(* Variant of `examples/private-authentication.sp` where cryptographic game
CPA_$ replaces the CCA1 and ENC-KP assumptions. *)
include Basic.
Typed-check process:
null
Added action dependencies lemmas:
System after processing:
null
System Empty registered with actions (init).
[warning>Loaded "Prelude.sp".
<]axiom [any] eq_iff : forall (x,y:bool), (x = y) = (x <=> y)
axiom [any] eq_not : forall (x,y:bool), (not x = not y) = (x = y)
Goal eq_sym :
(x = y) = (y = x)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
(x = y) = (y = x)
[> Line 17: by (rewrite ...) [goal> lemma eq_sym is proved
lemma [any] eq_sym ['a] : forall (x,y:'a), (x = y) = (y = x)
Exiting proof mode.
Goal neq_sym :
(x <> y) = (y <> x)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
(x <> y) = (y <> x)
[> Line 23: by (rewrite ...) [goal> lemma neq_sym is proved
lemma [any] neq_sym ['a] : forall (x,y:'a), (x <> y) = (y <> x)
Exiting proof mode.
Goal eq_refl_e :
(x = x) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x:'a
----------------------------------------
(x = x) = true
[> Line 31: by (rewrite ...) [goal> lemma eq_refl_e is proved
lemma [any] eq_refl_e ['a] : forall (x:'a), (x = x) = true
Exiting proof mode.
Goal eq_refl :
x = x
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x:'a
----------------------------------------
x = x
[> Line 43: by (rewrite ...) [goal> lemma eq_refl is proved
lemma [any] eq_refl ['a] : forall (x:'a), x = x
Exiting proof mode.
Goal neq_irrefl :
x <> x <=> false
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x:'a
----------------------------------------
x <> x <=> false
[> Line 51: by split [goal> lemma neq_irrefl is proved
lemma [any] neq_irrefl ['a] : forall (x:'a), x <> x <=> false
Exiting proof mode.
Goal eq_assoc :
((b0 = b1) = b2) = (b0 = (b1 = b2))
[goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool
----------------------------------------
((b0 = b1) = b2) = (b0 = (b1 = b2))
[> Line 65: ((have ...); 1: by (rewrite ...)) [goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool[const]
true_false: (true = false) = false
----------------------------------------
((b0 = b1) = b2) = (b0 = (b1 = b2))
[> Line 67: ((have ...); 1: by (rewrite ...)) [goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool[const]
false_true: (false = true) = false
true_false: (true = false) = false
----------------------------------------
((b0 = b1) = b2) = (b0 = (b1 = b2))
[> Line 69: ((case ..., b0);
((case ..., b1);((case ..., b2);(try (auto ...)))))
[goal> Focused goal (1/2):
System: any
Variables: b0,b1,b2:bool[const]
false_true: (false = true) = false
true_false: (true = false) = false
----------------------------------------
not b2 => not b1 => b0 => ((true = false) = false) = (true = (false = false))
[> Line 69: by (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool[const]
false_true: (false = true) = false
true_false: (true = false) = false
----------------------------------------
b2 => not b1 => not b0 => ((false = false) = true) = (false = (false = true))
[> Line 69: by (rewrite ...) [goal> lemma eq_assoc is proved
lemma [any] eq_assoc :
forall (b0,b1,b2:bool), ((b0 = b1) = b2) = (b0 = (b1 = b2))
Exiting proof mode.
Goal true_false :
(true = false) = false
[goal> Focused goal (1/1):
System: any
----------------------------------------
(true = false) = false
[> Line 87: by (rewrite ...) [goal> lemma true_false is proved
lemma [any] true_false : (true = false) = false
Exiting proof mode.
Goal false_true :
(false = true) = false
[goal> Focused goal (1/1):
System: any
----------------------------------------
(false = true) = false
[> Line 97: by (rewrite ...) [goal> lemma false_true is proved
lemma [any] false_true : (false = true) = false
Exiting proof mode.
Goal eq_true :
(b = true) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b = true) = b
[> Line 107: by (case ..., b) [goal> lemma eq_true is proved
lemma [any] eq_true : forall (b:bool), (b = true) = b
Exiting proof mode.
Goal eq_true2 :
(true = b) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(true = b) = b
[> Line 115: by (case ..., b) [goal> lemma eq_true2 is proved
lemma [any] eq_true2 : forall (b:bool), (true = b) = b
Exiting proof mode.
axiom [any] not_true : not true = false
axiom [any] not_false : not false = true
Goal not_not :
not (not b) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
not (not b) = b
[> Line 145: by (case ..., b) [goal> lemma not_not is proved
lemma [any] not_not : forall (b:bool), not (not b) = b
Exiting proof mode.
Goal not_eq :
not (x = y) = (x <> y)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
not (x = y) = (x <> y)
[> Line 157: by (rewrite ...) [goal> lemma not_eq is proved
lemma [any] not_eq ['a] : forall (x,y:'a), not (x = y) = (x <> y)
Exiting proof mode.
Goal not_neq :
not (x <> y) = (x = y)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
not (x <> y) = (x = y)
[> Line 169: by (rewrite ...) [goal> lemma not_neq is proved
lemma [any] not_neq ['a] : forall (x,y:'a), not (x <> y) = (x = y)
Exiting proof mode.
Goal not_eqfalse :
(b = false) = not b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b = false) = not b
[> Line 181: by (case ..., b) [goal> lemma not_eqfalse is proved
lemma [any] not_eqfalse : forall (b:bool), (b = false) = not b
Exiting proof mode.
Goal not_impl :
not (a => b) = (a && not b)
[goal> Focused goal (1/1):
System: any
Variables: a,b:bool
----------------------------------------
not (a => b) = (a && not b)
[> Line 191: ((rewrite ...);(split;(intro H))) [goal> Focused goal (1/2):
System: any
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
a && not b
[> Line 193: split [goal> Focused goal (1/3):
System: any
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
a
[> Line 195: (rewrite ...) [goal> Focused goal (1/3):
System: any
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
not (not a)
[> Line 197: (intro Hna) [goal> Focused goal (1/3):
System: any
Variables: a,b:bool[const]
H: not (a => b)
Hna: not a
----------------------------------------
false
[> Line 199: by (apply ... ) [goal> Focused goal (1/2):
System: any
Variables: a,b:bool[const]
H: not (a => b)
----------------------------------------
not b
[> Line 201: (intro Hb) [goal> Focused goal (1/2):
System: any
Variables: a,b:bool[const]
H: not (a => b)
Hb: b
----------------------------------------
false
[> Line 203: by (apply ... ) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
H: a && not b
----------------------------------------
not (a => b)
[> Line 205: (intro Hi) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
H: a && not b
Hi: a => b
----------------------------------------
false
[> Line 207: (destruct H, [Ha Hnb]) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
Ha: a
Hi: a => b
Hnb: not b
----------------------------------------
false
[> Line 209: (apply ... ) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
Ha: a
Hi: a => b
Hnb: not b
----------------------------------------
b
[> Line 211: by (apply ... ) [goal> lemma not_impl is proved
lemma [any] not_impl : forall (a,b:bool), not (a => b) = (a && not b)
Exiting proof mode.
Goal eq_false :
((x = y) = false) = (x <> y)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
((x = y) = false) = (x <> y)
[> Line 227: (rewrite ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
((x = y) = false) = not (x = y)
[> Line 227: ((case ..., (= x y));(intro _)) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: x,y:'a
_: x = y
----------------------------------------
(true = false) = not true
[> Line 227: (simpl ...) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: x,y:'a
_: x = y
----------------------------------------
true
[> Line 227: (auto ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
_: not (x = y)
----------------------------------------
(false = false) = not false
[> Line 229: by (rewrite ...) [goal> lemma eq_false is proved
lemma [any] eq_false ['a] : forall (x,y:'a), ((x = y) = false) = (x <> y)
Exiting proof mode.
axiom [any] and_comm : forall (b,b':bool), (b && b') = (b' && b)
Goal and_dist :
((b0 || b1) && b2) = (b0 && b2 || b1 && b2)
[goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool
----------------------------------------
((b0 || b1) && b2) = (b0 && b2 || b1 && b2)
[> Line 249: (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool[const]
----------------------------------------
(b0 || b1) && b2 <=> b0 && b2 || b1 && b2
[> Line 249: by split [goal> lemma and_dist is proved
lemma [any] and_dist :
forall (b0,b1,b2:bool), ((b0 || b1) && b2) = (b0 && b2 || b1 && b2)
Exiting proof mode.
axiom [any] and_true_l : forall (b:bool), (true && b) = b
Goal and_true_r :
(b && true) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b && true) = b
[> Line 261: by (rewrite ... ...) [goal> lemma and_true_r is proved
lemma [any] and_true_r : forall (b:bool), (b && true) = b
Exiting proof mode.
axiom [any] and_false_l : forall (b:bool), (false && b) = false
Goal and_false_r :
(b && false) = false
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b && false) = false
[> Line 275: by (rewrite ... ...) [goal> lemma and_false_r is proved
lemma [any] and_false_r : forall (b:bool), (b && false) = false
Exiting proof mode.
Goal and_double :
(b && b) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b && b) = b
[> Line 285: by (case ..., b) [goal> lemma and_double is proved
lemma [any] and_double : forall (b:bool), (b && b) = b
Exiting proof mode.
axiom [any] or_comm : forall (b,b':bool), (b || b') = (b' || b)
Goal or_dist :
((b0 || b2) && (b1 || b2)) = (b0 && b1 || b2)
[goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool
----------------------------------------
((b0 || b2) && (b1 || b2)) = (b0 && b1 || b2)
[> Line 301: (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: b0,b1,b2:bool[const]
----------------------------------------
(b0 || b2) && (b1 || b2) <=> b0 && b1 || b2
[> Line 301: by split [goal> lemma or_dist is proved
lemma [any] or_dist :
forall (b0,b1,b2:bool), ((b0 || b2) && (b1 || b2)) = (b0 && b1 || b2)
Exiting proof mode.
axiom [any] or_false_l : forall (b:bool), (false || b) = b
Goal or_false_r :
(b || false) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b || false) = b
[> Line 313: by (rewrite ... ...) [goal> lemma or_false_r is proved
lemma [any] or_false_r : forall (b:bool), (b || false) = b
Exiting proof mode.
axiom [any] or_true_l : forall (b:bool), (true || b) = true
Goal or_true_r :
(b || true) = true
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b || true) = true
[> Line 327: by (rewrite ... ...) [goal> lemma or_true_r is proved
lemma [any] or_true_r : forall (b:bool), (b || true) = true
Exiting proof mode.
Goal or_double :
(b || b) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b || b) = b
[> Line 335: by (case ..., b) [goal> lemma or_double is proved
lemma [any] or_double : forall (b:bool), (b || b) = b
Exiting proof mode.
Goal impl_charac :
(b => b') = (not b || b')
[goal> Focused goal (1/1):
System: any
Variables: b,b':bool
----------------------------------------
(b => b') = (not b || b')
[> Line 349: (((rewrite ...);(split;((case ..., b);(case ..., b'))));
(intro //=))
[goal> lemma impl_charac is proved
lemma [any] impl_charac : forall (b,b':bool), (b => b') = (not b || b')
Exiting proof mode.
Goal impl_false_l :
(false => b) = true
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(false => b) = true
[> Line 357: by ((rewrite ...);(case ..., b)) [goal> lemma impl_false_l is proved
lemma [any] impl_false_l : forall (b:bool), (false => b) = true
Exiting proof mode.
Goal impl_true_r :
(b => true) = true
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(b => true) = true
[> Line 365: (auto ...) [goal> lemma impl_true_r is proved
lemma [any] impl_true_r : forall (b:bool), (b => true) = true
Exiting proof mode.
Goal impl_true_l :
(true => b) = b
[goal> Focused goal (1/1):
System: any
Variables: b:bool
----------------------------------------
(true => b) = b
[> Line 373: by (rewrite ...) [goal> lemma impl_true_l is proved
lemma [any] impl_true_l : forall (b:bool), (true => b) = b
Exiting proof mode.
Goal impl_contra :
(b => c) = (not c => not b)
[goal> Focused goal (1/1):
System: any
Variables: b,c:bool
----------------------------------------
(b => c) = (not c => not b)
[> Line 383: (rewrite ... /=) [goal> Focused goal (1/1):
System: any
Variables: b,c:bool[const]
----------------------------------------
(not b || c) = (c || not b)
[> Line 385: by (rewrite ...) [goal> lemma impl_contra is proved
lemma [any] impl_contra : forall (b,c:bool), (b => c) = (not c => not b)
Exiting proof mode.
Goal not_and :
not (a && b) = (not a || not b)
[goal> Focused goal (1/1):
System: any
Variables: a,b:bool
----------------------------------------
not (a && b) = (not a || not b)
[> Line 401: (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
----------------------------------------
not (a && b) <=> not a || not b
[> Line 403: (((case ..., a);(case ..., b));(intro //=)) [goal> lemma not_and is proved
lemma [any] not_and : forall (a,b:bool), not (a && b) = (not a || not b)
Exiting proof mode.
Goal not_or :
not (a || b) = (not a && not b)
[goal> Focused goal (1/1):
System: any
Variables: a,b:bool
----------------------------------------
not (a || b) = (not a && not b)
[> Line 413: (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: a,b:bool[const]
----------------------------------------
not (a || b) <=> not a && not b
[> Line 415: (((case ..., a);(case ..., b));(intro //=)) [goal> lemma not_or is proved
lemma [any] not_or : forall (a,b:bool), not (a || b) = (not a && not b)
Exiting proof mode.
Goal if_true :
b => if b then x else y = x
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool,x,y:'a
----------------------------------------
b => if b then x else y = x
[> Line 433: (intro *) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
----------------------------------------
if b then x else y = x
[> Line 435: (case ..., (if b x y)) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
----------------------------------------
b && if b then x else y = x => x = x
[> Line 437: (auto ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
----------------------------------------
not b && if b then x else y = y => y = x
[> Line 439: (intro [HH _]) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: b
HH: not b
_: if b then x else y = y
----------------------------------------
y = x
[> Line 439: by (have ...) [goal> lemma if_true is proved
lemma [any] if_true ['a] :
forall (b:bool,x,y:'a), b => if b then x else y = x
Exiting proof mode.
Goal if_true0 :
if true then x else y = x
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
if true then x else y = x
[> Line 451: by (rewrite ...) [goal> lemma if_true0 is proved
lemma [any] if_true0 ['a] : forall (x,y:'a), if true then x else y = x
Exiting proof mode.
Goal if_false :
not b => if b then x else y = y
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool,x,y:'a
----------------------------------------
not b => if b then x else y = y
[> Line 465: ((intro *);(case ..., (if b x y))) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: not b
----------------------------------------
b && if b then x else y = x => x = y
[> Line 467: (intro [H1 H2]) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: not b
H1: b
H2: if b then x else y = x
----------------------------------------
x = y
[> Line 469: by (rewrite ... in H2) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool[const],x,y:'a
H: not b
----------------------------------------
not b && if b then x else y = y => y = y
[> Line 471: (auto ...) [goal> lemma if_false is proved
lemma [any] if_false ['a] :
forall (b:bool,x,y:'a), not b => if b then x else y = y
Exiting proof mode.
Goal if_false0 :
if false then x else y = y
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
if false then x else y = y
[> Line 483: by (rewrite ...) [goal> lemma if_false0 is proved
lemma [any] if_false0 ['a] : forall (x,y:'a), if false then x else y = y
Exiting proof mode.
Goal if_then_then :
if b then (if b' then x else y) else y = if (b && b') then x else y
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y:'a
----------------------------------------
if b then (if b' then x else y) else y = if (b && b') then x else y
[> Line 497: by ((case ..., b);(case ..., b')) [goal> lemma if_then_then is proved
lemma [any] if_then_then ['a] :
forall (b,b':bool,x,y:'a),
if b then (if b' then x else y) else y = if (b && b') then x else y
Exiting proof mode.
Goal if_then_or :
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
[goal> Focused goal (1/1):
System: any
Variables: b0,b1:bool,m0,m1:message
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
[> Line 513: ((have ...); 1: by (auto ...)) [goal> Focused goal (1/2):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
[> Line 513: ((rewrite ...);(intro //)) [goal> Focused goal (1/2):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: b0
----------------------------------------
m0 = if (b0 || b1) then m0 else m1
[> Line 513: ((rewrite ...);(intro //)) [goal> Focused goal (1/1):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: not b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
[> Line 515: ((have ...); 1: by (auto ...)) [goal> Focused goal (1/2):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: b1
_: not b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
[> Line 515: ((rewrite ...);(intro //)) [goal> Focused goal (1/2):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: b1
_: not b0
----------------------------------------
if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
[> Line 515: ((rewrite ...);(intro //)) [goal> Focused goal (1/1):
System: any
Variables: b0,b1:bool[const],m0,m1:message
_: not b1
_: not b0
----------------------------------------
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
[> Line 517: ((rewrite ...);(intro //)) [goal> lemma if_then_or is proved
lemma [any] if_then_or :
forall (b0,b1:bool,m0,m1:message),
if b0 then m0 else if b1 then m0 else m1 = if (b0 || b1) then m0 else m1
Exiting proof mode.
Goal if_then_implies :
if b then (if b' then x else y) else z =
if b then (if (b => b') then x else y) else z
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
if b then (if b' then x else y) else z =
if b then (if (b => b') then x else y) else z
[> Line 531: ((case ..., b);
((intro H);
((case ..., b');((intro H');((simpl ...);(try (auto ...)))))))
[goal> lemma if_then_implies is proved
lemma [any] if_then_implies ['a] :
forall (b,b':bool,x,y,z:'a),
if b then (if b' then x else y) else z =
if b then (if (b => b') then x else y) else z
Exiting proof mode.
Goal if_same :
if b then x else x = x
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b:bool,x:'a
----------------------------------------
if b then x else x = x
[> Line 543: by (case ..., b) [goal> lemma if_same is proved
lemma [any] if_same ['a] : forall (b:bool,x:'a), if b then x else x = x
Exiting proof mode.
Goal if_then :
b = b' => if b then (if b' then x else y) else z = if b then x else z
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = b' => if b then (if b' then x else y) else z = if b then x else z
[> Line 561: by ((intro ->);(case ..., b')) [goal> lemma if_then is proved
lemma [any] if_then ['a] :
forall (b,b':bool,x,y,z:'a),
b = b' => if b then (if b' then x else y) else z = if b then x else z
Exiting proof mode.
Goal if_then_inv :
if b then m0 else m1 = if b then (if b then m0) else m1
[goal> Focused goal (1/1):
System: any
Variables: b:bool,m0,m1:message
----------------------------------------
if b then m0 else m1 = if b then (if b then m0) else m1
[> Line 575: (auto ...) [goal> lemma if_then_inv is proved
lemma [any] if_then_inv :
forall (b:bool,m0,m1:message),
if b then m0 else m1 = if b then (if b then m0) else m1
Exiting proof mode.
Goal if_else :
b = b' => if b then x else if b' then y else z = if b then x else z
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = b' => if b then x else if b' then y else z = if b then x else z
[> Line 589: by ((intro ->);(case ..., b')) [goal> lemma if_else is proved
lemma [any] if_else ['a] :
forall (b,b':bool,x,y,z:'a),
b = b' => if b then x else if b' then y else z = if b then x else z
Exiting proof mode.
Goal if_else_inv :
if b then m0 else m1 = if b then m0 else if not b then m1
[goal> Focused goal (1/1):
System: any
Variables: b:bool,m0,m1:message
----------------------------------------
if b then m0 else m1 = if b then m0 else if not b then m1
[> Line 601: by (case ..., b) [goal> lemma if_else_inv is proved
lemma [any] if_else_inv :
forall (b:bool,m0,m1:message),
if b then m0 else m1 = if b then m0 else if not b then m1
Exiting proof mode.
Goal if_push :
if b then m0 else m1 = if b then (if b then m0) else if not b then m1
[goal> Focused goal (1/1):
System: any
Variables: b:bool,m0,m1:message
----------------------------------------
if b then m0 else m1 = if b then (if b then m0) else if not b then m1
[> Line 609: by (rewrite ... ...) [goal> lemma if_push is proved
lemma [any] if_push :
forall (b:bool,m0,m1:message),
if b then m0 else m1 = if b then (if b then m0) else if not b then m1
Exiting proof mode.
Goal if_then_not :
b = not b' => if b then (if b' then x else y) else z = if b then y else z
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = not b' => if b then (if b' then x else y) else z = if b then y else z
[> Line 623: by ((intro ->);(case ..., b')) [goal> lemma if_then_not is proved
lemma [any] if_then_not ['a] :
forall (b,b':bool,x,y,z:'a),
b = not b' => if b then (if b' then x else y) else z = if b then y else z
Exiting proof mode.
Goal if_else_not :
b = not b' => if b then x else if b' then y else z = if b then x else y
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: b,b':bool,x,y,z:'a
----------------------------------------
b = not b' => if b then x else if b' then y else z = if b then x else y
[> Line 641: by ((intro ->);(case ..., b')) [goal> lemma if_else_not is proved
lemma [any] if_else_not ['a] :
forall (b,b':bool,x,y,z:'a),
b = not b' => if b then x else if b' then y else z = if b then x else y
Exiting proof mode.
Goal if_app :
f (if c then x else y) = if c then f x else f y
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: c:bool,f:'a -> 'b,x,y:'a
----------------------------------------
f (if c then x else y) = if c then f x else f y
[> Line 653: by (case ..., c) [goal> lemma if_app is proved
lemma [any] if_app ['a 'b] :
forall (f:'a -> 'b,c:bool,x,y:'a),
f (if c then x else y) = if c then f x else f y
Exiting proof mode.
Goal fst_pair :
fst <x,y> = x
[goal> Focused goal (1/1):
System: any
Variables: x,y:message
----------------------------------------
fst <x,y> = x
[> Line 665: (auto ...) [goal> lemma fst_pair is proved
lemma [any] fst_pair : forall (x,y:message), fst <x,y> = x
Exiting proof mode.
Goal snd_pair :
snd <x,y> = y
[goal> Focused goal (1/1):
System: any
Variables: x,y:message
----------------------------------------
snd <x,y> = y
[> Line 673: (auto ...) [goal> lemma snd_pair is proved
lemma [any] snd_pair : forall (x,y:message), snd <x,y> = y
Exiting proof mode.
Goal iff_def :
(x <=> y) = ((x => y) && (y => x))
[goal> Focused goal (1/1):
System: any
Variables: x,y:bool
----------------------------------------
(x <=> y) = ((x => y) && (y => x))
[> Line 689: ((rewrite ...);split) [goal> Focused goal (1/2):
System: any
Variables: x,y:bool[const]
----------------------------------------
x <=> y => (x => y) && (y => x)
[> Line 691: by (intro ->) [goal> Focused goal (1/1):
System: any
Variables: x,y:bool[const]
----------------------------------------
(x => y) && (y => x) => x <=> y
[> Line 693: (auto ...) [goal> lemma iff_def is proved
lemma [any] iff_def : forall (x,y:bool), (x <=> y) = ((x => y) && (y => x))
Exiting proof mode.
Goal iff_refl :
(x <=> x) = true
[goal> Focused goal (1/1):
System: any
Variables: x:bool
----------------------------------------
(x <=> x) = true
[> Line 703: by (rewrite ...) [goal> lemma iff_refl is proved
lemma [any] iff_refl : forall (x:bool), (x <=> x) = true
Exiting proof mode.
Goal iff_sym :
(x <=> y) = (y <=> x)
[goal> Focused goal (1/1):
System: any
Variables: x,y:bool
----------------------------------------
(x <=> y) = (y <=> x)
[> Line 715: by (rewrite ... ...) [goal> lemma iff_sym is proved
lemma [any] iff_sym : forall (x,y:bool), (x <=> y) = (y <=> x)
Exiting proof mode.
Goal true_iff_false :
(true <=> false) = false
[goal> Focused goal (1/1):
System: any
----------------------------------------
(true <=> false) = false
[> Line 725: by (rewrite ...) [goal> lemma true_iff_false is proved
lemma [any] true_iff_false : (true <=> false) = false
Exiting proof mode.
Goal false_iff_true :
(false <=> true) = false
[goal> Focused goal (1/1):
System: any
----------------------------------------
(false <=> true) = false
[> Line 737: by (rewrite ...) [goal> lemma false_iff_true is proved
lemma [any] false_iff_true : (false <=> true) = false
Exiting proof mode.
Goal contra_iff :
(not x <=> y) = (x <=> not y)
[goal> Focused goal (1/1):
System: any
Variables: x,y:bool
----------------------------------------
(not x <=> y) = (x <=> not y)
[> Line 751: (rewrite ...) [goal> Focused goal (1/1):
System: any
Variables: x,y:bool[const]
----------------------------------------
(not x <=> y) <=> (x <=> not y)
[> Line 753: (split;by (rewrite ... ...)) [goal> lemma contra_iff is proved
lemma [any] contra_iff : forall (x,y:bool), (not x <=> y) = (x <=> not y)
Exiting proof mode.
Goal exists_false1 :
(exists (a:'a), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a
----------------------------------------
(exists (a:'a), false) = false
[> Line 769: by (rewrite ...) [goal> lemma exists_false1 is proved
lemma [any] exists_false1 ['a] : (exists (a:'a), false) = false
Exiting proof mode.
Goal exists_false2 :
(exists (a:'a,b:'b), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
----------------------------------------
(exists (a:'a,b:'b), false) = false
[> Line 777: by (rewrite ...) [goal> lemma exists_false2 is proved
lemma [any] exists_false2 ['a 'b] : (exists (a:'a,b:'b), false) = false
Exiting proof mode.
Goal exists_false3 :
(exists (a:'a,b:'b,c:'c), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c
----------------------------------------
(exists (a:'a,b:'b,c:'c), false) = false
[> Line 785: by (rewrite ...) [goal> lemma exists_false3 is proved
lemma [any] exists_false3 ['a 'b 'c] :
(exists (a:'a,b:'b,c:'c), false) = false
Exiting proof mode.
Goal exists_false4 :
(exists (a:'a,b:'b,c:'c,d:'d), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd
----------------------------------------
(exists (a:'a,b:'b,c:'c,d:'d), false) = false
[> Line 793: by (rewrite ...) [goal> lemma exists_false4 is proved
lemma [any] exists_false4 ['a 'b 'c 'd] :
(exists (a:'a,b:'b,c:'c,d:'d), false) = false
Exiting proof mode.
Goal exists_false5 :
(exists (a:'a,b:'b,c:'c,d:'d,e:'e), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd, 'e
----------------------------------------
(exists (a:'a,b:'b,c:'c,d:'d,e:'e), false) = false
[> Line 801: by (rewrite ...) [goal> lemma exists_false5 is proved
lemma [any] exists_false5 ['a 'b 'c 'd 'e] :
(exists (a:'a,b:'b,c:'c,d:'d,e:'e), false) = false
Exiting proof mode.
Goal exists_false6 :
(exists (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), false) = false
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd, 'e, 'f
----------------------------------------
(exists (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), false) = false
[> Line 809: by (rewrite ...) [goal> lemma exists_false6 is proved
lemma [any] exists_false6 ['a 'b 'c 'd 'e 'f] :
(exists (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), false) = false
Exiting proof mode.
Goal forall_true1 :
(forall (a:'a), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a
----------------------------------------
(forall (a:'a), true) = true
[> Line 829: (auto ...) [goal> lemma forall_true1 is proved
lemma [any] forall_true1 ['a] : (forall (a:'a), true) = true
Exiting proof mode.
Goal forall_true2 :
(forall (a:'a,b:'b), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
----------------------------------------
(forall (a:'a,b:'b), true) = true
[> Line 837: (auto ...) [goal> lemma forall_true2 is proved
lemma [any] forall_true2 ['a 'b] : (forall (a:'a,b:'b), true) = true
Exiting proof mode.
Goal forall_true3 :
(forall (a:'a,b:'b,c:'c), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c
----------------------------------------
(forall (a:'a,b:'b,c:'c), true) = true
[> Line 845: (auto ...) [goal> lemma forall_true3 is proved
lemma [any] forall_true3 ['a 'b 'c] : (forall (a:'a,b:'b,c:'c), true) = true
Exiting proof mode.
Goal forall_true4 :
(forall (a:'a,b:'b,c:'c,d:'d), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd
----------------------------------------
(forall (a:'a,b:'b,c:'c,d:'d), true) = true
[> Line 853: (auto ...) [goal> lemma forall_true4 is proved
lemma [any] forall_true4 ['a 'b 'c 'd] :
(forall (a:'a,b:'b,c:'c,d:'d), true) = true
Exiting proof mode.
Goal forall_true5 :
(forall (a:'a,b:'b,c:'c,d:'d,e:'e), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd, 'e
----------------------------------------
(forall (a:'a,b:'b,c:'c,d:'d,e:'e), true) = true
[> Line 861: (auto ...) [goal> lemma forall_true5 is proved
lemma [any] forall_true5 ['a 'b 'c 'd 'e] :
(forall (a:'a,b:'b,c:'c,d:'d,e:'e), true) = true
Exiting proof mode.
Goal forall_true6 :
(forall (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), true) = true
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b, 'c, 'd, 'e, 'f
----------------------------------------
(forall (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), true) = true
[> Line 869: (auto ...) [goal> lemma forall_true6 is proved
lemma [any] forall_true6 ['a 'b 'c 'd 'e 'f] :
(forall (a:'a,b:'b,c:'c,d:'d,e:'e,f:'f), true) = true
Exiting proof mode.
axiom [any] len_zeroes : forall (x:message), len (zeroes x) = len x
axiom [any] exec_not_init :
forall (tau:timestamp),
init < tau => exec@tau = (exec@pred tau && cond@tau)
axiom [any] exec_init : forall (tau:timestamp), tau = init => exec@tau = true
axiom [any] cond_init : forall (tau:timestamp), tau = init => cond@tau = true
Goal exec_le :
tau' <= tau => exec@tau => exec@tau'
[goal> Focused goal (1/1):
System: any
Variables: tau,tau':timestamp
----------------------------------------
tau' <= tau => exec@tau => exec@tau'
[> Line 917: ((induction tau);(intro tau IH Hle Hexec)) [goal> Focused goal (1/1):
System: any
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
exec@tau'
[> Line 919: (case ..., (= tau tau')) [goal> Focused goal (1/2):
System: any
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
tau = tau' => exec@tau'
[> Line 921: (auto ...) [goal> Focused goal (1/1):
System: any
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
not (tau = tau') => exec@tau'
[> Line 923: (intro Hneq) [goal> Focused goal (1/1):
System: any
Variables: tau,tau':timestamp[const]
Hexec: exec@tau
Hle: tau' <= tau
Hneq: not (tau = tau')
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
exec@tau'
[> Line 925: (rewrite ... // in Hexec) [goal> Focused goal (1/1):
System: any
Variables: tau,tau':timestamp[const]
Hexec: exec@pred tau && cond@tau
Hle: tau' <= tau
Hneq: not (tau = tau')
IH: forall (tau0:timestamp),
tau0 < tau => tau' <= tau0 => exec@tau0 => exec@tau'
----------------------------------------
exec@tau'
[> Line 927: by (apply ... ) [goal> lemma exec_le is proved
lemma [any] exec_le :
forall (tau,tau':timestamp), tau' <= tau => exec@tau => exec@tau'
Exiting proof mode.
Goal exec_cond :
happens(tau) => exec@tau => cond@tau
[goal> Focused goal (1/1):
System: any
Variables: tau:timestamp
----------------------------------------
happens(tau) => exec@tau => cond@tau
[> Line 937: (intro Hap Hexec) [goal> Focused goal (1/1):
System: any
Variables: tau:timestamp[const]
Hap: happens(tau)
Hexec: exec@tau
----------------------------------------
cond@tau
[> Line 939: ((case ..., (< init tau));(intro _)) [goal> Focused goal (1/2):
System: any
Variables: tau:timestamp[const]
Hap: happens(tau)
Hexec: exec@tau
_: init < tau
----------------------------------------
cond@tau
[> Line 941: by (rewrite ... in Hexec) [goal> Focused goal (1/1):
System: any
Variables: tau:timestamp[const]
Hap: happens(tau)
Hexec: exec@tau
_: not (init < tau)
----------------------------------------
cond@tau
[> Line 943: by (rewrite ...) [goal> lemma exec_cond is proved
lemma [any] exec_cond :
forall (tau:timestamp), happens(tau) => exec@tau => cond@tau
Exiting proof mode.
Goal f_apply :
x = y => f x = f y
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: f:'a -> 'b,x,y:'a
----------------------------------------
x = y => f x = f y
[> Line 955: by (intro ->) [goal> lemma f_apply is proved
lemma [any] f_apply ['a 'b] : forall (f:'a -> 'b,x,y:'a), x = y => f x = f y
Exiting proof mode.
Goal not_exists_1 :
not exists (a:'a), phi a = forall (a:'a), not (phi a)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
not exists (a:'a), phi a = forall (a:'a), not (phi a)
[> Line 965: (rewrite ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
not exists (a:'a), phi a <=> forall (a:'a), not (phi a)
[> Line 967: split [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
not exists (a:'a), phi a => forall (a:'a), not (phi a)
[> Line 969: (intro H a Hp) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: a:'a,phi:'a -> bool
H: not exists (a:'a), phi a
Hp: phi a
----------------------------------------
false
[> Line 971: (apply ... ) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: a:'a,phi:'a -> bool
H: not exists (a:'a), phi a
Hp: phi a
----------------------------------------
exists (a:'a), phi a
[> Line 973: by (exists a) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool
----------------------------------------
(forall (a:'a), not (phi a)) => not exists (a:'a), phi a
[> Line 975: (intro H [a Hp]) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: a:'a,phi:'a -> bool
H: forall (a:'a), not (phi a)
Hp: phi a
----------------------------------------
false
[> Line 977: by (have ...) [goal> lemma not_exists_1 is proved
lemma [any] not_exists_1 ['a] :
forall (phi:'a -> bool),
not exists (a:'a), phi a = forall (a:'a), not (phi a)
Exiting proof mode.
Goal not_exists_2 :
not exists (a:'a,b:'b), phi a b = forall (a:'a,b:'b), not (phi a b)
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
not exists (a:'a,b:'b), phi a b = forall (a:'a,b:'b), not (phi a b)
[> Line 989: (rewrite ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
not exists (a:'a,b:'b), phi a b <=> forall (a:'a,b:'b), not (phi a b)
[> Line 991: split [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
not exists (a:'a,b:'b), phi a b => forall (a:'a,b:'b), not (phi a b)
[> Line 993: (intro H a b Hp) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: a:'a,b:'b,phi:'a -> 'b -> bool
H: not exists (a:'a,b:'b), phi a b
Hp: phi a b
----------------------------------------
false
[> Line 995: (apply ... ) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: a:'a,b:'b,phi:'a -> 'b -> bool
H: not exists (a:'a,b:'b), phi a b
Hp: phi a b
----------------------------------------
exists (a:'a,b:'b), phi a b
[> Line 997: by (exists a, b) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(forall (a:'a,b:'b), not (phi a b)) => not exists (a:'a,b:'b), phi a b
[> Line 999: (intro H [a b Hp]) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: a:'a,b:'b,phi:'a -> 'b -> bool
H: forall (a:'a,b:'b), not (phi a b)
Hp: phi a b
----------------------------------------
false
[> Line 1001: by (have ...) [goal> lemma not_exists_2 is proved
lemma [any] not_exists_2 ['a 'b] :
forall (phi:'a -> 'b -> bool),
not exists (a:'a,b:'b), phi a b = forall (a:'a,b:'b), not (phi a b)
Exiting proof mode.
axiom [any] not_forall_1 ['a] :
forall (phi:'a -> bool),
not forall (a:'a), phi a = exists (a:'a), not (phi a)
axiom [any] not_forall_2 ['a 'b] :
forall (phi:'a -> 'b -> bool),
not forall (a:'a,b:'b), phi a b = exists (a:'a,b:'b), not (phi a b)
axiom [any] try_carac_1 ['a 'b] :
forall (phi:'a -> bool,f:'a -> 'b,g:'b),
try find x:'a such that phi x in f x else g =
if (exists (x:'a), phi x) then f (choose phi) else g
Goal choose_spec :
phi x => phi (choose phi)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
----------------------------------------
phi x => phi (choose phi)
[> Line 1053: (intro H) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
phi (choose phi)
[> Line 1059: (have ...) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
phi (choose phi) = if (exists (x:'a), phi x) then phi (choose phi) else false
[> Line 1061: ?? [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
phi (choose phi) = if (exists (x:'a), phi x) then phi (choose phi) else false
[> Line 1063: ((rewrite ...);(intro //)) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
exists (x:'a), phi x
[> Line 1063: by (exists x) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
if (exists (x:'a), phi x) then phi (choose phi) else false
[> Line 1065: ?? [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
if (exists (x:'a), phi x) then phi (choose phi) else false
[> Line 1067: (rewrite ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
try find x:'a such that phi x in phi x else false
[> Line 1069: (case ...,
try find x:_ such that (phi x) in (phi x) else false)
[goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
(exists (x:'a),
phi x && try find x:'a such that phi x in phi x else false = phi x) =>
try find x:'a such that phi x in phi x else false
[> Line 1071: (auto ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:'a -> bool,x:'a
H: phi x
----------------------------------------
(forall (x:'a), not (phi x)) &&
try find x:'a such that phi x in phi x else false = false =>
try find x:'a such that phi x in phi x else false
[> Line 1073: ((intro [HH _]);by (have ...)) [goal> lemma choose_spec is proved
lemma [any] choose_spec ['a] :
forall (phi:'a -> bool,x:'a), phi x => phi (choose phi)
Exiting proof mode.
Goal try_choose :
phi x => try find x:'a such that phi x in f x else g = f (choose phi)
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
----------------------------------------
phi x => try find x:'a such that phi x in f x else g = f (choose phi)
[> Line 1091: (intro H) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
H: phi x
----------------------------------------
try find x:'a such that phi x in f x else g = f (choose phi)
[> Line 1093: (rewrite ...) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
H: phi x
----------------------------------------
if (exists (x:'a), phi x) then f (choose phi) else g = f (choose phi)
[> Line 1095: ((rewrite ...);(intro //)) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: f:'a -> 'b,g:'b,phi:'a -> bool,x:'a
H: phi x
----------------------------------------
exists (x:'a), phi x
[> Line 1097: by (exists x) [goal> lemma try_choose is proved
lemma [any] try_choose ['a 'b] :
forall (phi:'a -> bool,f:'a -> 'b,g:'b,x:'a),
phi x => try find x:'a such that phi x in f x else g = f (choose phi)
Exiting proof mode.
Goal forall_exists :
(forall (x:'a), exists (y:'b), phi x y) =
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)
[goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(forall (x:'a), exists (y:'b), phi x y) =
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)
[> Line 1115: ((rewrite ...);split) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(forall (x:'a), exists (y:'b), phi x y) =>
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)
[> Line 1117: (intro H) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
H: forall (x:'a), exists (y:'b), phi x y
----------------------------------------
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)
[> Line 1119: (exists (fun (x : _) => (choose (fun (y : _) => (phi x y))))) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
H: forall (x:'a), exists (y:'b), phi x y
----------------------------------------
forall (x:'a), phi x ((fun (x:'a) => choose (fun (y:'b) => phi x y)) x)
[> Line 1121: ((intro x);(simpl ...)) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a
H: forall (x:'a), exists (y:'b), phi x y
----------------------------------------
phi x (choose (fun (y:'b) => phi x y))
[> Line 1123: (have (.. := ...)) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y:'b
H: forall (x:'a), exists (y:'b), phi x y
Hy: phi x y
----------------------------------------
phi x (choose (fun (y:'b) => phi x y))
[> Line 1131: ((have ...); 1: by (auto ...)) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y:'b
H: forall (x:'a), exists (y:'b), phi x y
Hy: phi x y
----------------------------------------
(fun (y:'b) => phi x y) (choose (fun (y:'b) => phi x y))
[> Line 1133: (apply ... ) [goal> Focused goal (1/2):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y:'b
H: forall (x:'a), exists (y:'b), phi x y
Hy: phi x y
----------------------------------------
(fun (y:'b) => phi x y) y
[> Line 1135: ((simpl ...);assumption) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool
----------------------------------------
(exists (y':'a -> 'b), forall (x:'a), phi x (y' x)) =>
forall (x:'a), exists (y:'b), phi x y
[> Line 1137: (intro [y' H] x) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y':'a -> 'b
H: forall (x:'a), phi x (y' x)
----------------------------------------
exists (y:'b), phi x y
[> Line 1139: (exists (y' x)) [goal> Focused goal (1/1):
System: any
Type variables: 'a, 'b
Variables: phi:'a -> 'b -> bool,x:'a,y':'a -> 'b
H: forall (x:'a), phi x (y' x)
----------------------------------------
phi x (y' x)
[> Line 1141: by (apply ... ) [goal> lemma forall_exists is proved
lemma [any] forall_exists ['a 'b] :
forall (phi:'a -> 'b -> bool),
(forall (x:'a), exists (y:'b), phi x y) =
exists (y':'a -> 'b), forall (x:'a), phi x (y' x)
Exiting proof mode.
Goal implies_exists :
(phi => exists (j:'a), psi j) = exists (x:'a), phi => psi x
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:bool,psi:'a -> bool
----------------------------------------
(phi => exists (j:'a), psi j) = exists (x:'a), phi => psi x
[> Line 1155: ((rewrite ...);split) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
----------------------------------------
(phi => exists (j:'a), psi j) => exists (x:'a), phi => psi x
[> Line 1157: (intro H) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
----------------------------------------
exists (x:'a), phi => psi x
[> Line 1159: (case ..., phi) [goal> Focused goal (1/3):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
----------------------------------------
phi => exists (x:'a), true => psi x
[> Line 1161: (intro phi) [goal> Focused goal (1/3):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
phi: phi
----------------------------------------
exists (x:'a), true => psi x
[> Line 1163: ((have ...); 1: by (apply ... )) [goal> Focused goal (1/3):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool,x:'a
H: phi => exists (j:'a), psi j
_: psi x
phi: phi
----------------------------------------
exists (x:'a), true => psi x
[> Line 1165: by (exists x) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
----------------------------------------
not phi => exists (x:'a), false => psi x
[> Line 1167: (intro _) [goal> Focused goal (1/2):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
H: phi => exists (j:'a), psi j
_: not phi
----------------------------------------
exists (x:'a), false => psi x
[> Line 1169: by (exists (choose (fun (_x : _) => false))) [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool
----------------------------------------
(exists (x:'a), phi => psi x) => phi => exists (j:'a), psi j
[> Line 1171: (intro [x H] H') [goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: phi:bool[const],psi:'a -> bool,x:'a
H: phi => psi x
H': phi
----------------------------------------
exists (j:'a), psi j
[> Line 1173: by (exists x) [goal> lemma implies_exists is proved
lemma [any] implies_exists ['a] :
forall (phi:bool,psi:'a -> bool),
(phi => exists (j:'a), psi j) = exists (x:'a), phi => psi x
Exiting proof mode.
axiom [any] le_trans ['a] : forall (x,y,z:'a), x <= y => y <= z => x <= z
axiom [any] lt_trans ['a] : forall (x,y,z:'a), x < y => y < z => x < z
axiom [any] lt_le_trans ['a] : forall (x,y,z:'a), x < y => y <= z => x < z
axiom [any] le_lt_trans ['a] : forall (x,y,z:'a), x <= y => y < z => x < z
axiom [any] lt_charac ['a] : forall (x,y:'a), x < y <=> x <> y && x <= y
axiom [any] le_not_lt_impl_eq ['a] :
forall (x,y:'a), x <= y => not (x < y) => x = y
Goal lt_impl_le :
x < y => x <= y
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x,y:'a
----------------------------------------
x < y => x <= y
[> Line 1205: by (rewrite ...) [goal> lemma lt_impl_le is proved
lemma [any] lt_impl_le ['a] : forall (x,y:'a), x < y => x <= y
Exiting proof mode.
Goal not_lt_refl :
not (x < x)
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x:'a
----------------------------------------
not (x < x)
[> Line 1211: (auto ...) [goal> lemma not_lt_refl is proved
lemma [any] not_lt_refl ['a] : forall (x:'a), not (x < x)
Exiting proof mode.
Goal lt_irrefl :
x < x <=> false
[goal> Focused goal (1/1):
System: any
Type variables: 'a
Variables: x:'a
----------------------------------------
x < x <=> false
[> Line 1217: (auto ...) [goal> lemma lt_irrefl is proved
lemma [any] lt_irrefl ['a] : forall (x:'a), x < x <=> false
Exiting proof mode.
axiom [any] le_impl_eq_lt ['a] : forall (x,y:'a), x <= y => x = y || x < y
axiom [any] le_refl_index : forall (x:index), x <= x
Goal le_refl_index_eq :
x <= x = true
[goal> Focused goal (1/1):
System: any
Variables: x:index
----------------------------------------
x <= x = true
[> Line 1241: by (rewrite ...) [goal> lemma le_refl_index_eq is proved
lemma [any] le_refl_index_eq : forall (x:index), x <= x = true
Exiting proof mode.
Goal le_pred_lt :
t <= pred t' = t < t'
[goal> Focused goal (1/1):
System: any
Variables: t,t':timestamp
----------------------------------------
t <= pred t' = t < t'
[> Line 1251: by (rewrite ...) [goal> lemma le_pred_lt is proved
lemma [any] le_pred_lt : forall (t,t':timestamp), t <= pred t' = t < t'
Exiting proof mode.
Goal neq_le_pred_le :
t <> t' => t <= t' = t <= pred t'
[goal> Focused goal (1/1):
System: any
Variables: t,t':timestamp
----------------------------------------
t <> t' => t <= t' = t <= pred t'
[> Line 1259: by (rewrite ...) [goal> lemma neq_le_pred_le is proved
lemma [any] neq_le_pred_le :
forall (t,t':timestamp), t <> t' => t <= t' = t <= pred t'
Exiting proof mode.
axiom [any] le_lt ['a] : forall (x,x':'a), x <> x' => x <= x' = x < x'
axiom [any] empty_set_is_empty : forall (x:message), not (mem x empty_set)
[warning>Loaded "Basic.sp".
<]
PRIVATE AUTHENTICATION
The Private Authentication protocol as described in [F] involves an initiator A and a responder B.
The initiator A sends a message enc(<pkA,n0>,r0,pkB)
to the responder B, where pkA
(respectively pkB
) is the public key of A (respectively B). The responder B checks that the first projection of the decryption of the received message is equal to pkA
and that the second projection of the decryption of the received message has a correct length. In that case, B sends back enc(<n0,n>,r,pkA)
.
The protocol is as follows:
- A -> B : enc(<pkA,n0>,r0,pkB)
- B -> A : enc(<n0,n>,r,pkA)
This is a “light” model without the last check of A.
In this file we prove that an attacker can’t tell whether B is willing to communication with A or some other agent Abis. We use the CCA$ cryptographic assumption instead of CCA1.
[F] G. Bana and H. Comon-Lundh. A computationally complete symbolic attacker for equivalence properties. In 2014 ACM Conference on Computer and Communications Security, CCS ’14, pages 609–620. ACM, 2014