[STATEMENT]
lemma Nonce_compromise [rule_format (no_asm)]:
     "evs \<in> set_cr ==>
      (\<forall>N KK. (\<forall>K \<in> KK. \<not> KeyCryptNonce K N evs)   \<longrightarrow>
               (Nonce N \<in> analz (Key`KK \<union> (knows Spy evs))) =
               (Nonce N \<in> analz (knows Spy evs)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. evs \<in> set_cr \<Longrightarrow> \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs)) = (Nonce N \<in> analz (knows Spy evs))
[PROOF STEP]
apply (erule set_cr.induct)
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N []) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy [])) = (Nonce N \<in> analz (knows Spy []))
 2. \<And>evsf X B. \<lbrakk>evsf \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsf) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsf)) = (Nonce N \<in> analz (knows Spy evsf)); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says Spy B X # evsf)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says Spy B X # evsf))) = (Nonce N \<in> analz (knows Spy (Says Spy B X # evsf)))
 3. \<And>evsr A B X. \<lbrakk>evsr \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsr) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsr)) = (Nonce N \<in> analz (knows Spy evsr)); Says A B X \<in> set evsr\<rbrakk> \<Longrightarrow> \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Gets B X # evsr)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Gets B X # evsr))) = (Nonce N \<in> analz (knows Spy (Gets B X # evsr)))
 4. \<And>evs1 C k NC1 i. \<lbrakk>evs1 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs1) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs1)) = (Nonce N \<in> analz (knows Spy evs1)); C = Cardholder k; Nonce NC1 \<notin> used evs1\<rbrakk> \<Longrightarrow> \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1))) = (Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)))
 5. \<And>evs2 i C NC1. \<lbrakk>evs2 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs2) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs2)) = (Nonce N \<in> analz (knows Spy evs2)); Gets (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2))) = (Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)))
 6. \<And>evs3 C k NC2 KC1 SKi X NC1 i EKi. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3))) = (Nonce N \<in> analz (knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)))
 7. \<And>evs4 NCA KC1 i EKi C NC2 X. \<lbrakk>evs4 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs4) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs4)) = (Nonce N \<in> analz (knows Spy evs4)); Nonce NCA \<notin> used evs4; KC1 \<in> symKeys; Gets (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan X))) \<in> set evs4\<rbrakk> \<Longrightarrow> \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4))) = (Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)))
 8. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5\<rbrakk> \<Longrightarrow> \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5))) = (Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)))
 9. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6\<rbrakk> \<Longrightarrow> \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6))) = (Nonce N \<in> analz (knows Spy (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6)))
[PROOF STEP]
apply (rule_tac [!] allI)+
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<And>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N []) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy [])) = (Nonce N \<in> analz (knows Spy []))
 2. \<And>evsf X B N KK. \<lbrakk>evsf \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsf) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsf)) = (Nonce N \<in> analz (knows Spy evsf)); X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says Spy B X # evsf)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says Spy B X # evsf))) = (Nonce N \<in> analz (knows Spy (Says Spy B X # evsf)))
 3. \<And>evsr A B X N KK. \<lbrakk>evsr \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsr) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsr)) = (Nonce N \<in> analz (knows Spy evsr)); Says A B X \<in> set evsr\<rbrakk> \<Longrightarrow> (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Gets B X # evsr)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Gets B X # evsr))) = (Nonce N \<in> analz (knows Spy (Gets B X # evsr)))
 4. \<And>evs1 C k NC1 i N KK. \<lbrakk>evs1 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs1) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs1)) = (Nonce N \<in> analz (knows Spy evs1)); C = Cardholder k; Nonce NC1 \<notin> used evs1\<rbrakk> \<Longrightarrow> (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1))) = (Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)))
 5. \<And>evs2 i C NC1 N KK. \<lbrakk>evs2 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs2) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs2)) = (Nonce N \<in> analz (knows Spy evs2)); Gets (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2))) = (Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)))
 6. \<And>evs3 C k NC2 KC1 SKi X NC1 i EKi N KK. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3))) = (Nonce N \<in> analz (knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)))
 7. \<And>evs4 NCA KC1 i EKi C NC2 X N KK. \<lbrakk>evs4 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs4) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs4)) = (Nonce N \<in> analz (knows Spy evs4)); Nonce NCA \<notin> used evs4; KC1 \<in> symKeys; Gets (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan X))) \<in> set evs4\<rbrakk> \<Longrightarrow> (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4))) = (Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)))
 8. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5\<rbrakk> \<Longrightarrow> (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5))) = (Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)))
 9. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6\<rbrakk> \<Longrightarrow> (\<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6)) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6))) = (Nonce N \<in> analz (knows Spy (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6)))
[PROOF STEP]
apply (rule_tac [!] impI [THEN Nonce_analz_image_Key_lemma])+
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<And>N KK. \<forall>K\<in>KK. \<not> KeyCryptNonce K N [] \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy []) \<longrightarrow> Nonce N \<in> analz (knows Spy [])
 2. \<And>evsf X B N KK. \<lbrakk>evsf \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsf) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsf)) = (Nonce N \<in> analz (knows Spy evsf)); X \<in> synth (analz (knows Spy evsf)); \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says Spy B X # evsf)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says Spy B X # evsf)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says Spy B X # evsf))
 3. \<And>evsr A B X N KK. \<lbrakk>evsr \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsr) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsr)) = (Nonce N \<in> analz (knows Spy evsr)); Says A B X \<in> set evsr; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Gets B X # evsr)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Gets B X # evsr)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Gets B X # evsr))
 4. \<And>evs1 C k NC1 i N KK. \<lbrakk>evs1 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs1) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs1)) = (Nonce N \<in> analz (knows Spy evs1)); C = Cardholder k; Nonce NC1 \<notin> used evs1; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1))
 5. \<And>evs2 i C NC1 N KK. \<lbrakk>evs2 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs2) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs2)) = (Nonce N \<in> analz (knows Spy evs2)); Gets (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs2; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2))
 6. \<And>evs3 C k NC2 KC1 SKi X NC1 i EKi N KK. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs3; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3))
 7. \<And>evs4 NCA KC1 i EKi C NC2 X N KK. \<lbrakk>evs4 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs4) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs4)) = (Nonce N \<in> analz (knows Spy evs4)); Nonce NCA \<notin> used evs4; KC1 \<in> symKeys; Gets (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan X))) \<in> set evs4; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4))
 8. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5))
 9. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6))
[PROOF STEP]
apply (frule_tac [8] Gets_certificate_valid) \<comment> \<open>for message 5\<close>
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<And>N KK. \<forall>K\<in>KK. \<not> KeyCryptNonce K N [] \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy []) \<longrightarrow> Nonce N \<in> analz (knows Spy [])
 2. \<And>evsf X B N KK. \<lbrakk>evsf \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsf) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsf)) = (Nonce N \<in> analz (knows Spy evsf)); X \<in> synth (analz (knows Spy evsf)); \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says Spy B X # evsf)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says Spy B X # evsf)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says Spy B X # evsf))
 3. \<And>evsr A B X N KK. \<lbrakk>evsr \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsr) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsr)) = (Nonce N \<in> analz (knows Spy evsr)); Says A B X \<in> set evsr; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Gets B X # evsr)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Gets B X # evsr)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Gets B X # evsr))
 4. \<And>evs1 C k NC1 i N KK. \<lbrakk>evs1 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs1) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs1)) = (Nonce N \<in> analz (knows Spy evs1)); C = Cardholder k; Nonce NC1 \<notin> used evs1; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1))
 5. \<And>evs2 i C NC1 N KK. \<lbrakk>evs2 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs2) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs2)) = (Nonce N \<in> analz (knows Spy evs2)); Gets (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs2; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2))
 6. \<And>evs3 C k NC2 KC1 SKi X NC1 i EKi N KK. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs3; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3))
 7. \<And>evs4 NCA KC1 i EKi C NC2 X N KK. \<lbrakk>evs4 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs4) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs4)) = (Nonce N \<in> analz (knows Spy evs4)); Nonce NCA \<notin> used evs4; KC1 \<in> symKeys; Gets (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan X))) \<in> set evs4; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4))
 8. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)\<rbrakk> \<Longrightarrow> evs5 \<in> set_cr
 9. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5); EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5))
 10. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6))
[PROOF STEP]
apply (frule_tac [6] Gets_certificate_valid) \<comment> \<open>for message 3\<close>
[PROOF STATE]
proof (prove)
goal (11 subgoals):
 1. \<And>N KK. \<forall>K\<in>KK. \<not> KeyCryptNonce K N [] \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy []) \<longrightarrow> Nonce N \<in> analz (knows Spy [])
 2. \<And>evsf X B N KK. \<lbrakk>evsf \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsf) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsf)) = (Nonce N \<in> analz (knows Spy evsf)); X \<in> synth (analz (knows Spy evsf)); \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says Spy B X # evsf)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says Spy B X # evsf)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says Spy B X # evsf))
 3. \<And>evsr A B X N KK. \<lbrakk>evsr \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsr) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsr)) = (Nonce N \<in> analz (knows Spy evsr)); Says A B X \<in> set evsr; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Gets B X # evsr)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Gets B X # evsr)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Gets B X # evsr))
 4. \<And>evs1 C k NC1 i N KK. \<lbrakk>evs1 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs1) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs1)) = (Nonce N \<in> analz (knows Spy evs1)); C = Cardholder k; Nonce NC1 \<notin> used evs1; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1))
 5. \<And>evs2 i C NC1 N KK. \<lbrakk>evs2 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs2) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs2)) = (Nonce N \<in> analz (knows Spy evs2)); Gets (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs2; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2))
 6. \<And>evs3 C k NC2 KC1 SKi X NC1 i EKi N KK. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs3; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)\<rbrakk> \<Longrightarrow> evs3 \<in> set_cr
 7. \<And>evs3 C k NC2 KC1 SKi X NC1 i EKi N KK. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs3; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3); EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3))
 8. \<And>evs4 NCA KC1 i EKi C NC2 X N KK. \<lbrakk>evs4 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs4) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs4)) = (Nonce N \<in> analz (knows Spy evs4)); Nonce NCA \<notin> used evs4; KC1 \<in> symKeys; Gets (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan X))) \<in> set evs4; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4))
 9. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)\<rbrakk> \<Longrightarrow> evs5 \<in> set_cr
 10. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5); EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5))
A total of 11 subgoals...
[PROOF STEP]
apply (frule_tac [11] msg6_KeyCryptNonce_disj)
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. \<And>N KK. \<forall>K\<in>KK. \<not> KeyCryptNonce K N [] \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy []) \<longrightarrow> Nonce N \<in> analz (knows Spy [])
 2. \<And>evsf X B N KK. \<lbrakk>evsf \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsf) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsf)) = (Nonce N \<in> analz (knows Spy evsf)); X \<in> synth (analz (knows Spy evsf)); \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says Spy B X # evsf)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says Spy B X # evsf)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says Spy B X # evsf))
 3. \<And>evsr A B X N KK. \<lbrakk>evsr \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsr) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsr)) = (Nonce N \<in> analz (knows Spy evsr)); Says A B X \<in> set evsr; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Gets B X # evsr)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Gets B X # evsr)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Gets B X # evsr))
 4. \<And>evs1 C k NC1 i N KK. \<lbrakk>evs1 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs1) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs1)) = (Nonce N \<in> analz (knows Spy evs1)); C = Cardholder k; Nonce NC1 \<notin> used evs1; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1))
 5. \<And>evs2 i C NC1 N KK. \<lbrakk>evs2 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs2) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs2)) = (Nonce N \<in> analz (knows Spy evs2)); Gets (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs2; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2))
 6. \<And>evs3 C k NC2 KC1 SKi X NC1 i EKi N KK. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs3; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)\<rbrakk> \<Longrightarrow> evs3 \<in> set_cr
 7. \<And>evs3 C k NC2 KC1 SKi X NC1 i EKi N KK. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs3; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3); EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3))
 8. \<And>evs4 NCA KC1 i EKi C NC2 X N KK. \<lbrakk>evs4 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs4) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs4)) = (Nonce N \<in> analz (knows Spy evs4)); Nonce NCA \<notin> used evs4; KC1 \<in> symKeys; Gets (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan X))) \<in> set evs4; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4))
 9. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)\<rbrakk> \<Longrightarrow> evs5 \<in> set_cr
 10. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5); EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5))
A total of 13 subgoals...
[PROOF STEP]
apply (erule_tac [13] disjE)
[PROOF STATE]
proof (prove)
goal (14 subgoals):
 1. \<And>N KK. \<forall>K\<in>KK. \<not> KeyCryptNonce K N [] \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy []) \<longrightarrow> Nonce N \<in> analz (knows Spy [])
 2. \<And>evsf X B N KK. \<lbrakk>evsf \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsf) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsf)) = (Nonce N \<in> analz (knows Spy evsf)); X \<in> synth (analz (knows Spy evsf)); \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says Spy B X # evsf)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says Spy B X # evsf)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says Spy B X # evsf))
 3. \<And>evsr A B X N KK. \<lbrakk>evsr \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsr) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsr)) = (Nonce N \<in> analz (knows Spy evsr)); Says A B X \<in> set evsr; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Gets B X # evsr)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Gets B X # evsr)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Gets B X # evsr))
 4. \<And>evs1 C k NC1 i N KK. \<lbrakk>evs1 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs1) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs1)) = (Nonce N \<in> analz (knows Spy evs1)); C = Cardholder k; Nonce NC1 \<notin> used evs1; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1))
 5. \<And>evs2 i C NC1 N KK. \<lbrakk>evs2 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs2) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs2)) = (Nonce N \<in> analz (knows Spy evs2)); Gets (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs2; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2))
 6. \<And>evs3 C k NC2 KC1 SKi X NC1 i EKi N KK. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs3; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)\<rbrakk> \<Longrightarrow> evs3 \<in> set_cr
 7. \<And>evs3 C k NC2 KC1 SKi X NC1 i EKi N KK. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs3; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3); EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3))
 8. \<And>evs4 NCA KC1 i EKi C NC2 X N KK. \<lbrakk>evs4 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs4) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs4)) = (Nonce N \<in> analz (knows Spy evs4)); Nonce NCA \<notin> used evs4; KC1 \<in> symKeys; Gets (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan X))) \<in> set evs4; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4))
 9. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)\<rbrakk> \<Longrightarrow> evs5 \<in> set_cr
 10. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5; \<forall>K\<in>KK. \<not> KeyCryptNonce K N (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5); EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (Key ` KK \<union> knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)) \<longrightarrow> Nonce N \<in> analz (knows Spy (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5))
A total of 14 subgoals...
[PROOF STEP]
apply (simp_all del: image_insert image_Un
         add: symKey_compromise
              analz_image_keys_simps analz_knows_absorb
              analz_Key_image_insert_eq notin_image_iff
              N_fresh_not_KeyCryptNonce
              DK_fresh_not_KeyCryptNonce K_fresh_not_KeyCryptKey
              ball_conj_distrib analz_image_priEK)
  \<comment> \<open>14 seconds on a 1.6GHz machine\<close>
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>evsf X N KK. \<lbrakk>evsf \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evsf) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evsf)) = (Nonce N \<in> analz (knows Spy evsf)); X \<in> synth (analz (knows Spy evsf)); \<forall>K\<in>KK. \<not> KeyCryptNonce K N evsf\<rbrakk> \<Longrightarrow> Nonce N \<in> analz (insert X (Key ` KK \<union> knows Spy evsf)) \<longrightarrow> Nonce N \<in> analz (insert X (knows Spy evsf))
 2. \<And>evs3 C k NC2 KC1 SKi X NC1 i N KK. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets (Cardholder k) \<lbrace>sign (priSK (CA i)) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says (Cardholder k) (CA i) \<lbrace>Agent (Cardholder k), Nonce NC1\<rbrace> \<in> set evs3; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<and> (KC1 \<in> KK \<longrightarrow> NC2 \<noteq> N) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Cardholder k \<notin> bad \<longrightarrow> (priEK (CA i) \<in> KK \<longrightarrow> CA i \<notin> bad \<longrightarrow> Key KC1 \<notin> analz (knows Spy evs3) \<longrightarrow> N = NC2 \<longrightarrow> Nonce NC2 \<in> analz (knows Spy evs3)) \<and> (priEK (CA i) \<notin> KK \<and> CA i \<notin> bad \<longrightarrow> KC1 \<in> KK \<longrightarrow> Key KC1 \<notin> analz (knows Spy evs3) \<longrightarrow> N = NC2 \<longrightarrow> Nonce NC2 \<in> analz (knows Spy evs3))
 3. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets (Cardholder k) \<lbrace>sign (priSK (CA i)) \<lbrace>Agent (Cardholder k), Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says (Cardholder k) (CA i) (EXHcrypt KC1 (pubEK (CA i)) \<lbrace>Agent (Cardholder k), Nonce NC2\<rbrace> (Pan (pan (Cardholder k)))) \<in> set evs5; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<and> (KC3 \<in> KK \<longrightarrow> NC3 \<noteq> N) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> (Cardholder k \<in> bad \<longrightarrow> priEK (CA i) \<in> KK \<longrightarrow> CA i \<notin> bad \<longrightarrow> N = CardSecret \<longrightarrow> Nonce CardSecret \<in> analz (knows Spy evs5)) \<and> (Cardholder k \<notin> bad \<longrightarrow> (priEK (CA i) \<in> KK \<longrightarrow> CA i \<notin> bad \<longrightarrow> (Key KC3 \<in> analz (knows Spy evs5) \<longrightarrow> N = CardSecret \<longrightarrow> Nonce CardSecret \<in> analz (knows Spy evs5)) \<and> (Key KC3 \<notin> analz (knows Spy evs5) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs5)) \<and> (N = CardSecret \<longrightarrow> Nonce CardSecret \<in> analz (knows Spy evs5)))) \<and> (priEK (CA i) \<notin> KK \<and> CA i \<notin> bad \<longrightarrow> KC3 \<in> KK \<longrightarrow> Key KC3 \<notin> analz (knows Spy evs5) \<longrightarrow> N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs5)))
 4. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); Key cardSK \<in> analz (knows Spy evs6)\<rbrakk> \<Longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))
 5. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); (\<forall>K. \<not> KeyCryptKey cardSK K evs6) \<and> (\<forall>N. \<not> KeyCryptNonce cardSK N evs6)\<rbrakk> \<Longrightarrow> (CA i \<in> bad \<longrightarrow> Key KC2 \<in> analz (Key ` insert cardSK KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))) \<and> (CA i \<notin> bad \<longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6)))
[PROOF STEP]
apply spy_analz  \<comment> \<open>Fake\<close>
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>evs3 C k NC2 KC1 SKi X NC1 i N KK. \<lbrakk>evs3 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs3)) = (Nonce N \<in> analz (knows Spy evs3)); C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets (Cardholder k) \<lbrace>sign (priSK (CA i)) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says (Cardholder k) (CA i) \<lbrace>Agent (Cardholder k), Nonce NC1\<rbrace> \<in> set evs3; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs3) \<and> (KC1 \<in> KK \<longrightarrow> NC2 \<noteq> N) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Cardholder k \<notin> bad \<longrightarrow> (priEK (CA i) \<in> KK \<longrightarrow> CA i \<notin> bad \<longrightarrow> Key KC1 \<notin> analz (knows Spy evs3) \<longrightarrow> N = NC2 \<longrightarrow> Nonce NC2 \<in> analz (knows Spy evs3)) \<and> (priEK (CA i) \<notin> KK \<and> CA i \<notin> bad \<longrightarrow> KC1 \<in> KK \<longrightarrow> Key KC1 \<notin> analz (knows Spy evs3) \<longrightarrow> N = NC2 \<longrightarrow> Nonce NC2 \<in> analz (knows Spy evs3))
 2. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets (Cardholder k) \<lbrace>sign (priSK (CA i)) \<lbrace>Agent (Cardholder k), Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says (Cardholder k) (CA i) (EXHcrypt KC1 (pubEK (CA i)) \<lbrace>Agent (Cardholder k), Nonce NC2\<rbrace> (Pan (pan (Cardholder k)))) \<in> set evs5; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<and> (KC3 \<in> KK \<longrightarrow> NC3 \<noteq> N) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> (Cardholder k \<in> bad \<longrightarrow> priEK (CA i) \<in> KK \<longrightarrow> CA i \<notin> bad \<longrightarrow> N = CardSecret \<longrightarrow> Nonce CardSecret \<in> analz (knows Spy evs5)) \<and> (Cardholder k \<notin> bad \<longrightarrow> (priEK (CA i) \<in> KK \<longrightarrow> CA i \<notin> bad \<longrightarrow> (Key KC3 \<in> analz (knows Spy evs5) \<longrightarrow> N = CardSecret \<longrightarrow> Nonce CardSecret \<in> analz (knows Spy evs5)) \<and> (Key KC3 \<notin> analz (knows Spy evs5) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs5)) \<and> (N = CardSecret \<longrightarrow> Nonce CardSecret \<in> analz (knows Spy evs5)))) \<and> (priEK (CA i) \<notin> KK \<and> CA i \<notin> bad \<longrightarrow> KC3 \<in> KK \<longrightarrow> Key KC3 \<notin> analz (knows Spy evs5) \<longrightarrow> N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs5)))
 3. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); Key cardSK \<in> analz (knows Spy evs6)\<rbrakk> \<Longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))
 4. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); (\<forall>K. \<not> KeyCryptKey cardSK K evs6) \<and> (\<forall>N. \<not> KeyCryptNonce cardSK N evs6)\<rbrakk> \<Longrightarrow> (CA i \<in> bad \<longrightarrow> Key KC2 \<in> analz (Key ` insert cardSK KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))) \<and> (CA i \<notin> bad \<longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6)))
[PROOF STEP]
apply blast  \<comment> \<open>3\<close>
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i KC1 N KK. \<lbrakk>evs5 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs5)) = (Nonce N \<in> analz (knows Spy evs5)); C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets (Cardholder k) \<lbrace>sign (priSK (CA i)) \<lbrace>Agent (Cardholder k), Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says (Cardholder k) (CA i) (EXHcrypt KC1 (pubEK (CA i)) \<lbrace>Agent (Cardholder k), Nonce NC2\<rbrace> (Pan (pan (Cardholder k)))) \<in> set evs5; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs5) \<and> (KC3 \<in> KK \<longrightarrow> NC3 \<noteq> N) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> (Cardholder k \<in> bad \<longrightarrow> priEK (CA i) \<in> KK \<longrightarrow> CA i \<notin> bad \<longrightarrow> N = CardSecret \<longrightarrow> Nonce CardSecret \<in> analz (knows Spy evs5)) \<and> (Cardholder k \<notin> bad \<longrightarrow> (priEK (CA i) \<in> KK \<longrightarrow> CA i \<notin> bad \<longrightarrow> (Key KC3 \<in> analz (knows Spy evs5) \<longrightarrow> N = CardSecret \<longrightarrow> Nonce CardSecret \<in> analz (knows Spy evs5)) \<and> (Key KC3 \<notin> analz (knows Spy evs5) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs5)) \<and> (N = CardSecret \<longrightarrow> Nonce CardSecret \<in> analz (knows Spy evs5)))) \<and> (priEK (CA i) \<notin> KK \<and> CA i \<notin> bad \<longrightarrow> KC3 \<in> KK \<longrightarrow> Key KC3 \<notin> analz (knows Spy evs5) \<longrightarrow> N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs5)))
 2. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); Key cardSK \<in> analz (knows Spy evs6)\<rbrakk> \<Longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))
 3. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); (\<forall>K. \<not> KeyCryptKey cardSK K evs6) \<and> (\<forall>N. \<not> KeyCryptNonce cardSK N evs6)\<rbrakk> \<Longrightarrow> (CA i \<in> bad \<longrightarrow> Key KC2 \<in> analz (Key ` insert cardSK KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))) \<and> (CA i \<notin> bad \<longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6)))
[PROOF STEP]
apply blast  \<comment> \<open>5\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); Key cardSK \<in> analz (knows Spy evs6)\<rbrakk> \<Longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))
 2. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); (\<forall>K. \<not> KeyCryptKey cardSK K evs6) \<and> (\<forall>N. \<not> KeyCryptNonce cardSK N evs6)\<rbrakk> \<Longrightarrow> (CA i \<in> bad \<longrightarrow> Key KC2 \<in> analz (Key ` insert cardSK KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))) \<and> (CA i \<notin> bad \<longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6)))
[PROOF STEP]
txt\<open>Message 6\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); Key cardSK \<in> analz (knows Spy evs6)\<rbrakk> \<Longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))
 2. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); (\<forall>K. \<not> KeyCryptKey cardSK K evs6) \<and> (\<forall>N. \<not> KeyCryptNonce cardSK N evs6)\<rbrakk> \<Longrightarrow> (CA i \<in> bad \<longrightarrow> Key KC2 \<in> analz (Key ` insert cardSK KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))) \<and> (CA i \<notin> bad \<longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6)))
[PROOF STEP]
apply (metis symKey_compromise)
  \<comment> \<open>cardSK compromised\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); (\<forall>K. \<not> KeyCryptKey cardSK K evs6) \<and> (\<forall>N. \<not> KeyCryptNonce cardSK N evs6)\<rbrakk> \<Longrightarrow> (CA i \<in> bad \<longrightarrow> Key KC2 \<in> analz (Key ` insert cardSK KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))) \<and> (CA i \<notin> bad \<longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6)))
[PROOF STEP]
txt\<open>Simplify again--necessary because the previous simplification introduces
  some logical connectives\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret N KK. \<lbrakk>evs6 \<in> set_cr; \<forall>N KK. (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<longrightarrow> (Nonce N \<in> analz (Key ` KK \<union> knows Spy evs6)) = (Nonce N \<in> analz (knows Spy evs6)); Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6; (\<forall>K\<in>KK. \<not> KeyCryptNonce K N evs6) \<and> (NC3 = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (NonceCCA = N \<longrightarrow> (\<forall>K\<in>KK. K \<noteq> KC2) \<and> (\<forall>K\<in>KK. \<not> KeyCryptKey K KC2 evs6)) \<and> (\<forall>K\<in>KK. \<forall>C. K \<noteq> priEK C); (\<forall>K. \<not> KeyCryptKey cardSK K evs6) \<and> (\<forall>N. \<not> KeyCryptNonce cardSK N evs6)\<rbrakk> \<Longrightarrow> (CA i \<in> bad \<longrightarrow> Key KC2 \<in> analz (Key ` insert cardSK KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6))) \<and> (CA i \<notin> bad \<longrightarrow> Key KC2 \<in> analz (Key ` KK \<union> knows Spy evs6) \<longrightarrow> Key KC2 \<notin> analz (knows Spy evs6) \<longrightarrow> (N = NC3 \<longrightarrow> Nonce NC3 \<in> analz (knows Spy evs6)) \<and> (N = NonceCCA \<longrightarrow> Nonce NonceCCA \<in> analz (knows Spy evs6)))
[PROOF STEP]
apply (force simp del: image_insert image_Un imp_disjL
          simp add: analz_image_keys_simps symKey_compromise)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done