saymrwulf/betrusted-ed25519-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/betrusted-ed25519-verified.git synced 2026-09-03 20:13:47 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
betrusted-ed25519-verified/verification/AUDIT-MANIFEST.txt

101 lines
438 KiB
Text
Raw Normal View History

verification: bind the statements, the specifications, and the model (P1-a) Phases 3/3b establish what each certificate RESTS ON. Neither says what it SAYS, nor what it is ABOUT. A certificate gutted to a tautology of the same axiom cone passes both; so does one whose reference definition has been redefined to BE the extracted code, at which point the theorem reads `loop = loop` and every cone is byte-identical. Phase 3c closes that. Proofs/Audit.lean emits a canonical block holding the policy constants, every certificate's fully-elaborated statement (pp.all, so implicit arguments, instances and universe levels are visible), and the body of every specification constant transitively reachable from those statements. Its SHA-256 is pinned in check.sh and the block itself is committed as AUDIT-MANIFEST.txt, so a mismatch is DIFFED, not merely reported. 31 certificates, 68 specification constants per repository. Two tiers, not one. These forks have an arithmetic tier that must stay oracle-free and an apex tier carrying this fork's hash and wire-format axioms, and the apex boundary genuinely differs per fork (dalek 8 extra names, anza 4, risc0 and betrusted 5). One shared constant would have widened the arithmetic tier to accept hash oracles, which is the most valuable property these repos have. Each auditor is generated from its own repository's policy. Phase 0b pins the extracted model. This was not a precaution: risc0 and betrusted were observed emitting BYTE-IDENTICAL audit-manifest digests (6c821b8e…) while shipping demonstrably different extracted models, their point-doubling routines differing in operation order. A statement names an extracted function; it does not contain that function's body. Binding statements is not binding the subject. Membership derives from the filesystem, so a new model file fails closed. selftest-statements.sh attacks both phases with ten cases, each asserting a specific diagnostic: an edited model body, an unlisted model file, a widened policy, a hand-edited committed block, a certificate dropped from the auditor WITH the digest refreshed to match, and a gutted statement whose cone is unchanged. It lifts the phases out of check.sh at run time, so it attacks the shipping gate rather than a copy. Two bugs found and fixed during that testing, both mine: Phase 3c read `$0` after `cd "$AENEAS_LEAN"`, and $0 is the caller's relative path; and the axgate self-test compared the tree against a pristine checkout rather than against how it found it. A third expectation was wrong rather than the code — widening the apex boundary is caught by the exact-cone requirement before the digest ever runs, which is a stronger rejection, and the test now says so. All sixteen runs green at these commits: four main buttons, four axgate self-tests, four binding self-tests, four scalar buttons. TRUSTED-BASE.md records what this binds and, at equal length, what it does not: a digest binds identity, not meaning; an author can rotate the pins in one commit and is caught by review, not by the script; and pinning the model says nothing about whether Charon and Aeneas translated the Rust faithfully. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-28 22:38:22 +00:00
policy|kernel3=Classical.choice,Quot.sound,propext|apexExtra=ed25519.Signature,ed25519.Signature.to_bytes,signature.error.Error,signature.error.Error.new,verifying.sha512_hash3|specPrefix=Proofs.
cert|CurveFieldProofs.fieldImplementation|cone=Classical.choice,Quot.sound,propext|type=CurveFieldProofs.IsFieldImplementation
cert|CurveFieldProofs.edwardsImplementation|cone=Classical.choice,Quot.sound,propext|type=CurveFieldProofs.IsEdwardsImplementation
cert|CurveFieldProofs.naf_table_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (A : CurveFieldProofs.EdPoint) (hA : CurveFieldProofs.ExtValid A) (hcA : CurveFieldProofs.OnCurveExt A), @Aeneas.Std.WP.spec.{0} (curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (curve25519_dalek.window.NafLookupTable5ProjectiveNielsPoint.Insts.CoreConvertFromSharedAEdwardsPoint.from A) fun (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e0 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e1 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e2 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e3 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e4 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e5 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e6 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e7 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => And (@Eq.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (CurveFieldProofs.tblEntries tbl) (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e0 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e1 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e2 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e3 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e4 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e5 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e6 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e7 (@List.nil.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint)))))))))) (And (CurveFieldProofs.NafEntryOf e0 A (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (And (CurveFieldProofs.NafEntryOf e1 A (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (CurveFieldProofs.NafEntryOf e2 A (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (And (CurveFieldProofs.NafEntryOf e3 A (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3)))) (And (CurveFieldProofs.NafEntryOf e4 A (@OfNat.ofNat.{0} Nat (nat_lit 4) (instOfNatNat (nat_lit 4)))) (And (CurveFieldProofs.NafEntryOf e5 A (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5)))) (And (CurveFieldProofs.NafEntryOf e6 A (@OfNat.ofNat.{0} Nat (nat_lit 6) (instOfNatNat (nat_lit 6)))) (CurveFieldProofs.NafEntryOf e7 A (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7)))))))))))
cert|CurveFieldProofs.naf_select_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (x : Aeneas.Std.Usize) (e0 e1 e2 e3 e4 e5 e6 e7 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (hl : @Eq.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (CurveFieldProofs.tblEntries tbl) (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e0 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e1 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e2 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e3 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e4 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e5 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e6 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e7 (@List.nil.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint)))))))))) (hodd : @Eq.{1} Nat (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (hlt : @LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint (@curve25519_dalek.window.NafLookupTable5.select curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreMarkerCopy tbl x) fun (r : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e0) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e1) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e2) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e3) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e4) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 11) (instOfNatNat (nat_lit 11))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e5) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 13) (instOfNatNat (nat_lit 13))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e6) (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 15) (instOfNatNat (nat_lit 15))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e7)))))))
cert|CurveFieldProofs.proj_double_law|cone=Classical.choice,Quot.sound,propext|type=∀ (p : CurveFieldProofs.ProjPoint) (hp : CurveFieldProofs.ProjValid p) (hcp : CurveFieldProofs.OnCurve (CurveFieldProofs.projX p) (CurveFieldProofs.projY p)), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.curve_models.CompletedPoint (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.double p) fun (t : curve25519_dalek.backend.serial.curve_models.CompletedPoint) => And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (And (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T t)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (And (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.complX t) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.edAdd (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.projX p) (CurveFieldProofs.projY p)) (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.projX p) (CurveFieldProofs.projY p))))) (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.complY t) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.edAdd (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.projX p) (CurveFieldProofs.projY p)) (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.projX p) (CurveFieldProofs.projY p)))))))))))
cert|CurveFieldProofs.compl_as_projective_law|cone=Classical.choice,Quot.sound,propext|type=∀ (p : CurveFieldProofs.ComplPoint) (hbX : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X p) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbY : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y p) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbZ : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z p) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbT : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T p) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hZ0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z p)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (hT0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T p)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.curve_models.ProjectivePoint (curve25519_dalek.backend.serial.curve_models.CompletedPoint.as_projective p) fun (r : curve25519_dalek.backend.serial.curve_models.ProjectivePoint) => And (CurveFieldProofs.ProjValid r) (And (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.projX r) (CurveFieldProofs.complX p)) (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.projY r) (CurveFieldProofs.complY p)))
cert|CurveFieldProofs.dsm_step_p_law|cone=Classical.choice,Quot.sound,propext|type=∀ (t : CurveFieldProofs.ComplPoint) (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (d : Aeneas.Std.I8) (A : CurveFieldProofs.EdPoint) (e0 e1 e2 e3 e4 e5 e6 e7 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (hl : @Eq.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (CurveFieldProofs.tblEntries tbl) (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e0 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e1 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e2 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e3 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e4 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e5 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e6 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e7 (@List.nil.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint)))))))))) (h0 : CurveFieldProofs.NafEntryOf e0 A (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (h1 : CurveFieldProofs.NafEntryOf e1 A (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (h2 : CurveFieldProofs.NafEntryOf e2 A (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (h3 : CurveFieldProofs.NafEntryOf e3 A (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3)))) (h4 : CurveFieldProofs.NafEntryOf e4 A (@OfNat.ofNat.{0} Nat (nat_lit 4) (instOfNatNat (nat_lit 4)))) (h5 : CurveFieldProofs.NafEntryOf e5 A (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5)))) (h6 : CurveFieldProofs.NafEntryOf e6 A (@OfNat.ofNat.{0} Nat (nat_lit 6) (instOfNatNat (nat_lit 6)))) (h7 : CurveFieldProofs.NafEntryOf e7 A (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7)))) (hbX : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbY : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbZ : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbT : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hZ0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (hT0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (c
cert|CurveFieldProofs.dsm_step_b_law|cone=Classical.choice,Quot.sound,propext|type=∀ (t : CurveFieldProofs.ComplPoint) (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (d : Aeneas.Std.I8) (A : CurveFieldProofs.EdPoint) (e0 e1 e2 e3 e4 e5 e6 e7 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (hl : @Eq.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (CurveFieldProofs.tblEntries tbl) (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e0 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e1 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e2 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e3 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e4 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e5 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e6 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e7 (@List.nil.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint)))))))))) (h0 : CurveFieldProofs.NafEntryOf e0 A (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (h1 : CurveFieldProofs.NafEntryOf e1 A (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (h2 : CurveFieldProofs.NafEntryOf e2 A (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (h3 : CurveFieldProofs.NafEntryOf e3 A (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3)))) (h4 : CurveFieldProofs.NafEntryOf e4 A (@OfNat.ofNat.{0} Nat (nat_lit 4) (instOfNatNat (nat_lit 4)))) (h5 : CurveFieldProofs.NafEntryOf e5 A (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5)))) (h6 : CurveFieldProofs.NafEntryOf e6 A (@OfNat.ofNat.{0} Nat (nat_lit 6) (instOfNatNat (nat_lit 6)))) (h7 : CurveFieldProofs.NafEntryOf e7 A (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7)))) (hbX : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbY : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbZ : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbT : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hZ0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (hT0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (c
cert|CurveFieldProofs.dsm_loop_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (i : Aeneas.Std.Usize) (hi : @Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize i) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255)))) (a_naf b_naf : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (ta tb : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (A B : CurveFieldProofs.EdPoint) (hta : CurveFieldProofs.NafTableOf ta A) (htb : CurveFieldProofs.NafTableOf tb B) (hda : CurveFieldProofs.NafDigits a_naf) (hdb : CurveFieldProofs.NafDigits b_naf), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.curve_models.ProjectivePoint (curve25519_dalek.backend.serial.scalar_mul.vartime_double_base.dsm_loop i a_naf b_naf ta tb) fun (res : curve25519_dalek.backend.serial.curve_models.ProjectivePoint) => And (CurveFieldProofs.ProjValid res) (And (CurveFieldProofs.OnCurve (CurveFieldProofs.projX res) (CurveFieldProofs.projY res)) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.projX res) (CurveFieldProofs.projY res)) (CurveFieldProofs.dsmFold (CurveFieldProofs.nafDigit a_naf) (CurveFieldProofs.nafDigit b_naf) (CurveFieldProofs.edPt A) (CurveFieldProofs.edPt B) CurveFieldProofs.edId (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))))))
cert|CurveFieldProofs.naf_load_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (self : curve25519_dalek.scalar.Scalar) (x_u64 : Aeneas.Std.Array.{0} Aeneas.Std.U64 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes self)) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (hx : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)))
cert|CurveFieldProofs.naf_exit|cone=Classical.choice,Quot.sound,propext|type=∀ (V pos carry : Nat) (S : Int) (hV : @LT.lt.{0} Nat instLTNat V (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 253) (instOfNatNat (nat_lit 253))))) (hpos : @LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) pos) (hc : @LE.le.{0} Nat instLENat carry (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (hcp : @Eq.{1} Nat carry (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) → @LE.le.{0} Nat instLENat pos (@OfNat.ofNat.{0} Nat (nat_lit 254) (instOfNatNat (nat_lit 254)))) (hinv : @Eq.{1} Int (@HAdd.hAdd.{0, 0, 0} Int Int Int (@instHAdd.{0} Int Int.instAdd) S (@HMul.hMul.{0, 0, 0} Int Int Int (@instHMul.{0} Int Int.instMul) (@Nat.cast.{0} Int instNatCastInt carry) (@HPow.hPow.{0, 0, 0} Int Nat Int (@instHPow.{0, 0} Int Nat (@Monoid.toPow.{0} Int Int.instMonoid)) (@OfNat.ofNat.{0} Int (nat_lit 2) (@instOfNat (nat_lit 2))) pos))) (@Nat.cast.{0} Int instNatCastInt (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) V (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) pos)))), @Eq.{1} Int S (@Nat.cast.{0} Int instNatCastInt V)
cert|CurveFieldProofs.naf_digit_loop_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (x_u64 : Aeneas.Std.Array.{0} Aeneas.Std.U64 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (v0 v1 v2 v3 : Aeneas.Std.U64) (V : Nat) (hx : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) x_u64) (@List.cons.{0} Aeneas.Std.U64 v0 (@List.cons.{0} Aeneas.Std.U64 v1 (@List.cons.{0} Aeneas.Std.U64 v2 (@List.cons.{0} Aeneas.Std.U64 v3 (@List.cons.{0} Aeneas.Std.U64 (Aeneas.Std.U64.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) (@List.nil.{0} Aeneas.Std.U64))))))) (hVdef : @Eq.{1} Nat V (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v1) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v2) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHA
cert|CurveFieldProofs.non_adjacent_form_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (self : curve25519_dalek.scalar.Scalar) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes self)) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (V : Nat) (hVbytes : @Eq.{1} Nat V (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0
cert|CurveFieldProofs.run_basepoint|cone=Classical.choice,Quot.sound,propext|type=@Exists.{1} CurveFieldProofs.EdPoint fun (B : CurveFieldProofs.EdPoint) => And (@Eq.{1} (Aeneas.Std.Result.{0} curve25519_dalek.edwards.EdwardsPoint) curve25519_dalek.backend.serial.u64.constants.ED25519_BASEPOINT_POINT (@Aeneas.Std.Result.ok.{0} CurveFieldProofs.EdPoint B)) (And (CurveFieldProofs.ExtValid B) (And (CurveFieldProofs.OnCurveExt B) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (CurveFieldProofs.edPt B) CurveFieldProofs.edBasePt)))
cert|CurveFieldProofs.vartime_double_base_mul_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : curve25519_dalek.scalar.Scalar) (A : CurveFieldProofs.EdPoint) (a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 a10 a11 a12 a13 a14 a15 a16 a17 a18 a19 a20 a21 a22 a23 a24 a25 a26 a27 a28 a29 a30 a31 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hab : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes a)) (@List.cons.{0} Aeneas.Std.U8 a0 (@List.cons.{0} Aeneas.Std.U8 a1 (@List.cons.{0} Aeneas.Std.U8 a2 (@List.cons.{0} Aeneas.Std.U8 a3 (@List.cons.{0} Aeneas.Std.U8 a4 (@List.cons.{0} Aeneas.Std.U8 a5 (@List.cons.{0} Aeneas.Std.U8 a6 (@List.cons.{0} Aeneas.Std.U8 a7 (@List.cons.{0} Aeneas.Std.U8 a8 (@List.cons.{0} Aeneas.Std.U8 a9 (@List.cons.{0} Aeneas.Std.U8 a10 (@List.cons.{0} Aeneas.Std.U8 a11 (@List.cons.{0} Aeneas.Std.U8 a12 (@List.cons.{0} Aeneas.Std.U8 a13 (@List.cons.{0} Aeneas.Std.U8 a14 (@List.cons.{0} Aeneas.Std.U8 a15 (@List.cons.{0} Aeneas.Std.U8 a16 (@List.cons.{0} Aeneas.Std.U8 a17 (@List.cons.{0} Aeneas.Std.U8 a18 (@List.cons.{0} Aeneas.Std.U8 a19 (@List.cons.{0} Aeneas.Std.U8 a20 (@List.cons.{0} Aeneas.Std.U8 a21 (@List.cons.{0} Aeneas.Std.U8 a22 (@List.cons.{0} Aeneas.Std.U8 a23 (@List.cons.{0} Aeneas.Std.U8 a24 (@List.cons.{0} Aeneas.Std.U8 a25 (@List.cons.{0} Aeneas.Std.U8 a26 (@List.cons.{0} Aeneas.Std.U8 a27 (@List.cons.{0} Aeneas.Std.U8 a28 (@List.cons.{0} Aeneas.Std.U8 a29 (@List.cons.{0} Aeneas.Std.U8 a30 (@List.cons.{0} Aeneas.Std.U8 a31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (hbb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes b)) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aenea
cert|CurveFieldProofs.verify_loop_full|cone=Classical.choice,Quot.sound,propext|type=∀ (e r : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))), @Aeneas.Std.WP.spec.{0} Bool (ed25519_dalek.verifying.verify_sha512_loop e r Bool.true (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) fun (res : Bool) => @Eq.{1} Bool res (@Decidable.decide (CurveFieldProofs.rangeEq e r (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (CurveFieldProofs.instDecidableRangeEq e r (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))))
cert|CurveFieldProofs.to_bytes_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a : CurveFieldProofs.Fe) (l0 l1 l2 l3 l4 : Aeneas.Std.U64) (hl : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (@List.cons.{0} Aeneas.Std.U64 l0 (@List.cons.{0} Aeneas.Std.U64 l1 (@List.cons.{0} Aeneas.Std.U64 l2 (@List.cons.{0} Aeneas.Std.U64 l3 (@List.cons.{0} Aeneas.Std.U64 l4 (@List.nil.{0} Aeneas.Std.U64))))))), @Aeneas.Std.WP.spec.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (CurveFieldProofs.fe_to_bytes a) fun (s : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) => @Eq.{1} Nat (CurveFieldProofs.bytesVal s) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (CurveFieldProofs.feVal a) CurveFieldProofs.P)
cert|CurveFieldProofs.ed_compress_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (Pt : CurveFieldProofs.EdPoint) (hv : CurveFieldProofs.ExtValid Pt), @Aeneas.Std.WP.spec.{0} curve25519_dalek.edwards.CompressedEdwardsY (curve25519_dalek.edwards.EdwardsPoint.compress Pt) fun (s : curve25519_dalek.edwards.CompressedEdwardsY) => @Eq.{1} Nat (CurveFieldProofs.bytesVal s) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edY Pt)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edX Pt)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255))))))
cert|ScalarProofs.from_bytes_mod_order_wide_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (input : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Aeneas.Std.U8) (hb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) input) (have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b60 (@List.cons.{0} Aeneas.Std.U8 b61 (@List.cons.{0} Aeneas.Std.U8 b62 (@List.cons.{0} Aeneas.Std.U8 b63 (@List.nil.{0} Aeneas.Std.U8)))); @List.cons.{0} Aeneas.Std.U8 b56 (@List.cons.{0} Aeneas.Std.U8 b57 (@List.cons.{0} Aeneas.Std.U8 b58 (@List.cons.{0} Aeneas.Std.U8 b59 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b52 (@List.cons.{0} Aeneas.Std.U8 b53 (@List.cons.{0} Aeneas.Std.U8 b54 (@List.cons.{0} Aeneas.Std.U8 b55 y))); @List.cons.{0} Aeneas.Std.U8 b48 (@List.cons.{0} Aeneas.Std.U8 b49 (@List.cons.{0} Aeneas.Std.U8 b50 (@List.cons.{0} Aeneas.Std.U8 b51 y))); have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b44 (@List.cons.{0} Aeneas.Std.U8 b45 (@List.cons.{0} Aeneas.Std.U8 b46 (@List.cons.{0} Aeneas.Std.U8 b47 y))); @List.cons.{0} Aeneas.Std.U8 b40 (@List.cons.{0} Aeneas.Std.U8 b41 (@List.cons.{0} Aeneas.Std.U8 b42 (@List.cons.{0} Aeneas.Std.U8 b43 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b36 (@List.cons.{0} Aeneas.Std.U8 b37 (@List.cons.{0} Aeneas.Std.U8 b38 (@List.cons.{0} Aeneas.Std.U8 b39 y))); @List.cons.{0} Aeneas.Std.U8 b32 (@List.cons.{0} Aeneas.Std.U8 b33 (@List.cons.{0} Aeneas.Std.U8 b34 (@List.cons.{0} Aeneas.Std.U8 b35 y))); have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 y))); @List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Ae
cert|CurveFieldProofs.vartime_dsm_basepoint_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : curve25519_dalek.scalar.Scalar) (A : CurveFieldProofs.EdPoint) (a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 a10 a11 a12 a13 a14 a15 a16 a17 a18 a19 a20 a21 a22 a23 a24 a25 a26 a27 a28 a29 a30 a31 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hab : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes a)) (@List.cons.{0} Aeneas.Std.U8 a0 (@List.cons.{0} Aeneas.Std.U8 a1 (@List.cons.{0} Aeneas.Std.U8 a2 (@List.cons.{0} Aeneas.Std.U8 a3 (@List.cons.{0} Aeneas.Std.U8 a4 (@List.cons.{0} Aeneas.Std.U8 a5 (@List.cons.{0} Aeneas.Std.U8 a6 (@List.cons.{0} Aeneas.Std.U8 a7 (@List.cons.{0} Aeneas.Std.U8 a8 (@List.cons.{0} Aeneas.Std.U8 a9 (@List.cons.{0} Aeneas.Std.U8 a10 (@List.cons.{0} Aeneas.Std.U8 a11 (@List.cons.{0} Aeneas.Std.U8 a12 (@List.cons.{0} Aeneas.Std.U8 a13 (@List.cons.{0} Aeneas.Std.U8 a14 (@List.cons.{0} Aeneas.Std.U8 a15 (@List.cons.{0} Aeneas.Std.U8 a16 (@List.cons.{0} Aeneas.Std.U8 a17 (@List.cons.{0} Aeneas.Std.U8 a18 (@List.cons.{0} Aeneas.Std.U8 a19 (@List.cons.{0} Aeneas.Std.U8 a20 (@List.cons.{0} Aeneas.Std.U8 a21 (@List.cons.{0} Aeneas.Std.U8 a22 (@List.cons.{0} Aeneas.Std.U8 a23 (@List.cons.{0} Aeneas.Std.U8 a24 (@List.cons.{0} Aeneas.Std.U8 a25 (@List.cons.{0} Aeneas.Std.U8 a26 (@List.cons.{0} Aeneas.Std.U8 a27 (@List.cons.{0} Aeneas.Std.U8 a28 (@List.cons.{0} Aeneas.Std.U8 a29 (@List.cons.{0} Aeneas.Std.U8 a30 (@List.cons.{0} Aeneas.Std.U8 a31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (hbb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes b)) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.
cert|CurveFieldProofs.enc_point_inj|cone=Classical.choice,Quot.sound,propext|type=∀ (Pt Q : CurveFieldProofs.EdPoint) (hPv : CurveFieldProofs.ExtValid Pt) (hPc : CurveFieldProofs.OnCurveExt Pt) (hQv : CurveFieldProofs.ExtValid Q) (hQc : CurveFieldProofs.OnCurveExt Q) (h : @Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edY Pt)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edX Pt)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255)))))) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edY Q)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edX Q)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255))))))), @Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (CurveFieldProofs.edPt Pt) (CurveFieldProofs.edPt Q)
cert|CurveFieldProofs.pow_p58_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a : CurveFieldProofs.Fe) (hba : CurveFieldProofs.Bnd a (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.field.FieldElement51 (curve25519_dalek.field.FieldElement51.pow_p58 a) fun (r : curve25519_dalek.backend.serial.u64.field.FieldElement51) => And (CurveFieldProofs.Bnd r (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote r) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (CurveFieldProofs.denote a) (@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 252) (instOfNatNat (nat_lit 252)))) (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3))))))
cert|CurveFieldProofs.fe_ct_eq_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : CurveFieldProofs.Fe), @Aeneas.Std.WP.spec.{0} subtle.Choice (curve25519_dalek.backend.serial.u64.field.FieldElement51.Insts.SubtleConstantTimeEq.ct_eq a b) fun (c : subtle.Choice) => And (Or (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 c) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 c) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))))) (Iff (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 c) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote a) (CurveFieldProofs.denote b)))
cert|CurveFieldProofs.sqrt_core|cone=Classical.choice,Quot.sound,propext|type=∀ (u v x : CurveFieldProofs.Fp) (hv : @Ne.{1} CurveFieldProofs.Fp v (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (hx : @Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) x (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) v) u), Or (@Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) v (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) u (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero
cert|CurveFieldProofs.sqrt_ratio_i_sq_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (u v : CurveFieldProofs.Fe) (hbu : CurveFieldProofs.Bnd u (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbv : CurveFieldProofs.Bnd v (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hvne : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote v) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (x : CurveFieldProofs.Fp) (hx : @Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) x (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (CurveFieldProofs.denote v)) (CurveFieldProofs.denote u)), @Aeneas.Std.WP.spec.{0} (Prod.{0, 0} subtle.Choice curve25519_dalek.backend.serial.u64.field.FieldElement51) (curve25519_dalek.field.FieldElement51.sqrt_ratio_i u v) fun (cr : Prod.{0, 0} subtle.Choice curve25519_dalek.backend.serial.u64.field.FieldElement51) => And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 (@Prod.fst.{0, 0} subtle.Choice curve25519_dalek.backend.serial.u64.field.FieldElement51 cr)) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (CurveFieldProofs.Bnd (@Prod.snd.{0, 0} subtle.Choice curve25519_dalek.backend.serial.u64.field.FieldElement51 cr) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@Divisio
cert|CurveFieldProofs.from_bytes_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (bytes : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hbl : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) bytes) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.field.FieldElement51 (curve25519_dalek.backend.serial.u64.field.FieldElement51.from_bytes bytes) fun (r : curve25519_dalek.backend.serial.u64.field.FieldElement51) => And (CurveFieldProofs.Bnd r (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 51) (instOfNatNat (nat_lit 51))))) (@Eq.{1} Nat (CurveFieldProofs.feVal r) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (CurveFieldProofs.bytesVal bytes) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255))))))
cert|CurveFieldProofs.decompress_of_canonical|cone=Classical.choice,Quot.sound,propext|type=∀ (Q : CurveFieldProofs.EdPoint) (hQv : CurveFieldProofs.ExtValid Q) (hQc : CurveFieldProofs.OnCurveExt Q) (rb : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hbl : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) rb) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (henc : @Eq.{1} Nat (CurveFieldProofs.bytesVal rb) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edY Q)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edX Q)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255))))))), @Aeneas.Std.WP.spec.{0} (Option.{0} curve25519_dalek.edwards.EdwardsPoint) (curve25519_dalek.edwards.CompressedEdwardsY.decompress rb) fun (o : Option.{0} curve25519_dalek.edwards.EdwardsPoint) => @Exists.{1} Curv
cert|CurveFieldProofs.verify_accepts_iff|cone=Classical.choice,Quot.sound,ed25519.Signature,ed25519.Signature.to_bytes,propext,signature.error.Error,signature.error.Error.new,verifying.sha512_hash3|type=∀ (key : ed25519_dalek.verifying.VerifyingKey) (msg : Aeneas.Std.Slice.{0} Aeneas.Std.U8) (sig : ed25519.Signature) (val : ed25519_dalek.signature.InternalSignature) (er : curve25519_dalek.edwards.CompressedEdwardsY) (e r1 : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (hparse : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error)) (ed25519_dalek.signature.InternalSignature.Insts.CoreConvertTryFromShared0SignatureError.try_from sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error val))) (hrec : @Eq.{1} (Aeneas.Std.Result.{0} curve25519_dalek.edwards.CompressedEdwardsY) (ed25519_dalek.verifying.recompute_r_sha512 key val msg) (@Aeneas.Std.Result.ok.{0} curve25519_dalek.edwards.CompressedEdwardsY er)) (he : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes er) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) e)) (hr1 : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide
cert|CurveFieldProofs.verify_accepts_iff_point|cone=Classical.choice,Quot.sound,ed25519.Signature,ed25519.Signature.to_bytes,propext,signature.error.Error,signature.error.Error.new,verifying.sha512_hash3|type=∀ (key : ed25519_dalek.verifying.VerifyingKey) (msg : Aeneas.Std.Slice.{0} Aeneas.Std.U8) (sig : ed25519.Signature) (val : ed25519_dalek.signature.InternalSignature) (er : curve25519_dalek.edwards.CompressedEdwardsY) (e r1 : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (hparse : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error)) (ed25519_dalek.signature.InternalSignature.Insts.CoreConvertTryFromShared0SignatureError.try_from sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error val))) (hrec : @Eq.{1} (Aeneas.Std.Result.{0} curve25519_dalek.edwards.CompressedEdwardsY) (ed25519_dalek.verifying.recompute_r_sha512 key val msg) (@Aeneas.Std.Result.ok.{0} curve25519_dalek.edwards.CompressedEdwardsY er)) (he : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes er) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) e)) (hr1 : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.d
cert|CurveFieldProofs.verify_accepts_iff_point_eq|cone=Classical.choice,Quot.sound,ed25519.Signature,ed25519.Signature.to_bytes,propext,signature.error.Error,signature.error.Error.new,verifying.sha512_hash3|type=∀ (key : ed25519_dalek.verifying.VerifyingKey) (msg : Aeneas.Std.Slice.{0} Aeneas.Std.U8) (sig : ed25519.Signature) (val : ed25519_dalek.signature.InternalSignature) (er : curve25519_dalek.edwards.CompressedEdwardsY) (e r1 : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (hparse : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error)) (ed25519_dalek.signature.InternalSignature.Insts.CoreConvertTryFromShared0SignatureError.try_from sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error val))) (hrec : @Eq.{1} (Aeneas.Std.Result.{0} curve25519_dalek.edwards.CompressedEdwardsY) (ed25519_dalek.verifying.recompute_r_sha512 key val msg) (@Aeneas.Std.Result.ok.{0} curve25519_dalek.edwards.CompressedEdwardsY er)) (he : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes er) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) e)) (hr1 : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidabl
cert|CurveFieldProofs.verify_accepts_iff_decompress|cone=Classical.choice,Quot.sound,ed25519.Signature,ed25519.Signature.to_bytes,propext,signature.error.Error,signature.error.Error.new,verifying.sha512_hash3|type=∀ (key : ed25519_dalek.verifying.VerifyingKey) (msg : Aeneas.Std.Slice.{0} Aeneas.Std.U8) (sig : ed25519.Signature) (val : ed25519_dalek.signature.InternalSignature) (er : curve25519_dalek.edwards.CompressedEdwardsY) (e r1 : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (hparse : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error)) (ed25519_dalek.signature.InternalSignature.Insts.CoreConvertTryFromShared0SignatureError.try_from sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error val))) (hrec : @Eq.{1} (Aeneas.Std.Result.{0} curve25519_dalek.edwards.CompressedEdwardsY) (ed25519_dalek.verifying.recompute_r_sha512 key val msg) (@Aeneas.Std.Result.ok.{0} curve25519_dalek.edwards.CompressedEdwardsY er)) (he : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes er) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) e)) (hr1 : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decida
spec|CurveFieldProofs.Bnd|def|value=fun (a : CurveFieldProofs.Fe) (c : Nat) => CurveFieldProofs.feVal.match_1.{1} (fun (x : List.{0} Aeneas.Std.U64) => Prop) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (fun (a0 a1 a2 a3 a4 : Aeneas.Std.U64) => And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) c) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) c) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) c) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) c) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) c))))) fun (x : List.{0} Aeneas.Std.U64) => False
spec|CurveFieldProofs.ComplPoint|def|value=curve25519_dalek.backend.serial.curve_models.CompletedPoint
spec|CurveFieldProofs.EdPoint|def|value=curve25519_dalek.edwards.EdwardsPoint
spec|CurveFieldProofs.ExtValid|def|value=fun (Pt : CurveFieldProofs.EdPoint) => And (CurveFieldProofs.Bnd (curve25519_dalek.edwards.EdwardsPoint.X Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.edwards.EdwardsPoint.Y Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.edwards.EdwardsPoint.Z Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.edwards.EdwardsPoint.T Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Z Pt)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (@Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.X Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Y Pt))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Z Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.T Pt))))))))
spec|CurveFieldProofs.Fe|def|value=curve25519_dalek.backend.serial.u64.field.FieldElement51
spec|CurveFieldProofs.Fp|def|value=ZMod CurveFieldProofs.P
spec|CurveFieldProofs.IsEdwardsImplementation|other|type=Prop
spec|CurveFieldProofs.IsFieldImplementation|other|type=Prop
spec|CurveFieldProofs.IsNielsOf|def|value=fun (N : CurveFieldProofs.ProjNiels) (Pt : CurveFieldProofs.EdPoint) => And (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Y_plus_X N)) (@HAdd.hAdd.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHAdd.{0} CurveFieldProofs.Fp (@Distrib.toAdd.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Y Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.X Pt)))) (And (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Y_minus_X N)) (@HSub.hSub.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHSub.{0} CurveFieldProofs.Fp (@SubNegMonoid.toSub.{0} CurveFieldProofs.Fp (@AddGroup.toSubNegMonoid.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddGroup.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Y Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.X Pt)))) (And (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Z N)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Z Pt))) (@Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 121666) (@instOfNatAtLeastTwo.{0} CurveFieldProofs.Fp (nat_lit 121666) (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))) CurveFieldProofs.IsNielsOf._proof_1)) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.T2d N))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@Neg.neg.{0} CurveFieldProofs.Fp (@NegZeroClass.toNeg.{0} CurveFieldProofs.Fp (@SubNegZeroMonoid.toNegZeroClass.{0} CurveFieldProofs.Fp (@SubtractionMonoid.toSubNegZeroMonoid.{0} CurveFieldProofs.Fp (@SubtractionCommMonoid.toSubtractionMonoid.{0} CurveFieldProofs.Fp (@AddCommGroup.toDivisionAddCommMonoid.{0} CurveFieldProofs.Fp (@Ring.toAddCommGroup.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField Curve
spec|CurveFieldProofs.IsNielsOf._proof_1|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 121665) (instOfNatNat (nat_lit 121665))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))))
spec|CurveFieldProofs.IsNielsOf._proof_2|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 243329) (instOfNatNat (nat_lit 243329))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))))
spec|CurveFieldProofs.NafDigits|def|value=fun (a : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) CurveFieldProofs.nafDigit._proof_1)) => ∀ (k : Nat), @LT.lt.{0} Nat instLTNat k (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) → And (Or (@Eq.{1} Int (CurveFieldProofs.nafDigit a k) (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0)))) (@Eq.{1} Int (@HMod.hMod.{0, 0, 0} Int Int Int (@instHMod.{0} Int Int.instMod) (CurveFieldProofs.nafDigit a k) (@OfNat.ofNat.{0} Int (nat_lit 2) (@instOfNat (nat_lit 2)))) (@OfNat.ofNat.{0} Int (nat_lit 1) (@instOfNat (nat_lit 1))))) (And (@LT.lt.{0} Int Int.instLTInt (@Neg.neg.{0} Int Int.instNegInt (@OfNat.ofNat.{0} Int (nat_lit 16) (@instOfNat (nat_lit 16)))) (CurveFieldProofs.nafDigit a k)) (@LT.lt.{0} Int Int.instLTInt (CurveFieldProofs.nafDigit a k) (@OfNat.ofNat.{0} Int (nat_lit 16) (@instOfNat (nat_lit 16)))))
spec|CurveFieldProofs.NafEntryOf|def|value=fun (e : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (A : CurveFieldProofs.EdPoint) (k : Nat) => And (CurveFieldProofs.ProjNielsValid e) (@Exists.{1} CurveFieldProofs.EdPoint fun (Q : CurveFieldProofs.EdPoint) => And (CurveFieldProofs.IsNielsOf e Q) (And (CurveFieldProofs.ExtValid Q) (And (CurveFieldProofs.OnCurveExt Q) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (CurveFieldProofs.edPt Q) (CurveFieldProofs.edOdd k (CurveFieldProofs.edPt A))))))
spec|CurveFieldProofs.NafTableOf|def|value=fun (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (A : CurveFieldProofs.EdPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e0 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e1 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e2 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e3 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e4 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e5 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e6 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e7 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => And (@Eq.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (CurveFieldProofs.tblEntries tbl) (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e0 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e1 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e2 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e3 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e4 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e5 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e6 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e7 (@List.nil.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint)))))))))) (And (CurveFieldProofs.NafEntryOf e0 A (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (And (CurveFieldProofs.NafEntryOf e1 A (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (CurveFieldProofs.NafEntryOf e2 A (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (And (CurveFieldProofs.NafEntryOf e3 A (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3)))) (And (CurveFieldProofs.NafEntryOf e4 A (@OfNat.ofNat.{0} Nat (nat_lit 4) (instOfNatNat (nat_lit 4)))) (And (CurveFieldProofs.NafEntryOf e5 A (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5)))) (And (CurveFieldProofs.NafEntryOf e6 A (@OfNat.ofNat.{0} Nat (nat_lit 6) (instOfNatNat (nat_lit 6)))) (CurveFieldProofs.NafEntryOf e7 A (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7)))))))))))
spec|CurveFieldProofs.OnCurve|def|value=fun (x y : CurveFieldProofs.Fp) => @Eq.{1} CurveFieldProofs.Fp (@HAdd.hAdd.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHAdd.{0} CurveFieldProofs.Fp (@Distrib.toAdd.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@Neg.neg.{0} CurveFieldProofs.Fp (@NegZeroClass.toNeg.{0} CurveFieldProofs.Fp (@SubNegZeroMonoid.toNegZeroClass.{0} CurveFieldProofs.Fp (@SubtractionMonoid.toSubNegZeroMonoid.{0} CurveFieldProofs.Fp (@SubtractionCommMonoid.toSubtractionMonoid.{0} CurveFieldProofs.Fp (@AddCommGroup.toDivisionAddCommMonoid.{0} CurveFieldProofs.Fp (@Ring.toAddCommGroup.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) x (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) y (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))))) (@HAdd.hAdd.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHAdd.{0} CurveFieldProofs.Fp (@Distrib.toAdd.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 1) (@One.toOfNat1.{0} CurveFieldProofs.Fp (@AddMonoidWithOne.toOne.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRi
spec|CurveFieldProofs.OnCurveExt|def|value=fun (P : CurveFieldProofs.EdPoint) => CurveFieldProofs.OnCurve (CurveFieldProofs.edX P) (CurveFieldProofs.edY P)
spec|CurveFieldProofs.P|def|value=@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255)))) (@OfNat.ofNat.{0} Nat (nat_lit 19) (instOfNatNat (nat_lit 19)))
spec|CurveFieldProofs.ProjNiels|def|value=curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint
spec|CurveFieldProofs.ProjNielsValid|def|value=fun (N : CurveFieldProofs.ProjNiels) => And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Y_plus_X N) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 53) (instOfNatNat (nat_lit 53))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Y_minus_X N) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 53) (instOfNatNat (nat_lit 53))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Z N) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.T2d N) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Z N)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))))))
spec|CurveFieldProofs.ProjPoint|def|value=curve25519_dalek.backend.serial.curve_models.ProjectivePoint
spec|CurveFieldProofs.ProjValid|def|value=fun (Pt : CurveFieldProofs.ProjPoint) => And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.X Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Y Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Z Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Z Pt)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P))))))))))))
spec|CurveFieldProofs.bytesVal|def|value=fun (s : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.bytesVal._proof_1)) => CurveFieldProofs.bytesVal.match_1.{1} (fun (x : List.{0} Aeneas.Std.U8) => Nat) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.bytesVal._proof_1))) s) (fun (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) => @HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat
spec|CurveFieldProofs.bytesVal._proof_1|prop|type=@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)
spec|CurveFieldProofs.bytesVal._sparseCasesOn_1|def|value=fun {α : Type u} {motive : (t : List.{u} α) → Sort u_1} (t : List.{u} α) (cons : (head : α) → (tail : List.{u} α) → motive (@List.cons.{u} α head tail)) => @List.rec.{u_1, u} α (fun (t : List.{u} α) => ((h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α t)) → motive t) → motive t) (fun («else» : (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α (@List.nil.{u} α))) → motive (@List.nil.{u} α)) => «else» (@Nat.ne_of_beq_eq_false (Nat.land (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (Nat.shiftRight (nat_lit 2) (nat_lit 0))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Eq.refl.{1} Bool Bool.false))) (fun (head : α) (tail : List.{u} α) (tail_ih : ((h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α tail)) → motive tail) → motive tail) («else» : (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α (@List.cons.{u} α head tail))) → motive (@List.cons.{u} α head tail)) => cons head tail) t
spec|CurveFieldProofs.bytesVal._sparseCasesOn_2|def|value=fun {α : Type u} {motive : (t : List.{u} α) → Sort u_1} (t : List.{u} α) (nil : motive (@List.nil.{u} α)) => @List.rec.{u_1, u} α (fun (t : List.{u} α) => ((h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α t)) → motive t) → motive t) (fun («else» : (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α (@List.nil.{u} α))) → motive (@List.nil.{u} α)) => nil) (fun (head : α) (tail : List.{u} α) (tail_ih : ((h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α tail)) → motive tail) → motive tail) («else» : (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α (@List.cons.{u} α head tail))) → motive (@List.cons.{u} α head tail)) => «else» (@Nat.ne_of_beq_eq_false (Nat.land (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (Nat.shiftRight (nat_lit 1) (nat_lit 1))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Eq.refl.{1} Bool Bool.false))) t
spec|CurveFieldProofs.bytesVal.match_1|def|value=fun (motive : List.{0} Aeneas.Std.U8 → Sort u_1) (x : List.{0} Aeneas.Std.U8) (h_1 : (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) → motive (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (h_2 : (x : List.{0} Aeneas.Std.U8) → motive x) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive x) x (fun (head : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head x)) tail (fun (head_1 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 x))) tail (fun (head_2 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 x)))) tail (fun (head_3 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 x))))) tail (fun (head_4 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 x)))))) tail (fun (head_5 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 x))))))) tail (fun (head_6 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 x)))))))) tail (fun (head_7 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8)
spec|CurveFieldProofs.complX|def|value=fun (Pt : CurveFieldProofs.ComplPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X Pt)) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z Pt))
spec|CurveFieldProofs.complY|def|value=fun (Pt : CurveFieldProofs.ComplPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y Pt)) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T Pt))
spec|CurveFieldProofs.denote|def|value=fun (a : CurveFieldProofs.Fe) => @Nat.cast.{0} CurveFieldProofs.Fp (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@CommRing.toRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P))))) (CurveFieldProofs.feVal a)
spec|CurveFieldProofs.dsmFold|def|value=fun (aD bD : Nat → Int) (pA pB x : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x_1 : Nat) => @Nat.brecOn.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x_1 (CurveFieldProofs.dsmFold._f aD bD pA pB) x
spec|CurveFieldProofs.dsmFold._f|def|value=fun (aD bD : Nat → Int) (pA pB : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x : Nat) (f : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x) (x_1 : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => CurveFieldProofs.dsmFold.match_1.{1} (fun (x : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x_2 : Nat) => @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x_2 → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x_1 x (fun (P : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) => P) (fun (P : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (j : Nat) (x : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (Nat.succ j)) => x.1 (CurveFieldProofs.edDigit pB (bD j) (CurveFieldProofs.edDigit pA (aD j) (CurveFieldProofs.edAdd P P)))) f
spec|CurveFieldProofs.dsmFold.match_1|def|value=fun (motive : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Nat → Sort u_1) (x : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x_1 : Nat) (h_1 : (P : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) → motive P (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (h_2 : (P : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) → (j : Nat) → motive P (Nat.succ j)) => @Nat.casesOn.{u_1} (fun (x_2 : Nat) => motive x x_2) x_1 (h_1 x) fun (n : Nat) => h_2 x n
spec|CurveFieldProofs.edAdd|def|value=fun (p q : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => @Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (@HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (@HAdd.hAdd.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHAdd.{0} CurveFieldProofs.Fp (@Distrib.toAdd.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp q)) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp q) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p))) (@HAdd.hAdd.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHAdd.{0} CurveFieldProofs.Fp (@Distrib.toAdd.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 1) (@One.toOfNat1.{0} CurveFieldProofs.Fp (@AddMonoidWithOne.toOne.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonA
spec|CurveFieldProofs.edBasePt|def|value=@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 15112221349535400772501151409588531511454012693041857206046113283949847762202) (@instOfNatAtLeastTwo.{0} CurveFieldProofs.Fp (nat_lit 15112221349535400772501151409588531511454012693041857206046113283949847762202) (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))) CurveFieldProofs.edBasePt._proof_1)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 46316835694926478169428394003475163141307993866256225615783033603165251855960) (@instOfNatAtLeastTwo.{0} CurveFieldProofs.Fp (nat_lit 46316835694926478169428394003475163141307993866256225615783033603165251855960) (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))) CurveFieldProofs.edBasePt._proof_2))
spec|CurveFieldProofs.edBasePt._proof_1|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 15112221349535400772501151409588531511454012693041857206046113283949847762201) (instOfNatNat (nat_lit 15112221349535400772501151409588531511454012693041857206046113283949847762201))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))))
spec|CurveFieldProofs.edBasePt._proof_2|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 46316835694926478169428394003475163141307993866256225615783033603165251855959) (instOfNatNat (nat_lit 46316835694926478169428394003475163141307993866256225615783033603165251855959))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))))
spec|CurveFieldProofs.edD|def|value=@HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (@Neg.neg.{0} CurveFieldProofs.Fp (@NegZeroClass.toNeg.{0} CurveFieldProofs.Fp (@SubNegZeroMonoid.toNegZeroClass.{0} CurveFieldProofs.Fp (@SubtractionMonoid.toSubNegZeroMonoid.{0} CurveFieldProofs.Fp (@SubtractionCommMonoid.toSubtractionMonoid.{0} CurveFieldProofs.Fp (@AddCommGroup.toDivisionAddCommMonoid.{0} CurveFieldProofs.Fp (@Ring.toAddCommGroup.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 121665) (@instOfNatAtLeastTwo.{0} CurveFieldProofs.Fp (nat_lit 121665) (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))) CurveFieldProofs.edD._proof_1))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 121666) (@instOfNatAtLeastTwo.{0} CurveFieldProofs.Fp (nat_lit 121666) (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))) CurveFieldProofs.edD._proof_2))
spec|CurveFieldProofs.edD._proof_1|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 121664) (instOfNatNat (nat_lit 121664))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))))
spec|CurveFieldProofs.edD._proof_2|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 121665) (instOfNatNat (nat_lit 121665))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))))
spec|CurveFieldProofs.edDigit|def|value=fun (aPt : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (d : Int) (P : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => @ite.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@LT.lt.{0} Int Int.instLTInt (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0))) d) (Int.decLt (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0))) d) (CurveFieldProofs.edAdd P (CurveFieldProofs.edOdd (@HDiv.hDiv.{0, 0, 0} Nat Nat Nat (@instHDiv.{0} Nat Nat.instDiv) (@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (Int.toNat d) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) aPt)) (@ite.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@LT.lt.{0} Int Int.instLTInt d (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0)))) (Int.decLt d (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0)))) (CurveFieldProofs.edAdd P (CurveFieldProofs.edNeg (CurveFieldProofs.edOdd (@HDiv.hDiv.{0, 0, 0} Nat Nat Nat (@instHDiv.{0} Nat Nat.instDiv) (@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (Int.toNat (@Neg.neg.{0} Int Int.instNegInt d)) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) aPt))) P)
spec|CurveFieldProofs.edId|def|value=@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P))))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 1) (@One.toOfNat1.{0} CurveFieldProofs.Fp (@AddMonoidWithOne.toOne.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))))))
spec|CurveFieldProofs.edNeg|def|value=fun (p : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => @Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (@Neg.neg.{0} CurveFieldProofs.Fp (@NegZeroClass.toNeg.{0} CurveFieldProofs.Fp (@SubNegZeroMonoid.toNegZeroClass.{0} CurveFieldProofs.Fp (@SubtractionMonoid.toSubNegZeroMonoid.{0} CurveFieldProofs.Fp (@SubtractionCommMonoid.toSubtractionMonoid.{0} CurveFieldProofs.Fp (@AddCommGroup.toDivisionAddCommMonoid.{0} CurveFieldProofs.Fp (@Ring.toAddCommGroup.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))))))) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p)) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p)
spec|CurveFieldProofs.edOdd|def|value=fun (x : Nat) (x_1 : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => @Nat.brecOn.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x CurveFieldProofs.edOdd._f x_1
spec|CurveFieldProofs.edOdd._f|def|value=fun (x : Nat) (f : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x) (x_1 : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => CurveFieldProofs.edOdd.match_1.{1} (fun (x : Nat) (x_2 : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x x_1 (fun (p : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) => p) (fun (k : Nat) (p : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (Nat.succ k)) => CurveFieldProofs.edAdd (CurveFieldProofs.edAdd p p) (x.1 p)) f
spec|CurveFieldProofs.edOdd.match_1|def|value=fun (motive : Nat → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Sort u_1) (x : Nat) (x_1 : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (h_1 : (p : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) → motive (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) p) (h_2 : (k : Nat) → (p : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) → motive (Nat.succ k) p) => @Nat.casesOn.{u_1} (fun (x : Nat) => motive x x_1) x (h_1 x_1) fun (n : Nat) => h_2 n x_1
spec|CurveFieldProofs.edPt|def|value=fun (P : CurveFieldProofs.EdPoint) => @Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.edX P) (CurveFieldProofs.edY P)
spec|CurveFieldProofs.edX|def|value=fun (Pt : CurveFieldProofs.EdPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.X Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Z Pt))
spec|CurveFieldProofs.edY|def|value=fun (Pt : CurveFieldProofs.EdPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Y Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Z Pt))
spec|CurveFieldProofs.feVal|def|value=fun (a : CurveFieldProofs.Fe) => CurveFieldProofs.feVal.match_1.{1} (fun (x : List.{0} Aeneas.Std.U64) => Nat) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (fun (a0 a1 a2 a3 a4 : Aeneas.Std.U64) => CurveFieldProofs.limbsVal a0 a1 a2 a3 a4) fun (x : List.{0} Aeneas.Std.U64) => @OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))
spec|CurveFieldProofs.feVal._sparseCasesOn_1|def|value=fun {α : Type u} {motive : (t : List.{u} α) → Sort u_1} (t : List.{u} α) (cons : (head : α) → (tail : List.{u} α) → motive (@List.cons.{u} α head tail)) => @List.rec.{u_1, u} α (fun (t : List.{u} α) => ((h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α t)) → motive t) → motive t) (fun («else» : (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α (@List.nil.{u} α))) → motive (@List.nil.{u} α)) => «else» (@Nat.ne_of_beq_eq_false (Nat.land (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (Nat.shiftRight (nat_lit 2) (nat_lit 0))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Eq.refl.{1} Bool Bool.false))) (fun (head : α) (tail : List.{u} α) (tail_ih : ((h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α tail)) → motive tail) → motive tail) («else» : (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α (@List.cons.{u} α head tail))) → motive (@List.cons.{u} α head tail)) => cons head tail) t
spec|CurveFieldProofs.feVal._sparseCasesOn_2|def|value=fun {α : Type u} {motive : (t : List.{u} α) → Sort u_1} (t : List.{u} α) (nil : motive (@List.nil.{u} α)) => @List.rec.{u_1, u} α (fun (t : List.{u} α) => ((h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α t)) → motive t) → motive t) (fun («else» : (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α (@List.nil.{u} α))) → motive (@List.nil.{u} α)) => nil) (fun (head : α) (tail : List.{u} α) (tail_ih : ((h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α tail)) → motive tail) → motive tail) («else» : (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α (@List.cons.{u} α head tail))) → motive (@List.cons.{u} α head tail)) => «else» (@Nat.ne_of_beq_eq_false (Nat.land (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (Nat.shiftRight (nat_lit 1) (nat_lit 1))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Eq.refl.{1} Bool Bool.false))) t
spec|CurveFieldProofs.feVal.match_1|def|value=fun (motive : List.{0} Aeneas.Std.U64 → Sort u_1) (x : List.{0} Aeneas.Std.U64) (h_1 : (a0 a1 a2 a3 a4 : Aeneas.Std.U64) → motive (@List.cons.{0} Aeneas.Std.U64 a0 (@List.cons.{0} Aeneas.Std.U64 a1 (@List.cons.{0} Aeneas.Std.U64 a2 (@List.cons.{0} Aeneas.Std.U64 a3 (@List.cons.{0} Aeneas.Std.U64 a4 (@List.nil.{0} Aeneas.Std.U64))))))) (h_2 : (x : List.{0} Aeneas.Std.U64) → motive x) => @CurveFieldProofs.feVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive x) x (fun (head : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @CurveFieldProofs.feVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head x)) tail (fun (head_1 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @CurveFieldProofs.feVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 x))) tail (fun (head_2 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @CurveFieldProofs.feVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 x)))) tail (fun (head_3 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @CurveFieldProofs.feVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 x))))) tail (fun (head_4 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @CurveFieldProofs.feVal._sparseCasesOn_2.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 (@List.cons.{0} Aeneas.Std.U64 head_4 x)))))) tail (h_1 head head_1 head_2 head_3 head_4) fun (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 (@List.cons.{0} Aeneas.Std.U64 head_4 tail)))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 tail))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 tail)))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 tail))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head tail)) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 x)) => h_2 x
spec|CurveFieldProofs.fe_to_bytes|def|value=curve25519_dalek.backend.serial.u64.field.FieldElement51.as_bytes
spec|CurveFieldProofs.instDecidableRangeEq|def|value=fun (e r : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1)) (n : Nat) => have this : Iff (CurveFieldProofs.rangeEq e r n) (∀ (j : Nat), @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j)) := CurveFieldProofs.instDecidableRangeEq._proof_1 e r n; @decidable_of_iff (CurveFieldProofs.rangeEq e r n) (∀ (j : Nat), @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j)) (CurveFieldProofs.instDecidableRangeEq._proof_2 e r n this) (@Nat.decidableBallLT (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (fun (j : Nat) (a : @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))) => @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e)
spec|CurveFieldProofs.instDecidableRangeEq._proof_1|prop|type=∀ (e r : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (n : Nat), Iff (CurveFieldProofs.rangeEq e r n) (∀ (j : Nat), @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j))
spec|CurveFieldProofs.instDecidableRangeEq._proof_2|prop|type=∀ (e r : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1)) (n : Nat) (this : Iff (CurveFieldProofs.rangeEq e r n) (∀ (j : Nat), @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j))), Iff (∀ (j : Nat), @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j)) (CurveFieldProofs.rangeEq e r n)
spec|CurveFieldProofs.instFactPrimeP|prop|type=Fact (Nat.Prime CurveFieldProofs.P)
spec|CurveFieldProofs.limbsVal|def|value=fun (a0 a1 a2 a3 a4 : Aeneas.Std.U64) => @HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 51) (instOfNatNat (nat_lit 51)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 102) (instOfNatNat (nat_lit 102)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 153) (instOfNatNat (nat_lit 153)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 204) (instOfNatNat (nat_lit 204)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4))
spec|CurveFieldProofs.nafDigit|def|value=fun (a : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) CurveFieldProofs.nafDigit._proof_1)) (k : Nat) => @Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.I8) Nat Aeneas.Std.I8 (fun («as» : List.{0} Aeneas.Std.I8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.I8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.I8) (Aeneas.Std.instInhabitedIScalar Aeneas.Std.IScalarTy.I8) (@Subtype.val.{1} (List.{0} Aeneas.Std.I8) (fun (l : List.{0} Aeneas.Std.I8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.I8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) CurveFieldProofs.nafDigit._proof_1))) a) k)
spec|CurveFieldProofs.nafDigit._proof_1|prop|type=@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)
spec|CurveFieldProofs.nafSum|def|value=fun (naf : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) CurveFieldProofs.nafSum._proof_1)) (m : Nat) => @Finset.sum.{0, 0} Nat Int Int.instAddCommMonoid (Finset.range m) fun (k : Nat) => @HMul.hMul.{0, 0, 0} Int Int Int (@instHMul.{0} Int Int.instMul) (CurveFieldProofs.nafDigit naf k) (@HPow.hPow.{0, 0, 0} Int Nat Int (@instHPow.{0, 0} Int Nat (@Monoid.toPow.{0} Int Int.instMonoid)) (@OfNat.ofNat.{0} Int (nat_lit 2) (@instOfNat (nat_lit 2))) k)
spec|CurveFieldProofs.nafSum._proof_1|prop|type=@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)
spec|CurveFieldProofs.projX|def|value=fun (Pt : CurveFieldProofs.ProjPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.X Pt)) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Z Pt))
spec|CurveFieldProofs.projY|def|value=fun (Pt : CurveFieldProofs.ProjPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Y Pt)) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Z Pt))
spec|CurveFieldProofs.rangeEq|def|value=fun (e r : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1)) (n : Nat) => ∀ (j : Nat), @LE.le.{0} Nat instLENat n j → @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j)
spec|CurveFieldProofs.rangeEq._proof_1|prop|type=@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)
spec|CurveFieldProofs.tblEntries|def|value=fun (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Subtype.val.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (fun (l : List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Eq.{1} Nat (@List.length.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) curve25519_dalek.window.NafLookupTable5._proof_1))) tbl
spec|ScalarProofs.Ell|def|value=@OfNat.ofNat.{0} Nat (nat_lit 7237005577332262213973186563042994240857116359379907606001950938285454250989) (instOfNatNat (nat_lit 7237005577332262213973186563042994240857116359379907606001950938285454250989))
Reference in a new issue Copy permalink