src/HOL/Auth/Message.thy
changeset 13926 6e62e5357a10
parent 13922 75ae4244a596
child 13956 8fe7e12290e1
     1.1 --- a/src/HOL/Auth/Message.thy	Sat Apr 26 12:38:17 2003 +0200
     1.2 +++ b/src/HOL/Auth/Message.thy	Sat Apr 26 12:38:42 2003 +0200
     1.3 @@ -7,11 +7,10 @@
     1.4  Inductive relations "parts", "analz" and "synth"
     1.5  *)
     1.6  
     1.7 -theory Message = Main
     1.8 -files ("Message_lemmas.ML"):
     1.9 +theory Message = Main:
    1.10  
    1.11  (*Needed occasionally with spy_analz_tac, e.g. in analz_insert_Key_newK*)
    1.12 -lemma [simp] : "A Un (B Un A) = B Un A"
    1.13 +lemma [simp] : "A \<union> (B \<union> A) = B \<union> A"
    1.14  by blast
    1.15  
    1.16  types 
    1.17 @@ -83,6 +82,238 @@
    1.18  done
    1.19  
    1.20  
    1.21 +(*Equations hold because constructors are injective; cannot prove for all f*)
    1.22 +lemma Friend_image_eq [simp]: "(Friend x \<in> Friend`A) = (x:A)"
    1.23 +by auto
    1.24 +
    1.25 +lemma Key_image_eq [simp]: "(Key x \<in> Key`A) = (x\<in>A)"
    1.26 +by auto
    1.27 +
    1.28 +lemma Nonce_Key_image_eq [simp]: "(Nonce x \<notin> Key`A)"
    1.29 +by auto
    1.30 +
    1.31 +
    1.32 +(** Inverse of keys **)
    1.33 +
    1.34 +lemma invKey_eq [simp]: "(invKey K = invKey K') = (K=K')"
    1.35 +apply safe
    1.36 +apply (drule_tac f = invKey in arg_cong, simp)
    1.37 +done
    1.38 +
    1.39 +
    1.40 +subsection{*keysFor operator*}
    1.41 +
    1.42 +lemma keysFor_empty [simp]: "keysFor {} = {}"
    1.43 +by (unfold keysFor_def, blast)
    1.44 +
    1.45 +lemma keysFor_Un [simp]: "keysFor (H \<union> H') = keysFor H \<union> keysFor H'"
    1.46 +by (unfold keysFor_def, blast)
    1.47 +
    1.48 +lemma keysFor_UN [simp]: "keysFor (\<Union>i\<in>A. H i) = (\<Union>i\<in>A. keysFor (H i))"
    1.49 +by (unfold keysFor_def, blast)
    1.50 +
    1.51 +(*Monotonicity*)
    1.52 +lemma keysFor_mono: "G\<subseteq>H ==> keysFor(G) \<subseteq> keysFor(H)"
    1.53 +by (unfold keysFor_def, blast)
    1.54 +
    1.55 +lemma keysFor_insert_Agent [simp]: "keysFor (insert (Agent A) H) = keysFor H"
    1.56 +by (unfold keysFor_def, auto)
    1.57 +
    1.58 +lemma keysFor_insert_Nonce [simp]: "keysFor (insert (Nonce N) H) = keysFor H"
    1.59 +by (unfold keysFor_def, auto)
    1.60 +
    1.61 +lemma keysFor_insert_Number [simp]: "keysFor (insert (Number N) H) = keysFor H"
    1.62 +by (unfold keysFor_def, auto)
    1.63 +
    1.64 +lemma keysFor_insert_Key [simp]: "keysFor (insert (Key K) H) = keysFor H"
    1.65 +by (unfold keysFor_def, auto)
    1.66 +
    1.67 +lemma keysFor_insert_Hash [simp]: "keysFor (insert (Hash X) H) = keysFor H"
    1.68 +by (unfold keysFor_def, auto)
    1.69 +
    1.70 +lemma keysFor_insert_MPair [simp]: "keysFor (insert {|X,Y|} H) = keysFor H"
    1.71 +by (unfold keysFor_def, auto)
    1.72 +
    1.73 +lemma keysFor_insert_Crypt [simp]: 
    1.74 +    "keysFor (insert (Crypt K X) H) = insert (invKey K) (keysFor H)"
    1.75 +apply (unfold keysFor_def, auto)
    1.76 +done
    1.77 +
    1.78 +lemma keysFor_image_Key [simp]: "keysFor (Key`E) = {}"
    1.79 +by (unfold keysFor_def, auto)
    1.80 +
    1.81 +lemma Crypt_imp_invKey_keysFor: "Crypt K X \<in> H ==> invKey K \<in> keysFor H"
    1.82 +by (unfold keysFor_def, blast)
    1.83 +
    1.84 +
    1.85 +subsection{*Inductive relation "parts"*}
    1.86 +
    1.87 +lemma MPair_parts:
    1.88 +     "[| {|X,Y|} \<in> parts H;        
    1.89 +         [| X \<in> parts H; Y \<in> parts H |] ==> P |] ==> P"
    1.90 +by (blast dest: parts.Fst parts.Snd) 
    1.91 +
    1.92 +declare MPair_parts [elim!]  parts.Body [dest!]
    1.93 +text{*NB These two rules are UNSAFE in the formal sense, as they discard the
    1.94 +     compound message.  They work well on THIS FILE.  
    1.95 +  @{text MPair_parts} is left as SAFE because it speeds up proofs.
    1.96 +  The Crypt rule is normally kept UNSAFE to avoid breaking up certificates.*}
    1.97 +
    1.98 +lemma parts_increasing: "H \<subseteq> parts(H)"
    1.99 +by blast
   1.100 +
   1.101 +lemmas parts_insertI = subset_insertI [THEN parts_mono, THEN subsetD, standard]
   1.102 +
   1.103 +lemma parts_empty [simp]: "parts{} = {}"
   1.104 +apply safe
   1.105 +apply (erule parts.induct, blast+)
   1.106 +done
   1.107 +
   1.108 +lemma parts_emptyE [elim!]: "X\<in> parts{} ==> P"
   1.109 +by simp
   1.110 +
   1.111 +(*WARNING: loops if H = {Y}, therefore must not be repeated!*)
   1.112 +lemma parts_singleton: "X\<in> parts H ==> \<exists>Y\<in>H. X\<in> parts {Y}"
   1.113 +by (erule parts.induct, blast+)
   1.114 +
   1.115 +
   1.116 +(** Unions **)
   1.117 +
   1.118 +lemma parts_Un_subset1: "parts(G) \<union> parts(H) \<subseteq> parts(G \<union> H)"
   1.119 +by (intro Un_least parts_mono Un_upper1 Un_upper2)
   1.120 +
   1.121 +lemma parts_Un_subset2: "parts(G \<union> H) \<subseteq> parts(G) \<union> parts(H)"
   1.122 +apply (rule subsetI)
   1.123 +apply (erule parts.induct, blast+)
   1.124 +done
   1.125 +
   1.126 +lemma parts_Un [simp]: "parts(G \<union> H) = parts(G) \<union> parts(H)"
   1.127 +by (intro equalityI parts_Un_subset1 parts_Un_subset2)
   1.128 +
   1.129 +lemma parts_insert: "parts (insert X H) = parts {X} \<union> parts H"
   1.130 +apply (subst insert_is_Un [of _ H])
   1.131 +apply (simp only: parts_Un)
   1.132 +done
   1.133 +
   1.134 +(*TWO inserts to avoid looping.  This rewrite is better than nothing.
   1.135 +  Not suitable for Addsimps: its behaviour can be strange.*)
   1.136 +lemma parts_insert2: "parts (insert X (insert Y H)) = parts {X} \<union> parts {Y} \<union> parts H"
   1.137 +apply (simp add: Un_assoc)
   1.138 +apply (simp add: parts_insert [symmetric])
   1.139 +done
   1.140 +
   1.141 +lemma parts_UN_subset1: "(\<Union>x\<in>A. parts(H x)) \<subseteq> parts(\<Union>x\<in>A. H x)"
   1.142 +by (intro UN_least parts_mono UN_upper)
   1.143 +
   1.144 +lemma parts_UN_subset2: "parts(\<Union>x\<in>A. H x) \<subseteq> (\<Union>x\<in>A. parts(H x))"
   1.145 +apply (rule subsetI)
   1.146 +apply (erule parts.induct, blast+)
   1.147 +done
   1.148 +
   1.149 +lemma parts_UN [simp]: "parts(\<Union>x\<in>A. H x) = (\<Union>x\<in>A. parts(H x))"
   1.150 +by (intro equalityI parts_UN_subset1 parts_UN_subset2)
   1.151 +
   1.152 +(*Added to simplify arguments to parts, analz and synth.
   1.153 +  NOTE: the UN versions are no longer used!*)
   1.154 +
   1.155 +
   1.156 +text{*This allows @{text blast} to simplify occurrences of 
   1.157 +  @{term "parts(G\<union>H)"} in the assumption.*}
   1.158 +declare parts_Un [THEN equalityD1, THEN subsetD, THEN UnE, elim!] 
   1.159 +
   1.160 +
   1.161 +lemma parts_insert_subset: "insert X (parts H) \<subseteq> parts(insert X H)"
   1.162 +by (blast intro: parts_mono [THEN [2] rev_subsetD])
   1.163 +
   1.164 +(** Idempotence and transitivity **)
   1.165 +
   1.166 +lemma parts_partsD [dest!]: "X\<in> parts (parts H) ==> X\<in> parts H"
   1.167 +by (erule parts.induct, blast+)
   1.168 +
   1.169 +lemma parts_idem [simp]: "parts (parts H) = parts H"
   1.170 +by blast
   1.171 +
   1.172 +lemma parts_trans: "[| X\<in> parts G;  G \<subseteq> parts H |] ==> X\<in> parts H"
   1.173 +by (drule parts_mono, blast)
   1.174 +
   1.175 +(*Cut*)
   1.176 +lemma parts_cut: "[| Y\<in> parts (insert X G);  X\<in> parts H |]  
   1.177 +               ==> Y\<in> parts (G \<union> H)"
   1.178 +apply (erule parts_trans, auto)
   1.179 +done
   1.180 +
   1.181 +lemma parts_cut_eq [simp]: "X\<in> parts H ==> parts (insert X H) = parts H"
   1.182 +by (force dest!: parts_cut intro: parts_insertI)
   1.183 +
   1.184 +
   1.185 +(** Rewrite rules for pulling out atomic messages **)
   1.186 +
   1.187 +lemmas parts_insert_eq_I = equalityI [OF subsetI parts_insert_subset]
   1.188 +
   1.189 +
   1.190 +lemma parts_insert_Agent [simp]: "parts (insert (Agent agt) H) = insert (Agent agt) (parts H)"
   1.191 +apply (rule parts_insert_eq_I) 
   1.192 +apply (erule parts.induct, auto) 
   1.193 +done
   1.194 +
   1.195 +lemma parts_insert_Nonce [simp]: "parts (insert (Nonce N) H) = insert (Nonce N) (parts H)"
   1.196 +apply (rule parts_insert_eq_I) 
   1.197 +apply (erule parts.induct, auto) 
   1.198 +done
   1.199 +
   1.200 +lemma parts_insert_Number [simp]: "parts (insert (Number N) H) = insert (Number N) (parts H)"
   1.201 +apply (rule parts_insert_eq_I) 
   1.202 +apply (erule parts.induct, auto) 
   1.203 +done
   1.204 +
   1.205 +lemma parts_insert_Key [simp]: "parts (insert (Key K) H) = insert (Key K) (parts H)"
   1.206 +apply (rule parts_insert_eq_I) 
   1.207 +apply (erule parts.induct, auto) 
   1.208 +done
   1.209 +
   1.210 +lemma parts_insert_Hash [simp]: "parts (insert (Hash X) H) = insert (Hash X) (parts H)"
   1.211 +apply (rule parts_insert_eq_I) 
   1.212 +apply (erule parts.induct, auto) 
   1.213 +done
   1.214 +
   1.215 +lemma parts_insert_Crypt [simp]: "parts (insert (Crypt K X) H) =  
   1.216 +          insert (Crypt K X) (parts (insert X H))"
   1.217 +apply (rule equalityI)
   1.218 +apply (rule subsetI)
   1.219 +apply (erule parts.induct, auto)
   1.220 +apply (erule parts.induct)
   1.221 +apply (blast intro: parts.Body)+
   1.222 +done
   1.223 +
   1.224 +lemma parts_insert_MPair [simp]: "parts (insert {|X,Y|} H) =  
   1.225 +          insert {|X,Y|} (parts (insert X (insert Y H)))"
   1.226 +apply (rule equalityI)
   1.227 +apply (rule subsetI)
   1.228 +apply (erule parts.induct, auto)
   1.229 +apply (erule parts.induct)
   1.230 +apply (blast intro: parts.Fst parts.Snd)+
   1.231 +done
   1.232 +
   1.233 +lemma parts_image_Key [simp]: "parts (Key`N) = Key`N"
   1.234 +apply auto
   1.235 +apply (erule parts.induct, auto)
   1.236 +done
   1.237 +
   1.238 +
   1.239 +(*In any message, there is an upper bound N on its greatest nonce.*)
   1.240 +lemma msg_Nonce_supply: "\<exists>N. \<forall>n. N\<le>n --> Nonce n \<notin> parts {msg}"
   1.241 +apply (induct_tac "msg")
   1.242 +apply (simp_all (no_asm_simp) add: exI parts_insert2)
   1.243 +(*MPair case: blast_tac works out the necessary sum itself!*)
   1.244 +prefer 2 apply (blast elim!: add_leE)
   1.245 +(*Nonce case*)
   1.246 +apply (rule_tac x = "N + Suc nat" in exI)
   1.247 +apply (auto elim!: add_leE)
   1.248 +done
   1.249 +
   1.250 +
   1.251 +subsection{*Inductive relation "analz"*}
   1.252 +
   1.253  (** Inductive definition of "analz" -- what can be broken down from a set of
   1.254      messages, including keys.  A form of downward closure.  Pairs can
   1.255      be taken apart; messages decrypted with known keys.  **)
   1.256 @@ -104,6 +335,211 @@
   1.257  apply (auto dest: Fst Snd) 
   1.258  done
   1.259  
   1.260 +text{*Making it safe speeds up proofs*}
   1.261 +lemma MPair_analz [elim!]:
   1.262 +     "[| {|X,Y|} \<in> analz H;        
   1.263 +             [| X \<in> analz H; Y \<in> analz H |] ==> P   
   1.264 +          |] ==> P"
   1.265 +by (blast dest: analz.Fst analz.Snd)
   1.266 +
   1.267 +lemma analz_increasing: "H \<subseteq> analz(H)"
   1.268 +by blast
   1.269 +
   1.270 +lemma analz_subset_parts: "analz H \<subseteq> parts H"
   1.271 +apply (rule subsetI)
   1.272 +apply (erule analz.induct, blast+)
   1.273 +done
   1.274 +
   1.275 +lemmas not_parts_not_analz = analz_subset_parts [THEN contra_subsetD, standard]
   1.276 +
   1.277 +
   1.278 +lemma parts_analz [simp]: "parts (analz H) = parts H"
   1.279 +apply (rule equalityI)
   1.280 +apply (rule analz_subset_parts [THEN parts_mono, THEN subset_trans], simp)
   1.281 +apply (blast intro: analz_increasing [THEN parts_mono, THEN subsetD])
   1.282 +done
   1.283 +
   1.284 +lemma analz_parts [simp]: "analz (parts H) = parts H"
   1.285 +apply auto
   1.286 +apply (erule analz.induct, auto)
   1.287 +done
   1.288 +
   1.289 +lemmas analz_insertI = subset_insertI [THEN analz_mono, THEN [2] rev_subsetD, standard]
   1.290 +
   1.291 +(** General equational properties **)
   1.292 +
   1.293 +lemma analz_empty [simp]: "analz{} = {}"
   1.294 +apply safe
   1.295 +apply (erule analz.induct, blast+)
   1.296 +done
   1.297 +
   1.298 +(*Converse fails: we can analz more from the union than from the 
   1.299 +  separate parts, as a key in one might decrypt a message in the other*)
   1.300 +lemma analz_Un: "analz(G) \<union> analz(H) \<subseteq> analz(G \<union> H)"
   1.301 +by (intro Un_least analz_mono Un_upper1 Un_upper2)
   1.302 +
   1.303 +lemma analz_insert: "insert X (analz H) \<subseteq> analz(insert X H)"
   1.304 +by (blast intro: analz_mono [THEN [2] rev_subsetD])
   1.305 +
   1.306 +(** Rewrite rules for pulling out atomic messages **)
   1.307 +
   1.308 +lemmas analz_insert_eq_I = equalityI [OF subsetI analz_insert]
   1.309 +
   1.310 +lemma analz_insert_Agent [simp]: "analz (insert (Agent agt) H) = insert (Agent agt) (analz H)"
   1.311 +apply (rule analz_insert_eq_I) 
   1.312 +apply (erule analz.induct, auto) 
   1.313 +done
   1.314 +
   1.315 +lemma analz_insert_Nonce [simp]: "analz (insert (Nonce N) H) = insert (Nonce N) (analz H)"
   1.316 +apply (rule analz_insert_eq_I) 
   1.317 +apply (erule analz.induct, auto) 
   1.318 +done
   1.319 +
   1.320 +lemma analz_insert_Number [simp]: "analz (insert (Number N) H) = insert (Number N) (analz H)"
   1.321 +apply (rule analz_insert_eq_I) 
   1.322 +apply (erule analz.induct, auto) 
   1.323 +done
   1.324 +
   1.325 +lemma analz_insert_Hash [simp]: "analz (insert (Hash X) H) = insert (Hash X) (analz H)"
   1.326 +apply (rule analz_insert_eq_I) 
   1.327 +apply (erule analz.induct, auto) 
   1.328 +done
   1.329 +
   1.330 +(*Can only pull out Keys if they are not needed to decrypt the rest*)
   1.331 +lemma analz_insert_Key [simp]: 
   1.332 +    "K \<notin> keysFor (analz H) ==>   
   1.333 +          analz (insert (Key K) H) = insert (Key K) (analz H)"
   1.334 +apply (unfold keysFor_def)
   1.335 +apply (rule analz_insert_eq_I) 
   1.336 +apply (erule analz.induct, auto) 
   1.337 +done
   1.338 +
   1.339 +lemma analz_insert_MPair [simp]: "analz (insert {|X,Y|} H) =  
   1.340 +          insert {|X,Y|} (analz (insert X (insert Y H)))"
   1.341 +apply (rule equalityI)
   1.342 +apply (rule subsetI)
   1.343 +apply (erule analz.induct, auto)
   1.344 +apply (erule analz.induct)
   1.345 +apply (blast intro: analz.Fst analz.Snd)+
   1.346 +done
   1.347 +
   1.348 +(*Can pull out enCrypted message if the Key is not known*)
   1.349 +lemma analz_insert_Crypt:
   1.350 +     "Key (invKey K) \<notin> analz H 
   1.351 +      ==> analz (insert (Crypt K X) H) = insert (Crypt K X) (analz H)"
   1.352 +apply (rule analz_insert_eq_I) 
   1.353 +apply (erule analz.induct, auto) 
   1.354 +
   1.355 +done
   1.356 +
   1.357 +lemma lemma1: "Key (invKey K) \<in> analz H ==>   
   1.358 +               analz (insert (Crypt K X) H) \<subseteq>  
   1.359 +               insert (Crypt K X) (analz (insert X H))"
   1.360 +apply (rule subsetI)
   1.361 +apply (erule_tac xa = x in analz.induct, auto)
   1.362 +done
   1.363 +
   1.364 +lemma lemma2: "Key (invKey K) \<in> analz H ==>   
   1.365 +               insert (Crypt K X) (analz (insert X H)) \<subseteq>  
   1.366 +               analz (insert (Crypt K X) H)"
   1.367 +apply auto
   1.368 +apply (erule_tac xa = x in analz.induct, auto)
   1.369 +apply (blast intro: analz_insertI analz.Decrypt)
   1.370 +done
   1.371 +
   1.372 +lemma analz_insert_Decrypt: "Key (invKey K) \<in> analz H ==>   
   1.373 +               analz (insert (Crypt K X) H) =  
   1.374 +               insert (Crypt K X) (analz (insert X H))"
   1.375 +by (intro equalityI lemma1 lemma2)
   1.376 +
   1.377 +(*Case analysis: either the message is secure, or it is not!
   1.378 +  Effective, but can cause subgoals to blow up!
   1.379 +  Use with split_if;  apparently split_tac does not cope with patterns
   1.380 +  such as "analz (insert (Crypt K X) H)" *)
   1.381 +lemma analz_Crypt_if [simp]:
   1.382 +     "analz (insert (Crypt K X) H) =                 
   1.383 +          (if (Key (invKey K) \<in> analz H)                 
   1.384 +           then insert (Crypt K X) (analz (insert X H))  
   1.385 +           else insert (Crypt K X) (analz H))"
   1.386 +by (simp add: analz_insert_Crypt analz_insert_Decrypt)
   1.387 +
   1.388 +
   1.389 +(*This rule supposes "for the sake of argument" that we have the key.*)
   1.390 +lemma analz_insert_Crypt_subset: "analz (insert (Crypt K X) H) \<subseteq>   
   1.391 +           insert (Crypt K X) (analz (insert X H))"
   1.392 +apply (rule subsetI)
   1.393 +apply (erule analz.induct, auto)
   1.394 +done
   1.395 +
   1.396 +
   1.397 +lemma analz_image_Key [simp]: "analz (Key`N) = Key`N"
   1.398 +apply auto
   1.399 +apply (erule analz.induct, auto)
   1.400 +done
   1.401 +
   1.402 +
   1.403 +(** Idempotence and transitivity **)
   1.404 +
   1.405 +lemma analz_analzD [dest!]: "X\<in> analz (analz H) ==> X\<in> analz H"
   1.406 +by (erule analz.induct, blast+)
   1.407 +
   1.408 +lemma analz_idem [simp]: "analz (analz H) = analz H"
   1.409 +by blast
   1.410 +
   1.411 +lemma analz_trans: "[| X\<in> analz G;  G \<subseteq> analz H |] ==> X\<in> analz H"
   1.412 +by (drule analz_mono, blast)
   1.413 +
   1.414 +(*Cut; Lemma 2 of Lowe*)
   1.415 +lemma analz_cut: "[| Y\<in> analz (insert X H);  X\<in> analz H |] ==> Y\<in> analz H"
   1.416 +by (erule analz_trans, blast)
   1.417 +
   1.418 +(*Cut can be proved easily by induction on
   1.419 +   "Y: analz (insert X H) ==> X: analz H --> Y: analz H"
   1.420 +*)
   1.421 +
   1.422 +(*This rewrite rule helps in the simplification of messages that involve
   1.423 +  the forwarding of unknown components (X).  Without it, removing occurrences
   1.424 +  of X can be very complicated. *)
   1.425 +lemma analz_insert_eq: "X\<in> analz H ==> analz (insert X H) = analz H"
   1.426 +by (blast intro: analz_cut analz_insertI)
   1.427 +
   1.428 +
   1.429 +(** A congruence rule for "analz" **)
   1.430 +
   1.431 +lemma analz_subset_cong: "[| analz G \<subseteq> analz G'; analz H \<subseteq> analz H'  
   1.432 +               |] ==> analz (G \<union> H) \<subseteq> analz (G' \<union> H')"
   1.433 +apply clarify
   1.434 +apply (erule analz.induct)
   1.435 +apply (best intro: analz_mono [THEN subsetD])+
   1.436 +done
   1.437 +
   1.438 +lemma analz_cong: "[| analz G = analz G'; analz H = analz H'  
   1.439 +               |] ==> analz (G \<union> H) = analz (G' \<union> H')"
   1.440 +apply (intro equalityI analz_subset_cong, simp_all) 
   1.441 +done
   1.442 +
   1.443 +
   1.444 +lemma analz_insert_cong: "analz H = analz H' ==> analz(insert X H) = analz(insert X H')"
   1.445 +by (force simp only: insert_def intro!: analz_cong)
   1.446 +
   1.447 +(*If there are no pairs or encryptions then analz does nothing*)
   1.448 +lemma analz_trivial: "[| \<forall>X Y. {|X,Y|} \<notin> H;  \<forall>X K. Crypt K X \<notin> H |] ==> analz H = H"
   1.449 +apply safe
   1.450 +apply (erule analz.induct, blast+)
   1.451 +done
   1.452 +
   1.453 +(*These two are obsolete (with a single Spy) but cost little to prove...*)
   1.454 +lemma analz_UN_analz_lemma: "X\<in> analz (\<Union>i\<in>A. analz (H i)) ==> X\<in> analz (\<Union>i\<in>A. H i)"
   1.455 +apply (erule analz.induct)
   1.456 +apply (blast intro: analz_mono [THEN [2] rev_subsetD])+
   1.457 +done
   1.458 +
   1.459 +lemma analz_UN_analz [simp]: "analz (\<Union>i\<in>A. analz (H i)) = analz (\<Union>i\<in>A. H i)"
   1.460 +by (blast intro: analz_UN_analz_lemma analz_mono [THEN [2] rev_subsetD])
   1.461 +
   1.462 +
   1.463 +subsection{*Inductive relation "synth"*}
   1.464 +
   1.465  (** Inductive definition of "synth" -- what can be built up from a set of
   1.466      messages.  A form of upward closure.  Pairs can be built, messages
   1.467      encrypted with known keys.  Agent names are public domain.
   1.468 @@ -133,7 +569,376 @@
   1.469  inductive_cases MPair_synth [elim!]: "{|X,Y|} \<in> synth H"
   1.470  inductive_cases Crypt_synth [elim!]: "Crypt K X \<in> synth H"
   1.471  
   1.472 -use "Message_lemmas.ML"
   1.473 +
   1.474 +lemma synth_increasing: "H \<subseteq> synth(H)"
   1.475 +by blast
   1.476 +
   1.477 +(** Unions **)
   1.478 +
   1.479 +(*Converse fails: we can synth more from the union than from the 
   1.480 +  separate parts, building a compound message using elements of each.*)
   1.481 +lemma synth_Un: "synth(G) \<union> synth(H) \<subseteq> synth(G \<union> H)"
   1.482 +by (intro Un_least synth_mono Un_upper1 Un_upper2)
   1.483 +
   1.484 +lemma synth_insert: "insert X (synth H) \<subseteq> synth(insert X H)"
   1.485 +by (blast intro: synth_mono [THEN [2] rev_subsetD])
   1.486 +
   1.487 +(** Idempotence and transitivity **)
   1.488 +
   1.489 +lemma synth_synthD [dest!]: "X\<in> synth (synth H) ==> X\<in> synth H"
   1.490 +by (erule synth.induct, blast+)
   1.491 +
   1.492 +lemma synth_idem: "synth (synth H) = synth H"
   1.493 +by blast
   1.494 +
   1.495 +lemma synth_trans: "[| X\<in> synth G;  G \<subseteq> synth H |] ==> X\<in> synth H"
   1.496 +by (drule synth_mono, blast)
   1.497 +
   1.498 +(*Cut; Lemma 2 of Lowe*)
   1.499 +lemma synth_cut: "[| Y\<in> synth (insert X H);  X\<in> synth H |] ==> Y\<in> synth H"
   1.500 +by (erule synth_trans, blast)
   1.501 +
   1.502 +lemma Agent_synth [simp]: "Agent A \<in> synth H"
   1.503 +by blast
   1.504 +
   1.505 +lemma Number_synth [simp]: "Number n \<in> synth H"
   1.506 +by blast
   1.507 +
   1.508 +lemma Nonce_synth_eq [simp]: "(Nonce N \<in> synth H) = (Nonce N \<in> H)"
   1.509 +by blast
   1.510 +
   1.511 +lemma Key_synth_eq [simp]: "(Key K \<in> synth H) = (Key K \<in> H)"
   1.512 +by blast
   1.513 +
   1.514 +lemma Crypt_synth_eq [simp]: "Key K \<notin> H ==> (Crypt K X \<in> synth H) = (Crypt K X \<in> H)"
   1.515 +by blast
   1.516 +
   1.517 +
   1.518 +lemma keysFor_synth [simp]: 
   1.519 +    "keysFor (synth H) = keysFor H \<union> invKey`{K. Key K \<in> H}"
   1.520 +apply (unfold keysFor_def, blast)
   1.521 +done
   1.522 +
   1.523 +
   1.524 +(*** Combinations of parts, analz and synth ***)
   1.525 +
   1.526 +lemma parts_synth [simp]: "parts (synth H) = parts H \<union> synth H"
   1.527 +apply (rule equalityI)
   1.528 +apply (rule subsetI)
   1.529 +apply (erule parts.induct)
   1.530 +apply (blast intro: synth_increasing [THEN parts_mono, THEN subsetD] 
   1.531 +                    parts.Fst parts.Snd parts.Body)+
   1.532 +done
   1.533 +
   1.534 +lemma analz_analz_Un [simp]: "analz (analz G \<union> H) = analz (G \<union> H)"
   1.535 +apply (intro equalityI analz_subset_cong)+
   1.536 +apply simp_all
   1.537 +done
   1.538 +
   1.539 +lemma analz_synth_Un [simp]: "analz (synth G \<union> H) = analz (G \<union> H) \<union> synth G"
   1.540 +apply (rule equalityI)
   1.541 +apply (rule subsetI)
   1.542 +apply (erule analz.induct)
   1.543 +prefer 5 apply (blast intro: analz_mono [THEN [2] rev_subsetD])
   1.544 +apply (blast intro: analz.Fst analz.Snd analz.Decrypt)+
   1.545 +done
   1.546 +
   1.547 +lemma analz_synth [simp]: "analz (synth H) = analz H \<union> synth H"
   1.548 +apply (cut_tac H = "{}" in analz_synth_Un)
   1.549 +apply (simp (no_asm_use))
   1.550 +done
   1.551 +
   1.552 +
   1.553 +(** For reasoning about the Fake rule in traces **)
   1.554 +
   1.555 +lemma parts_insert_subset_Un: "X\<in> G ==> parts(insert X H) \<subseteq> parts G \<union> parts H"
   1.556 +by (rule subset_trans [OF parts_mono parts_Un_subset2], blast)
   1.557 +
   1.558 +(*More specifically for Fake.  Very occasionally we could do with a version
   1.559 +  of the form  parts{X} \<subseteq> synth (analz H) \<union> parts H *)
   1.560 +lemma Fake_parts_insert: "X \<in> synth (analz H) ==>  
   1.561 +      parts (insert X H) \<subseteq> synth (analz H) \<union> parts H"
   1.562 +apply (drule parts_insert_subset_Un)
   1.563 +apply (simp (no_asm_use))
   1.564 +apply blast
   1.565 +done
   1.566 +
   1.567 +(*H is sometimes (Key ` KK \<union> spies evs), so can't put G=H*)
   1.568 +lemma Fake_analz_insert: "X\<in> synth (analz G) ==>  
   1.569 +      analz (insert X H) \<subseteq> synth (analz G) \<union> analz (G \<union> H)"
   1.570 +apply (rule subsetI)
   1.571 +apply (subgoal_tac "x \<in> analz (synth (analz G) \<union> H) ")
   1.572 +prefer 2 apply (blast intro: analz_mono [THEN [2] rev_subsetD] analz_mono [THEN synth_mono, THEN [2] rev_subsetD])
   1.573 +apply (simp (no_asm_use))
   1.574 +apply blast
   1.575 +done
   1.576 +
   1.577 +lemma analz_conj_parts [simp]: "(X \<in> analz H & X \<in> parts H) = (X \<in> analz H)"
   1.578 +by (blast intro: analz_subset_parts [THEN [2] rev_subsetD])
   1.579 +
   1.580 +lemma analz_disj_parts [simp]: "(X \<in> analz H | X \<in> parts H) = (X \<in> parts H)"
   1.581 +by (blast intro: analz_subset_parts [THEN [2] rev_subsetD])
   1.582 +
   1.583 +(*Without this equation, other rules for synth and analz would yield
   1.584 +  redundant cases*)
   1.585 +lemma MPair_synth_analz [iff]:
   1.586 +     "({|X,Y|} \<in> synth (analz H)) =  
   1.587 +      (X \<in> synth (analz H) & Y \<in> synth (analz H))"
   1.588 +by blast
   1.589 +
   1.590 +lemma Crypt_synth_analz: "[| Key K \<in> analz H;  Key (invKey K) \<in> analz H |]  
   1.591 +       ==> (Crypt K X \<in> synth (analz H)) = (X \<in> synth (analz H))"
   1.592 +by blast
   1.593 +
   1.594 +
   1.595 +lemma Hash_synth_analz [simp]: "X \<notin> synth (analz H)  
   1.596 +      ==> (Hash{|X,Y|} \<in> synth (analz H)) = (Hash{|X,Y|} \<in> analz H)"
   1.597 +by blast
   1.598 +
   1.599 +
   1.600 +subsection{*HPair: a combination of Hash and MPair*}
   1.601 +
   1.602 +(*** Freeness ***)
   1.603 +
   1.604 +lemma Agent_neq_HPair: "Agent A ~= Hash[X] Y"
   1.605 +by (unfold HPair_def, simp)
   1.606 +
   1.607 +lemma Nonce_neq_HPair: "Nonce N ~= Hash[X] Y"
   1.608 +by (unfold HPair_def, simp)
   1.609 +
   1.610 +lemma Number_neq_HPair: "Number N ~= Hash[X] Y"
   1.611 +by (unfold HPair_def, simp)
   1.612 +
   1.613 +lemma Key_neq_HPair: "Key K ~= Hash[X] Y"
   1.614 +by (unfold HPair_def, simp)
   1.615 +
   1.616 +lemma Hash_neq_HPair: "Hash Z ~= Hash[X] Y"
   1.617 +by (unfold HPair_def, simp)
   1.618 +
   1.619 +lemma Crypt_neq_HPair: "Crypt K X' ~= Hash[X] Y"
   1.620 +by (unfold HPair_def, simp)
   1.621 +
   1.622 +lemmas HPair_neqs = Agent_neq_HPair Nonce_neq_HPair Number_neq_HPair 
   1.623 +                    Key_neq_HPair Hash_neq_HPair Crypt_neq_HPair
   1.624 +
   1.625 +declare HPair_neqs [iff]
   1.626 +declare HPair_neqs [symmetric, iff]
   1.627 +
   1.628 +lemma HPair_eq [iff]: "(Hash[X'] Y' = Hash[X] Y) = (X' = X & Y'=Y)"
   1.629 +by (simp add: HPair_def)
   1.630 +
   1.631 +lemma MPair_eq_HPair [iff]: "({|X',Y'|} = Hash[X] Y) = (X' = Hash{|X,Y|} & Y'=Y)"
   1.632 +by (simp add: HPair_def)
   1.633 +
   1.634 +lemma HPair_eq_MPair [iff]: "(Hash[X] Y = {|X',Y'|}) = (X' = Hash{|X,Y|} & Y'=Y)"
   1.635 +by (auto simp add: HPair_def)
   1.636 +
   1.637 +
   1.638 +(*** Specialized laws, proved in terms of those for Hash and MPair ***)
   1.639 +
   1.640 +lemma keysFor_insert_HPair [simp]: "keysFor (insert (Hash[X] Y) H) = keysFor H"
   1.641 +by (simp add: HPair_def)
   1.642 +
   1.643 +lemma parts_insert_HPair [simp]: 
   1.644 +    "parts (insert (Hash[X] Y) H) =  
   1.645 +     insert (Hash[X] Y) (insert (Hash{|X,Y|}) (parts (insert Y H)))"
   1.646 +by (simp add: HPair_def)
   1.647 +
   1.648 +lemma analz_insert_HPair [simp]: 
   1.649 +    "analz (insert (Hash[X] Y) H) =  
   1.650 +     insert (Hash[X] Y) (insert (Hash{|X,Y|}) (analz (insert Y H)))"
   1.651 +by (simp add: HPair_def)
   1.652 +
   1.653 +lemma HPair_synth_analz [simp]:
   1.654 +     "X \<notin> synth (analz H)  
   1.655 +    ==> (Hash[X] Y \<in> synth (analz H)) =  
   1.656 +        (Hash {|X, Y|} \<in> analz H & Y \<in> synth (analz H))"
   1.657 +by (simp add: HPair_def)
   1.658 +
   1.659 +
   1.660 +(*We do NOT want Crypt... messages broken up in protocols!!*)
   1.661 +declare parts.Body [rule del]
   1.662 +
   1.663 +
   1.664 +ML
   1.665 +{*
   1.666 +(*ML bindings for definitions and axioms*)
   1.667 +
   1.668 +val invKey = thm "invKey"
   1.669 +val keysFor_def = thm "keysFor_def"
   1.670 +val HPair_def = thm "HPair_def"
   1.671 +val symKeys_def = thm "symKeys_def"
   1.672 +
   1.673 +structure parts =
   1.674 +  struct
   1.675 +  val induct = thm "parts.induct"
   1.676 +  val Inj    = thm "parts.Inj"
   1.677 +  val Fst    = thm "parts.Fst"
   1.678 +  val Snd    = thm "parts.Snd"
   1.679 +  val Body   = thm "parts.Body"
   1.680 +  end
   1.681 +
   1.682 +structure analz =
   1.683 +  struct
   1.684 +  val induct = thm "analz.induct"
   1.685 +  val Inj    = thm "analz.Inj"
   1.686 +  val Fst    = thm "analz.Fst"
   1.687 +  val Snd    = thm "analz.Snd"
   1.688 +  val Decrypt = thm "analz.Decrypt"
   1.689 +  end
   1.690 +
   1.691 +
   1.692 +(** Rewrites to push in Key and Crypt messages, so that other messages can
   1.693 +    be pulled out using the analz_insert rules **)
   1.694 +
   1.695 +fun insComm x y = inst "x" x (inst "y" y insert_commute);
   1.696 +
   1.697 +bind_thms ("pushKeys",
   1.698 +           map (insComm "Key ?K") 
   1.699 +                   ["Agent ?C", "Nonce ?N", "Number ?N", 
   1.700 +		    "Hash ?X", "MPair ?X ?Y", "Crypt ?X ?K'"]);
   1.701 +
   1.702 +bind_thms ("pushCrypts",
   1.703 +           map (insComm "Crypt ?X ?K") 
   1.704 +                     ["Agent ?C", "Nonce ?N", "Number ?N", 
   1.705 +		      "Hash ?X'", "MPair ?X' ?Y"]);
   1.706 +*}
   1.707 +
   1.708 +text{*Cannot be added with @{text "[simp]"} -- messages should not always be
   1.709 +  re-ordered. *}
   1.710 +lemmas pushes = pushKeys pushCrypts
   1.711 +
   1.712 +
   1.713 +subsection{*Tactics useful for many protocol proofs*}
   1.714 +ML
   1.715 +{*
   1.716 +val parts_mono = thm "parts_mono";
   1.717 +val analz_mono = thm "analz_mono";
   1.718 +val Key_image_eq = thm "Key_image_eq";
   1.719 +val Nonce_Key_image_eq = thm "Nonce_Key_image_eq";
   1.720 +val keysFor_Un = thm "keysFor_Un";
   1.721 +val keysFor_mono = thm "keysFor_mono";
   1.722 +val keysFor_image_Key = thm "keysFor_image_Key";
   1.723 +val Crypt_imp_invKey_keysFor = thm "Crypt_imp_invKey_keysFor";
   1.724 +val MPair_parts = thm "MPair_parts";
   1.725 +val parts_increasing = thm "parts_increasing";
   1.726 +val parts_insertI = thm "parts_insertI";
   1.727 +val parts_empty = thm "parts_empty";
   1.728 +val parts_emptyE = thm "parts_emptyE";
   1.729 +val parts_singleton = thm "parts_singleton";
   1.730 +val parts_Un_subset1 = thm "parts_Un_subset1";
   1.731 +val parts_Un_subset2 = thm "parts_Un_subset2";
   1.732 +val parts_insert = thm "parts_insert";
   1.733 +val parts_insert2 = thm "parts_insert2";
   1.734 +val parts_UN_subset1 = thm "parts_UN_subset1";
   1.735 +val parts_UN_subset2 = thm "parts_UN_subset2";
   1.736 +val parts_UN = thm "parts_UN";
   1.737 +val parts_insert_subset = thm "parts_insert_subset";
   1.738 +val parts_partsD = thm "parts_partsD";
   1.739 +val parts_trans = thm "parts_trans";
   1.740 +val parts_cut = thm "parts_cut";
   1.741 +val parts_cut_eq = thm "parts_cut_eq";
   1.742 +val parts_insert_eq_I = thm "parts_insert_eq_I";
   1.743 +val parts_image_Key = thm "parts_image_Key";
   1.744 +val MPair_analz = thm "MPair_analz";
   1.745 +val analz_increasing = thm "analz_increasing";
   1.746 +val analz_subset_parts = thm "analz_subset_parts";
   1.747 +val not_parts_not_analz = thm "not_parts_not_analz";
   1.748 +val parts_analz = thm "parts_analz";
   1.749 +val analz_parts = thm "analz_parts";
   1.750 +val analz_insertI = thm "analz_insertI";
   1.751 +val analz_empty = thm "analz_empty";
   1.752 +val analz_Un = thm "analz_Un";
   1.753 +val analz_insert_Crypt_subset = thm "analz_insert_Crypt_subset";
   1.754 +val analz_image_Key = thm "analz_image_Key";
   1.755 +val analz_analzD = thm "analz_analzD";
   1.756 +val analz_trans = thm "analz_trans";
   1.757 +val analz_cut = thm "analz_cut";
   1.758 +val analz_insert_eq = thm "analz_insert_eq";
   1.759 +val analz_subset_cong = thm "analz_subset_cong";
   1.760 +val analz_cong = thm "analz_cong";
   1.761 +val analz_insert_cong = thm "analz_insert_cong";
   1.762 +val analz_trivial = thm "analz_trivial";
   1.763 +val analz_UN_analz = thm "analz_UN_analz";
   1.764 +val synth_mono = thm "synth_mono";
   1.765 +val synth_increasing = thm "synth_increasing";
   1.766 +val synth_Un = thm "synth_Un";
   1.767 +val synth_insert = thm "synth_insert";
   1.768 +val synth_synthD = thm "synth_synthD";
   1.769 +val synth_trans = thm "synth_trans";
   1.770 +val synth_cut = thm "synth_cut";
   1.771 +val Agent_synth = thm "Agent_synth";
   1.772 +val Number_synth = thm "Number_synth";
   1.773 +val Nonce_synth_eq = thm "Nonce_synth_eq";
   1.774 +val Key_synth_eq = thm "Key_synth_eq";
   1.775 +val Crypt_synth_eq = thm "Crypt_synth_eq";
   1.776 +val keysFor_synth = thm "keysFor_synth";
   1.777 +val parts_synth = thm "parts_synth";
   1.778 +val analz_analz_Un = thm "analz_analz_Un";
   1.779 +val analz_synth_Un = thm "analz_synth_Un";
   1.780 +val analz_synth = thm "analz_synth";
   1.781 +val parts_insert_subset_Un = thm "parts_insert_subset_Un";
   1.782 +val Fake_parts_insert = thm "Fake_parts_insert";
   1.783 +val Fake_analz_insert = thm "Fake_analz_insert";
   1.784 +val analz_conj_parts = thm "analz_conj_parts";
   1.785 +val analz_disj_parts = thm "analz_disj_parts";
   1.786 +val MPair_synth_analz = thm "MPair_synth_analz";
   1.787 +val Crypt_synth_analz = thm "Crypt_synth_analz";
   1.788 +val Hash_synth_analz = thm "Hash_synth_analz";
   1.789 +val pushes = thms "pushes";
   1.790 +
   1.791 +
   1.792 +(*Prove base case (subgoal i) and simplify others.  A typical base case
   1.793 +  concerns  Crypt K X \<notin> Key`shrK`bad  and cannot be proved by rewriting
   1.794 +  alone.*)
   1.795 +fun prove_simple_subgoals_tac i = 
   1.796 +    force_tac (claset(), simpset() addsimps [image_eq_UN]) i THEN
   1.797 +    ALLGOALS Asm_simp_tac
   1.798 +
   1.799 +(*Analysis of Fake cases.  Also works for messages that forward unknown parts,
   1.800 +  but this application is no longer necessary if analz_insert_eq is used.
   1.801 +  Abstraction over i is ESSENTIAL: it delays the dereferencing of claset
   1.802 +  DEPENDS UPON "X" REFERRING TO THE FRADULENT MESSAGE *)
   1.803 +
   1.804 +(*Apply rules to break down assumptions of the form
   1.805 +  Y \<in> parts(insert X H)  and  Y \<in> analz(insert X H)
   1.806 +*)
   1.807 +val Fake_insert_tac = 
   1.808 +    dresolve_tac [impOfSubs Fake_analz_insert,
   1.809 +                  impOfSubs Fake_parts_insert] THEN'
   1.810 +    eresolve_tac [asm_rl, thm"synth.Inj"];
   1.811 +
   1.812 +fun Fake_insert_simp_tac ss i = 
   1.813 +    REPEAT (Fake_insert_tac i) THEN asm_full_simp_tac ss i;
   1.814 +
   1.815 +fun atomic_spy_analz_tac (cs,ss) = SELECT_GOAL
   1.816 +    (Fake_insert_simp_tac ss 1
   1.817 +     THEN
   1.818 +     IF_UNSOLVED (Blast.depth_tac
   1.819 +		  (cs addIs [analz_insertI,
   1.820 +				   impOfSubs analz_subset_parts]) 4 1))
   1.821 +
   1.822 +(*The explicit claset and simpset arguments help it work with Isar*)
   1.823 +fun gen_spy_analz_tac (cs,ss) i =
   1.824 +  DETERM
   1.825 +   (SELECT_GOAL
   1.826 +     (EVERY 
   1.827 +      [  (*push in occurrences of X...*)
   1.828 +       (REPEAT o CHANGED)
   1.829 +           (res_inst_tac [("x1","X")] (insert_commute RS ssubst) 1),
   1.830 +       (*...allowing further simplifications*)
   1.831 +       simp_tac ss 1,
   1.832 +       REPEAT (FIRSTGOAL (resolve_tac [allI,impI,notI,conjI,iffI])),
   1.833 +       DEPTH_SOLVE (atomic_spy_analz_tac (cs,ss) 1)]) i)
   1.834 +
   1.835 +fun spy_analz_tac i = gen_spy_analz_tac (claset(), simpset()) i
   1.836 +*}
   1.837 +
   1.838 +(*By default only o_apply is built-in.  But in the presence of eta-expansion
   1.839 +  this means that some terms displayed as (f o g) will be rewritten, and others
   1.840 +  will not!*)
   1.841 +declare o_def [simp]
   1.842 +
   1.843  
   1.844  lemma Crypt_notin_image_Key [simp]: "Crypt K X \<notin> Key ` A"
   1.845  by auto
   1.846 @@ -174,7 +979,7 @@
   1.847  done
   1.848  
   1.849  lemma Fake_parts_sing:
   1.850 -     "X \<in> synth (analz H) ==> parts{X} \<subseteq> synth (analz H) Un parts H";
   1.851 +     "X \<in> synth (analz H) ==> parts{X} \<subseteq> synth (analz H) \<union> parts H";
   1.852  apply (rule subset_trans) 
   1.853   apply (erule_tac [2] Fake_parts_insert) 
   1.854  apply (simp add: parts_mono) 
   1.855 @@ -200,4 +1005,5 @@
   1.856              Fake_insert_simp_tac (Simplifier.get_local_simpset ctxt) 1)) *}
   1.857      "for debugging spy_analz"
   1.858  
   1.859 +
   1.860  end