Inductive not_comp_of : C -> list C -> Prop :=
| C1 :
forall (c1 c2 : C) (k : K) (s : list C),
not_comp_of (B2C (K2B k)) s ->
c1 <> Encrypt c2 k -> not_comp_of c1 (Encrypt c2 k :: s)
| C2 :
forall (c1 c2 : C) (k : K) (s : list C),
not_comp_of c1 (c2 :: s) ->
c1 <> Encrypt c2 k -> not_comp_of c1 (Encrypt c2 k :: s)
| C3 :
forall (c1 : C) (d : D) (s : list C),
not_comp_of c1 s ->
c1 <> B2C (D2B d) -> not_comp_of c1 (B2C (D2B d) :: s)
| C4 :
forall (c1 c2 c3 : C) (s : list C),
not_comp_of c1 (c2 :: c3 :: s) ->
c1 <> Pair c2 c3 -> not_comp_of c1 (Pair c2 c3 :: s)
| C5 : forall c1 : C, not_comp_of c1 nil
| C7 :
forall (k : K) (s : list C),
~ In (B2C (K2B k)) s -> setofkeys s -> not_comp_of (B2C (K2B k)) s
| D1 : forall (c1 : C) (s : list C), ~ known_in c1 s -> not_comp_of c1 s
| UnionSnE1 :
forall (c : C) (s1 s2 : list C),
not_comp_of c (s1 ++ s2) -> not_comp_of c s1.
Axiom
D2 :
forall (b : B) (s : list C),
not_comp_of (B2C b) s -> ~ known_in (B2C b) s.
Axiom
E1 :
forall (c1 c2 : C) (s : list C),
~ known_in c1 (c2 :: s) -> ~ known_in c1 s.
Axiom
EP1 :
forall (c : C) (s1 s2 : list C),
~ known_in c (s1 ++ s2) -> ~ known_in c s1.
Hint Resolve C1 C2 C3 C4 C5 C7 D1 UnionSnE1 D2 E1 EP1: otway_rees.
Axiom
equivknown :
forall (c : C) (s1 s2 : list C),
equivS s1 s2 -> known_in c s1 -> known_in c s2.
Axiom
equivncomp :
forall (c : C) (s1 s2 : list C),
equivS s1 s2 -> not_comp_of c s1 -> not_comp_of c s2.

(* Specifications: *)
Lemma equivnknown1 :
forall (c1 c2 : C) (s1 s2 : list C),
equivS s1 s2 -> c1 = c2 -> ~ known_in c1 s1 -> ~ known_in c2 s2.