(* We show in this file how the `crypto` tactic on the IND-CPA game
can support applications which are beyond the reach of the current
`cca1` tactic. *)

include Basic.
Typed-check process:

null

Added action dependencies lemmas:


System after processing:

null

System Empty registered with actions (init).
[warning>Loaded "Prelude.sp".
<]axiom [any] eq_iff : forall (x,y:bool), (x = y) = (x <=> y)
axiom [any] eq_not : forall (x,y:bool), (not x = not y) = (x = y)
Goal eq_sym :
(x = y) = (y = x)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
(x = y) = (y = x)

[> Line 17: by (rewrite ...) [goal> lemma eq_sym is proved

lemma [any] eq_sym ['a] : forall (x,y:'a), (x = y) = (y = x)
Exiting proof mode.

Goal neq_sym :
(x <> y) = (y <> x)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
(x <> y) = (y <> x)

[> Line 23: by (rewrite ...) [goal> lemma neq_sym is proved

lemma [any] neq_sym ['a] : forall (x,y:'a), (x <> y) = (y <> x)
Exiting proof mode.

Goal eq_refl_e :
(x = x) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x:'a
----------------------------------------
(x = x) = true

[> Line 31: by (rewrite ...) [goal> lemma eq_refl_e is proved

lemma [any] eq_refl_e ['a] : forall (x:'a), (x = x) = true
Exiting proof mode.

Goal eq_refl :
x = x
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x:'a
----------------------------------------
x = x

[> Line 43: by (rewrite ...) [goal> lemma eq_refl is proved

lemma [any] eq_refl ['a] : forall (x:'a), x = x
Exiting proof mode.

Goal neq_irrefl :
x <> x <=> false
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x:'a
----------------------------------------
x <> x <=> false

[> Line 51: by split [goal> lemma neq_irrefl is proved

lemma [any] neq_irrefl ['a] : forall (x:'a), x <> x <=> false
Exiting proof mode.

Goal eq_assoc :
((b0 = b1) = b2) = (b0 = (b1 = b2))
[goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool
----------------------------------------
((b0 = b1) = b2) = (b0 = (b1 = b2))

[> Line 65: ((have ...); 1: by (rewrite ...)) [goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool[const]
true_false: (true = false) = false
----------------------------------------
((b0 = b1) = b2) = (b0 = (b1 = b2))

[> Line 67: ((have ...); 1: by (rewrite ...)) [goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool[const]
false_true: (false = true) = false
true_false: (true = false) = false
----------------------------------------
((b0 = b1) = b2) = (b0 = (b1 = b2))

[> Line 69: ((case ..., b0);
((case ..., b1);((case ..., b2);(try (auto ...)))))
[goal> Focused goal (1/2):
System: any
Variables: b0,b1,b2:bool[const]
false_true: (false = true) = false
true_false: (true = false) = false
----------------------------------------
not b2 => not b1 => b0 => ((true = false) = false) = (true = (false = false))

[> Line 69: by (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool[const]
false_true: (false = true) = false
true_false: (true = false) = false
----------------------------------------
b2 => not b1 => not b0 => ((false = false) = true) = (false = (false = true))

[> Line 69: by (rewrite ...) [goal> lemma eq_assoc is proved

lemma [any] eq_assoc :
forall (b0,b1,b2:bool), ((b0 = b1) = b2) = (b0 = (b1 = b2))
Exiting proof mode.

Goal true_false :
(true = false) = false
[goal> Focused goal (1/1):
System: any
----------------------------------------
(true = false) = false

[> Line 87: by (rewrite ...) [goal> lemma true_false is proved

lemma [any] true_false : (true = false) = false
Exiting proof mode.

Goal false_true :
(false = true) = false
[goal> Focused goal (1/1):
System: any
----------------------------------------
(false = true) = false

[> Line 97: by (rewrite ...) [goal> lemma false_true is proved

lemma [any] false_true : (false = true) = false
Exiting proof mode.

Goal eq_true :
(b = true) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b = true) = b

[> Line 107: by (case ..., b) [goal> lemma eq_true is proved

lemma [any] eq_true : forall (b:bool), (b = true) = b
Exiting proof mode.

Goal eq_true2 :
(true = b) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(true = b) = b

[> Line 115: by (case ..., b) [goal> lemma eq_true2 is proved

lemma [any] eq_true2 : forall (b:bool), (true = b) = b
Exiting proof mode.

axiom [any] not_true : not true = false
axiom [any] not_false : not false = true
Goal not_not :
not (not b) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
not (not b) = b

[> Line 145: by (case ..., b) [goal> lemma not_not is proved

lemma [any] not_not : forall (b:bool), not (not b) = b
Exiting proof mode.

Goal not_eq :
not (x = y) = (x <> y)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
not (x = y) = (x <> y)

[> Line 157: by (rewrite ...) [goal> lemma not_eq is proved

lemma [any] not_eq ['a] : forall (x,y:'a), not (x = y) = (x <> y)
Exiting proof mode.

Goal not_neq :
not (x <> y) = (x = y)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
not (x <> y) = (x = y)

[> Line 169: by (rewrite ...) [goal> lemma not_neq is proved

lemma [any] not_neq ['a] : forall (x,y:'a), not (x <> y) = (x = y)
Exiting proof mode.

Goal not_eqfalse :
(b = false) = not b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b = false) = not b

[> Line 181: by (case ..., b) [goal> lemma not_eqfalse is proved

lemma [any] not_eqfalse : forall (b:bool), (b = false) = not b
Exiting proof mode.

Goal not_impl :
not (a => b) = (a && not b)
[goal> Focused goal (1/1):
System: any
Variables: a,b:bool
----------------------------------------
not (a => b) = (a && not b)

[> Line 191: ((rewrite ...);(split;(intro H))) [goal> Focused goal (1/2):
System: any
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
a && not b

[> Line 193: split [goal> Focused goal (1/3):
System: any
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
a

[> Line 195: (rewrite ...) [goal> Focused goal (1/3):
System: any
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
not (not a)

[> Line 197: (intro Hna) [goal> Focused goal (1/3):
System: any
Variables: a,b:bool[const]
H: not (a => b)
Hna: not a
----------------------------------------
false

[> Line 199: by (apply ... ) [goal> Focused goal (1/2):
System: any
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
not b

[> Line 201: (intro Hb) [goal> Focused goal (1/2):
System: any
Variables: a,b:bool[const]
H: not (a => b)
Hb: b
----------------------------------------
false

[> Line 203: by (apply ... ) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
H: a && not b
----------------------------------------
not (a => b)

[> Line 205: (intro Hi) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
H: a && not b
Hi: a => b
----------------------------------------
false

[> Line 207: (destruct H, [Ha Hnb]) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
Ha: a
Hi: a => b
Hnb: not b
----------------------------------------
false

[> Line 209: (apply ... ) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
Ha: a
Hi: a => b
Hnb: not b
----------------------------------------
b

[> Line 211: by (apply ... ) [goal> lemma not_impl is proved

lemma [any] not_impl : forall (a,b:bool), not (a => b) = (a && not b)
Exiting proof mode.

Goal eq_false :
((x = y) = false) = (x <> y)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
((x = y) = false) = (x <> y)

[> Line 227: (rewrite ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
((x = y) = false) = not (x = y)

[> Line 227: ((case ..., (= x y));(intro _)) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: x,y:'a
_: x = y
----------------------------------------
(true = false) = not true

[> Line 227: (simpl ...) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: x,y:'a
_: x = y
----------------------------------------
true

[> Line 227: (auto ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
_: not (x = y)
----------------------------------------
(false = false) = not false

[> Line 229: by (rewrite ...) [goal> lemma eq_false is proved

lemma [any] eq_false ['a] : forall (x,y:'a), ((x = y) = false) = (x <> y)
Exiting proof mode.

axiom [any] and_comm : forall (b,b':bool), (b && b') = (b' && b)
Goal and_dist :
((b0 || b1) && b2) = (b0 && b2 || b1 && b2)
[goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool
----------------------------------------
((b0 || b1) && b2) = (b0 && b2 || b1 && b2)

[> Line 249: (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool[const]
----------------------------------------
(b0 || b1) && b2 <=> b0 && b2 || b1 && b2

[> Line 249: by split [goal> lemma and_dist is proved

lemma [any] and_dist :
forall (b0,b1,b2:bool), ((b0 || b1) && b2) = (b0 && b2 || b1 && b2)
Exiting proof mode.

axiom [any] and_true_l : forall (b:bool), (true && b) = b
Goal and_true_r :
(b && true) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b && true) = b

[> Line 261: by (rewrite ... ...) [goal> lemma and_true_r is proved

lemma [any] and_true_r : forall (b:bool), (b && true) = b
Exiting proof mode.

axiom [any] and_false_l : forall (b:bool), (false && b) = false
Goal and_false_r :
(b && false) = false
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b && false) = false

[> Line 275: by (rewrite ... ...) [goal> lemma and_false_r is proved

lemma [any] and_false_r : forall (b:bool), (b && false) = false
Exiting proof mode.

Goal and_double :
(b && b) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b && b) = b

[> Line 285: by (case ..., b) [goal> lemma and_double is proved

lemma [any] and_double : forall (b:bool), (b && b) = b
Exiting proof mode.

axiom [any] or_comm : forall (b,b':bool), (b || b') = (b' || b)
Goal or_dist :
((b0 || b2) && (b1 || b2)) = (b0 && b1 || b2)
[goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool
----------------------------------------
((b0 || b2) && (b1 || b2)) = (b0 && b1 || b2)

[> Line 301: (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool[const]
----------------------------------------
(b0 || b2) && (b1 || b2) <=> b0 && b1 || b2

[> Line 301: by split [goal> lemma or_dist is proved

lemma [any] or_dist :
forall (b0,b1,b2:bool), ((b0 || b2) && (b1 || b2)) = (b0 && b1 || b2)
Exiting proof mode.

axiom [any] or_false_l : forall (b:bool), (false || b) = b
Goal or_false_r :
(b || false) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b || false) = b

[> Line 313: by (rewrite ... ...) [goal> lemma or_false_r is proved

lemma [any] or_false_r : forall (b:bool), (b || false) = b
Exiting proof mode.

axiom [any] or_true_l : forall (b:bool), (true || b) = true
Goal or_true_r :
(b || true) = true
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b || true) = true

[> Line 327: by (rewrite ... ...) [goal> lemma or_true_r is proved

lemma [any] or_true_r : forall (b:bool), (b || true) = true
Exiting proof mode.

Goal or_double :
(b || b) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b || b) = b

[> Line 335: by (case ..., b) [goal> lemma or_double is proved

lemma [any] or_double : forall (b:bool), (b || b) = b
Exiting proof mode.

Goal impl_charac :
(b => b') = (not b || b')
[goal> Focused goal (1/1):
System: any
Variables: b,b':bool
----------------------------------------
(b => b') = (not b || b')

[> Line 349: (((rewrite ...);(split;((case ..., b);(case ..., b'))));
(intro //=))
[goal> lemma impl_charac is proved

lemma [any] impl_charac : forall (b,b':bool), (b => b') = (not b || b')
Exiting proof mode.

Goal impl_false_l :
(false => b) = true
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(false => b) = true

[> Line 357: by ((rewrite ...);(case ..., b)) [goal> lemma impl_false_l is proved

lemma [any] impl_false_l : forall (b:bool), (false => b) = true
Exiting proof mode.

Goal impl_true_r :
(b => true) = true
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b => true) = true

[> Line 365: (auto ...) [goal> lemma impl_true_r is proved

lemma [any] impl_true_r : forall (b:bool), (b => true) = true
Exiting proof mode.

Goal impl_true_l :
(true => b) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(true => b) = b

[> Line 373: by (rewrite ...) [goal> lemma impl_true_l is proved

lemma [any] impl_true_l : forall (b:bool), (true => b) = b
Exiting proof mode.

Goal impl_contra :
(b => c) = (not c => not b)
[goal> Focused goal (1/1):
System: any
Variables: b,c:bool
----------------------------------------
(b => c) = (not c => not b)

[> Line 383: (rewrite ... /=) [goal> Focused goal (1/1):
System: any
Variables: b,c:bool[const]
----------------------------------------
(not b || c) = (c || not b)

[> Line 385: by (rewrite ...) [goal> lemma impl_contra is proved

lemma [any] impl_contra : forall (b,c:bool), (b => c) = (not c => not b)
Exiting proof mode.

Goal not_and :
not (a && b) = (not a || not b)
[goal> Focused goal (1/1):
System: any
Variables: a,b:bool
----------------------------------------
not (a && b) = (not a || not b)

[> Line 401: (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
----------------------------------------
not (a && b) <=> not a || not b

[> Line 403: (((case ..., a);(case ..., b));(intro //=)) [goal> lemma not_and is proved

lemma [any] not_and : forall (a,b:bool), not (a && b) = (not a || not b)
Exiting proof mode.

Goal not_or :
not (a || b) = (not a && not b)
[goal> Focused goal (1/1):
System: any
Variables: a,b:bool
----------------------------------------
not (a || b) = (not a && not b)

[> Line 413: (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
----------------------------------------
not (a || b) <=> not a && not b

[> Line 415: (((case ..., a);(case ..., b));(intro //=)) [goal> lemma not_or is proved

lemma [any] not_or : forall (a,b:bool), not (a || b) = (not a && not b)
Exiting proof mode.

Goal if_true :
b => if b then x else y = x
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool,x,y:'a
----------------------------------------
b => if b then x else y = x

[> Line 433: (intro *) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
----------------------------------------
if b then x else y = x

[> Line 435: (case ..., (if b x y)) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
----------------------------------------
b && if b then x else y = x => x = x

[> Line 437: (auto ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
----------------------------------------
not b && if b then x else y = y => y = x

[> Line 439: (intro [HH _]) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
HH: not b
_: if b then x else y = y
----------------------------------------
y = x

[> Line 439: by (have ...) [goal> lemma if_true is proved

lemma [any] if_true ['a] :
forall (b:bool,x,y:'a), b => if b then x else y = x
Exiting proof mode.

Goal if_true0 :
if true then x else y = x
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
if true then x else y = x

[> Line 451: by (rewrite ...) [goal> lemma if_true0 is proved

lemma [any] if_true0 ['a] : forall (x,y:'a), if true then x else y = x
Exiting proof mode.

Goal if_false :
not b => if b then x else y = y
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool,x,y:'a
----------------------------------------
not b => if b then x else y = y

[> Line 465: ((intro *);(case ..., (if b x y))) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: not b
----------------------------------------
b && if b then x else y = x => x = y

[> Line 467: (intro [H1 H2]) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: not b
H1: b
H2: if b then x else y = x
----------------------------------------
x = y

[> Line 469: by (rewrite ... in H2) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: not b
----------------------------------------
not b && if b then x else y = y => y = y

[> Line 471: (auto ...) [goal> lemma if_false is proved

lemma [any] if_false ['a] :
forall (b:bool,x,y:'a), not b => if b then x else y = y
Exiting proof mode.

Goal if_false0 :
if false then x else y = y
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
if false then x else y = y

[> Line 483: by (rewrite ...) [goal> lemma if_false0 is proved

lemma [any] if_false0 ['a] : forall (x,y:'a), if false then x else y = y
Exiting proof mode.

Goal if_then_then :
if b then (if b' then x else y) else y = if (b && b') then x else y
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y:'a
----------------------------------------
if b then (if b' then x else y) else y = if (b && b') then x else y

[> Line 497: by ((case ..., b);(case ..., b')) [goal> lemma if_then_then is proved

lemma [any] if_then_then ['a] :
forall (b,b':bool,x,y:'a),
if b then (if b' then x else y) else y = if (b && b') then x else y
Exiting proof mode.

Goal if_then_or :
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
[goal> Focused goal (1/1):
System: any
Variables: b0,b1:bool,m0,m1:message
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 513: ((have ...); 1: by (auto ...)) [goal> Focused goal (1/2):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 513: ((rewrite ...);(intro //)) [goal> Focused goal (1/2):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: b0
----------------------------------------
m0 = if (b0 || b1) then m0 else m1

[> Line 513: ((rewrite ...);(intro //)) [goal> Focused goal (1/1):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: not b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 515: ((have ...); 1: by (auto ...)) [goal> Focused goal (1/2):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: b1
_: not b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 515: ((rewrite ...);(intro //)) [goal> Focused goal (1/2):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: b1
_: not b0
----------------------------------------
if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 515: ((rewrite ...);(intro //)) [goal> Focused goal (1/1):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: not b1
_: not b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1

[> Line 517: ((rewrite ...);(intro //)) [goal> lemma if_then_or is proved

lemma [any] if_then_or :
forall (b0,b1:bool,m0,m1:message),
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
Exiting proof mode.

Goal if_then_implies :
if b then (if b' then x else y) else z =
if b then (if (b => b') then x else y) else z
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
if b then (if b' then x else y) else z =
if b then (if (b => b') then x else y) else z

[> Line 531: ((case ..., b);
((intro H);
((case ..., b');((intro H');((simpl ...);(try (auto ...)))))))
[goal> lemma if_then_implies is proved

lemma [any] if_then_implies ['a] :
forall (b,b':bool,x,y,z:'a),
if b then (if b' then x else y) else z =
if b then (if (b => b') then x else y) else z
Exiting proof mode.

Goal if_same :
if b then x else x = x
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool,x:'a
----------------------------------------
if b then x else x = x

[> Line 543: by (case ..., b) [goal> lemma if_same is proved

lemma [any] if_same ['a] : forall (b:bool,x:'a), if b then x else x = x
Exiting proof mode.

Goal if_then :
b = b' => if b then (if b' then x else y) else z = if b then x else z
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = b' => if b then (if b' then x else y) else z = if b then x else z

[> Line 561: by ((intro ->);(case ..., b')) [goal> lemma if_then is proved

lemma [any] if_then ['a] :
forall (b,b':bool,x,y,z:'a),
b = b' => if b then (if b' then x else y) else z = if b then x else z
Exiting proof mode.

Goal if_then_inv :
if b then m0 else m1 = if b then (if b then m0) else m1
[goal> Focused goal (1/1):
System: any
Variables: b:bool,m0,m1:message
----------------------------------------
if b then m0 else m1 = if b then (if b then m0) else m1

[> Line 575: (auto ...) [goal> lemma if_then_inv is proved

lemma [any] if_then_inv :
forall (b:bool,m0,m1:message),
if b then m0 else m1 = if b then (if b then m0) else m1
Exiting proof mode.

Goal if_else :
b = b' => if b then x else if b' then y else z = if b then x else z
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = b' => if b then x else if b' then y else z = if b then x else z

[> Line 589: by ((intro ->);(case ..., b')) [goal> lemma if_else is proved

lemma [any] if_else ['a] :
forall (b,b':bool,x,y,z:'a),
b = b' => if b then x else if b' then y else z = if b then x else z
Exiting proof mode.

Goal if_else_inv :
if b then m0 else m1 = if b then m0 else if not b then m1
[goal> Focused goal (1/1):
System: any
Variables: b:bool,m0,m1:message
----------------------------------------
if b then m0 else m1 = if b then m0 else if not b then m1

[> Line 601: by (case ..., b) [goal> lemma if_else_inv is proved

lemma [any] if_else_inv :
forall (b:bool,m0,m1:message),
if b then m0 else m1 = if b then m0 else if not b then m1
Exiting proof mode.

Goal if_push :
if b then m0 else m1 = if b then (if b then m0) else if not b then m1
[goal> Focused goal (1/1):
System: any
Variables: b:bool,m0,m1:message
----------------------------------------
if b then m0 else m1 = if b then (if b then m0) else if not b then m1

[> Line 609: by (rewrite ... ...) [goal> lemma if_push is proved

lemma [any] if_push :
forall (b:bool,m0,m1:message),
if b then m0 else m1 = if b then (if b then m0) else if not b then m1
Exiting proof mode.

Goal if_then_not :
b = not b' => if b then (if b' then x else y) else z = if b then y else z
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = not b' => if b then (if b' then x else y) else z = if b then y else z

[> Line 623: by ((intro ->);(case ..., b')) [goal> lemma if_then_not is proved

lemma [any] if_then_not ['a] :
forall (b,b':bool,x,y,z:'a),
b = not b' => if b then (if b' then x else y) else z = if b then y else z
Exiting proof mode.

Goal if_else_not :
b = not b' => if b then x else if b' then y else z = if b then x else y
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = not b' => if b then x else if b' then y else z = if b then x else y

[> Line 641: by ((intro ->);(case ..., b')) [goal> lemma if_else_not is proved

lemma [any] if_else_not ['a] :
forall (b,b':bool,x,y,z:'a),
b = not b' => if b then x else if b' then y else z = if b then x else y
Exiting proof mode.

Goal if_app :
f (if c then x else y) = if c then f x else f y
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: c:bool,f:'a -> 'b,x,y:'a
----------------------------------------
f (if c then x else y) = if c then f x else f y

[> Line 653: by (case ..., c) [goal> lemma if_app is proved

lemma [any] if_app ['a 'b] :
forall (f:'a -> 'b,c:bool,x,y:'a),
f (if c then x else y) = if c then f x else f y
Exiting proof mode.

Goal fst_pair :
fst <x,y> = x
[goal> Focused goal (1/1):
System: any
Variables: x,y:message
----------------------------------------
fst <x,y> = x

[> Line 665: (auto ...) [goal> lemma fst_pair is proved

lemma [any] fst_pair : forall (x,y:message), fst <x,y> = x
Exiting proof mode.

Goal snd_pair :
snd <x,y> = y
[goal> Focused goal (1/1):
System: any
Variables: x,y:message
----------------------------------------
snd <x,y> = y

[> Line 673: (auto ...) [goal> lemma snd_pair is proved

lemma [any] snd_pair : forall (x,y:message), snd <x,y> = y
Exiting proof mode.

Goal iff_def :
(x <=> y) = ((x => y) && (y => x))
[goal> Focused goal (1/1):
System: any
Variables: x,y:bool
----------------------------------------
(x <=> y) = ((x => y) && (y => x))

[> Line 689: ((rewrite ...);split) [goal> Focused goal (1/2):
System: any
Variables: x,y:bool[const]
----------------------------------------
x <=> y => (x => y) && (y => x)

[> Line 691: by (intro ->) [goal> Focused goal (1/1):
System: any
Variables: x,y:bool[const]
----------------------------------------
(x => y) && (y => x) => x <=> y

[> Line 693: (auto ...) [goal> lemma iff_def is proved

lemma [any] iff_def : forall (x,y:bool), (x <=> y) = ((x => y) && (y => x))
Exiting proof mode.

Goal iff_refl :
(x <=> x) = true
[goal> Focused goal (1/1):
System: any
Variables: x:bool
----------------------------------------
(x <=> x) = true

[> Line 703: by (rewrite ...) [goal> lemma iff_refl is proved

lemma [any] iff_refl : forall (x:bool), (x <=> x) = true
Exiting proof mode.

Goal iff_sym :
(x <=> y) = (y <=> x)
[goal> Focused goal (1/1):
System: any
Variables: x,y:bool
----------------------------------------
(x <=> y) = (y <=> x)

[> Line 715: by (rewrite ... ...) [goal> lemma iff_sym is proved

lemma [any] iff_sym : forall (x,y:bool), (x <=> y) = (y <=> x)
Exiting proof mode.

Goal true_iff_false :
(true <=> false) = false
[goal> Focused goal (1/1):
System: any
----------------------------------------
(true <=> false) = false

[> Line 725: by (rewrite ...) [goal> lemma true_iff_false is proved

lemma [any] true_iff_false : (true <=> false) = false
Exiting proof mode.

Goal false_iff_true :
(false <=> true) = false
[goal> Focused goal (1/1):
System: any
----------------------------------------
(false <=> true) = false

[> Line 737: by (rewrite ...) [goal> lemma false_iff_true is proved

lemma [any] false_iff_true : (false <=> true) = false
Exiting proof mode.

Goal contra_iff :
(not x <=> y) = (x <=> not y)
[goal> Focused goal (1/1):
System: any
Variables: x,y:bool
----------------------------------------
(not x <=> y) = (x <=> not y)

[> Line 751: (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: x,y:bool[const]
----------------------------------------
(not x <=> y) <=> (x <=> not y)

[> Line 753: (split;by (rewrite ... ...)) [goal> lemma contra_iff is proved

lemma [any] contra_iff : forall (x,y:bool), (not x <=> y) = (x <=> not y)
Exiting proof mode.

Goal exists_false1 :
(exists (a:'a), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a
----------------------------------------
(exists (a:'a), false) = false

[> Line 769: by (rewrite ...) [goal> lemma exists_false1 is proved

lemma [any] exists_false1 ['a] : (exists (a:'a), false) = false
Exiting proof mode.

Goal exists_false2 :
(exists (a:'a,b:'b), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
----------------------------------------
(exists (a:'a,b:'b), false) = false

[> Line 777: by (rewrite ...) [goal> lemma exists_false2 is proved

lemma [any] exists_false2 ['a 'b] : (exists (a:'a,b:'b), false) = false
Exiting proof mode.

Goal exists_false3 :
(exists (a:'a,b:'b,c:'c), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c
----------------------------------------
(exists (a:'a,b:'b,c:'c), false) = false

[> Line 785: by (rewrite ...) [goal> lemma exists_false3 is proved

lemma [any] exists_false3 ['a 'b 'c] :
(exists (a:'a,b:'b,c:'c), false) = false
Exiting proof mode.

Goal exists_false4 :
(exists (a:'a,b:'b,c:'c,d:'d), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd
----------------------------------------
(exists (a:'a,b:'b,c:'c,d:'d), false) = false

[> Line 793: by (rewrite ...) [goal> lemma exists_false4 is proved

lemma [any] exists_false4 ['a 'b 'c 'd] :
(exists (a:'a,b:'b,c:'c,d:'d), false) = false
Exiting proof mode.

Goal exists_false5 :
(exists (a:'a,b:'b,c:'c,d:'d,e:'e), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd, 'e
----------------------------------------
(exists (a:'a,b:'b,c:'c,d:'d,e:'e), false) = false

[> Line 801: by (rewrite ...) [goal> lemma exists_false5 is proved

lemma [any] exists_false5 ['a 'b 'c 'd 'e] :
(exists (a:'a,b:'b,c:'c,d:'d,e:'e), false) = false
Exiting proof mode.

Goal exists_false6 :
(exists (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd, 'e, 'f
----------------------------------------
(exists (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), false) = false

[> Line 809: by (rewrite ...) [goal> lemma exists_false6 is proved

lemma [any] exists_false6 ['a 'b 'c 'd 'e 'f] :
(exists (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), false) = false
Exiting proof mode.

Goal forall_true1 :
(forall (a:'a), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a
----------------------------------------
(forall (a:'a), true) = true

[> Line 829: (auto ...) [goal> lemma forall_true1 is proved

lemma [any] forall_true1 ['a] : (forall (a:'a), true) = true
Exiting proof mode.

Goal forall_true2 :
(forall (a:'a,b:'b), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
----------------------------------------
(forall (a:'a,b:'b), true) = true

[> Line 837: (auto ...) [goal> lemma forall_true2 is proved

lemma [any] forall_true2 ['a 'b] : (forall (a:'a,b:'b), true) = true
Exiting proof mode.

Goal forall_true3 :
(forall (a:'a,b:'b,c:'c), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c
----------------------------------------
(forall (a:'a,b:'b,c:'c), true) = true

[> Line 845: (auto ...) [goal> lemma forall_true3 is proved

lemma [any] forall_true3 ['a 'b 'c] : (forall (a:'a,b:'b,c:'c), true) = true
Exiting proof mode.

Goal forall_true4 :
(forall (a:'a,b:'b,c:'c,d:'d), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd
----------------------------------------
(forall (a:'a,b:'b,c:'c,d:'d), true) = true

[> Line 853: (auto ...) [goal> lemma forall_true4 is proved

lemma [any] forall_true4 ['a 'b 'c 'd] :
(forall (a:'a,b:'b,c:'c,d:'d), true) = true
Exiting proof mode.

Goal forall_true5 :
(forall (a:'a,b:'b,c:'c,d:'d,e:'e), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd, 'e
----------------------------------------
(forall (a:'a,b:'b,c:'c,d:'d,e:'e), true) = true

[> Line 861: (auto ...) [goal> lemma forall_true5 is proved

lemma [any] forall_true5 ['a 'b 'c 'd 'e] :
(forall (a:'a,b:'b,c:'c,d:'d,e:'e), true) = true
Exiting proof mode.

Goal forall_true6 :
(forall (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd, 'e, 'f
----------------------------------------
(forall (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), true) = true

[> Line 869: (auto ...) [goal> lemma forall_true6 is proved

lemma [any] forall_true6 ['a 'b 'c 'd 'e 'f] :
(forall (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), true) = true
Exiting proof mode.

axiom [any] len_zeroes : forall (x:message), len (zeroes x) = len x
axiom [any] exec_not_init :
forall (tau:timestamp),
init < tau => exec@tau = (exec@pred tau && cond@tau)
axiom [any] exec_init : forall (tau:timestamp), tau = init => exec@tau = true
axiom [any] cond_init : forall (tau:timestamp), tau = init => cond@tau = true
Goal exec_le :
tau' <= tau => exec@tau => exec@tau'
[goal> Focused goal (1/1):
System: any
Variables: tau,tau':timestamp
----------------------------------------
tau' <= tau => exec@tau => exec@tau'

[> Line 917: ((induction tau);(intro tau IH Hle Hexec)) [goal> Focused goal (1/1):
System: any
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
exec@tau'

[> Line 919: (case ..., (= tau tau')) [goal> Focused goal (1/2):
System: any
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
tau = tau' => exec@tau'

[> Line 921: (auto ...) [goal> Focused goal (1/1):
System: any
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
not (tau = tau') => exec@tau'

[> Line 923: (intro Hneq) [goal> Focused goal (1/1):
System: any
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
Hneq: not (tau = tau')
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
exec@tau'

[> Line 925: (rewrite ... // in Hexec) [goal> Focused goal (1/1):
System: any
Variables: tau,tau':timestamp[const]
Hexec: exec@pred tau && cond@tau
Hle: tau' <= tau
Hneq: not (tau = tau')
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
exec@tau'

[> Line 927: by (apply ... ) [goal> lemma exec_le is proved

lemma [any] exec_le :
forall (tau,tau':timestamp), tau' <= tau => exec@tau => exec@tau'
Exiting proof mode.

Goal exec_cond :
happens(tau) => exec@tau => cond@tau
[goal> Focused goal (1/1):
System: any
Variables: tau:timestamp
----------------------------------------
happens(tau) => exec@tau => cond@tau

[> Line 937: (intro Hap Hexec) [goal> Focused goal (1/1):
System: any
Variables: tau:timestamp[const]
Hap: happens(tau)
Hexec: exec@tau
----------------------------------------
cond@tau

[> Line 939: ((case ..., (< init tau));(intro _)) [goal> Focused goal (1/2):
System: any
Variables: tau:timestamp[const]
Hap: happens(tau)
Hexec: exec@tau
_: init < tau
----------------------------------------
cond@tau

[> Line 941: by (rewrite ... in Hexec) [goal> Focused goal (1/1):
System: any
Variables: tau:timestamp[const]
Hap: happens(tau)
Hexec: exec@tau
_: not (init < tau)
----------------------------------------
cond@tau

[> Line 943: by (rewrite ...) [goal> lemma exec_cond is proved

lemma [any] exec_cond :
forall (tau:timestamp), happens(tau) => exec@tau => cond@tau
Exiting proof mode.

Goal f_apply :
x = y => f x = f y
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: f:'a -> 'b,x,y:'a
----------------------------------------
x = y => f x = f y

[> Line 955: by (intro ->) [goal> lemma f_apply is proved

lemma [any] f_apply ['a 'b] : forall (f:'a -> 'b,x,y:'a), x = y => f x = f y
Exiting proof mode.

Goal not_exists_1 :
not exists (a:'a), phi a = forall (a:'a), not (phi a)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
not exists (a:'a), phi a = forall (a:'a), not (phi a)

[> Line 965: (rewrite ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
not exists (a:'a), phi a <=> forall (a:'a), not (phi a)

[> Line 967: split [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
not exists (a:'a), phi a => forall (a:'a), not (phi a)

[> Line 969: (intro H a Hp) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: a:'a,phi:'a -> bool
H: not exists (a:'a), phi a
Hp: phi a
----------------------------------------
false

[> Line 971: (apply ... ) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: a:'a,phi:'a -> bool
H: not exists (a:'a), phi a
Hp: phi a
----------------------------------------
exists (a:'a), phi a

[> Line 973: by (exists a) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
(forall (a:'a), not (phi a)) => not exists (a:'a), phi a

[> Line 975: (intro H [a Hp]) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: a:'a,phi:'a -> bool
H: forall (a:'a), not (phi a)
Hp: phi a
----------------------------------------
false

[> Line 977: by (have ...) [goal> lemma not_exists_1 is proved

lemma [any] not_exists_1 ['a] :
forall (phi:'a -> bool),
not exists (a:'a), phi a = forall (a:'a), not (phi a)
Exiting proof mode.

Goal not_exists_2 :
not exists (a:'a,b:'b), phi a b = forall (a:'a,b:'b), not (phi a b)
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
not exists (a:'a,b:'b), phi a b = forall (a:'a,b:'b), not (phi a b)

[> Line 989: (rewrite ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
not exists (a:'a,b:'b), phi a b <=> forall (a:'a,b:'b), not (phi a b)

[> Line 991: split [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
not exists (a:'a,b:'b), phi a b => forall (a:'a,b:'b), not (phi a b)

[> Line 993: (intro H a b Hp) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: a:'a,b:'b,phi:'a -> 'b -> bool
H: not exists (a:'a,b:'b), phi a b
Hp: phi a b
----------------------------------------
false

[> Line 995: (apply ... ) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: a:'a,b:'b,phi:'a -> 'b -> bool
H: not exists (a:'a,b:'b), phi a b
Hp: phi a b
----------------------------------------
exists (a:'a,b:'b), phi a b

[> Line 997: by (exists a, b) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(forall (a:'a,b:'b), not (phi a b)) => not exists (a:'a,b:'b), phi a b

[> Line 999: (intro H [a b Hp]) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: a:'a,b:'b,phi:'a -> 'b -> bool
H: forall (a:'a,b:'b), not (phi a b)
Hp: phi a b
----------------------------------------
false

[> Line 1001: by (have ...) [goal> lemma not_exists_2 is proved

lemma [any] not_exists_2 ['a 'b] :
forall (phi:'a -> 'b -> bool),
not exists (a:'a,b:'b), phi a b = forall (a:'a,b:'b), not (phi a b)
Exiting proof mode.

axiom [any] not_forall_1 ['a] :
forall (phi:'a -> bool),
not forall (a:'a), phi a = exists (a:'a), not (phi a)
axiom [any] not_forall_2 ['a 'b] :
forall (phi:'a -> 'b -> bool),
not forall (a:'a,b:'b), phi a b = exists (a:'a,b:'b), not (phi a b)
axiom [any] try_carac_1 ['a 'b] :
forall (phi:'a -> bool,f:'a -> 'b,g:'b),
try find x:'a such that phi x in f x else g =
if (exists (x:'a), phi x) then f (choose phi) else g
Goal choose_spec :
phi x => phi (choose phi)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
----------------------------------------
phi x => phi (choose phi)

[> Line 1053: (intro H) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
phi (choose phi)

[> Line 1059: (have ...) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
phi (choose phi) = if (exists (x:'a), phi x) then phi (choose phi) else false

[> Line 1061: ?? [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
phi (choose phi) = if (exists (x:'a), phi x) then phi (choose phi) else false

[> Line 1063: ((rewrite ...);(intro //)) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
exists (x:'a), phi x

[> Line 1063: by (exists x) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
if (exists (x:'a), phi x) then phi (choose phi) else false

[> Line 1065: ?? [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
if (exists (x:'a), phi x) then phi (choose phi) else false

[> Line 1067: (rewrite ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
try find x:'a such that phi x in phi x else false

[> Line 1069: (case ...,
try find x:_ such that (phi x) in (phi x) else false)
[goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
(exists (x:'a),
phi x && try find x:'a such that phi x in phi x else false = phi x) =>
try find x:'a such that phi x in phi x else false

[> Line 1071: (auto ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
(forall (x:'a), not (phi x)) &&
try find x:'a such that phi x in phi x else false = false =>
try find x:'a such that phi x in phi x else false

[> Line 1073: ((intro [HH _]);by (have ...)) [goal> lemma choose_spec is proved

lemma [any] choose_spec ['a] :
forall (phi:'a -> bool,x:'a), phi x => phi (choose phi)
Exiting proof mode.

Goal try_choose :
phi x => try find x:'a such that phi x in f x else g = f (choose phi)
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
----------------------------------------
phi x => try find x:'a such that phi x in f x else g = f (choose phi)

[> Line 1091: (intro H) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
H: phi x
----------------------------------------
try find x:'a such that phi x in f x else g = f (choose phi)

[> Line 1093: (rewrite ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
H: phi x
----------------------------------------
if (exists (x:'a), phi x) then f (choose phi) else g = f (choose phi)

[> Line 1095: ((rewrite ...);(intro //)) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
H: phi x
----------------------------------------
exists (x:'a), phi x

[> Line 1097: by (exists x) [goal> lemma try_choose is proved

lemma [any] try_choose ['a 'b] :
forall (phi:'a -> bool,f:'a -> 'b,g:'b,x:'a),
phi x => try find x:'a such that phi x in f x else g = f (choose phi)
Exiting proof mode.

Goal forall_exists :
(forall (x:'a), exists (y:'b), phi x y) =
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(forall (x:'a), exists (y:'b), phi x y) =
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)

[> Line 1115: ((rewrite ...);split) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(forall (x:'a), exists (y:'b), phi x y) =>
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)

[> Line 1117: (intro H) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
H: forall (x:'a), exists (y:'b), phi x y
----------------------------------------
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)

[> Line 1119: (exists (fun (x : _) => (choose (fun (y : _) => (phi x y))))) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
H: forall (x:'a), exists (y:'b), phi x y
----------------------------------------
forall (x:'a), phi x ((fun (x:'a) => choose (fun (y:'b) => phi x y)) x)

[> Line 1121: ((intro x);(simpl ...)) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a
H: forall (x:'a), exists (y:'b), phi x y
----------------------------------------
phi x (choose (fun (y:'b) => phi x y))

[> Line 1123: (have (.. := ...)) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y:'b
H: forall (x:'a), exists (y:'b), phi x y
Hy: phi x y
----------------------------------------
phi x (choose (fun (y:'b) => phi x y))

[> Line 1131: ((have ...); 1: by (auto ...)) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y:'b
H: forall (x:'a), exists (y:'b), phi x y
Hy: phi x y
----------------------------------------
(fun (y:'b) => phi x y) (choose (fun (y:'b) => phi x y))

[> Line 1133: (apply ... ) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y:'b
H: forall (x:'a), exists (y:'b), phi x y
Hy: phi x y
----------------------------------------
(fun (y:'b) => phi x y) y

[> Line 1135: ((simpl ...);assumption) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(exists (y':'a -> 'b), forall (x:'a), phi x (y' x)) =>
forall (x:'a), exists (y:'b), phi x y

[> Line 1137: (intro [y' H] x) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y':'a -> 'b
H: forall (x:'a), phi x (y' x)
----------------------------------------
exists (y:'b), phi x y

[> Line 1139: (exists (y' x)) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y':'a -> 'b
H: forall (x:'a), phi x (y' x)
----------------------------------------
phi x (y' x)

[> Line 1141: by (apply ... ) [goal> lemma forall_exists is proved

lemma [any] forall_exists ['a 'b] :
forall (phi:'a -> 'b -> bool),
(forall (x:'a), exists (y:'b), phi x y) =
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)
Exiting proof mode.

Goal implies_exists :
(phi => exists (j:'a), psi j) = exists (x:'a), phi => psi x
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:bool,psi:'a -> bool
----------------------------------------
(phi => exists (j:'a), psi j) = exists (x:'a), phi => psi x

[> Line 1155: ((rewrite ...);split) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
----------------------------------------
(phi => exists (j:'a), psi j) => exists (x:'a), phi => psi x

[> Line 1157: (intro H) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
----------------------------------------
exists (x:'a), phi => psi x

[> Line 1159: (case ..., phi) [goal> Focused goal (1/3):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
----------------------------------------
phi => exists (x:'a), true => psi x

[> Line 1161: (intro phi) [goal> Focused goal (1/3):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
phi: phi
----------------------------------------
exists (x:'a), true => psi x

[> Line 1163: ((have ...); 1: by (apply ... )) [goal> Focused goal (1/3):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool,x:'a
H: phi => exists (j:'a), psi j
_: psi x
phi: phi
----------------------------------------
exists (x:'a), true => psi x

[> Line 1165: by (exists x) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
----------------------------------------
not phi => exists (x:'a), false => psi x

[> Line 1167: (intro _) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
_: not phi
----------------------------------------
exists (x:'a), false => psi x

[> Line 1169: by (exists (choose (fun (_x : _) => false))) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
----------------------------------------
(exists (x:'a), phi => psi x) => phi => exists (j:'a), psi j

[> Line 1171: (intro [x H] H') [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool,x:'a
H: phi => psi x
H': phi
----------------------------------------
exists (j:'a), psi j

[> Line 1173: by (exists x) [goal> lemma implies_exists is proved

lemma [any] implies_exists ['a] :
forall (phi:bool,psi:'a -> bool),
(phi => exists (j:'a), psi j) = exists (x:'a), phi => psi x
Exiting proof mode.

axiom [any] le_trans ['a] : forall (x,y,z:'a), x <= y => y <= z => x <= z
axiom [any] lt_trans ['a] : forall (x,y,z:'a), x < y => y < z => x < z
axiom [any] lt_le_trans ['a] : forall (x,y,z:'a), x < y => y <= z => x < z
axiom [any] le_lt_trans ['a] : forall (x,y,z:'a), x <= y => y < z => x < z
axiom [any] lt_charac ['a] : forall (x,y:'a), x < y <=> x <> y && x <= y
axiom [any] le_not_lt_impl_eq ['a] :
forall (x,y:'a), x <= y => not (x < y) => x = y
Goal lt_impl_le :
x < y => x <= y
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
x < y => x <= y

[> Line 1205: by (rewrite ...) [goal> lemma lt_impl_le is proved

lemma [any] lt_impl_le ['a] : forall (x,y:'a), x < y => x <= y
Exiting proof mode.

Goal not_lt_refl :
not (x < x)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x:'a
----------------------------------------
not (x < x)

[> Line 1211: (auto ...) [goal> lemma not_lt_refl is proved

lemma [any] not_lt_refl ['a] : forall (x:'a), not (x < x)
Exiting proof mode.

Goal lt_irrefl :
x < x <=> false
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x:'a
----------------------------------------
x < x <=> false

[> Line 1217: (auto ...) [goal> lemma lt_irrefl is proved

lemma [any] lt_irrefl ['a] : forall (x:'a), x < x <=> false
Exiting proof mode.

axiom [any] le_impl_eq_lt ['a] : forall (x,y:'a), x <= y => x = y || x < y
axiom [any] le_refl_index : forall (x:index), x <= x
Goal le_refl_index_eq :
x <= x = true
[goal> Focused goal (1/1):
System: any
Variables: x:index
----------------------------------------
x <= x = true

[> Line 1241: by (rewrite ...) [goal> lemma le_refl_index_eq is proved

lemma [any] le_refl_index_eq : forall (x:index), x <= x = true
Exiting proof mode.

Goal le_pred_lt :
t <= pred t' = t < t'
[goal> Focused goal (1/1):
System: any
Variables: t,t':timestamp
----------------------------------------
t <= pred t' = t < t'

[> Line 1251: by (rewrite ...) [goal> lemma le_pred_lt is proved

lemma [any] le_pred_lt : forall (t,t':timestamp), t <= pred t' = t < t'
Exiting proof mode.

Goal neq_le_pred_le :
t <> t' => t <= t' = t <= pred t'
[goal> Focused goal (1/1):
System: any
Variables: t,t':timestamp
----------------------------------------
t <> t' => t <= t' = t <= pred t'

[> Line 1259: by (rewrite ...) [goal> lemma neq_le_pred_le is proved

lemma [any] neq_le_pred_le :
forall (t,t':timestamp), t <> t' => t <= t' = t <= pred t'
Exiting proof mode.

axiom [any] le_lt ['a] : forall (x,x':'a), x <> x' => x <= x' = x < x'
axiom [any] empty_set_is_empty : forall (x:message), not (mem x empty_set)
[warning>Loaded "Basic.sp".
<]


(* Defining an encryption function as an abstract function. *)
abstract enc : message -> message -> message -> message.


(* CPA game for our encryption function.
It states the indistinguishability between
the encryption of any message x and
the encryption of a message of same size but with only 0 bits.*)
game CPA = {
rnd key : message;
oracle enc x = {
rnd r : message;
return enc (diff(x,zeroes x)) r key
}
}.
game CPA = {
rnd key : message;

oracle enc (x:message) : message = {
rnd r : message; return enc diff(x, zeroes x) r key
}
}


(* A very simple bi-protocol with many sessions of a process that outputs
- on the left: the encryption of some random message `foo`;
- on the right: the encryption of a zeroed-out version of that message. *)
name k : message.
global axiom [any] namelength_k : [len k = namelength_message]

channel c.

process foo (i:index) =
new foo;
new n;
out(c,diff((enc foo n (k)), (enc (zeroes foo) n (k)))).
process foo (i:index) =
new foo : message;
new n : message;
out(c,diff(enc foo n k, enc (zeroes foo) n k));
null


system (!_i F : foo(i)).
Typed-check process:

!_i( F: foo i)

global axiom [any] namelength_foo :
[forall (i:index), len (foo i) = namelength_message]
global axiom [any] namelength_n :
[forall (i:index), len (n i) = namelength_message]
Added action dependencies lemmas:

axiom [default] depends_default_init_F :
forall (t:timestamp,i:index), t = F(i) => happens(t) => init < F(i)

System after processing:

!_i(
F: out(c,diff(enc (foo i) (n i) k, enc (zeroes (foo i)) (n i) k)); null)

System Empty registered with actions (init).
System default registered with actions (init,F).


(* Proof of indistinguishability for the two projections of the system.
The `crypto` tactics handles induction, and can thus prove indistinguishability
for all frames. Proving such goals can be useful to support rewriting a system
into a variant system, to reduce the proof on one protocol to a proof of
the same property on another, simple protocol. *)
global lemma _ (t:timestamp[const]) : [happens(t)] -> equiv(frame@t).
Goal unnamedgoal1 :
forall t:timestamp[const, glob], [happens(t)] -> equiv(frame@t)

Proof.
[goal> Focused goal (1/1):
Systems: default (same for equivalences)
Variables: t:timestamp[const, glob]
----------------------------------------
[happens(t)] -> equiv(frame@t)


intro H.
[> Line 81: (intro H) [goal> Focused goal (1/1):
Systems: default (same for equivalences)
Variables: t:timestamp[const, glob]
H: [happens(t)]
----------------------------------------
0: frame@t



crypto CPA (key : k) => //.
[> Line 83: ((crypto ...);(intro //)) Direct bi-deduction sub-goal (assuming recursive calls are bi-deducible):
{ input@t0 | ∀ t0 : pred t0 <= t },
{ output@t0 | ∀ t0 : t0 <= t && exec@t0 },
{ exec@t0 | ∀ t0 : t0 <= t }, { frame@t0 | ∀ t0 : t0 <= t },
{ frame@t | true },

frame@t

Bi-deduction sub-goals for recursive calls:
i:index : ∅ ▷ { true | F(i) <= t }

i:index : ∅ ▷ { enc diff(foo i, zeroes (foo i)) (n i) k | F(i) <= t }

∅ ▷ { true | init <= t }

∅ ▷ { empty | init <= t }

Constraints are:
{ n i0, L | ∀ i0 : F(i0) <= t }
{ foo i0, A | ∀ i0 : F(i0) <= t }
{ k , Gkey }
Constraints subgoals are:
forall (i,i0:index), F(i) <= t && F(i0) <= t => i <> i0 => i <> i0
Oracle subgoals are:
Final memory is: { }
[goal> lemma unnamedgoal1 is proved


Qed.
global lemma [default (same for equivalences)] unnamedgoal1 :
Forall (t:timestamp[const, glob]), [happens(t)] -> equiv(frame@t)
Exiting proof mode.



(* Another use where `crypto` handles many diffs at a time,
which e.g. the current `cca1` tactic does not support. *)
abstract msg : index -> message.

name key : message.
global axiom [any] namelength_key : [len key = namelength_message]

name rand : index -> message.
global axiom [any] namelength_rand :
[forall (i:index), len (rand i) = namelength_message]

global lemma _ : equiv(fun i => enc (diff(msg i, zeroes (msg i))) (rand i) key).
Goal unnamedgoal2 :
equiv(fun (i:index) => enc diff(msg i, zeroes (msg i)) (rand i) key)

Proof.
[goal> Focused goal (1/1):
Systems: default (same for equivalences)
----------------------------------------
0: fun (i:index) => enc diff(msg i, zeroes (msg i)) (rand i) key



crypto CPA (key : key) => //.
[> Line 103: ((crypto ...);(intro //)) Direct bi-deduction sub-goal (assuming recursive calls are bi-deducible):
∅ ▷ fun (i:index) => enc diff(msg i, zeroes (msg i)) (rand i) key

Bi-deduction sub-goals for recursive calls:


Constraints are: { rand i0, L | ∀ i0 }
{ key , Gkey }
Constraints subgoals are: forall (i,i0:index), i <> i0 => i <> i0
Oracle subgoals are:
Final memory is: { }
[goal> lemma unnamedgoal2 is proved


Qed.
global lemma [default (same for equivalences)] unnamedgoal2 :
equiv(fun (i:index) => enc diff(msg i, zeroes (msg i)) (rand i) key)
Exiting proof mode.

Press the left and right arrows to do and undo an instruction.

Alternatively, you can double-click on an instruction.

This zone shows a Squirrel file. You can double-click on a comment to collapse it for better readabilility.

This zone shows the output given by Squirrel.

This zone shows the output of the previous instruction, to help identifying the change caused by the instruction.

Previously: