induct: fixes x :: "event list"   and P :: "event list \<Rightarrow> bool" assumes "x \<in> set_cr"   and "P []"   and "\<And>evsf X B. \<lbrakk>evsf \<in> set_cr; P evsf; X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> P (Says Spy B X # evsf)"   and "\<And>evsr A B X. \<lbrakk>evsr \<in> set_cr; P evsr; Says A B X \<in> set evsr\<rbrakk> \<Longrightarrow> P (Gets B X # evsr)"   and "\<And>evs1 C k NC1 i. \<lbrakk>evs1 \<in> set_cr; P evs1; C = Cardholder k; Nonce NC1 \<notin> used evs1\<rbrakk> \<Longrightarrow> P (Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> # evs1)"   and "\<And>evs2 i C NC1. \<lbrakk>evs2 \<in> set_cr; P evs2; Gets (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> P (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC1\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs2)"   and "\<And>evs3 C k NC2 KC1 SKi X NC1 i EKi. \<lbrakk>evs3 \<in> set_cr; P evs3; C = Cardholder k; Nonce NC2 \<notin> used evs3; Key KC1 \<notin> used evs3; KC1 \<in> symKeys; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent X, Nonce NC1\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs3; Says C (CA i) \<lbrace>Agent C, Nonce NC1\<rbrace> \<in> set evs3\<rbrakk> \<Longrightarrow> P (Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) # Notes C \<lbrace>Key KC1, Agent (CA i)\<rbrace> # evs3)"   and "\<And>evs4 NCA KC1 i EKi C NC2 X. \<lbrakk>evs4 \<in> set_cr; P evs4; Nonce NCA \<notin> used evs4; KC1 \<in> symKeys; Gets (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan X))) \<in> set evs4\<rbrakk> \<Longrightarrow> P (Says (CA i) C \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) (pubEK (CA i)) onlyEnc (priSK RCA), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace> # evs4)"   and "\<And>evs5 C k NC3 CardSecret KC2 KC3 SKi NC2 NCA i EKi KC1. \<lbrakk>evs5 \<in> set_cr; P evs5; C = Cardholder k; Nonce NC3 \<notin> used evs5; Nonce CardSecret \<notin> used evs5; NC3 \<noteq> CardSecret; Key KC2 \<notin> used evs5; KC2 \<in> symKeys; Key KC3 \<notin> used evs5; KC3 \<in> symKeys; KC2 \<noteq> KC3; Gets C \<lbrace>sign (invKey SKi) \<lbrace>Agent C, Nonce NC2, Nonce NCA\<rbrace>, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs5; Says C (CA i) (EXHcrypt KC1 EKi \<lbrace>Agent C, Nonce NC2\<rbrace> (Pan (pan C))) \<in> set evs5\<rbrakk> \<Longrightarrow> P (Says C (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Crypt (priSK C) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key (pubSK C), Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt EKi \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> # Notes C \<lbrace>Key KC2, Agent (CA i)\<rbrace> # Notes C \<lbrace>Key KC3, Agent (CA i)\<rbrace> # evs5)"   and "\<And>evs6 NonceCCA KC2 KC3 cardSK i C NC3 CardSecret. \<lbrakk>evs6 \<in> set_cr; P evs6; Nonce NonceCCA \<notin> used evs6; KC2 \<in> symKeys; KC3 \<in> symKeys; cardSK \<notin> symKeys; Notes (CA i) (Key cardSK) \<notin> set evs6; Gets (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Crypt (invKey cardSK) (Hash \<lbrace>Agent C, Nonce NC3, Key KC2, Key cardSK, Pan (pan C), Nonce CardSecret\<rbrace>)\<rbrace>, Crypt (pubEK (CA i)) \<lbrace>Key KC3, Pan (pan C), Nonce CardSecret\<rbrace>\<rbrace> \<in> set evs6\<rbrakk> \<Longrightarrow> P (Says (CA i) C (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce NC3, Agent (CA i), Nonce NonceCCA\<rbrace>, certC (pan C) cardSK (XOR (CardSecret, NonceCCA)) onlySig (priSK (CA i)), cert (CA i) (pubSK (CA i)) onlySig (priSK RCA)\<rbrace>) # Notes (CA i) (Key cardSK) # evs6)" shows "P x"