intros.
apply le_h_le_h_impl_union_le_h.
apply le_h_trans with h1; trivial.
apply inclusion_impl_le_h; apply hedge_left_union.
apply le_h_trans with h2; trivial.
apply inclusion_impl_le_h; apply hedge_right_union.
Qed.
(** we define how to analyse 'one time' a hedge h: all the pairs are splitted and the encrypted messages are decrypted if the keys are in the synthesis of h *)
Inductive analysis (h : hedge) : hedge :=
| AnaInc : forall M N : Msg, h M N -> analysis h M N
| AnaSplitL :
forall M1 M2 N1 N2 : Msg,
analysis h (MPair M1 M2) (MPair N1 N2) -> analysis h M1 N1
| AnaSplitR :
forall M1 M2 N1 N2 : Msg,
analysis h (MPair M1 M2) (MPair N1 N2) -> analysis h M2 N2
| AnaDec :
forall M N K L : Msg,
analysis h (MEnc M K) (MEnc N L) ->
synthesis h (inv K) (inv L) -> analysis h M N.

(* Specifications: *)
(** if g is included in h then (analysis g) is included in (analysis h) *)
Lemma inclusion_analysis_inclusion :
forall g h : hedge, inclusion g h -> inclusion (analysis g) (analysis h).