src/HOL/Auth/Message.thy
 changeset 13926 6e62e5357a10 parent 13922 75ae4244a596 child 13956 8fe7e12290e1
```     1.1 --- a/src/HOL/Auth/Message.thy	Sat Apr 26 12:38:17 2003 +0200
1.2 +++ b/src/HOL/Auth/Message.thy	Sat Apr 26 12:38:42 2003 +0200
1.3 @@ -7,11 +7,10 @@
1.4  Inductive relations "parts", "analz" and "synth"
1.5  *)
1.6
1.7 -theory Message = Main
1.8 -files ("Message_lemmas.ML"):
1.9 +theory Message = Main:
1.10
1.11  (*Needed occasionally with spy_analz_tac, e.g. in analz_insert_Key_newK*)
1.12 -lemma [simp] : "A Un (B Un A) = B Un A"
1.13 +lemma [simp] : "A \<union> (B \<union> A) = B \<union> A"
1.14  by blast
1.15
1.16  types
1.17 @@ -83,6 +82,238 @@
1.18  done
1.19
1.20
1.21 +(*Equations hold because constructors are injective; cannot prove for all f*)
1.22 +lemma Friend_image_eq [simp]: "(Friend x \<in> Friend`A) = (x:A)"
1.23 +by auto
1.24 +
1.25 +lemma Key_image_eq [simp]: "(Key x \<in> Key`A) = (x\<in>A)"
1.26 +by auto
1.27 +
1.28 +lemma Nonce_Key_image_eq [simp]: "(Nonce x \<notin> Key`A)"
1.29 +by auto
1.30 +
1.31 +
1.32 +(** Inverse of keys **)
1.33 +
1.34 +lemma invKey_eq [simp]: "(invKey K = invKey K') = (K=K')"
1.35 +apply safe
1.36 +apply (drule_tac f = invKey in arg_cong, simp)
1.37 +done
1.38 +
1.39 +
1.40 +subsection{*keysFor operator*}
1.41 +
1.42 +lemma keysFor_empty [simp]: "keysFor {} = {}"
1.43 +by (unfold keysFor_def, blast)
1.44 +
1.45 +lemma keysFor_Un [simp]: "keysFor (H \<union> H') = keysFor H \<union> keysFor H'"
1.46 +by (unfold keysFor_def, blast)
1.47 +
1.48 +lemma keysFor_UN [simp]: "keysFor (\<Union>i\<in>A. H i) = (\<Union>i\<in>A. keysFor (H i))"
1.49 +by (unfold keysFor_def, blast)
1.50 +
1.51 +(*Monotonicity*)
1.52 +lemma keysFor_mono: "G\<subseteq>H ==> keysFor(G) \<subseteq> keysFor(H)"
1.53 +by (unfold keysFor_def, blast)
1.54 +
1.55 +lemma keysFor_insert_Agent [simp]: "keysFor (insert (Agent A) H) = keysFor H"
1.56 +by (unfold keysFor_def, auto)
1.57 +
1.58 +lemma keysFor_insert_Nonce [simp]: "keysFor (insert (Nonce N) H) = keysFor H"
1.59 +by (unfold keysFor_def, auto)
1.60 +
1.61 +lemma keysFor_insert_Number [simp]: "keysFor (insert (Number N) H) = keysFor H"
1.62 +by (unfold keysFor_def, auto)
1.63 +
1.64 +lemma keysFor_insert_Key [simp]: "keysFor (insert (Key K) H) = keysFor H"
1.65 +by (unfold keysFor_def, auto)
1.66 +
1.67 +lemma keysFor_insert_Hash [simp]: "keysFor (insert (Hash X) H) = keysFor H"
1.68 +by (unfold keysFor_def, auto)
1.69 +
1.70 +lemma keysFor_insert_MPair [simp]: "keysFor (insert {|X,Y|} H) = keysFor H"
1.71 +by (unfold keysFor_def, auto)
1.72 +
1.73 +lemma keysFor_insert_Crypt [simp]:
1.74 +    "keysFor (insert (Crypt K X) H) = insert (invKey K) (keysFor H)"
1.75 +apply (unfold keysFor_def, auto)
1.76 +done
1.77 +
1.78 +lemma keysFor_image_Key [simp]: "keysFor (Key`E) = {}"
1.79 +by (unfold keysFor_def, auto)
1.80 +
1.81 +lemma Crypt_imp_invKey_keysFor: "Crypt K X \<in> H ==> invKey K \<in> keysFor H"
1.82 +by (unfold keysFor_def, blast)
1.83 +
1.84 +
1.85 +subsection{*Inductive relation "parts"*}
1.86 +
1.87 +lemma MPair_parts:
1.88 +     "[| {|X,Y|} \<in> parts H;
1.89 +         [| X \<in> parts H; Y \<in> parts H |] ==> P |] ==> P"
1.90 +by (blast dest: parts.Fst parts.Snd)
1.91 +
1.92 +declare MPair_parts [elim!]  parts.Body [dest!]
1.93 +text{*NB These two rules are UNSAFE in the formal sense, as they discard the
1.94 +     compound message.  They work well on THIS FILE.
1.95 +  @{text MPair_parts} is left as SAFE because it speeds up proofs.
1.96 +  The Crypt rule is normally kept UNSAFE to avoid breaking up certificates.*}
1.97 +
1.98 +lemma parts_increasing: "H \<subseteq> parts(H)"
1.99 +by blast
1.100 +
1.101 +lemmas parts_insertI = subset_insertI [THEN parts_mono, THEN subsetD, standard]
1.102 +
1.103 +lemma parts_empty [simp]: "parts{} = {}"
1.104 +apply safe
1.105 +apply (erule parts.induct, blast+)
1.106 +done
1.107 +
1.108 +lemma parts_emptyE [elim!]: "X\<in> parts{} ==> P"
1.109 +by simp
1.110 +
1.111 +(*WARNING: loops if H = {Y}, therefore must not be repeated!*)
1.112 +lemma parts_singleton: "X\<in> parts H ==> \<exists>Y\<in>H. X\<in> parts {Y}"
1.113 +by (erule parts.induct, blast+)
1.114 +
1.115 +
1.116 +(** Unions **)
1.117 +
1.118 +lemma parts_Un_subset1: "parts(G) \<union> parts(H) \<subseteq> parts(G \<union> H)"
1.119 +by (intro Un_least parts_mono Un_upper1 Un_upper2)
1.120 +
1.121 +lemma parts_Un_subset2: "parts(G \<union> H) \<subseteq> parts(G) \<union> parts(H)"
1.122 +apply (rule subsetI)
1.123 +apply (erule parts.induct, blast+)
1.124 +done
1.125 +
1.126 +lemma parts_Un [simp]: "parts(G \<union> H) = parts(G) \<union> parts(H)"
1.127 +by (intro equalityI parts_Un_subset1 parts_Un_subset2)
1.128 +
1.129 +lemma parts_insert: "parts (insert X H) = parts {X} \<union> parts H"
1.130 +apply (subst insert_is_Un [of _ H])
1.131 +apply (simp only: parts_Un)
1.132 +done
1.133 +
1.134 +(*TWO inserts to avoid looping.  This rewrite is better than nothing.
1.135 +  Not suitable for Addsimps: its behaviour can be strange.*)
1.136 +lemma parts_insert2: "parts (insert X (insert Y H)) = parts {X} \<union> parts {Y} \<union> parts H"
1.138 +apply (simp add: parts_insert [symmetric])
1.139 +done
1.140 +
1.141 +lemma parts_UN_subset1: "(\<Union>x\<in>A. parts(H x)) \<subseteq> parts(\<Union>x\<in>A. H x)"
1.142 +by (intro UN_least parts_mono UN_upper)
1.143 +
1.144 +lemma parts_UN_subset2: "parts(\<Union>x\<in>A. H x) \<subseteq> (\<Union>x\<in>A. parts(H x))"
1.145 +apply (rule subsetI)
1.146 +apply (erule parts.induct, blast+)
1.147 +done
1.148 +
1.149 +lemma parts_UN [simp]: "parts(\<Union>x\<in>A. H x) = (\<Union>x\<in>A. parts(H x))"
1.150 +by (intro equalityI parts_UN_subset1 parts_UN_subset2)
1.151 +
1.152 +(*Added to simplify arguments to parts, analz and synth.
1.153 +  NOTE: the UN versions are no longer used!*)
1.154 +
1.155 +
1.156 +text{*This allows @{text blast} to simplify occurrences of
1.157 +  @{term "parts(G\<union>H)"} in the assumption.*}
1.158 +declare parts_Un [THEN equalityD1, THEN subsetD, THEN UnE, elim!]
1.159 +
1.160 +
1.161 +lemma parts_insert_subset: "insert X (parts H) \<subseteq> parts(insert X H)"
1.162 +by (blast intro: parts_mono [THEN [2] rev_subsetD])
1.163 +
1.164 +(** Idempotence and transitivity **)
1.165 +
1.166 +lemma parts_partsD [dest!]: "X\<in> parts (parts H) ==> X\<in> parts H"
1.167 +by (erule parts.induct, blast+)
1.168 +
1.169 +lemma parts_idem [simp]: "parts (parts H) = parts H"
1.170 +by blast
1.171 +
1.172 +lemma parts_trans: "[| X\<in> parts G;  G \<subseteq> parts H |] ==> X\<in> parts H"
1.173 +by (drule parts_mono, blast)
1.174 +
1.175 +(*Cut*)
1.176 +lemma parts_cut: "[| Y\<in> parts (insert X G);  X\<in> parts H |]
1.177 +               ==> Y\<in> parts (G \<union> H)"
1.178 +apply (erule parts_trans, auto)
1.179 +done
1.180 +
1.181 +lemma parts_cut_eq [simp]: "X\<in> parts H ==> parts (insert X H) = parts H"
1.182 +by (force dest!: parts_cut intro: parts_insertI)
1.183 +
1.184 +
1.185 +(** Rewrite rules for pulling out atomic messages **)
1.186 +
1.187 +lemmas parts_insert_eq_I = equalityI [OF subsetI parts_insert_subset]
1.188 +
1.189 +
1.190 +lemma parts_insert_Agent [simp]: "parts (insert (Agent agt) H) = insert (Agent agt) (parts H)"
1.191 +apply (rule parts_insert_eq_I)
1.192 +apply (erule parts.induct, auto)
1.193 +done
1.194 +
1.195 +lemma parts_insert_Nonce [simp]: "parts (insert (Nonce N) H) = insert (Nonce N) (parts H)"
1.196 +apply (rule parts_insert_eq_I)
1.197 +apply (erule parts.induct, auto)
1.198 +done
1.199 +
1.200 +lemma parts_insert_Number [simp]: "parts (insert (Number N) H) = insert (Number N) (parts H)"
1.201 +apply (rule parts_insert_eq_I)
1.202 +apply (erule parts.induct, auto)
1.203 +done
1.204 +
1.205 +lemma parts_insert_Key [simp]: "parts (insert (Key K) H) = insert (Key K) (parts H)"
1.206 +apply (rule parts_insert_eq_I)
1.207 +apply (erule parts.induct, auto)
1.208 +done
1.209 +
1.210 +lemma parts_insert_Hash [simp]: "parts (insert (Hash X) H) = insert (Hash X) (parts H)"
1.211 +apply (rule parts_insert_eq_I)
1.212 +apply (erule parts.induct, auto)
1.213 +done
1.214 +
1.215 +lemma parts_insert_Crypt [simp]: "parts (insert (Crypt K X) H) =
1.216 +          insert (Crypt K X) (parts (insert X H))"
1.217 +apply (rule equalityI)
1.218 +apply (rule subsetI)
1.219 +apply (erule parts.induct, auto)
1.220 +apply (erule parts.induct)
1.221 +apply (blast intro: parts.Body)+
1.222 +done
1.223 +
1.224 +lemma parts_insert_MPair [simp]: "parts (insert {|X,Y|} H) =
1.225 +          insert {|X,Y|} (parts (insert X (insert Y H)))"
1.226 +apply (rule equalityI)
1.227 +apply (rule subsetI)
1.228 +apply (erule parts.induct, auto)
1.229 +apply (erule parts.induct)
1.230 +apply (blast intro: parts.Fst parts.Snd)+
1.231 +done
1.232 +
1.233 +lemma parts_image_Key [simp]: "parts (Key`N) = Key`N"
1.234 +apply auto
1.235 +apply (erule parts.induct, auto)
1.236 +done
1.237 +
1.238 +
1.239 +(*In any message, there is an upper bound N on its greatest nonce.*)
1.240 +lemma msg_Nonce_supply: "\<exists>N. \<forall>n. N\<le>n --> Nonce n \<notin> parts {msg}"
1.241 +apply (induct_tac "msg")
1.242 +apply (simp_all (no_asm_simp) add: exI parts_insert2)
1.243 +(*MPair case: blast_tac works out the necessary sum itself!*)
1.244 +prefer 2 apply (blast elim!: add_leE)
1.245 +(*Nonce case*)
1.246 +apply (rule_tac x = "N + Suc nat" in exI)
1.248 +done
1.249 +
1.250 +
1.251 +subsection{*Inductive relation "analz"*}
1.252 +
1.253  (** Inductive definition of "analz" -- what can be broken down from a set of
1.254      messages, including keys.  A form of downward closure.  Pairs can
1.255      be taken apart; messages decrypted with known keys.  **)
1.256 @@ -104,6 +335,211 @@
1.257  apply (auto dest: Fst Snd)
1.258  done
1.259
1.260 +text{*Making it safe speeds up proofs*}
1.261 +lemma MPair_analz [elim!]:
1.262 +     "[| {|X,Y|} \<in> analz H;
1.263 +             [| X \<in> analz H; Y \<in> analz H |] ==> P
1.264 +          |] ==> P"
1.265 +by (blast dest: analz.Fst analz.Snd)
1.266 +
1.267 +lemma analz_increasing: "H \<subseteq> analz(H)"
1.268 +by blast
1.269 +
1.270 +lemma analz_subset_parts: "analz H \<subseteq> parts H"
1.271 +apply (rule subsetI)
1.272 +apply (erule analz.induct, blast+)
1.273 +done
1.274 +
1.275 +lemmas not_parts_not_analz = analz_subset_parts [THEN contra_subsetD, standard]
1.276 +
1.277 +
1.278 +lemma parts_analz [simp]: "parts (analz H) = parts H"
1.279 +apply (rule equalityI)
1.280 +apply (rule analz_subset_parts [THEN parts_mono, THEN subset_trans], simp)
1.281 +apply (blast intro: analz_increasing [THEN parts_mono, THEN subsetD])
1.282 +done
1.283 +
1.284 +lemma analz_parts [simp]: "analz (parts H) = parts H"
1.285 +apply auto
1.286 +apply (erule analz.induct, auto)
1.287 +done
1.288 +
1.289 +lemmas analz_insertI = subset_insertI [THEN analz_mono, THEN [2] rev_subsetD, standard]
1.290 +
1.291 +(** General equational properties **)
1.292 +
1.293 +lemma analz_empty [simp]: "analz{} = {}"
1.294 +apply safe
1.295 +apply (erule analz.induct, blast+)
1.296 +done
1.297 +
1.298 +(*Converse fails: we can analz more from the union than from the
1.299 +  separate parts, as a key in one might decrypt a message in the other*)
1.300 +lemma analz_Un: "analz(G) \<union> analz(H) \<subseteq> analz(G \<union> H)"
1.301 +by (intro Un_least analz_mono Un_upper1 Un_upper2)
1.302 +
1.303 +lemma analz_insert: "insert X (analz H) \<subseteq> analz(insert X H)"
1.304 +by (blast intro: analz_mono [THEN [2] rev_subsetD])
1.305 +
1.306 +(** Rewrite rules for pulling out atomic messages **)
1.307 +
1.308 +lemmas analz_insert_eq_I = equalityI [OF subsetI analz_insert]
1.309 +
1.310 +lemma analz_insert_Agent [simp]: "analz (insert (Agent agt) H) = insert (Agent agt) (analz H)"
1.311 +apply (rule analz_insert_eq_I)
1.312 +apply (erule analz.induct, auto)
1.313 +done
1.314 +
1.315 +lemma analz_insert_Nonce [simp]: "analz (insert (Nonce N) H) = insert (Nonce N) (analz H)"
1.316 +apply (rule analz_insert_eq_I)
1.317 +apply (erule analz.induct, auto)
1.318 +done
1.319 +
1.320 +lemma analz_insert_Number [simp]: "analz (insert (Number N) H) = insert (Number N) (analz H)"
1.321 +apply (rule analz_insert_eq_I)
1.322 +apply (erule analz.induct, auto)
1.323 +done
1.324 +
1.325 +lemma analz_insert_Hash [simp]: "analz (insert (Hash X) H) = insert (Hash X) (analz H)"
1.326 +apply (rule analz_insert_eq_I)
1.327 +apply (erule analz.induct, auto)
1.328 +done
1.329 +
1.330 +(*Can only pull out Keys if they are not needed to decrypt the rest*)
1.331 +lemma analz_insert_Key [simp]:
1.332 +    "K \<notin> keysFor (analz H) ==>
1.333 +          analz (insert (Key K) H) = insert (Key K) (analz H)"
1.334 +apply (unfold keysFor_def)
1.335 +apply (rule analz_insert_eq_I)
1.336 +apply (erule analz.induct, auto)
1.337 +done
1.338 +
1.339 +lemma analz_insert_MPair [simp]: "analz (insert {|X,Y|} H) =
1.340 +          insert {|X,Y|} (analz (insert X (insert Y H)))"
1.341 +apply (rule equalityI)
1.342 +apply (rule subsetI)
1.343 +apply (erule analz.induct, auto)
1.344 +apply (erule analz.induct)
1.345 +apply (blast intro: analz.Fst analz.Snd)+
1.346 +done
1.347 +
1.348 +(*Can pull out enCrypted message if the Key is not known*)
1.349 +lemma analz_insert_Crypt:
1.350 +     "Key (invKey K) \<notin> analz H
1.351 +      ==> analz (insert (Crypt K X) H) = insert (Crypt K X) (analz H)"
1.352 +apply (rule analz_insert_eq_I)
1.353 +apply (erule analz.induct, auto)
1.354 +
1.355 +done
1.356 +
1.357 +lemma lemma1: "Key (invKey K) \<in> analz H ==>
1.358 +               analz (insert (Crypt K X) H) \<subseteq>
1.359 +               insert (Crypt K X) (analz (insert X H))"
1.360 +apply (rule subsetI)
1.361 +apply (erule_tac xa = x in analz.induct, auto)
1.362 +done
1.363 +
1.364 +lemma lemma2: "Key (invKey K) \<in> analz H ==>
1.365 +               insert (Crypt K X) (analz (insert X H)) \<subseteq>
1.366 +               analz (insert (Crypt K X) H)"
1.367 +apply auto
1.368 +apply (erule_tac xa = x in analz.induct, auto)
1.369 +apply (blast intro: analz_insertI analz.Decrypt)
1.370 +done
1.371 +
1.372 +lemma analz_insert_Decrypt: "Key (invKey K) \<in> analz H ==>
1.373 +               analz (insert (Crypt K X) H) =
1.374 +               insert (Crypt K X) (analz (insert X H))"
1.375 +by (intro equalityI lemma1 lemma2)
1.376 +
1.377 +(*Case analysis: either the message is secure, or it is not!
1.378 +  Effective, but can cause subgoals to blow up!
1.379 +  Use with split_if;  apparently split_tac does not cope with patterns
1.380 +  such as "analz (insert (Crypt K X) H)" *)
1.381 +lemma analz_Crypt_if [simp]:
1.382 +     "analz (insert (Crypt K X) H) =
1.383 +          (if (Key (invKey K) \<in> analz H)
1.384 +           then insert (Crypt K X) (analz (insert X H))
1.385 +           else insert (Crypt K X) (analz H))"
1.386 +by (simp add: analz_insert_Crypt analz_insert_Decrypt)
1.387 +
1.388 +
1.389 +(*This rule supposes "for the sake of argument" that we have the key.*)
1.390 +lemma analz_insert_Crypt_subset: "analz (insert (Crypt K X) H) \<subseteq>
1.391 +           insert (Crypt K X) (analz (insert X H))"
1.392 +apply (rule subsetI)
1.393 +apply (erule analz.induct, auto)
1.394 +done
1.395 +
1.396 +
1.397 +lemma analz_image_Key [simp]: "analz (Key`N) = Key`N"
1.398 +apply auto
1.399 +apply (erule analz.induct, auto)
1.400 +done
1.401 +
1.402 +
1.403 +(** Idempotence and transitivity **)
1.404 +
1.405 +lemma analz_analzD [dest!]: "X\<in> analz (analz H) ==> X\<in> analz H"
1.406 +by (erule analz.induct, blast+)
1.407 +
1.408 +lemma analz_idem [simp]: "analz (analz H) = analz H"
1.409 +by blast
1.410 +
1.411 +lemma analz_trans: "[| X\<in> analz G;  G \<subseteq> analz H |] ==> X\<in> analz H"
1.412 +by (drule analz_mono, blast)
1.413 +
1.414 +(*Cut; Lemma 2 of Lowe*)
1.415 +lemma analz_cut: "[| Y\<in> analz (insert X H);  X\<in> analz H |] ==> Y\<in> analz H"
1.416 +by (erule analz_trans, blast)
1.417 +
1.418 +(*Cut can be proved easily by induction on
1.419 +   "Y: analz (insert X H) ==> X: analz H --> Y: analz H"
1.420 +*)
1.421 +
1.422 +(*This rewrite rule helps in the simplification of messages that involve
1.423 +  the forwarding of unknown components (X).  Without it, removing occurrences
1.424 +  of X can be very complicated. *)
1.425 +lemma analz_insert_eq: "X\<in> analz H ==> analz (insert X H) = analz H"
1.426 +by (blast intro: analz_cut analz_insertI)
1.427 +
1.428 +
1.429 +(** A congruence rule for "analz" **)
1.430 +
1.431 +lemma analz_subset_cong: "[| analz G \<subseteq> analz G'; analz H \<subseteq> analz H'
1.432 +               |] ==> analz (G \<union> H) \<subseteq> analz (G' \<union> H')"
1.433 +apply clarify
1.434 +apply (erule analz.induct)
1.435 +apply (best intro: analz_mono [THEN subsetD])+
1.436 +done
1.437 +
1.438 +lemma analz_cong: "[| analz G = analz G'; analz H = analz H'
1.439 +               |] ==> analz (G \<union> H) = analz (G' \<union> H')"
1.440 +apply (intro equalityI analz_subset_cong, simp_all)
1.441 +done
1.442 +
1.443 +
1.444 +lemma analz_insert_cong: "analz H = analz H' ==> analz(insert X H) = analz(insert X H')"
1.445 +by (force simp only: insert_def intro!: analz_cong)
1.446 +
1.447 +(*If there are no pairs or encryptions then analz does nothing*)
1.448 +lemma analz_trivial: "[| \<forall>X Y. {|X,Y|} \<notin> H;  \<forall>X K. Crypt K X \<notin> H |] ==> analz H = H"
1.449 +apply safe
1.450 +apply (erule analz.induct, blast+)
1.451 +done
1.452 +
1.453 +(*These two are obsolete (with a single Spy) but cost little to prove...*)
1.454 +lemma analz_UN_analz_lemma: "X\<in> analz (\<Union>i\<in>A. analz (H i)) ==> X\<in> analz (\<Union>i\<in>A. H i)"
1.455 +apply (erule analz.induct)
1.456 +apply (blast intro: analz_mono [THEN [2] rev_subsetD])+
1.457 +done
1.458 +
1.459 +lemma analz_UN_analz [simp]: "analz (\<Union>i\<in>A. analz (H i)) = analz (\<Union>i\<in>A. H i)"
1.460 +by (blast intro: analz_UN_analz_lemma analz_mono [THEN [2] rev_subsetD])
1.461 +
1.462 +
1.463 +subsection{*Inductive relation "synth"*}
1.464 +
1.465  (** Inductive definition of "synth" -- what can be built up from a set of
1.466      messages.  A form of upward closure.  Pairs can be built, messages
1.467      encrypted with known keys.  Agent names are public domain.
1.468 @@ -133,7 +569,376 @@
1.469  inductive_cases MPair_synth [elim!]: "{|X,Y|} \<in> synth H"
1.470  inductive_cases Crypt_synth [elim!]: "Crypt K X \<in> synth H"
1.471
1.472 -use "Message_lemmas.ML"
1.473 +
1.474 +lemma synth_increasing: "H \<subseteq> synth(H)"
1.475 +by blast
1.476 +
1.477 +(** Unions **)
1.478 +
1.479 +(*Converse fails: we can synth more from the union than from the
1.480 +  separate parts, building a compound message using elements of each.*)
1.481 +lemma synth_Un: "synth(G) \<union> synth(H) \<subseteq> synth(G \<union> H)"
1.482 +by (intro Un_least synth_mono Un_upper1 Un_upper2)
1.483 +
1.484 +lemma synth_insert: "insert X (synth H) \<subseteq> synth(insert X H)"
1.485 +by (blast intro: synth_mono [THEN [2] rev_subsetD])
1.486 +
1.487 +(** Idempotence and transitivity **)
1.488 +
1.489 +lemma synth_synthD [dest!]: "X\<in> synth (synth H) ==> X\<in> synth H"
1.490 +by (erule synth.induct, blast+)
1.491 +
1.492 +lemma synth_idem: "synth (synth H) = synth H"
1.493 +by blast
1.494 +
1.495 +lemma synth_trans: "[| X\<in> synth G;  G \<subseteq> synth H |] ==> X\<in> synth H"
1.496 +by (drule synth_mono, blast)
1.497 +
1.498 +(*Cut; Lemma 2 of Lowe*)
1.499 +lemma synth_cut: "[| Y\<in> synth (insert X H);  X\<in> synth H |] ==> Y\<in> synth H"
1.500 +by (erule synth_trans, blast)
1.501 +
1.502 +lemma Agent_synth [simp]: "Agent A \<in> synth H"
1.503 +by blast
1.504 +
1.505 +lemma Number_synth [simp]: "Number n \<in> synth H"
1.506 +by blast
1.507 +
1.508 +lemma Nonce_synth_eq [simp]: "(Nonce N \<in> synth H) = (Nonce N \<in> H)"
1.509 +by blast
1.510 +
1.511 +lemma Key_synth_eq [simp]: "(Key K \<in> synth H) = (Key K \<in> H)"
1.512 +by blast
1.513 +
1.514 +lemma Crypt_synth_eq [simp]: "Key K \<notin> H ==> (Crypt K X \<in> synth H) = (Crypt K X \<in> H)"
1.515 +by blast
1.516 +
1.517 +
1.518 +lemma keysFor_synth [simp]:
1.519 +    "keysFor (synth H) = keysFor H \<union> invKey`{K. Key K \<in> H}"
1.520 +apply (unfold keysFor_def, blast)
1.521 +done
1.522 +
1.523 +
1.524 +(*** Combinations of parts, analz and synth ***)
1.525 +
1.526 +lemma parts_synth [simp]: "parts (synth H) = parts H \<union> synth H"
1.527 +apply (rule equalityI)
1.528 +apply (rule subsetI)
1.529 +apply (erule parts.induct)
1.530 +apply (blast intro: synth_increasing [THEN parts_mono, THEN subsetD]
1.531 +                    parts.Fst parts.Snd parts.Body)+
1.532 +done
1.533 +
1.534 +lemma analz_analz_Un [simp]: "analz (analz G \<union> H) = analz (G \<union> H)"
1.535 +apply (intro equalityI analz_subset_cong)+
1.536 +apply simp_all
1.537 +done
1.538 +
1.539 +lemma analz_synth_Un [simp]: "analz (synth G \<union> H) = analz (G \<union> H) \<union> synth G"
1.540 +apply (rule equalityI)
1.541 +apply (rule subsetI)
1.542 +apply (erule analz.induct)
1.543 +prefer 5 apply (blast intro: analz_mono [THEN [2] rev_subsetD])
1.544 +apply (blast intro: analz.Fst analz.Snd analz.Decrypt)+
1.545 +done
1.546 +
1.547 +lemma analz_synth [simp]: "analz (synth H) = analz H \<union> synth H"
1.548 +apply (cut_tac H = "{}" in analz_synth_Un)
1.549 +apply (simp (no_asm_use))
1.550 +done
1.551 +
1.552 +
1.553 +(** For reasoning about the Fake rule in traces **)
1.554 +
1.555 +lemma parts_insert_subset_Un: "X\<in> G ==> parts(insert X H) \<subseteq> parts G \<union> parts H"
1.556 +by (rule subset_trans [OF parts_mono parts_Un_subset2], blast)
1.557 +
1.558 +(*More specifically for Fake.  Very occasionally we could do with a version
1.559 +  of the form  parts{X} \<subseteq> synth (analz H) \<union> parts H *)
1.560 +lemma Fake_parts_insert: "X \<in> synth (analz H) ==>
1.561 +      parts (insert X H) \<subseteq> synth (analz H) \<union> parts H"
1.562 +apply (drule parts_insert_subset_Un)
1.563 +apply (simp (no_asm_use))
1.564 +apply blast
1.565 +done
1.566 +
1.567 +(*H is sometimes (Key ` KK \<union> spies evs), so can't put G=H*)
1.568 +lemma Fake_analz_insert: "X\<in> synth (analz G) ==>
1.569 +      analz (insert X H) \<subseteq> synth (analz G) \<union> analz (G \<union> H)"
1.570 +apply (rule subsetI)
1.571 +apply (subgoal_tac "x \<in> analz (synth (analz G) \<union> H) ")
1.572 +prefer 2 apply (blast intro: analz_mono [THEN [2] rev_subsetD] analz_mono [THEN synth_mono, THEN [2] rev_subsetD])
1.573 +apply (simp (no_asm_use))
1.574 +apply blast
1.575 +done
1.576 +
1.577 +lemma analz_conj_parts [simp]: "(X \<in> analz H & X \<in> parts H) = (X \<in> analz H)"
1.578 +by (blast intro: analz_subset_parts [THEN [2] rev_subsetD])
1.579 +
1.580 +lemma analz_disj_parts [simp]: "(X \<in> analz H | X \<in> parts H) = (X \<in> parts H)"
1.581 +by (blast intro: analz_subset_parts [THEN [2] rev_subsetD])
1.582 +
1.583 +(*Without this equation, other rules for synth and analz would yield
1.584 +  redundant cases*)
1.585 +lemma MPair_synth_analz [iff]:
1.586 +     "({|X,Y|} \<in> synth (analz H)) =
1.587 +      (X \<in> synth (analz H) & Y \<in> synth (analz H))"
1.588 +by blast
1.589 +
1.590 +lemma Crypt_synth_analz: "[| Key K \<in> analz H;  Key (invKey K) \<in> analz H |]
1.591 +       ==> (Crypt K X \<in> synth (analz H)) = (X \<in> synth (analz H))"
1.592 +by blast
1.593 +
1.594 +
1.595 +lemma Hash_synth_analz [simp]: "X \<notin> synth (analz H)
1.596 +      ==> (Hash{|X,Y|} \<in> synth (analz H)) = (Hash{|X,Y|} \<in> analz H)"
1.597 +by blast
1.598 +
1.599 +
1.600 +subsection{*HPair: a combination of Hash and MPair*}
1.601 +
1.602 +(*** Freeness ***)
1.603 +
1.604 +lemma Agent_neq_HPair: "Agent A ~= Hash[X] Y"
1.605 +by (unfold HPair_def, simp)
1.606 +
1.607 +lemma Nonce_neq_HPair: "Nonce N ~= Hash[X] Y"
1.608 +by (unfold HPair_def, simp)
1.609 +
1.610 +lemma Number_neq_HPair: "Number N ~= Hash[X] Y"
1.611 +by (unfold HPair_def, simp)
1.612 +
1.613 +lemma Key_neq_HPair: "Key K ~= Hash[X] Y"
1.614 +by (unfold HPair_def, simp)
1.615 +
1.616 +lemma Hash_neq_HPair: "Hash Z ~= Hash[X] Y"
1.617 +by (unfold HPair_def, simp)
1.618 +
1.619 +lemma Crypt_neq_HPair: "Crypt K X' ~= Hash[X] Y"
1.620 +by (unfold HPair_def, simp)
1.621 +
1.622 +lemmas HPair_neqs = Agent_neq_HPair Nonce_neq_HPair Number_neq_HPair
1.623 +                    Key_neq_HPair Hash_neq_HPair Crypt_neq_HPair
1.624 +
1.625 +declare HPair_neqs [iff]
1.626 +declare HPair_neqs [symmetric, iff]
1.627 +
1.628 +lemma HPair_eq [iff]: "(Hash[X'] Y' = Hash[X] Y) = (X' = X & Y'=Y)"
1.630 +
1.631 +lemma MPair_eq_HPair [iff]: "({|X',Y'|} = Hash[X] Y) = (X' = Hash{|X,Y|} & Y'=Y)"
1.633 +
1.634 +lemma HPair_eq_MPair [iff]: "(Hash[X] Y = {|X',Y'|}) = (X' = Hash{|X,Y|} & Y'=Y)"
1.635 +by (auto simp add: HPair_def)
1.636 +
1.637 +
1.638 +(*** Specialized laws, proved in terms of those for Hash and MPair ***)
1.639 +
1.640 +lemma keysFor_insert_HPair [simp]: "keysFor (insert (Hash[X] Y) H) = keysFor H"
1.642 +
1.643 +lemma parts_insert_HPair [simp]:
1.644 +    "parts (insert (Hash[X] Y) H) =
1.645 +     insert (Hash[X] Y) (insert (Hash{|X,Y|}) (parts (insert Y H)))"
1.647 +
1.648 +lemma analz_insert_HPair [simp]:
1.649 +    "analz (insert (Hash[X] Y) H) =
1.650 +     insert (Hash[X] Y) (insert (Hash{|X,Y|}) (analz (insert Y H)))"
1.652 +
1.653 +lemma HPair_synth_analz [simp]:
1.654 +     "X \<notin> synth (analz H)
1.655 +    ==> (Hash[X] Y \<in> synth (analz H)) =
1.656 +        (Hash {|X, Y|} \<in> analz H & Y \<in> synth (analz H))"
1.658 +
1.659 +
1.660 +(*We do NOT want Crypt... messages broken up in protocols!!*)
1.661 +declare parts.Body [rule del]
1.662 +
1.663 +
1.664 +ML
1.665 +{*
1.666 +(*ML bindings for definitions and axioms*)
1.667 +
1.668 +val invKey = thm "invKey"
1.669 +val keysFor_def = thm "keysFor_def"
1.670 +val HPair_def = thm "HPair_def"
1.671 +val symKeys_def = thm "symKeys_def"
1.672 +
1.673 +structure parts =
1.674 +  struct
1.675 +  val induct = thm "parts.induct"
1.676 +  val Inj    = thm "parts.Inj"
1.677 +  val Fst    = thm "parts.Fst"
1.678 +  val Snd    = thm "parts.Snd"
1.679 +  val Body   = thm "parts.Body"
1.680 +  end
1.681 +
1.682 +structure analz =
1.683 +  struct
1.684 +  val induct = thm "analz.induct"
1.685 +  val Inj    = thm "analz.Inj"
1.686 +  val Fst    = thm "analz.Fst"
1.687 +  val Snd    = thm "analz.Snd"
1.688 +  val Decrypt = thm "analz.Decrypt"
1.689 +  end
1.690 +
1.691 +
1.692 +(** Rewrites to push in Key and Crypt messages, so that other messages can
1.693 +    be pulled out using the analz_insert rules **)
1.694 +
1.695 +fun insComm x y = inst "x" x (inst "y" y insert_commute);
1.696 +
1.697 +bind_thms ("pushKeys",
1.698 +           map (insComm "Key ?K")
1.699 +                   ["Agent ?C", "Nonce ?N", "Number ?N",
1.700 +		    "Hash ?X", "MPair ?X ?Y", "Crypt ?X ?K'"]);
1.701 +
1.702 +bind_thms ("pushCrypts",
1.703 +           map (insComm "Crypt ?X ?K")
1.704 +                     ["Agent ?C", "Nonce ?N", "Number ?N",
1.705 +		      "Hash ?X'", "MPair ?X' ?Y"]);
1.706 +*}
1.707 +
1.708 +text{*Cannot be added with @{text "[simp]"} -- messages should not always be
1.709 +  re-ordered. *}
1.710 +lemmas pushes = pushKeys pushCrypts
1.711 +
1.712 +
1.713 +subsection{*Tactics useful for many protocol proofs*}
1.714 +ML
1.715 +{*
1.716 +val parts_mono = thm "parts_mono";
1.717 +val analz_mono = thm "analz_mono";
1.718 +val Key_image_eq = thm "Key_image_eq";
1.719 +val Nonce_Key_image_eq = thm "Nonce_Key_image_eq";
1.720 +val keysFor_Un = thm "keysFor_Un";
1.721 +val keysFor_mono = thm "keysFor_mono";
1.722 +val keysFor_image_Key = thm "keysFor_image_Key";
1.723 +val Crypt_imp_invKey_keysFor = thm "Crypt_imp_invKey_keysFor";
1.724 +val MPair_parts = thm "MPair_parts";
1.725 +val parts_increasing = thm "parts_increasing";
1.726 +val parts_insertI = thm "parts_insertI";
1.727 +val parts_empty = thm "parts_empty";
1.728 +val parts_emptyE = thm "parts_emptyE";
1.729 +val parts_singleton = thm "parts_singleton";
1.730 +val parts_Un_subset1 = thm "parts_Un_subset1";
1.731 +val parts_Un_subset2 = thm "parts_Un_subset2";
1.732 +val parts_insert = thm "parts_insert";
1.733 +val parts_insert2 = thm "parts_insert2";
1.734 +val parts_UN_subset1 = thm "parts_UN_subset1";
1.735 +val parts_UN_subset2 = thm "parts_UN_subset2";
1.736 +val parts_UN = thm "parts_UN";
1.737 +val parts_insert_subset = thm "parts_insert_subset";
1.738 +val parts_partsD = thm "parts_partsD";
1.739 +val parts_trans = thm "parts_trans";
1.740 +val parts_cut = thm "parts_cut";
1.741 +val parts_cut_eq = thm "parts_cut_eq";
1.742 +val parts_insert_eq_I = thm "parts_insert_eq_I";
1.743 +val parts_image_Key = thm "parts_image_Key";
1.744 +val MPair_analz = thm "MPair_analz";
1.745 +val analz_increasing = thm "analz_increasing";
1.746 +val analz_subset_parts = thm "analz_subset_parts";
1.747 +val not_parts_not_analz = thm "not_parts_not_analz";
1.748 +val parts_analz = thm "parts_analz";
1.749 +val analz_parts = thm "analz_parts";
1.750 +val analz_insertI = thm "analz_insertI";
1.751 +val analz_empty = thm "analz_empty";
1.752 +val analz_Un = thm "analz_Un";
1.753 +val analz_insert_Crypt_subset = thm "analz_insert_Crypt_subset";
1.754 +val analz_image_Key = thm "analz_image_Key";
1.755 +val analz_analzD = thm "analz_analzD";
1.756 +val analz_trans = thm "analz_trans";
1.757 +val analz_cut = thm "analz_cut";
1.758 +val analz_insert_eq = thm "analz_insert_eq";
1.759 +val analz_subset_cong = thm "analz_subset_cong";
1.760 +val analz_cong = thm "analz_cong";
1.761 +val analz_insert_cong = thm "analz_insert_cong";
1.762 +val analz_trivial = thm "analz_trivial";
1.763 +val analz_UN_analz = thm "analz_UN_analz";
1.764 +val synth_mono = thm "synth_mono";
1.765 +val synth_increasing = thm "synth_increasing";
1.766 +val synth_Un = thm "synth_Un";
1.767 +val synth_insert = thm "synth_insert";
1.768 +val synth_synthD = thm "synth_synthD";
1.769 +val synth_trans = thm "synth_trans";
1.770 +val synth_cut = thm "synth_cut";
1.771 +val Agent_synth = thm "Agent_synth";
1.772 +val Number_synth = thm "Number_synth";
1.773 +val Nonce_synth_eq = thm "Nonce_synth_eq";
1.774 +val Key_synth_eq = thm "Key_synth_eq";
1.775 +val Crypt_synth_eq = thm "Crypt_synth_eq";
1.776 +val keysFor_synth = thm "keysFor_synth";
1.777 +val parts_synth = thm "parts_synth";
1.778 +val analz_analz_Un = thm "analz_analz_Un";
1.779 +val analz_synth_Un = thm "analz_synth_Un";
1.780 +val analz_synth = thm "analz_synth";
1.781 +val parts_insert_subset_Un = thm "parts_insert_subset_Un";
1.782 +val Fake_parts_insert = thm "Fake_parts_insert";
1.783 +val Fake_analz_insert = thm "Fake_analz_insert";
1.784 +val analz_conj_parts = thm "analz_conj_parts";
1.785 +val analz_disj_parts = thm "analz_disj_parts";
1.786 +val MPair_synth_analz = thm "MPair_synth_analz";
1.787 +val Crypt_synth_analz = thm "Crypt_synth_analz";
1.788 +val Hash_synth_analz = thm "Hash_synth_analz";
1.789 +val pushes = thms "pushes";
1.790 +
1.791 +
1.792 +(*Prove base case (subgoal i) and simplify others.  A typical base case
1.793 +  concerns  Crypt K X \<notin> Key`shrK`bad  and cannot be proved by rewriting
1.794 +  alone.*)
1.795 +fun prove_simple_subgoals_tac i =
1.796 +    force_tac (claset(), simpset() addsimps [image_eq_UN]) i THEN
1.797 +    ALLGOALS Asm_simp_tac
1.798 +
1.799 +(*Analysis of Fake cases.  Also works for messages that forward unknown parts,
1.800 +  but this application is no longer necessary if analz_insert_eq is used.
1.801 +  Abstraction over i is ESSENTIAL: it delays the dereferencing of claset
1.802 +  DEPENDS UPON "X" REFERRING TO THE FRADULENT MESSAGE *)
1.803 +
1.804 +(*Apply rules to break down assumptions of the form
1.805 +  Y \<in> parts(insert X H)  and  Y \<in> analz(insert X H)
1.806 +*)
1.807 +val Fake_insert_tac =
1.808 +    dresolve_tac [impOfSubs Fake_analz_insert,
1.809 +                  impOfSubs Fake_parts_insert] THEN'
1.810 +    eresolve_tac [asm_rl, thm"synth.Inj"];
1.811 +
1.812 +fun Fake_insert_simp_tac ss i =
1.813 +    REPEAT (Fake_insert_tac i) THEN asm_full_simp_tac ss i;
1.814 +
1.815 +fun atomic_spy_analz_tac (cs,ss) = SELECT_GOAL
1.816 +    (Fake_insert_simp_tac ss 1
1.817 +     THEN
1.818 +     IF_UNSOLVED (Blast.depth_tac
1.820 +				   impOfSubs analz_subset_parts]) 4 1))
1.821 +
1.822 +(*The explicit claset and simpset arguments help it work with Isar*)
1.823 +fun gen_spy_analz_tac (cs,ss) i =
1.824 +  DETERM
1.825 +   (SELECT_GOAL
1.826 +     (EVERY
1.827 +      [  (*push in occurrences of X...*)
1.828 +       (REPEAT o CHANGED)
1.829 +           (res_inst_tac [("x1","X")] (insert_commute RS ssubst) 1),
1.830 +       (*...allowing further simplifications*)
1.831 +       simp_tac ss 1,
1.832 +       REPEAT (FIRSTGOAL (resolve_tac [allI,impI,notI,conjI,iffI])),
1.833 +       DEPTH_SOLVE (atomic_spy_analz_tac (cs,ss) 1)]) i)
1.834 +
1.835 +fun spy_analz_tac i = gen_spy_analz_tac (claset(), simpset()) i
1.836 +*}
1.837 +
1.838 +(*By default only o_apply is built-in.  But in the presence of eta-expansion
1.839 +  this means that some terms displayed as (f o g) will be rewritten, and others
1.840 +  will not!*)
1.841 +declare o_def [simp]
1.842 +
1.843
1.844  lemma Crypt_notin_image_Key [simp]: "Crypt K X \<notin> Key ` A"
1.845  by auto
1.846 @@ -174,7 +979,7 @@
1.847  done
1.848
1.849  lemma Fake_parts_sing:
1.850 -     "X \<in> synth (analz H) ==> parts{X} \<subseteq> synth (analz H) Un parts H";
1.851 +     "X \<in> synth (analz H) ==> parts{X} \<subseteq> synth (analz H) \<union> parts H";
1.852  apply (rule subset_trans)
1.853   apply (erule_tac [2] Fake_parts_insert)