(*The main lemma deals with secuences of SFSstates.                  *) 
(*In that lemma we'll use the function nth (defined in PolyList)     *) 
(*which takes a natural (n), a list, and a default element with the  *) 
(*type of the list, and returns the n(th) element of list if there   *) 
(*are enough elements in it, or the default element if not.          *) 
(*For this reason, we need to define a default SFSstate. In fact we  *) 
(*won't use it in the proof, it's just a type requirement.           *) 
 
Parameter defaultState : SFSstate.

Lemma BasicSecurityTheorem : forall tr : list SFSstate, GeneralSecureState (nth 0 tr defaultState) -> (forall n : nat, n < length tr -> exists op : Operation, (exists u : SUBJECT, TransFunc u (nth n tr defaultState) op (nth (S n) tr defaultState))) -> forall n : nat, n <= length tr -> GeneralSecureState (nth n tr defaultState).