[STATEMENT]
lemma "~ P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> P
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> P
[PROOF STEP]
oops


[STATEMENT]
lemma loop_init:
  "inv\<^sub>3 {} {} {} {} U"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inv\<^sub>3 {} {} {} {} U
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. inv\<^sub>3 {} {} {} {} U
[PROOF STEP]
have *: "inv\<^sub>1 {} {} {} {} U"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inv\<^sub>1 {} {} {} {} U
[PROOF STEP]
unfolding bp_def partition_on_def pairwise_def wrap_def inv\<^sub>1_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<Union> ({} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}}) \<union> {{v} |v. v \<in> U}) = U \<and> (\<forall>x\<in>{} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}}) \<union> {{v} |v. v \<in> U}. \<forall>y\<in>{} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}}) \<union> {{v} |v. v \<in> U}. x \<noteq> y \<longrightarrow> disjnt x y) \<and> {} \<notin> {} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}}) \<union> {{v} |v. v \<in> U}) \<and> (\<forall>B\<in>{} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}}) \<union> {{v} |v. v \<in> U}. W B \<le> real c)) \<and> \<Union> ({} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}})) = U - U \<and> {} \<notin> {} \<union> {} \<union> (if {} = {} then {} else {{}}) \<and> {} \<notin> {} \<union> (if {} = {} then {} else {{}}) \<union> {} \<and> ({} \<union> (if {} = {} then {} else {{}})) \<inter> ({} \<union> (if {} = {} then {} else {{}})) = {}
[PROOF STEP]
using weight
[PROOF STATE]
proof (prove)
using this:
\<forall>u\<in>U. 0 < w u \<and> w u \<le> real c

goal (1 subgoal):
 1. ((\<Union> ({} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}}) \<union> {{v} |v. v \<in> U}) = U \<and> (\<forall>x\<in>{} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}}) \<union> {{v} |v. v \<in> U}. \<forall>y\<in>{} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}}) \<union> {{v} |v. v \<in> U}. x \<noteq> y \<longrightarrow> disjnt x y) \<and> {} \<notin> {} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}}) \<union> {{v} |v. v \<in> U}) \<and> (\<forall>B\<in>{} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}}) \<union> {{v} |v. v \<in> U}. W B \<le> real c)) \<and> \<Union> ({} \<union> (if {} = {} then {} else {{}}) \<union> {} \<union> (if {} = {} then {} else {{}})) = U - U \<and> {} \<notin> {} \<union> {} \<union> (if {} = {} then {} else {{}}) \<and> {} \<notin> {} \<union> (if {} = {} then {} else {{}}) \<union> {} \<and> ({} \<union> (if {} = {} then {} else {{}})) \<inter> ({} \<union> (if {} = {} then {} else {{}})) = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
inv\<^sub>1 {} {} {} {} U

goal (1 subgoal):
 1. inv\<^sub>3 {} {} {} {} U
[PROOF STEP]
have "bij_exists {} (\<Union> ({} \<union> wrap {}))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bij_exists {} (\<Union> ({} \<union> wrap {}))
[PROOF STEP]
using bij_betwI'
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>x y. \<lbrakk>x \<in> ?X; y \<in> ?X\<rbrakk> \<Longrightarrow> (?f x = ?f y) = (x = y); \<And>x. x \<in> ?X \<Longrightarrow> ?f x \<in> ?Y; \<And>y. y \<in> ?Y \<Longrightarrow> \<exists>x\<in>?X. y = ?f x\<rbrakk> \<Longrightarrow> bij_betw ?f ?X ?Y

goal (1 subgoal):
 1. bij_exists {} (\<Union> ({} \<union> wrap {}))
[PROOF STEP]
unfolding bij_exists_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>x y. \<lbrakk>x \<in> ?X; y \<in> ?X\<rbrakk> \<Longrightarrow> (?f x = ?f y) = (x = y); \<And>x. x \<in> ?X \<Longrightarrow> ?f x \<in> ?Y; \<And>y. y \<in> ?Y \<Longrightarrow> \<exists>x\<in>?X. y = ?f x\<rbrakk> \<Longrightarrow> bij_betw ?f ?X ?Y

goal (1 subgoal):
 1. \<exists>f. bij_betw f {} (\<Union> ({} \<union> wrap {})) \<and> (\<forall>B\<in>{}. real c < W B + w (f B))
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
bij_exists {} (\<Union> ({} \<union> wrap {}))

goal (1 subgoal):
 1. inv\<^sub>3 {} {} {} {} U
[PROOF STEP]
from inv\<^sub>2I[OF * _ this]
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>U \<inter> L \<noteq> {} \<Longrightarrow> \<forall>B\<in>{} \<union> wrap {}. B \<inter> L \<noteq> {}; 2 * card {} \<le> card (\<Union> {})\<rbrakk> \<Longrightarrow> inv\<^sub>2 {} {} {} {} U
[PROOF STEP]
have "inv\<^sub>2 {} {} {} {} U"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>U \<inter> L \<noteq> {} \<Longrightarrow> \<forall>B\<in>{} \<union> wrap {}. B \<inter> L \<noteq> {}; 2 * card {} \<le> card (\<Union> {})\<rbrakk> \<Longrightarrow> inv\<^sub>2 {} {} {} {} U

goal (1 subgoal):
 1. inv\<^sub>2 {} {} {} {} U
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
inv\<^sub>2 {} {} {} {} U

goal (1 subgoal):
 1. inv\<^sub>3 {} {} {} {} U
[PROOF STEP]
from inv\<^sub>3I[OF this]
[PROOF STATE]
proof (chain)
picking this:
{} \<subseteq> S \<Longrightarrow> inv\<^sub>3 {} {} {} {} U
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
{} \<subseteq> S \<Longrightarrow> inv\<^sub>3 {} {} {} {} U

goal (1 subgoal):
 1. inv\<^sub>3 {} {} {} {} U
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
inv\<^sub>3 {} {} {} {} U

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma m2_inv34_M3_authorized:
  assumes "Secure Sv B (Msg [aKey K, aAgt A]) \<in> chan s"
          "s \<in> m2_inv4_M3" "s \<in> m2_inv3_extrKey" "s \<in> m2_inv2b_corrKey_leaked"
          "K \<notin> Domain (leak s)"
  shows  "(K, B) \<in> azC (runs s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (K, B) \<in> azC (runs s)
[PROOF STEP]
proof (cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. ?P \<Longrightarrow> (K, B) \<in> azC (runs s)
 2. \<not> ?P \<Longrightarrow> (K, B) \<in> azC (runs s)
[PROOF STEP]
assume "B \<in> bad"
[PROOF STATE]
proof (state)
this:
B \<in> bad

goal (2 subgoals):
 1. ?P \<Longrightarrow> (K, B) \<in> azC (runs s)
 2. \<not> ?P \<Longrightarrow> (K, B) \<in> azC (runs s)
[PROOF STEP]
hence "aKey K \<in> extr ik0 (chan s)"
[PROOF STATE]
proof (prove)
using this:
B \<in> bad

goal (1 subgoal):
 1. aKey K \<in> extr ik0 (chan s)
[PROOF STEP]
using assms(1)
[PROOF STATE]
proof (prove)
using this:
B \<in> bad
StatCh secure Sv B (Msg [aKey K, aAgt A]) \<in> chan s

goal (1 subgoal):
 1. aKey K \<in> extr ik0 (chan s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
aKey K \<in> extr ik0 (chan s)

goal (2 subgoals):
 1. ?P \<Longrightarrow> (K, B) \<in> azC (runs s)
 2. \<not> ?P \<Longrightarrow> (K, B) \<in> azC (runs s)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
aKey K \<in> extr ik0 (chan s)

goal (1 subgoal):
 1. (K, B) \<in> azC (runs s)
[PROOF STEP]
using assms(3-)
[PROOF STATE]
proof (prove)
using this:
aKey K \<in> extr ik0 (chan s)
s \<in> m2_inv3_extrKey
s \<in> m2_inv2b_corrKey_leaked
K \<notin> Domain (m1_state.leak s)

goal (1 subgoal):
 1. (K, B) \<in> azC (runs s)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(K, B) \<in> azC (runs s)

goal (1 subgoal):
 1. B \<notin> bad \<Longrightarrow> (K, B) \<in> azC (runs s)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. B \<notin> bad \<Longrightarrow> (K, B) \<in> azC (runs s)
[PROOF STEP]
assume "B \<notin> bad"
[PROOF STATE]
proof (state)
this:
B \<notin> bad

goal (1 subgoal):
 1. B \<notin> bad \<Longrightarrow> (K, B) \<in> azC (runs s)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
B \<notin> bad

goal (1 subgoal):
 1. (K, B) \<in> azC (runs s)
[PROOF STEP]
using assms(1-2)
[PROOF STATE]
proof (prove)
using this:
B \<notin> bad
StatCh secure Sv B (Msg [aKey K, aAgt A]) \<in> chan s
s \<in> m2_inv4_M3

goal (1 subgoal):
 1. (K, B) \<in> azC (runs s)
[PROOF STEP]
by (auto dest: m2_inv4_M3D)
[PROOF STATE]
proof (state)
this:
(K, B) \<in> azC (runs s)

goal:
No subgoals!
[PROOF STEP]
qed