induct: fixes x :: "event list"   and P :: "event list \<Rightarrow> bool" assumes "x \<in> kerbIV_gets"   and "P []"   and "\<And>evsf X B. \<lbrakk>evsf \<in> kerbIV_gets; P evsf; X \<in> synth (analz (knows Spy evsf))\<rbrakk> \<Longrightarrow> P (Says Spy B X # evsf)"   and "\<And>evsr A B X. \<lbrakk>evsr \<in> kerbIV_gets; P evsr; Says A B X \<in> set evsr\<rbrakk> \<Longrightarrow> P (Gets B X # evsr)"   and "\<And>evs1 A. \<lbrakk>evs1 \<in> kerbIV_gets; P evs1\<rbrakk> \<Longrightarrow> P (Says A Kas \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> # evs1)"   and "\<And>evs2 authK A T1. \<lbrakk>evs2 \<in> kerbIV_gets; P evs2; Key authK \<notin> used evs2; authK \<in> symKeys; Gets Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs2\<rbrakk> \<Longrightarrow> P (Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number (CT evs2), Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number (CT evs2)\<rbrace>\<rbrace>) # evs2)"   and "\<And>evs3 A T1 authK Ta authTicket B. \<lbrakk>evs3 \<in> kerbIV_gets; P evs3; Says A Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace> \<in> set evs3; Gets A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evs3; valid Ta wrt T1\<rbrakk> \<Longrightarrow> P (Says A Tgs \<lbrace>authTicket, Crypt authK \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent B\<rbrace> # evs3)"   and "\<And>evs4 servK B authK A Ta T2. \<lbrakk>evs4 \<in> kerbIV_gets; P evs4; Key servK \<notin> used evs4; servK \<in> symKeys; B \<noteq> Tgs; authK \<in> symKeys; Gets Tgs \<lbrace>Crypt (shrK Tgs) \<lbrace>Agent A, Agent Tgs, Key authK, Number Ta\<rbrace>, Crypt authK \<lbrace>Agent A, Number T2\<rbrace>, Agent B\<rbrace> \<in> set evs4; \<not> expiredAK Ta evs4; \<not> expiredA T2 evs4; servKlife + CT evs4 \<le> authKlife + Ta\<rbrakk> \<Longrightarrow> P (Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number (CT evs4), Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number (CT evs4)\<rbrace>\<rbrace>) # evs4)"   and "\<And>evs5 authK servK A authTicket T2 B Ts servTicket. \<lbrakk>evs5 \<in> kerbIV_gets; P evs5; authK \<in> symKeys; servK \<in> symKeys; Says A Tgs \<lbrace>authTicket, Crypt authK \<lbrace>Agent A, Number T2\<rbrace>, Agent B\<rbrace> \<in> set evs5; Gets A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evs5; valid Ts wrt T2\<rbrakk> \<Longrightarrow> P (Says A B \<lbrace>servTicket, Crypt servK \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> # evs5)"   and "\<And>evs6 B A servK Ts T3. \<lbrakk>evs6 \<in> kerbIV_gets; P evs6; Gets B \<lbrace>Crypt (shrK B) \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace>, Crypt servK \<lbrace>Agent A, Number T3\<rbrace>\<rbrace> \<in> set evs6; \<not> expiredSK Ts evs6; \<not> expiredA T3 evs6\<rbrakk> \<Longrightarrow> P (Says B A (Crypt servK (Number T3)) # evs6)"   and "\<And>evsO1 A authK Ta authTicket. \<lbrakk>evsO1 \<in> kerbIV_gets; P evsO1; A \<noteq> Spy; Says Kas A (Crypt (shrK A) \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace>) \<in> set evsO1; expiredAK Ta evsO1\<rbrakk> \<Longrightarrow> P (Says A Spy \<lbrace>Agent A, Agent Tgs, Number Ta, Key authK\<rbrace> # evsO1)"   and "\<And>evsO2 A authK servK B Ts servTicket. \<lbrakk>evsO2 \<in> kerbIV_gets; P evsO2; A \<noteq> Spy; Says Tgs A (Crypt authK \<lbrace>Key servK, Agent B, Number Ts, servTicket\<rbrace>) \<in> set evsO2; expiredSK Ts evsO2\<rbrakk> \<Longrightarrow> P (Says A Spy \<lbrace>Agent A, Agent B, Number Ts, Key servK\<rbrace> # evsO2)" shows "P x"