src/HOL/Auth/NS_Public_Bad.ML
author paulson
Fri, 11 Jul 1997 13:26:15 +0200
changeset 3512 9dcb4daa15e8
parent 3466 30791e5a69c4
child 3519 ab0a9fbed4c0
permissions -rw-r--r--
Moving common declarations and proofs from theories "Shared" and "Public" to "Event". NB the original "Event" theory was later renamed "Shared". Addition of the Notes constructor to datatype "event".
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
     1
(*  Title:      HOL/Auth/NS_Public_Bad
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
     2
    ID:         $Id$
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
     3
    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
     4
    Copyright   1996  University of Cambridge
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
     5
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
     6
Inductive relation "ns_public" for the Needham-Schroeder Public-Key protocol.
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
     7
Flawed version, vulnerable to Lowe's attack.
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
     8
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
     9
From page 260 of
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    10
  Burrows, Abadi and Needham.  A Logic of Authentication.
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    11
  Proc. Royal Soc. 426 (1989)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    12
*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    13
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    14
open NS_Public_Bad;
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    15
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    16
proof_timing:=true;
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    17
HOL_quantifiers := false;
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    18
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    19
AddIffs [Spy_in_lost];
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    20
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    21
(*Replacing the variable by a constant improves search speed by 50%!*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    22
val Says_imp_sees_Spy' = 
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    23
    read_instantiate_sg (sign_of thy) [("lost","lost")] Says_imp_sees_Spy;
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    24
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    25
(*A "possibility property": there are traces that reach the end*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    26
goal thy 
2480
f9be937df511 Tidied up the unicity proofs
paulson
parents: 2451
diff changeset
    27
 "!!A B. A ~= B ==> EX NB. EX evs: ns_public.               \
3465
e85c24717cad set_of_list -> set
nipkow
parents: 3440
diff changeset
    28
\                     Says A B (Crypt (pubK B) (Nonce NB)) : set evs";
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    29
by (REPEAT (resolve_tac [exI,bexI] 1));
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    30
by (rtac (ns_public.Nil RS ns_public.NS1 RS ns_public.NS2 RS ns_public.NS3) 2);
2516
4d68fbe6378b Now with Andy Gordon's treatment of freshness to replace newN/K
paulson
parents: 2497
diff changeset
    31
by possibility_tac;
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    32
result();
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    33
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    34
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    35
(**** Inductive proofs about ns_public ****)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    36
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    37
(*Nobody sends themselves messages*)
3465
e85c24717cad set_of_list -> set
nipkow
parents: 3440
diff changeset
    38
goal thy "!!evs. evs : ns_public ==> ALL A X. Says A A X ~: set evs";
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    39
by (etac ns_public.induct 1);
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    40
by (Auto_tac());
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    41
qed_spec_mp "not_Says_to_self";
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    42
Addsimps [not_Says_to_self];
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    43
AddSEs   [not_Says_to_self RSN (2, rev_notE)];
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    44
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    45
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    46
(** Theorems of the form X ~: parts (sees lost Spy evs) imply that NOBODY
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    47
    sends messages containing X! **)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    48
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    49
(*Spy never sees another agent's private key! (unless it's lost at start)*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    50
goal thy 
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    51
 "!!evs. evs : ns_public \
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    52
\        ==> (Key (priK A) : parts (sees lost Spy evs)) = (A : lost)";
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
    53
by (etac ns_public.induct 1);
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
    54
by (prove_simple_subgoals_tac 1);
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
    55
by (Fake_parts_insert_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    56
qed "Spy_see_priK";
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    57
Addsimps [Spy_see_priK];
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    58
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    59
goal thy 
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    60
 "!!evs. evs : ns_public \
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    61
\        ==> (Key (priK A) : analz (sees lost Spy evs)) = (A : lost)";
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    62
by (auto_tac(!claset addDs [impOfSubs analz_subset_parts], !simpset));
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    63
qed "Spy_analz_priK";
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    64
Addsimps [Spy_analz_priK];
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    65
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    66
goal thy  "!!A. [| Key (priK A) : parts (sees lost Spy evs);       \
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    67
\                  evs : ns_public |] ==> A:lost";
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
    68
by (blast_tac (!claset addDs [Spy_see_priK]) 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    69
qed "Spy_see_priK_D";
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    70
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    71
bind_thm ("Spy_analz_priK_D", analz_subset_parts RS subsetD RS Spy_see_priK_D);
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    72
AddSDs [Spy_see_priK_D, Spy_analz_priK_D];
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    73
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    74
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
    75
fun analz_induct_tac i = 
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
    76
    etac ns_public.induct i   THEN
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
    77
    ALLGOALS (asm_simp_tac 
2516
4d68fbe6378b Now with Andy Gordon's treatment of freshness to replace newN/K
paulson
parents: 2497
diff changeset
    78
              (!simpset addsimps [not_parts_not_analz]
2480
f9be937df511 Tidied up the unicity proofs
paulson
parents: 2451
diff changeset
    79
                        setloop split_tac [expand_if]));
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
    80
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    81
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    82
(**** Authenticity properties obtained from NS2 ****)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    83
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    84
(*It is impossible to re-use a nonce in both NS1 and NS2, provided the nonce
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    85
  is secret.  (Honest users generate fresh nonces.)*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    86
goal thy 
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
    87
 "!!evs. [| Nonce NA ~: analz (sees lost Spy evs);  \
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
    88
\           Crypt (pubK B) {|Nonce NA, Agent A|} : parts (sees lost Spy evs); \
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
    89
\           evs : ns_public |]                      \
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
    90
\ ==> Crypt (pubK C) {|NA', Nonce NA|} ~: parts (sees lost Spy evs)";
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
    91
by (etac rev_mp 1);
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
    92
by (etac rev_mp 1);
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
    93
by (analz_induct_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    94
(*NS3*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
    95
by (blast_tac (!claset addSEs partsEs) 4);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    96
(*NS2*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
    97
by (blast_tac (!claset addSEs partsEs) 3);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
    98
(*Fake*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
    99
by (blast_tac (!claset addSIs [analz_insertI]
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   100
                        addDs [impOfSubs analz_subset_parts,
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   101
			       impOfSubs Fake_parts_insert]) 2);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   102
(*Base*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   103
by (Blast_tac 1);
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   104
qed "no_nonce_NS1_NS2";
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   105
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   106
2480
f9be937df511 Tidied up the unicity proofs
paulson
parents: 2451
diff changeset
   107
(*Unicity for NS1: nonce NA identifies agents A and B*)
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   108
goal thy 
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   109
 "!!evs. [| Nonce NA ~: analz (sees lost Spy evs);  evs : ns_public |]      \
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   110
\ ==> EX A' B'. ALL A B.                                                    \
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   111
\      Crypt (pubK B) {|Nonce NA, Agent A|} : parts (sees lost Spy evs) --> \
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   112
\      A=A' & B=B'";
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   113
by (etac rev_mp 1);
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
   114
by (analz_induct_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   115
(*NS1*)
2497
47de509bdd55 New treatment of nonce creation
paulson
parents: 2480
diff changeset
   116
by (simp_tac (!simpset addsimps [all_conj_distrib]) 3);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   117
by (expand_case_tac "NA = ?y" 3 THEN
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   118
    REPEAT (blast_tac (!claset addSEs partsEs) 3));
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   119
(*Base*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   120
by (Blast_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   121
(*Fake*)
2497
47de509bdd55 New treatment of nonce creation
paulson
parents: 2480
diff changeset
   122
by (simp_tac (!simpset addsimps [all_conj_distrib, parts_insert_sees]) 1);
2374
4148aa5b00a2 Streamlined many proofs
paulson
parents: 2324
diff changeset
   123
by (step_tac (!claset addSIs [analz_insertI]) 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   124
by (ex_strip_tac 1);
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   125
by (blast_tac (!claset delrules [conjI]
3440
22db7a9cbb52 Deleted spurious reference to Spy_not_see_NB, which by chance was defined
paulson
parents: 3121
diff changeset
   126
                       addSDs [impOfSubs Fake_parts_insert]
22db7a9cbb52 Deleted spurious reference to Spy_not_see_NB, which by chance was defined
paulson
parents: 3121
diff changeset
   127
                       addDs  [impOfSubs analz_subset_parts]) 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   128
val lemma = result();
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   129
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   130
goal thy 
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   131
 "!!evs. [| Crypt(pubK B)  {|Nonce NA, Agent A|}  : parts(sees lost Spy evs); \
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   132
\           Crypt(pubK B') {|Nonce NA, Agent A'|} : parts(sees lost Spy evs); \
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   133
\           Nonce NA ~: analz (sees lost Spy evs);                            \
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   134
\           evs : ns_public |]                                                \
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   135
\        ==> A=A' & B=B'";
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
   136
by (prove_unique_tac lemma 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   137
qed "unique_NA";
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   138
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   139
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   140
(*Secrecy: Spy does not see the nonce sent in msg NS1 if A and B are secure*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   141
goal thy 
3466
30791e5a69c4 Corrected indentations and margins after the renaming of "set_of_list"
paulson
parents: 3465
diff changeset
   142
 "!!evs. [| Says A B (Crypt(pubK B) {|Nonce NA, Agent A|}) : set evs;         \
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   143
\           A ~: lost;  B ~: lost;  evs : ns_public |]                        \
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   144
\        ==>  Nonce NA ~: analz (sees lost Spy evs)";
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   145
by (etac rev_mp 1);
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
   146
by (analz_induct_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   147
(*NS3*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   148
by (blast_tac (!claset addDs  [Says_imp_sees_Spy' RS parts.Inj]
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   149
                       addEs  [no_nonce_NS1_NS2 RSN (2, rev_notE)]) 4);
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   150
(*NS2*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   151
by (blast_tac (!claset addSEs [MPair_parts]
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   152
		       addDs  [Says_imp_sees_Spy' RS parts.Inj,
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   153
			       parts.Body, unique_NA]) 3);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   154
(*NS1*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   155
by (blast_tac (!claset addSEs sees_Spy_partsEs
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   156
                       addIs  [impOfSubs analz_subset_parts]) 2);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   157
(*Fake*)
2497
47de509bdd55 New treatment of nonce creation
paulson
parents: 2480
diff changeset
   158
by (spy_analz_tac 1);
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   159
qed "Spy_not_see_NA";
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   160
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   161
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   162
(*Authentication for A: if she receives message 2 and has used NA
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   163
  to start a run, then B has sent message 2.*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   164
goal thy 
3466
30791e5a69c4 Corrected indentations and margins after the renaming of "set_of_list"
paulson
parents: 3465
diff changeset
   165
 "!!evs. [| Says A B (Crypt (pubK B) {|Nonce NA, Agent A|}) : set evs;  \
30791e5a69c4 Corrected indentations and margins after the renaming of "set_of_list"
paulson
parents: 3465
diff changeset
   166
\           Says B' A (Crypt(pubK A) {|Nonce NA, Nonce NB|}): set evs;  \
30791e5a69c4 Corrected indentations and margins after the renaming of "set_of_list"
paulson
parents: 3465
diff changeset
   167
\           A ~: lost;  B ~: lost;  evs : ns_public |]                  \
3465
e85c24717cad set_of_list -> set
nipkow
parents: 3440
diff changeset
   168
\        ==> Says B A (Crypt(pubK A) {|Nonce NA, Nonce NB|}): set evs";
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   169
by (etac rev_mp 1);
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   170
(*prepare induction over Crypt (pubK A) {|NA,NB|} : parts H*)
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   171
by (etac (Says_imp_sees_Spy' RS parts.Inj RS rev_mp) 1);
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   172
by (etac ns_public.induct 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   173
by (ALLGOALS Asm_simp_tac);
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   174
(*NS1*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   175
by (blast_tac (!claset addSEs sees_Spy_partsEs) 2);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   176
(*Fake*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   177
by (blast_tac (!claset addSDs [impOfSubs Fake_parts_insert]
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   178
                       addDs  [Spy_not_see_NA, 
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   179
			       impOfSubs analz_subset_parts]) 1);
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   180
(*NS2; not clear why blast_tac needs to be preceeded by Step_tac*)
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   181
by (Step_tac 1);
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   182
by (blast_tac (!claset addDs [Says_imp_sees_Spy' RS parts.Inj,
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   183
			      Spy_not_see_NA, unique_NA]) 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   184
qed "A_trusts_NS2";
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   185
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   186
(*If the encrypted message appears then it originated with Alice in NS1*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   187
goal thy 
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   188
 "!!evs. [| Crypt (pubK B) {|Nonce NA, Agent A|} : parts (sees lost Spy evs); \
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   189
\           Nonce NA ~: analz (sees lost Spy evs);                 \
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   190
\           evs : ns_public |]                                     \
3465
e85c24717cad set_of_list -> set
nipkow
parents: 3440
diff changeset
   191
\   ==> Says A B (Crypt (pubK B) {|Nonce NA, Agent A|}) : set evs";
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   192
by (etac rev_mp 1);
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   193
by (etac rev_mp 1);
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
   194
by (analz_induct_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   195
(*Fake*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   196
by (blast_tac (!claset addSDs [impOfSubs Fake_parts_insert]
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   197
                       addIs  [analz_insertI]
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   198
                       addDs  [impOfSubs analz_subset_parts]) 2);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   199
(*Base*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   200
by (Blast_tac 1);
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   201
qed "B_trusts_NS1";
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   202
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   203
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   204
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   205
(**** Authenticity properties obtained from NS2 ****)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   206
2480
f9be937df511 Tidied up the unicity proofs
paulson
parents: 2451
diff changeset
   207
(*Unicity for NS2: nonce NB identifies agent A and nonce NA
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   208
  [proof closely follows that for unique_NA] *)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   209
goal thy 
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   210
 "!!evs. [| Nonce NB ~: analz (sees lost Spy evs);  evs : ns_public |]      \
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   211
\ ==> EX A' NA'. ALL A NA.                                                  \
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   212
\      Crypt (pubK A) {|Nonce NA, Nonce NB|}                                \
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   213
\        : parts (sees lost Spy evs)  -->  A=A' & NA=NA'";
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   214
by (etac rev_mp 1);
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
   215
by (analz_induct_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   216
(*NS2*)
2497
47de509bdd55 New treatment of nonce creation
paulson
parents: 2480
diff changeset
   217
by (simp_tac (!simpset addsimps [all_conj_distrib]) 3);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   218
by (expand_case_tac "NB = ?y" 3 THEN
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   219
    REPEAT (blast_tac (!claset addSEs partsEs) 3));
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   220
(*Base*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   221
by (Blast_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   222
(*Fake*)
2497
47de509bdd55 New treatment of nonce creation
paulson
parents: 2480
diff changeset
   223
by (simp_tac (!simpset addsimps [all_conj_distrib, parts_insert_sees]) 1);
2374
4148aa5b00a2 Streamlined many proofs
paulson
parents: 2324
diff changeset
   224
by (step_tac (!claset addSIs [analz_insertI]) 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   225
by (ex_strip_tac 1);
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   226
by (blast_tac (!claset delrules [conjI]
2516
4d68fbe6378b Now with Andy Gordon's treatment of freshness to replace newN/K
paulson
parents: 2497
diff changeset
   227
                      addSDs [impOfSubs Fake_parts_insert]
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   228
                      addDs  [impOfSubs analz_subset_parts]) 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   229
val lemma = result();
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   230
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   231
goal thy 
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   232
 "!!evs. [| Crypt(pubK A) {|Nonce NA, Nonce NB|}  : parts(sees lost Spy evs); \
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   233
\           Crypt(pubK A'){|Nonce NA', Nonce NB|} : parts(sees lost Spy evs); \
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   234
\           Nonce NB ~: analz (sees lost Spy evs);                            \
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   235
\           evs : ns_public |]                                                \
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   236
\        ==> A=A' & NA=NA'";
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
   237
by (prove_unique_tac lemma 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   238
qed "unique_NB";
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   239
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   240
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   241
(*NB remains secret PROVIDED Alice never responds with round 3*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   242
goal thy 
3466
30791e5a69c4 Corrected indentations and margins after the renaming of "set_of_list"
paulson
parents: 3465
diff changeset
   243
 "!!evs.[| Says B A (Crypt (pubK A) {|Nonce NA, Nonce NB|}) : set evs;  \
30791e5a69c4 Corrected indentations and margins after the renaming of "set_of_list"
paulson
parents: 3465
diff changeset
   244
\          (ALL C. Says A C (Crypt (pubK C) (Nonce NB)) ~: set evs);    \
30791e5a69c4 Corrected indentations and margins after the renaming of "set_of_list"
paulson
parents: 3465
diff changeset
   245
\          A ~: lost;  B ~: lost;  evs : ns_public |]                   \
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   246
\       ==> Nonce NB ~: analz (sees lost Spy evs)";
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   247
by (etac rev_mp 1);
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   248
by (etac rev_mp 1);
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
   249
by (analz_induct_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   250
(*NS1*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   251
by (blast_tac (!claset addSEs sees_Spy_partsEs) 2);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   252
(*Fake*)
2497
47de509bdd55 New treatment of nonce creation
paulson
parents: 2480
diff changeset
   253
by (spy_analz_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   254
(*NS2 and NS3*)
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   255
by (ALLGOALS (asm_simp_tac (!simpset addsimps [all_conj_distrib])));
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   256
by (step_tac (!claset delrules [allI]) 1);
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   257
by (Blast_tac 5);
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   258
(*NS3*)
3440
22db7a9cbb52 Deleted spurious reference to Spy_not_see_NB, which by chance was defined
paulson
parents: 3121
diff changeset
   259
by (blast_tac (!claset addDs [Says_imp_sees_Spy' RS parts.Inj, unique_NB]) 4);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   260
(*NS2*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   261
by (blast_tac (!claset addSEs sees_Spy_partsEs) 3);
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   262
by (blast_tac (!claset addSDs [Says_imp_sees_Spy' RS parts.Inj]
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   263
                       addEs  [no_nonce_NS1_NS2 RSN (2, rev_notE)]) 2);
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   264
by (blast_tac (!claset addSIs [impOfSubs analz_subset_parts]) 1);
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   265
qed "Spy_not_see_NB";
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   266
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   267
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   268
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   269
(*Authentication for B: if he receives message 3 and has used NB
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   270
  in message 2, then A has sent message 3--to somebody....*)
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   271
goal thy 
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   272
 "!!evs. [| Says B A  (Crypt (pubK A) {|Nonce NA, Nonce NB|})          \
3466
30791e5a69c4 Corrected indentations and margins after the renaming of "set_of_list"
paulson
parents: 3465
diff changeset
   273
\             : set evs;                                               \
30791e5a69c4 Corrected indentations and margins after the renaming of "set_of_list"
paulson
parents: 3465
diff changeset
   274
\           Says A' B (Crypt (pubK B) (Nonce NB)): set evs;            \
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   275
\           A ~: lost;  B ~: lost;  evs : ns_public |]                 \
3465
e85c24717cad set_of_list -> set
nipkow
parents: 3440
diff changeset
   276
\        ==> EX C. Says A C (Crypt (pubK C) (Nonce NB)) : set evs";
2536
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   277
by (etac rev_mp 1);
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   278
(*prepare induction over Crypt (pubK B) NB : parts H*)
1e04eb7f7eb1 Tidied proofs by using "etac rev_mp" instead of applying rev_mp to result()
paulson
parents: 2516
diff changeset
   279
by (etac (Says_imp_sees_Spy' RS parts.Inj RS rev_mp) 1);
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
   280
by (analz_induct_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   281
by (ALLGOALS (asm_simp_tac (!simpset addsimps [ex_disj_distrib])));
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   282
(*NS1*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   283
by (blast_tac (!claset addSEs sees_Spy_partsEs) 2);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   284
(*Fake*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   285
by (blast_tac (!claset addSDs [impOfSubs Fake_parts_insert]
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   286
                       addDs  [Spy_not_see_NB, 
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   287
			       impOfSubs analz_subset_parts]) 1);
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   288
(*NS3; not clear why blast_tac needs to be preceeded by Step_tac*)
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   289
by (Step_tac 1);
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   290
by (blast_tac (!claset addDs [Says_imp_sees_Spy' RS parts.Inj,
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   291
			      Spy_not_see_NB, unique_NB]) 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   292
qed "B_trusts_NS3";
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   293
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   294
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   295
(*Can we strengthen the secrecy theorem?  NO*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   296
goal thy 
3466
30791e5a69c4 Corrected indentations and margins after the renaming of "set_of_list"
paulson
parents: 3465
diff changeset
   297
 "!!evs. [| A ~: lost;  B ~: lost;  evs : ns_public |]           \
3465
e85c24717cad set_of_list -> set
nipkow
parents: 3440
diff changeset
   298
\ ==> Says B A (Crypt (pubK A) {|Nonce NA, Nonce NB|}) : set evs \
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   299
\     --> Nonce NB ~: analz (sees lost Spy evs)";
2418
6b6a92d05fb2 New tactics: prove_unique_tac and analz_induct_tac
paulson
parents: 2374
diff changeset
   300
by (analz_induct_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   301
(*NS1*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   302
by (blast_tac (!claset addSEs partsEs
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   303
                       addSDs [Says_imp_sees_Spy' RS parts.Inj]) 2);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   304
(*Fake*)
2497
47de509bdd55 New treatment of nonce creation
paulson
parents: 2480
diff changeset
   305
by (spy_analz_tac 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   306
(*NS2 and NS3*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   307
by (Step_tac 1);
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   308
by (blast_tac (!claset addSIs [impOfSubs analz_subset_parts, usedI]) 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   309
(*NS2*)
3121
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   310
by (blast_tac (!claset addSEs partsEs
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   311
                       addSDs [Says_imp_sees_Spy' RS parts.Inj]) 2);
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   312
by (blast_tac (!claset addSDs [Says_imp_sees_Spy' RS parts.Inj]
cbb6c0c1c58a Conversion to use blast_tac (with other improvements)
paulson
parents: 2637
diff changeset
   313
                       addEs  [no_nonce_NS1_NS2 RSN (2, rev_notE)]) 1);
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   314
(*NS3*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   315
by (forw_inst_tac [("A'","A")] (Says_imp_sees_Spy' RS parts.Inj RS unique_NB) 1
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   316
    THEN REPEAT (eresolve_tac [asm_rl, Says_imp_sees_Spy' RS parts.Inj] 1));
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   317
by (Step_tac 1);
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   319
(*
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   320
THIS IS THE ATTACK!
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   321
Level 9
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   322
!!evs. [| A ~: lost; B ~: lost; evs : ns_public |]
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   323
       ==> Says B A (Crypt (pubK A) {|Nonce NA, Nonce NB|})
3465
e85c24717cad set_of_list -> set
nipkow
parents: 3440
diff changeset
   324
           : set evs -->
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   325
           Nonce NB ~: analz (sees lost Spy evs)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   326
 1. !!evs Aa Ba B' NAa NBa evsa.
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   327
       [| A ~: lost; B ~: lost; evsa : ns_public; A ~= Ba;
3465
e85c24717cad set_of_list -> set
nipkow
parents: 3440
diff changeset
   328
          Says B' A (Crypt (pubK A) {|Nonce NA, Nonce NB|}) : set evsa;
e85c24717cad set_of_list -> set
nipkow
parents: 3440
diff changeset
   329
          Says A Ba (Crypt (pubK Ba) {|Nonce NA, Agent A|}) : set evsa;
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   330
          Ba : lost;
3465
e85c24717cad set_of_list -> set
nipkow
parents: 3440
diff changeset
   331
          Says B A (Crypt (pubK A) {|Nonce NA, Nonce NB|}) : set evsa;
2318
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   332
          Nonce NB ~: analz (sees lost Spy evsa) |]
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   333
       ==> False
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   334
*)
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   335
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   336
6d3f7c7f70b0 Public-key examples
paulson
parents:
diff changeset
   337