(* Property from Case-Analysis for Rippling and Inductive Proof,
   Moa Johansson, Lucas Dixon and Alan Bundy, ITP 2010.
   This Isabelle theory is produced using the TIP tool offered at the following website:
     https://github.com/tip-org/tools
   This file was originally provided as part of TIP benchmark at the following website:
     https://github.com/tip-org/benchmarks
   Yutaka Nagashima at CIIRC, CTU changed the TIP output theory file slightly
   to make it compatible with Isabelle2017.*)
  theory TIP_prop_42
  imports "../../Test_Base"
begin

datatype 'a list = nil2 | cons2 "'a" "'a list"

datatype Nat = Z | S "Nat"

fun take :: "Nat => 'a list => 'a list" where
  "take (Z) y = nil2"
| "take (S z) (nil2) = nil2"
| "take (S z) (cons2 x2 x3) = cons2 x2 (take z x3)"

theorem property0 :
  "((take (S n) (cons2 x xs)) = (cons2 x (take n xs)))"
  oops

end


(* Title: Diffie_Hellman.thy
  Author: Andreas Lochbihler, ETH Zurich *)

section \<open>Specifying security using games\<close>

theory Diffie_Hellman imports
  CryptHOL.Cyclic_Group_SPMF
  CryptHOL.Computational_Model
begin

subsection \<open>The DDH game\<close>

locale ddh =
  fixes \<G> :: "'grp cyclic_group" (structure)
begin

type_synonym 'grp' adversary = "'grp' \<Rightarrow> 'grp' \<Rightarrow> 'grp' \<Rightarrow> bool spmf"

definition ddh_0 :: "'grp adversary \<Rightarrow> bool spmf"
where "ddh_0 \<A> = do {
     x \<leftarrow> sample_uniform (order \<G>);
     y \<leftarrow> sample_uniform (order \<G>);
     \<A> (\<^bold>g [^] x) (\<^bold>g [^] y) (\<^bold>g [^] (x * y))
  }"

definition ddh_1 :: "'grp adversary \<Rightarrow> bool spmf"
where "ddh_1 \<A> = do {
     x \<leftarrow> sample_uniform (order \<G>);
     y \<leftarrow> sample_uniform (order \<G>);
     z \<leftarrow> sample_uniform (order \<G>);
     \<A> (\<^bold>g [^] x) (\<^bold>g [^] y) (\<^bold>g [^] z)
  }"

definition advantage :: "'grp adversary \<Rightarrow> real"
where "advantage \<A> = \<bar>spmf (ddh_0 \<A>) True - spmf (ddh_1 \<A>) True\<bar>"

definition lossless :: "'grp adversary \<Rightarrow> bool"
where "lossless \<A> \<longleftrightarrow> (\<forall>\<alpha> \<beta> \<gamma>. lossless_spmf (\<A> \<alpha> \<beta> \<gamma>))"

lemma lossless_ddh_0:
  "\<lbrakk> lossless \<A>; 0 < order \<G> \<rbrakk>
  \<Longrightarrow> lossless_spmf (ddh_0 \<A>)"
by(auto simp add: lossless_def ddh_0_def split_def Let_def)

lemma lossless_ddh_1:
  "\<lbrakk> lossless \<A>; 0 < order \<G> \<rbrakk>
  \<Longrightarrow> lossless_spmf (ddh_1 \<A>)"
by(auto simp add: lossless_def ddh_1_def split_def Let_def)

end

subsection \<open>The LCDH game\<close>

locale lcdh =
  fixes \<G> :: "'grp cyclic_group" (structure)
begin

type_synonym 'grp' adversary = "'grp' \<Rightarrow> 'grp' \<Rightarrow> 'grp' set spmf"

definition lcdh :: "'grp adversary \<Rightarrow> bool spmf"
where "lcdh \<A> = do {
     x \<leftarrow> sample_uniform (order \<G>);
     y \<leftarrow> sample_uniform (order \<G>);
     zs \<leftarrow> \<A> (\<^bold>g [^] x) (\<^bold>g [^] y);
     return_spmf (\<^bold>g [^] (x * y) \<in> zs)
  }"

definition advantage :: "'grp adversary \<Rightarrow> real"
where "advantage \<A> = spmf (lcdh \<A>) True"

definition lossless :: "'grp adversary \<Rightarrow> bool"
where "lossless \<A> \<longleftrightarrow> (\<forall>\<alpha> \<beta>. lossless_spmf (\<A> \<alpha> \<beta>))"

lemma lossless_lcdh:
  "\<lbrakk> lossless \<A>; 0 < order \<G> \<rbrakk>
  \<Longrightarrow> lossless_spmf (lcdh \<A>)"
by(auto simp add: lossless_def lcdh_def split_def Let_def)

end

end


theory ArityStack
imports Arity SestoftConf
begin

fun Astack :: "stack \<Rightarrow> Arity"
  where "Astack [] = 0"
      | "Astack (Arg x # S) = inc\<cdot>(Astack S)"
      | "Astack (Alts e1 e2 # S) = 0"
      | "Astack (Upd x # S) = 0"
      | "Astack (Dummy x # S) = 0"

lemma Astack_restr_stack_below:
  "Astack (restr_stack V S) \<sqsubseteq> Astack S"
  by (induction V S rule: restr_stack.induct) auto

lemma Astack_map_Dummy[simp]:
  "Astack (map Dummy l) = 0"
by (induction l) auto

lemma Astack_append_map_Dummy[simp]:
  "Astack S' = 0 \<Longrightarrow> Astack (S @ S') = Astack S"
by (induction S rule: Astack.induct) auto

end


(*<*)
theory Induction imports examples simplification begin
(*>*)

text{*
Assuming we have defined our function such that Isabelle could prove
termination and that the recursion equations (or some suitable derived
equations) are simplification rules, we might like to prove something about
our function. Since the function is recursive, the natural proof principle is
again induction. But this time the structural form of induction that comes
with datatypes is unlikely to work well --- otherwise we could have defined the
function by \isacommand{primrec}. Therefore \isacommand{recdef} automatically
proves a suitable induction rule $f$@{text".induct"} that follows the
recursion pattern of the particular function $f$. We call this
\textbf{recursion induction}. Roughly speaking, it
requires you to prove for each \isacommand{recdef} equation that the property
you are trying to establish holds for the left-hand side provided it holds
for all recursive calls on the right-hand side. Here is a simple example
involving the predefined @{term"map"} functional on lists:
*}

lemma "map f (sep(x,xs)) = sep(f x, map f xs)"

txt{*\noindent
Note that @{term"map f xs"}
is the result of applying @{term"f"} to all elements of @{term"xs"}. We prove
this lemma by recursion induction over @{term"sep"}:
*}

apply(induct_tac x xs rule: sep.induct)

txt{*\noindent
The resulting proof state has three subgoals corresponding to the three
clauses for @{term"sep"}:
@{subgoals[display,indent=0]}
The rest is pure simplification:
*}

apply simp_all
done

text{*
Try proving the above lemma by structural induction, and you find that you
need an additional case distinction. What is worse, the names of variables
are invented by Isabelle and have nothing to do with the names in the
definition of @{term"sep"}.

In general, the format of invoking recursion induction is
\begin{quote}
\isacommand{apply}@{text"(induct_tac"} $x@1 \dots x@n$ @{text"rule:"} $f$@{text".induct)"}
\end{quote}\index{*induct_tac (method)}%
where $x@1~\dots~x@n$ is a list of free variables in the subgoal and $f$ the
name of a function that takes an $n$-tuple. Usually the subgoal will
contain the term $f(x@1,\dots,x@n)$ but this need not be the case. The
induction rules do not mention $f$ at all. Here is @{thm[source]sep.induct}:
\begin{isabelle}
{\isasymlbrakk}~{\isasymAnd}a.~P~a~[];\isanewline
~~{\isasymAnd}a~x.~P~a~[x];\isanewline
~~{\isasymAnd}a~x~y~zs.~P~a~(y~\#~zs)~{\isasymLongrightarrow}~P~a~(x~\#~y~\#~zs){\isasymrbrakk}\isanewline
{\isasymLongrightarrow}~P~u~v%
\end{isabelle}
It merely says that in order to prove a property @{term"P"} of @{term"u"} and
@{term"v"} you need to prove it for the three cases where @{term"v"} is the
empty list, the singleton list, and the list with at least two elements.
The final case has an induction hypothesis:  you may assume that @{term"P"}
holds for the tail of that list.
*}

(*<*)
end
(*>*)