Add scalar-layer foundation (Scalar52 arithmetic mod ℓ)
Transpile the Scalar52 limb backend (backend::serial::u64::scalar
add/sub/mul/square/montgomery_*) from Rust to Lean via Charon/Aeneas,
scoped at the function level to the iterator-free arithmetic core.
- verification/extract-scalar.sh: function-level Charon/Aeneas extraction
- verification/gen/CurveScalar/{Types,Funs}.lean: transpiled model (27 defs).
This fork (v4.1.2) implements Scalar52::sub's constant-time conditional add
with a pure arithmetic mask (constants::L[i] & underflow_mask), so the
extraction pulls in NO external functions or types (unlike v5 dalek, which
routes sub through subtle, and v4.1.3, which uses a local black_box).
- verification/gen/CurveScalar/{TypesExternal,FunsExternal}.lean: decl-free
stub modules kept so the check manifest is uniform across forks.
- verification/Proofs/ScalarDenote.lean: semantic foundation — Scalar52
denotation into ℤ/ℓℤ, limb-bound invariant, and L_val (the transpiled
constants::L denotes exactly the group order ℓ, kernel-checked).
- verification/check-scalar.sh: guarded compile of the gen modules plus the
denotation foundation.
check-scalar.sh passes: gen compiles; denotation + L = ℓ proven.
add/sub/mul remain in progress.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-02 19:27:33 +00:00
|
|
|
|
#!/usr/bin/env bash
|
|
|
|
|
|
# Regenerate the SCALAR-layer Lean model (gen/CurveScalar) from Rust.
|
|
|
|
|
|
#
|
|
|
|
|
|
# SCOPE: the Scalar52 limb backend (backend::serial::u64::scalar) — the
|
|
|
|
|
|
# iterator-free ARITHMETIC core: add/sub/mul/square/montgomery_reduce/
|
|
|
|
|
|
# from_bytes/to_bytes mod ℓ = 2²⁵² + 27742317777372353535851937790883648493.
|
|
|
|
|
|
# The high-level crate::scalar wrapper (Sum/Product/NAF/radix/byte-parsing,
|
|
|
|
|
|
# all iterator-heavy) is brought in only for the signature layer.
|
|
|
|
|
|
set -euo pipefail
|
|
|
|
|
|
source ~/aeneas-toolchain/env.sh
|
|
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
|
|
CRATE=~/GitClone/FormalVerification/sources/betrusted-curve25519-dalek-source/curve25519-dalek
|
|
|
|
|
|
|
|
|
|
|
|
echo "[1/2] charon: Rust -> LLBC (scalar + Scalar52)"
|
|
|
|
|
|
cd "$CRATE"
|
|
|
|
|
|
charon cargo --preset=aeneas \
|
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::add' \
|
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::sub' \
|
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::mul' \
|
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::square' \
|
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::montgomery_mul' \
|
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::montgomery_square' \
|
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::montgomery_reduce' \
|
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::montgomery_invert' \
|
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::as_montgomery' \
|
|
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::from_montgomery' \
|
Signature layer, first bricks: canonicity closure + hash-to-scalar foundation
Canonicity pass (the layer is now closed under its own preconditions):
- sub_val_spec post carries the exact value equation
(exists beta <= 1, scVal r + scVal b = scVal a + ell*beta, with the
underflow guard beta = 1 -> scVal a < scVal b)
- add/montgomery_reduce/mul/aggregate posts all carry scVal r < ell:
canonical inputs give canonical outputs everywhere. Needed because
from_bytes_wide (hash-to-scalar) feeds Montgomery outputs into add.
Hash-to-scalar foundation (toward Scalar::from_hash / EdDSA verify):
- extraction scope + from_bytes_wide (brings constants::R); regenerated gen
- source repos carry a documented Aeneas-compat patch: the bare
`hi[4] = words[7] >> 20` extracts ill-typed at pin bf13c42e; masked
(semantic no-op, words[7] >> 20 < 2^44)
- Proofs/ScalarWideSpec.lean: R constant lemmas (R = 2^260 mod ell,
witness 2^260 = R + 255*ell) and montgomery_mul_spec, the single
Montgomery round: [r]*2^260 = [a]*[b], canonical bounded output
check-scalar.sh: 10 proof files, 11 kernel audits, all exactly
[propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-03 21:18:34 +00:00
|
|
|
|
--start-from 'crate::backend::serial::u64::scalar::_::from_bytes_wide' \
|
Add scalar-layer foundation (Scalar52 arithmetic mod ℓ)
Transpile the Scalar52 limb backend (backend::serial::u64::scalar
add/sub/mul/square/montgomery_*) from Rust to Lean via Charon/Aeneas,
scoped at the function level to the iterator-free arithmetic core.
- verification/extract-scalar.sh: function-level Charon/Aeneas extraction
- verification/gen/CurveScalar/{Types,Funs}.lean: transpiled model (27 defs).
This fork (v4.1.2) implements Scalar52::sub's constant-time conditional add
with a pure arithmetic mask (constants::L[i] & underflow_mask), so the
extraction pulls in NO external functions or types (unlike v5 dalek, which
routes sub through subtle, and v4.1.3, which uses a local black_box).
- verification/gen/CurveScalar/{TypesExternal,FunsExternal}.lean: decl-free
stub modules kept so the check manifest is uniform across forks.
- verification/Proofs/ScalarDenote.lean: semantic foundation — Scalar52
denotation into ℤ/ℓℤ, limb-bound invariant, and L_val (the transpiled
constants::L denotes exactly the group order ℓ, kernel-checked).
- verification/check-scalar.sh: guarded compile of the gen modules plus the
denotation foundation.
check-scalar.sh passes: gen compiles; denotation + L = ℓ proven.
add/sub/mul remain in progress.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-02 19:27:33 +00:00
|
|
|
|
--dest-file "$HERE/CurveScalar.llbc" \
|
|
|
|
|
|
-- --no-default-features
|
|
|
|
|
|
|
|
|
|
|
|
echo "[2/2] aeneas: LLBC -> Lean (split files, CurveScalar.* modules)"
|
|
|
|
|
|
cd "$HERE"
|
|
|
|
|
|
aeneas -backend lean -split-files -subdir CurveScalar -dest gen CurveScalar.llbc
|
|
|
|
|
|
echo "Done."
|