA A X' NB X K. \<lbrakk>evs4 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs4)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs4)); B \<noteq> Server; Says B Server \<lbrace>Nonce NA, Agent A, Agent B, X', Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> \<in> set evs4\<rbrakk> \<Longrightarrow> evs4 \<in> otway
 8. \<And>evs4 B NA A X' NB X K. \<lbrakk>evs4 \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evs4)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evs4)); B \<noteq> Server; Says B Server \<lbrace>Nonce NA, Agent A, Agent B, X', Nonce NB, Crypt (shrK B) \<lbrace>Nonce NA, Agent A, Agent B\<rbrace>\<rbrace> \<in> set evs4; X \<in> analz (knows Spy evs4)\<rbrakk> \<Longrightarrow> \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy (Says B A \<lbrace>Nonce NA, X\<rbrace> # evs4))) = (K \<in> KK \<or> Key K \<in> analz (knows Spy (Says B A \<lbrace>Nonce NA, X\<rbrace> # evs4)))
 9. \<And>evso B NA X NB K. \<lbrakk>evso \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evso)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evso)); Says Server B \<lbrace>Nonce NA, X, Crypt (shrK B) \<lbrace>Nonce NB, Key K\<rbrace>\<rbrace> \<in> set evso\<rbrakk> \<Longrightarrow> evso \<in> otway
 10. \<And>evso B NA X NB K. \<lbrakk>evso \<in> otway; \<forall>K KK. KK \<subseteq> - range shrK \<longrightarrow> (Key K \<in> analz (Key ` KK \<union> knows Spy evso)) = (K \<in> KK \<or> Key K \<in> analz (knows Spy evso)); Says Server B \<lbrace>Nonce NA, X, Crypt (shrK B) \<lbrace>Nonce NB, Key K\<rbrace>\<rbrace> \<in> set evso; K \<notin> range shrK \<and> (\<exists>i. Nonce NA = Nonce i) \<and> (\<exists>j. Nonce NB = Nonce j)\<rbrakk> \<Longrightarrow> \<forall>Ka KK. KK \<subseteq> - range shrK \<longrightarrow> (Key Ka \<in> analz (Key ` KK \<union> knows Spy (Notes Spy \<lbrace>Nonce NA, Nonce NB, Key K\<rbrace> # evso))) = (Ka \<in> KK \<or> Key Ka \<in> analz (knows Spy (Notes Spy \<lbrace>Nonce NA, Nonce NB, Key K\<rbrace> # evso)))
[PROOF STEP]
apply (drule_tac [5] OR2_analz_knows_Spy, analz_freshK, spy_analz, auto)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "ord0(exec as Empty)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ord0 (exec as Empty)
[PROOF STEP]
quickcheck
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ord0 (exec as Empty)
[PROOF STEP]
oops


[STATEMENT]
lemma eefm_clean_mem:
assumes "si' \<le> si"
    and "eq_except_for_mem (\<sigma> with updates) (\<sigma> with updates') a si v b"
  shows "eq_except_for_mem (\<sigma> with ((\<lbrakk>a,si'\<rbrakk> :=\<^sub>m v')#updates)) (\<sigma> with updates') a si v b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eq_except_for_mem (\<sigma> with ((\<lbrakk>a,si'\<rbrakk> :=\<^sub>m v') # updates)) (\<sigma> with updates') a si v b
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
si' \<le> si
eq_except_for_mem (\<sigma> with updates) (\<sigma> with updates') a si v b

goal (1 subgoal):
 1. eq_except_for_mem (\<sigma> with ((\<lbrakk>a,si'\<rbrakk> :=\<^sub>m v') # updates)) (\<sigma> with updates') a si v b
[PROOF STEP]
apply (auto simp add: eq_except_for_mem_def state_with_updates.simps(2) state_update.simps)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>si' \<le> si; (\<sigma> with updates)\<lparr>mem := override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = \<sigma> with updates'; b\<rbrakk> \<Longrightarrow> (\<sigma> with updates)\<lparr>mem := override_on (override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v') (region_addresses a si')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = \<sigma> with updates'
 2. \<lbrakk>si' \<le> si; (\<sigma> with updates)\<lparr>mem := override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = (\<sigma> with updates')\<lparr>mem := override_on (mem (\<sigma> with updates')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr>; \<not> b\<rbrakk> \<Longrightarrow> (\<sigma> with updates)\<lparr>mem := override_on (override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v') (region_addresses a si')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = (\<sigma> with updates')\<lparr>mem := override_on (mem (\<sigma> with updates')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr>
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>si' \<le> si; (\<sigma> with updates)\<lparr>mem := override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = \<sigma> with updates'; b\<rbrakk> \<Longrightarrow> (\<sigma> with updates)\<lparr>mem := override_on (override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v') (region_addresses a si')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = \<sigma> with updates'
[PROOF STEP]
apply (cases "\<sigma> with updates";cases "\<sigma> with updates'";cases "\<sigma>")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>regs mema flags rip regsa memaa flagsa ripa regsb memb flagsb ripb. \<lbrakk>si' \<le> si; (\<sigma> with updates)\<lparr>mem := override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = \<sigma> with updates'; b; \<sigma> with updates = \<lparr>regs = regs, mem = mema, flags = flags, rip = rip\<rparr>; \<sigma> with updates' = \<lparr>regs = regsa, mem = memaa, flags = flagsa, rip = ripa\<rparr>; \<sigma> = \<lparr>regs = regsb, mem = memb, flags = flagsb, rip = ripb\<rparr>\<rbrakk> \<Longrightarrow> (\<sigma> with updates)\<lparr>mem := override_on (override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v') (region_addresses a si')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = \<sigma> with updates'
[PROOF STEP]
by (auto simp add: override_on_def region_addresses_iff)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>si' \<le> si; (\<sigma> with updates)\<lparr>mem := override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = (\<sigma> with updates')\<lparr>mem := override_on (mem (\<sigma> with updates')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr>; \<not> b\<rbrakk> \<Longrightarrow> (\<sigma> with updates)\<lparr>mem := override_on (override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v') (region_addresses a si')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = (\<sigma> with updates')\<lparr>mem := override_on (mem (\<sigma> with updates')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr>
[PROOF STEP]
apply (cases "\<sigma> with updates";cases "\<sigma> with updates'")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>regs mema flags rip regsa memaa flagsa ripa. \<lbrakk>si' \<le> si; (\<sigma> with updates)\<lparr>mem := override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = (\<sigma> with updates')\<lparr>mem := override_on (mem (\<sigma> with updates')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr>; \<not> b; \<sigma> with updates = \<lparr>regs = regs, mem = mema, flags = flags, rip = rip\<rparr>; \<sigma> with updates' = \<lparr>regs = regsa, mem = memaa, flags = flagsa, rip = ripa\<rparr>\<rbrakk> \<Longrightarrow> (\<sigma> with updates)\<lparr>mem := override_on (override_on (mem (\<sigma> with updates)) (\<lambda>a'. take_byte (unat (a' - a)) v') (region_addresses a si')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr> = (\<sigma> with updates')\<lparr>mem := override_on (mem (\<sigma> with updates')) (\<lambda>a'. take_byte (unat (a' - a)) v) (region_addresses a si)\<rparr>
[PROOF STEP]
apply (auto simp add: override_on_def region_addresses_iff)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>regs mem flags rip mema. \<lbrakk>si' \<le> si; (\<lambda>aa. if unat (aa - a) < si then take_byte (unat (aa - a)) v else mem aa) = (\<lambda>aa. if unat (aa - a) < si then take_byte (unat (aa - a)) v else mema aa); \<not> b; \<sigma> with updates = \<lparr>regs = regs, mem = mem, flags = flags, rip = rip\<rparr>; \<sigma> with updates' = \<lparr>regs = regs, mem = mema, flags = flags, rip = rip\<rparr>\<rbrakk> \<Longrightarrow> (\<lambda>aa. if unat (aa - a) < si then take_byte (unat (aa - a)) v else if unat (aa - a) < si' then take_byte (unat (aa - a)) v' else mem aa) = (\<lambda>aa. if unat (aa - a) < si then take_byte (unat (aa - a)) v else mema aa)
[PROOF STEP]
apply (rule ext)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>regs mem flags rip mema aa. \<lbrakk>si' \<le> si; (\<lambda>aa. if unat (aa - a) < si then take_byte (unat (aa - a)) v else mem aa) = (\<lambda>aa. if unat (aa - a) < si then take_byte (unat (aa - a)) v else mema aa); \<not> b; \<sigma> with updates = \<lparr>regs = regs, mem = mem, flags = flags, rip = rip\<rparr>; \<sigma> with updates' = \<lparr>regs = regs, mem = mema, flags = flags, rip = rip\<rparr>\<rbrakk> \<Longrightarrow> (if unat (aa - a) < si then take_byte (unat (aa - a)) v else if unat (aa - a) < si' then take_byte (unat (aa - a)) v' else mem aa) = (if unat (aa - a) < si then take_byte (unat (aa - a)) v else mema aa)
[PROOF STEP]
apply (auto split: if_splits)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>regs mem flags rip mema aa. \<lbrakk>si' \<le> si; (\<lambda>aa. if unat (aa - a) < si then take_byte (unat (aa - a)) v else mem aa) = (\<lambda>aa. if unat (aa - a) < si then take_byte (unat (aa - a)) v else mema aa); \<not> b; \<sigma> with updates = \<lparr>regs = regs, mem = mem, flags = flags, rip = rip\<rparr>; \<sigma> with updates' = \<lparr>regs = regs, mem = mema, flags = flags, rip = rip\<rparr>; \<not> unat (aa - a) < si\<rbrakk> \<Longrightarrow> mem aa = mema aa
[PROOF STEP]
by meson


[STATEMENT]
lemma steps_hext_incr: "P,E \<turnstile> \<langle>es,s\<rangle> [\<rightarrow>]* \<langle>es',s'\<rangle>  \<Longrightarrow> hp s \<unlhd> hp s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P,E \<turnstile> \<langle>es,s\<rangle> [\<rightarrow>]* \<langle>es',s'\<rangle> \<Longrightarrow> hp s \<unlhd> hp s'
[PROOF STEP]
proof(induct rule:converse_rtrancl_induct2)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. hp s' \<unlhd> hp s'
 2. \<And>a b aa ba. \<lbrakk>((a, b), aa, ba) \<in> Reds P E; P,E \<turnstile> \<langle>aa,ba\<rangle> [\<rightarrow>]* \<langle>es',s'\<rangle>; hp ba \<unlhd> hp s'\<rbrakk> \<Longrightarrow> hp b \<unlhd> hp s'
[PROOF STEP]
case refl
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. hp s' \<unlhd> hp s'
 2. \<And>a b aa ba. \<lbrakk>((a, b), aa, ba) \<in> Reds P E; P,E \<turnstile> \<langle>aa,ba\<rangle> [\<rightarrow>]* \<langle>es',s'\<rangle>; hp ba \<unlhd> hp s'\<rbrakk> \<Longrightarrow> hp b \<unlhd> hp s'
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. hp s' \<unlhd> hp s'
[PROOF STEP]
by(rule hext_refl)
[PROOF STATE]
proof (state)
this:
hp s' \<unlhd> hp s'

goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>((a, b), aa, ba) \<in> Reds P E; P,E \<turnstile> \<langle>aa,ba\<rangle> [\<rightarrow>]* \<langle>es',s'\<rangle>; hp ba \<unlhd> hp s'\<rbrakk> \<Longrightarrow> hp b \<unlhd> hp s'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>((a, b), aa, ba) \<in> Reds P E; P,E \<turnstile> \<langle>aa,ba\<rangle> [\<rightarrow>]* \<langle>es',s'\<rangle>; hp ba \<unlhd> hp s'\<rbrakk> \<Longrightarrow> hp b \<unlhd> hp s'
[PROOF STEP]
case (step es s es'' s'')
[PROOF STATE]
proof (state)
this:
((es, s), es'', s'') \<in> Reds P E
P,E \<turnstile> \<langle>es'',s''\<rangle> [\<rightarrow>]* \<langle>es',s'\<rangle>
hp s'' \<unlhd> hp s'

goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>((a, b), aa, ba) \<in> Reds P E; P,E \<turnstile> \<langle>aa,ba\<rangle> [\<rightarrow>]* \<langle>es',s'\<rangle>; hp ba \<unlhd> hp s'\<rbrakk> \<Longrightarrow> hp b \<unlhd> hp s'
[PROOF STEP]
have Reds:"((es, s), es'', s'') \<in> Reds P E"
    and hext:"hp s'' \<unlhd> hp s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((es, s), es'', s'') \<in> Reds P E &&& hp s'' \<unlhd> hp s'
[PROOF STEP]
by fact+
[PROOF STATE]
proof (state)
this:
((es, s), es'', s'') \<in> Reds P E
hp s'' \<unlhd> hp s'

goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>((a, b), aa, ba) \<in> Reds P E; P,E \<turnstile> \<langle>aa,ba\<rangle> [\<rightarrow>]* \<langle>es',s'\<rangle>; hp ba \<unlhd> hp s'\<rbrakk> \<Longrightarrow> hp b \<unlhd> hp s'
[PROOF STEP]
from Reds
[PROOF STATE]
proof (chain)
picking this:
((es, s), es'', s'') \<in> Reds P E
[PROOF STEP]
have "P,E \<turnstile> \<langle>es,s\<rangle> [\<rightarrow>] \<langle>es'',s''\<rangle>"
[PROOF STATE]
proof (prove)
using this:
((es, s), es'', s'') \<in> Reds P E

goal (1 subgoal):
 1. P,E \<turnstile> \<langle>es,s\<rangle> [\<rightarrow>] \<langle>es'',s''\<rangle>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
P,E \<turnstile> \<langle>es,s\<rangle> [\<rightarrow>] \<langle>es'',s''\<rangle>

goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>((a, b), aa, ba) \<in> Reds P E; P,E \<turnstile> \<langle>aa,ba\<rangle> [\<rightarrow>]* \<langle>es',s'\<rangle>; hp ba \<unlhd> hp s'\<rbrakk> \<Longrightarrow> hp b \<unlhd> hp s'
[PROOF STEP]
hence "hp s \<unlhd> hp s''"
[PROOF STATE]
proof (prove)
using this:
P,E \<turnstile> \<langle>es,s\<rangle> [\<rightarrow>] \<langle>es'',s''\<rangle>

goal (1 subgoal):
 1. hp s \<unlhd> hp s''
[PROOF STEP]
by(cases s,cases s'',auto dest:reds_hext_incr)
[PROOF STATE]
proof (state)
this:
hp s \<unlhd> hp s''

goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>((a, b), aa, ba) \<in> Reds P E; P,E \<turnstile> \<langle>aa,ba\<rangle> [\<rightarrow>]* \<langle>es',s'\<rangle>; hp ba \<unlhd> hp s'\<rbrakk> \<Longrightarrow> hp b \<unlhd> hp s'
[PROOF STEP]
with hext
[PROOF STATE]
proof (chain)
picking this:
hp s'' \<unlhd> hp s'
hp s \<unlhd> hp s''
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
hp s'' \<unlhd> hp s'
hp s \<unlhd> hp s''

goal (1 subgoal):
 1. hp s \<unlhd> hp s'
[PROOF STEP]
by-(rule hext_trans)
[PROOF STATE]
proof (state)
this:
hp s \<unlhd> hp s'

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "\<FF> \<F> \<and> cf \<and> ci \<longrightarrow> ECQm(\<^bold>\<not>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ECQm \<^bold>\<not> \<longleftarrow> \<FF> \<F> \<and> cf \<and> (\<forall>P. contains (\<bullet>P) (\<^bold>\<not> ((\<^bold>\<and>) P\<^sup>c (\<^bold>\<not> P))))
[PROOF STEP]
oops


[STATEMENT]
lemma put_M\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_val_type_wf_preserved [simp]:
  "h \<turnstile> put_M character_data_ptr val_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h \<turnstile> put_M character_data_ptr val_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> DocumentClass.type_wf h = DocumentClass.type_wf h'
[PROOF STEP]
apply(auto simp add: CharacterDataMonad.put_M_defs put\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
      DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
      DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t is_node_kind_def
      dest!: get_heap_E  elim!: bind_returns_heap_E2
      intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I ElementMonad.type_wf_put_I
      NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M character_data_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast character_data_ptr)) (cast (cast (x\<lparr>val := v\<rparr>))) h; DocumentClass.type_wf (put (cast (cast character_data_ptr)) (cast (cast (x\<lparr>val := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> DocumentClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs CharacterDataMonad.get_M_defs ObjectClass.type_wf_defs
      CharacterDataClass.type_wf_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x node_ptr. \<lbrakk>\<forall>document_ptr\<in>fset (document_ptr_kinds h). \<exists>y. get document_ptr h = Some y; get character_data_ptr h = Some x; h' = put (cast (cast character_data_ptr)) (cast (cast (x\<lparr>val := v\<rparr>))) h; \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast character_data_ptr = node_ptr then cast (cast (cast (x\<lparr>val := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptr\<in>fset (element_ptr_kinds h). \<exists>y. get element_ptr h = Some y; \<forall>character_data_ptra\<in>fset (character_data_ptr_kinds h). \<exists>y. (if character_data_ptr = character_data_ptra then cast (cast (x\<lparr>val := v\<rparr>)) else get character_data_ptra h) = Some y; node_ptr |\<in>| node_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get node_ptr h = Some y
 2. \<And>x character_data_ptra. \<lbrakk>\<forall>document_ptr\<in>fset (document_ptr_kinds h). \<exists>y. get document_ptr h = Some y; get character_data_ptr h = Some x; h' = put (cast (cast character_data_ptr)) (cast (cast (x\<lparr>val := v\<rparr>))) h; \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast character_data_ptr = node_ptr then cast (cast (cast (x\<lparr>val := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptr\<in>fset (element_ptr_kinds h). \<exists>y. get element_ptr h = Some y; \<forall>character_data_ptra\<in>fset (character_data_ptr_kinds h). \<exists>y. (if character_data_ptr = character_data_ptra then cast (cast (x\<lparr>val := v\<rparr>)) else get character_data_ptra h) = Some y; character_data_ptra |\<in>| character_data_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get character_data_ptra h = Some y
[PROOF STEP]
apply (metis bind.bind_lzero finite_set_in get\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a_def option.distinct(1) option.exhaust_sel)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x character_data_ptra. \<lbrakk>\<forall>document_ptr\<in>fset (document_ptr_kinds h). \<exists>y. get document_ptr h = Some y; get character_data_ptr h = Some x; h' = put (cast (cast character_data_ptr)) (cast (cast (x\<lparr>val := v\<rparr>))) h; \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast character_data_ptr = node_ptr then cast (cast (cast (x\<lparr>val := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptr\<in>fset (element_ptr_kinds h). \<exists>y. get element_ptr h = Some y; \<forall>character_data_ptra\<in>fset (character_data_ptr_kinds h). \<exists>y. (if character_data_ptr = character_data_ptra then cast (cast (x\<lparr>val := v\<rparr>)) else get character_data_ptra h) = Some y; character_data_ptra |\<in>| character_data_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get character_data_ptra h = Some y
[PROOF STEP]
by (metis finite_set_in)