induct: fixes x :: "event list"   and P :: "event list \<Rightarrow> bool" assumes "x \<in> kerbV"   and "P []"   and "\<And>evsf X B. \<lbrakk>evsf \<in> kerbV; P evsf; X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> P (Says Spy B X # evsf)"   and "\<And>evs1 A. \<lbrakk>evs1 \<in> kerbV; P evs1\<rbrakk> \<Longrightarrow> P (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1)"   and "\<And>evs2 authK A' A T1. \<lbrakk>evs2 \<in> kerbV; P evs2; Key authK \<notin> used evs2; authK \<in> symKeys; Says A' Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> P (Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number (CT evs2)\<rbrace>, Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace>\<rbrace> # evs2)"   and "\<And>evs3 A T1 Kas' authK Ta authTicket B. \<lbrakk>evs3 \<in> kerbV; P evs3; A \<noteq> Kas; A \<noteq> Tgs; Says A Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs3; Says Kas' A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta\<rbrace>, authTicket\<rbrace> \<in> set evs3; valid Ta wrt T1\<rbrakk> \<Longrightarrow> P (Says A Tgs \<lbrace>authTicket, Crypt authK \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent B\<rbrace> # evs3)"   and "\<And>evs4 servK B authK A' A Ta T2. \<lbrakk>evs4 \<in> kerbV; P evs4; Key servK \<notin> used evs4; servK \<in> symKeys; B \<noteq> Tgs; authK \<in> symKeys; Says A' Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>, Crypt authK \<lbrace>Agent A, Number T2\<rbrace>, Agent B\<rbrace> \<in> set evs4; \<not> expiredAK Ta evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta\<rbrakk> \<Longrightarrow> P (Says Tgs A \<lbrace>Crypt authK \<lbrace>Key servK, Agent B, Number (CT evs4)\<rbrace>, Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number (CT evs4)\<rbrace>\<rbrace> # evs4)"   and "\<And>evs5 authK servK A authTicket T2 B Tgs' Ts servTicket. \<lbrakk>evs5 \<in> kerbV; P evs5; authK \<in> symKeys; servK \<in> symKeys; A \<noteq> Kas; A \<noteq> Tgs; Says A Tgs \<lbrace>authTicket, Crypt authK \<lbrace>Agent A, Number T2\<rbrace>, Agent B\<rbrace> \<in> set evs5; Says Tgs' A \<lbrace>Crypt authK \<lbrace>Key servK, Agent B, Number Ts\<rbrace>, servTicket\<rbrace> \<in> set evs5; valid Ts wrt T2\<rbrakk> \<Longrightarrow> P (Says A B \<lbrace>servTicket, Crypt servK \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5)"   and "\<And>evs6 B A' A servK Ts T3 Ta2. \<lbrakk>evs6 \<in> kerbV; P evs6; B \<noteq> Kas; B \<noteq> Tgs; Says A' B \<lbrace>Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace>, Crypt servK \<lbrace>Agent A, Number T3\<rbrace>\<rbrace> \<in> set evs6; \<not> expiredSK Ts evs6; \<not> expiredA T3 evs6\<rbrakk> \<Longrightarrow> P (Says B A (Crypt servK (Number Ta2)) # evs6)"   and "\<And>evsO1 A authK Ta authTicket. \<lbrakk>evsO1 \<in> kerbV; P evsO1; A \<noteq> Spy; Says Kas A \<lbrace>Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta\<rbrace>, authTicket\<rbrace> \<in> set evsO1; expiredAK Ta evsO1\<rbrakk> \<Longrightarrow> P (Notes Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authK\<rbrace> # evsO1)"   and "\<And>evsO2 A authK servK B Ts servTicket. \<lbrakk>evsO2 \<in> kerbV; P evsO2; A \<noteq> Spy; Says Tgs A \<lbrace>Crypt authK \<lbrace>Key servK, Agent B, Number Ts\<rbrace>, servTicket\<rbrace> \<in> set evsO2; expiredSK Ts evsO2\<rbrakk> \<Longrightarrow> P (Notes Spy \<lbrace>Agent A, Agent B, Number Ts, Key servK\<rbrace> # evsO2)" shows "P x"