Towards Producing

First-order logic models of security for cryptographicprotocols, based on variants of the Dolev-Yao model, arenow well-established tools. Given that we have checked agiven security protocol π using a given first-order prover,how hard is it to extract a formally checkable proof of it,as required in, e.g., common criteria at evaluation level 7?We demonstrate that this is surprisingly hard: the problemis non-recursive in general. On the practical side, we showhow we can extract finite modelsM from a set S of clausesrepresenting π, automatically, in two ways. We then definea model-checker testing M |= S, and show how we caninstrument it to output a formally checkable proof, e.g., inCoq. This was implemented in the h1 tool suite. Experienceon a number of protocols shows that this is practical.