From c848a490ff5f369f3c3b83d3394ad63874162863 Mon Sep 17 00:00:00 2001 From: mrwulf Date: Wed, 29 Jul 2026 00:38:22 +0200 Subject: [PATCH] verification: bind the statements, the specifications, and the model (P1-a) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Phases 3/3b establish what each certificate RESTS ON. Neither says what it SAYS, nor what it is ABOUT. A certificate gutted to a tautology of the same axiom cone passes both; so does one whose reference definition has been redefined to BE the extracted code, at which point the theorem reads `loop = loop` and every cone is byte-identical. Phase 3c closes that. Proofs/Audit.lean emits a canonical block holding the policy constants, every certificate's fully-elaborated statement (pp.all, so implicit arguments, instances and universe levels are visible), and the body of every specification constant transitively reachable from those statements. Its SHA-256 is pinned in check.sh and the block itself is committed as AUDIT-MANIFEST.txt, so a mismatch is DIFFED, not merely reported. 31 certificates, 68 specification constants per repository. Two tiers, not one. These forks have an arithmetic tier that must stay oracle-free and an apex tier carrying this fork's hash and wire-format axioms, and the apex boundary genuinely differs per fork (dalek 8 extra names, anza 4, risc0 and betrusted 5). One shared constant would have widened the arithmetic tier to accept hash oracles, which is the most valuable property these repos have. Each auditor is generated from its own repository's policy. Phase 0b pins the extracted model. This was not a precaution: risc0 and betrusted were observed emitting BYTE-IDENTICAL audit-manifest digests (6c821b8e…) while shipping demonstrably different extracted models, their point-doubling routines differing in operation order. A statement names an extracted function; it does not contain that function's body. Binding statements is not binding the subject. Membership derives from the filesystem, so a new model file fails closed. selftest-statements.sh attacks both phases with ten cases, each asserting a specific diagnostic: an edited model body, an unlisted model file, a widened policy, a hand-edited committed block, a certificate dropped from the auditor WITH the digest refreshed to match, and a gutted statement whose cone is unchanged. It lifts the phases out of check.sh at run time, so it attacks the shipping gate rather than a copy. Two bugs found and fixed during that testing, both mine: Phase 3c read `$0` after `cd "$AENEAS_LEAN"`, and $0 is the caller's relative path; and the axgate self-test compared the tree against a pristine checkout rather than against how it found it. A third expectation was wrong rather than the code — widening the apex boundary is caught by the exact-cone requirement before the digest ever runs, which is a stronger rejection, and the test now says so. All sixteen runs green at these commits: four main buttons, four axgate self-tests, four binding self-tests, four scalar buttons. TRUSTED-BASE.md records what this binds and, at equal length, what it does not: a digest binds identity, not meaning; an author can rotate the pins in one commit and is caught by review, not by the script; and pinning the model says nothing about whether Charon and Aeneas translated the Rust faithfully. Co-Authored-By: Claude Opus 4.8 --- TRUSTED-BASE.md | 32 ++++ verification/AUDIT-MANIFEST.txt | 100 +++++++++++ verification/GEN-MODEL.sha256 | 12 ++ verification/Proofs/Audit.lean | 234 +++++++++++++++++++++++++ verification/check.sh | 143 +++++++++++++++ verification/selftest-axgate.sh | 19 +- verification/selftest-statements.sh | 261 ++++++++++++++++++++++++++++ 7 files changed, 796 insertions(+), 5 deletions(-) create mode 100644 verification/AUDIT-MANIFEST.txt create mode 100644 verification/GEN-MODEL.sha256 create mode 100644 verification/Proofs/Audit.lean create mode 100755 verification/selftest-statements.sh diff --git a/TRUSTED-BASE.md b/TRUSTED-BASE.md index 3bac923..c09081c 100644 --- a/TRUSTED-BASE.md +++ b/TRUSTED-BASE.md @@ -53,3 +53,35 @@ running Rust code. Everything else is machine-checked. theorem says what its name — or this document — suggests it says. A theorem gutted to a tautology with the same axiom cone would pass every phase. Reading the statements remains a human act. +8. **What the statement binding covers.** `check.sh` Phase 3c compiles + `Proofs/Audit.lean`, which emits a canonical block containing the policy + constants, every certificate's fully-elaborated statement (`pp.all`, so + implicit arguments, instances and universe levels are all visible), and the + fully-elaborated body of every specification constant transitively + reachable from those statements. The SHA-256 of that block is pinned in + `check.sh` and the block itself is committed as `AUDIT-MANIFEST.txt`, so a + mismatch is diffed rather than merely reported. This is what makes a + certificate gutted to a tautology of the same axiom cone fail, and what + makes a reference definition redefined to BE the extracted code fail — two + attacks that move no cone at all. Phase 0b separately pins the bytes of + every extracted-model file under `gen/`, with membership derived from the + filesystem so a new model file fails closed. + + **The residue you must still supply yourself.** Three things, stated + plainly because a reader would otherwise assume them: + + · *A digest binds identity, not meaning.* The audit proves the statements + are the ones that were reviewed. Whether those statements say something + worth believing about ed25519 is a question only a human reading them + answers. `AUDIT-MANIFEST.txt` is committed precisely so that reading is + possible without re-running anything. + + · *An author can rotate the pins.* Editing a statement and refreshing the + digest in the same commit passes every phase. The defence is that both + changes are visible in the diff, reviewed at the pinned commit — not that + the script prevents it. No harness audits its own author. + + · *Phase 0b pins the model; it does not verify the translation.* That the + bytes under `gen/` are the reviewed bytes says nothing about whether + Charon and Aeneas translated the Rust faithfully. That assumption is + item 3 above and is unchanged. diff --git a/verification/AUDIT-MANIFEST.txt b/verification/AUDIT-MANIFEST.txt new file mode 100644 index 0000000..1e153c8 --- /dev/null +++ b/verification/AUDIT-MANIFEST.txt @@ -0,0 +1,100 @@ +policy|kernel3=Classical.choice,Quot.sound,propext|apexExtra=ed25519.Signature,ed25519.Signature.to_bytes,signature.error.Error,signature.error.Error.new,verifying.sha512_hash3|specPrefix=Proofs. +cert|CurveFieldProofs.fieldImplementation|cone=Classical.choice,Quot.sound,propext|type=CurveFieldProofs.IsFieldImplementation +cert|CurveFieldProofs.edwardsImplementation|cone=Classical.choice,Quot.sound,propext|type=CurveFieldProofs.IsEdwardsImplementation +cert|CurveFieldProofs.naf_table_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (A : CurveFieldProofs.EdPoint) (hA : CurveFieldProofs.ExtValid A) (hcA : CurveFieldProofs.OnCurveExt A), @Aeneas.Std.WP.spec.{0} (curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (curve25519_dalek.window.NafLookupTable5ProjectiveNielsPoint.Insts.CoreConvertFromSharedAEdwardsPoint.from A) fun (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e0 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e1 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e2 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e3 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e4 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e5 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e6 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e7 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => And (@Eq.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (CurveFieldProofs.tblEntries tbl) (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e0 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e1 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e2 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e3 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e4 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e5 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e6 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e7 (@List.nil.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint)))))))))) (And (CurveFieldProofs.NafEntryOf e0 A (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (And (CurveFieldProofs.NafEntryOf e1 A (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (CurveFieldProofs.NafEntryOf e2 A (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (And (CurveFieldProofs.NafEntryOf e3 A (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3)))) (And (CurveFieldProofs.NafEntryOf e4 A (@OfNat.ofNat.{0} Nat (nat_lit 4) (instOfNatNat (nat_lit 4)))) (And (CurveFieldProofs.NafEntryOf e5 A (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5)))) (And (CurveFieldProofs.NafEntryOf e6 A (@OfNat.ofNat.{0} Nat (nat_lit 6) (instOfNatNat (nat_lit 6)))) (CurveFieldProofs.NafEntryOf e7 A (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7))))))))))) +cert|CurveFieldProofs.naf_select_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (x : Aeneas.Std.Usize) (e0 e1 e2 e3 e4 e5 e6 e7 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (hl : @Eq.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (CurveFieldProofs.tblEntries tbl) (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e0 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e1 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e2 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e3 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e4 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e5 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e6 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e7 (@List.nil.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint)))))))))) (hodd : @Eq.{1} Nat (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (hlt : @LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint (@curve25519_dalek.window.NafLookupTable5.select curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreMarkerCopy tbl x) fun (r : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e0) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e1) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e2) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e3) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e4) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 11) (instOfNatNat (nat_lit 11))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e5) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 13) (instOfNatNat (nat_lit 13))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e6) (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize x) (@OfNat.ofNat.{0} Nat (nat_lit 15) (instOfNatNat (nat_lit 15))) → @Eq.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint r e7))))))) +cert|CurveFieldProofs.proj_double_law|cone=Classical.choice,Quot.sound,propext|type=∀ (p : CurveFieldProofs.ProjPoint) (hp : CurveFieldProofs.ProjValid p) (hcp : CurveFieldProofs.OnCurve (CurveFieldProofs.projX p) (CurveFieldProofs.projY p)), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.curve_models.CompletedPoint (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.double p) fun (t : curve25519_dalek.backend.serial.curve_models.CompletedPoint) => And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (And (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T t)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (And (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.complX t) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.edAdd (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.projX p) (CurveFieldProofs.projY p)) (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.projX p) (CurveFieldProofs.projY p))))) (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.complY t) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.edAdd (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.projX p) (CurveFieldProofs.projY p)) (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.projX p) (CurveFieldProofs.projY p))))))))))) +cert|CurveFieldProofs.compl_as_projective_law|cone=Classical.choice,Quot.sound,propext|type=∀ (p : CurveFieldProofs.ComplPoint) (hbX : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X p) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbY : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y p) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbZ : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z p) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbT : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T p) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hZ0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z p)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (hT0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T p)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.curve_models.ProjectivePoint (curve25519_dalek.backend.serial.curve_models.CompletedPoint.as_projective p) fun (r : curve25519_dalek.backend.serial.curve_models.ProjectivePoint) => And (CurveFieldProofs.ProjValid r) (And (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.projX r) (CurveFieldProofs.complX p)) (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.projY r) (CurveFieldProofs.complY p))) +cert|CurveFieldProofs.dsm_step_p_law|cone=Classical.choice,Quot.sound,propext|type=∀ (t : CurveFieldProofs.ComplPoint) (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (d : Aeneas.Std.I8) (A : CurveFieldProofs.EdPoint) (e0 e1 e2 e3 e4 e5 e6 e7 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (hl : @Eq.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (CurveFieldProofs.tblEntries tbl) (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e0 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e1 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e2 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e3 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e4 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e5 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e6 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e7 (@List.nil.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint)))))))))) (h0 : CurveFieldProofs.NafEntryOf e0 A (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (h1 : CurveFieldProofs.NafEntryOf e1 A (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (h2 : CurveFieldProofs.NafEntryOf e2 A (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (h3 : CurveFieldProofs.NafEntryOf e3 A (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3)))) (h4 : CurveFieldProofs.NafEntryOf e4 A (@OfNat.ofNat.{0} Nat (nat_lit 4) (instOfNatNat (nat_lit 4)))) (h5 : CurveFieldProofs.NafEntryOf e5 A (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5)))) (h6 : CurveFieldProofs.NafEntryOf e6 A (@OfNat.ofNat.{0} Nat (nat_lit 6) (instOfNatNat (nat_lit 6)))) (h7 : CurveFieldProofs.NafEntryOf e7 A (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7)))) (hbX : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbY : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbZ : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbT : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hZ0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (hT0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T t)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (hct : CurveFieldProofs.OnCurve (CurveFieldProofs.complX t) (CurveFieldProofs.complY t)) (hd : Or (@Eq.{1} Int (@Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 d) (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0)))) (@Eq.{1} Int (@HMod.hMod.{0, 0, 0} Int Int Int (@instHMod.{0} Int Int.instMod) (@Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 d) (@OfNat.ofNat.{0} Int (nat_lit 2) (@instOfNat (nat_lit 2)))) (@OfNat.ofNat.{0} Int (nat_lit 1) (@instOfNat (nat_lit 1))))) (hdlo : @LT.lt.{0} Int Int.instLTInt (@Neg.neg.{0} Int Int.instNegInt (@OfNat.ofNat.{0} Int (nat_lit 16) (@instOfNat (nat_lit 16)))) (@Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 d)) (hdhi : @LT.lt.{0} Int Int.instLTInt (@Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 d) (@OfNat.ofNat.{0} Int (nat_lit 16) (@instOfNat (nat_lit 16)))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.curve_models.CompletedPoint (curve25519_dalek.backend.serial.scalar_mul.vartime_double_base.dsm_step_p t tbl d) fun (r : curve25519_dalek.backend.serial.curve_models.CompletedPoint) => And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X r) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y r) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z r) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T r) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z r)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (And (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T r)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (And (CurveFieldProofs.OnCurve (CurveFieldProofs.complX r) (CurveFieldProofs.complY r)) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.complX r) (CurveFieldProofs.complY r)) (CurveFieldProofs.edDigit (CurveFieldProofs.edPt A) (@Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 d) (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.complX t) (CurveFieldProofs.complY t)))))))))) +cert|CurveFieldProofs.dsm_step_b_law|cone=Classical.choice,Quot.sound,propext|type=∀ (t : CurveFieldProofs.ComplPoint) (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (d : Aeneas.Std.I8) (A : CurveFieldProofs.EdPoint) (e0 e1 e2 e3 e4 e5 e6 e7 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (hl : @Eq.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (CurveFieldProofs.tblEntries tbl) (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e0 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e1 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e2 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e3 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e4 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e5 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e6 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e7 (@List.nil.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint)))))))))) (h0 : CurveFieldProofs.NafEntryOf e0 A (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (h1 : CurveFieldProofs.NafEntryOf e1 A (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (h2 : CurveFieldProofs.NafEntryOf e2 A (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (h3 : CurveFieldProofs.NafEntryOf e3 A (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3)))) (h4 : CurveFieldProofs.NafEntryOf e4 A (@OfNat.ofNat.{0} Nat (nat_lit 4) (instOfNatNat (nat_lit 4)))) (h5 : CurveFieldProofs.NafEntryOf e5 A (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5)))) (h6 : CurveFieldProofs.NafEntryOf e6 A (@OfNat.ofNat.{0} Nat (nat_lit 6) (instOfNatNat (nat_lit 6)))) (h7 : CurveFieldProofs.NafEntryOf e7 A (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7)))) (hbX : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbY : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbZ : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbT : CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T t) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hZ0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z t)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (hT0 : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T t)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (hct : CurveFieldProofs.OnCurve (CurveFieldProofs.complX t) (CurveFieldProofs.complY t)) (hd : Or (@Eq.{1} Int (@Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 d) (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0)))) (@Eq.{1} Int (@HMod.hMod.{0, 0, 0} Int Int Int (@instHMod.{0} Int Int.instMod) (@Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 d) (@OfNat.ofNat.{0} Int (nat_lit 2) (@instOfNat (nat_lit 2)))) (@OfNat.ofNat.{0} Int (nat_lit 1) (@instOfNat (nat_lit 1))))) (hdlo : @LT.lt.{0} Int Int.instLTInt (@Neg.neg.{0} Int Int.instNegInt (@OfNat.ofNat.{0} Int (nat_lit 16) (@instOfNat (nat_lit 16)))) (@Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 d)) (hdhi : @LT.lt.{0} Int Int.instLTInt (@Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 d) (@OfNat.ofNat.{0} Int (nat_lit 16) (@instOfNat (nat_lit 16)))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.curve_models.CompletedPoint (curve25519_dalek.backend.serial.scalar_mul.vartime_double_base.dsm_step_b t tbl d) fun (r : curve25519_dalek.backend.serial.curve_models.CompletedPoint) => And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X r) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y r) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z r) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T r) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (And (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z r)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (And (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T r)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (And (CurveFieldProofs.OnCurve (CurveFieldProofs.complX r) (CurveFieldProofs.complY r)) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.complX r) (CurveFieldProofs.complY r)) (CurveFieldProofs.edDigit (CurveFieldProofs.edPt A) (@Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 d) (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.complX t) (CurveFieldProofs.complY t)))))))))) +cert|CurveFieldProofs.dsm_loop_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (i : Aeneas.Std.Usize) (hi : @Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize i) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255)))) (a_naf b_naf : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (ta tb : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (A B : CurveFieldProofs.EdPoint) (hta : CurveFieldProofs.NafTableOf ta A) (htb : CurveFieldProofs.NafTableOf tb B) (hda : CurveFieldProofs.NafDigits a_naf) (hdb : CurveFieldProofs.NafDigits b_naf), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.curve_models.ProjectivePoint (curve25519_dalek.backend.serial.scalar_mul.vartime_double_base.dsm_loop i a_naf b_naf ta tb) fun (res : curve25519_dalek.backend.serial.curve_models.ProjectivePoint) => And (CurveFieldProofs.ProjValid res) (And (CurveFieldProofs.OnCurve (CurveFieldProofs.projX res) (CurveFieldProofs.projY res)) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.projX res) (CurveFieldProofs.projY res)) (CurveFieldProofs.dsmFold (CurveFieldProofs.nafDigit a_naf) (CurveFieldProofs.nafDigit b_naf) (CurveFieldProofs.edPt A) (CurveFieldProofs.edPt B) CurveFieldProofs.edId (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))))) +cert|CurveFieldProofs.naf_load_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (self : curve25519_dalek.scalar.Scalar) (x_u64 : Aeneas.Std.Array.{0} Aeneas.Std.U64 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes self)) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (hx : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) x_u64) (@List.cons.{0} (Aeneas.Std.UScalar Aeneas.Std.UScalarTy.U64) (Aeneas.Std.U64.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) (@List.cons.{0} (Aeneas.Std.UScalar Aeneas.Std.UScalarTy.U64) (Aeneas.Std.U64.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) (@List.cons.{0} (Aeneas.Std.UScalar Aeneas.Std.UScalarTy.U64) (Aeneas.Std.U64.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) (@List.cons.{0} (Aeneas.Std.UScalar Aeneas.Std.UScalarTy.U64) (Aeneas.Std.U64.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) (@List.cons.{0} (Aeneas.Std.UScalar Aeneas.Std.UScalarTy.U64) (Aeneas.Std.U64.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) (@List.nil.{0} (Aeneas.Std.UScalar Aeneas.Std.UScalarTy.U64)))))))), @Aeneas.Std.WP.spec.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U64 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (curve25519_dalek.scalar.Scalar.non_adjacent_form_loop0 self x_u64 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) fun (ws : Aeneas.Std.Array.{0} Aeneas.Std.U64 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) => @Exists.{1} Aeneas.Std.U64 fun (v0 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (v1 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (v2 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (v3 : Aeneas.Std.U64) => And (@Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) ws) (@List.cons.{0} Aeneas.Std.U64 v0 (@List.cons.{0} Aeneas.Std.U64 v1 (@List.cons.{0} Aeneas.Std.U64 v2 (@List.cons.{0} Aeneas.Std.U64 v3 (@List.cons.{0} Aeneas.Std.U64 (Aeneas.Std.U64.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) (@List.nil.{0} Aeneas.Std.U64))))))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v0) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56))))))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v1) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b8) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56))))))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v2) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b16) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56))))))) (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v3) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b24) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))))))) +cert|CurveFieldProofs.naf_exit|cone=Classical.choice,Quot.sound,propext|type=∀ (V pos carry : Nat) (S : Int) (hV : @LT.lt.{0} Nat instLTNat V (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 253) (instOfNatNat (nat_lit 253))))) (hpos : @LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) pos) (hc : @LE.le.{0} Nat instLENat carry (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (hcp : @Eq.{1} Nat carry (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) → @LE.le.{0} Nat instLENat pos (@OfNat.ofNat.{0} Nat (nat_lit 254) (instOfNatNat (nat_lit 254)))) (hinv : @Eq.{1} Int (@HAdd.hAdd.{0, 0, 0} Int Int Int (@instHAdd.{0} Int Int.instAdd) S (@HMul.hMul.{0, 0, 0} Int Int Int (@instHMul.{0} Int Int.instMul) (@Nat.cast.{0} Int instNatCastInt carry) (@HPow.hPow.{0, 0, 0} Int Nat Int (@instHPow.{0, 0} Int Nat (@Monoid.toPow.{0} Int Int.instMonoid)) (@OfNat.ofNat.{0} Int (nat_lit 2) (@instOfNat (nat_lit 2))) pos))) (@Nat.cast.{0} Int instNatCastInt (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) V (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) pos)))), @Eq.{1} Int S (@Nat.cast.{0} Int instNatCastInt V) +cert|CurveFieldProofs.naf_digit_loop_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (x_u64 : Aeneas.Std.Array.{0} Aeneas.Std.U64 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (v0 v1 v2 v3 : Aeneas.Std.U64) (V : Nat) (hx : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) x_u64) (@List.cons.{0} Aeneas.Std.U64 v0 (@List.cons.{0} Aeneas.Std.U64 v1 (@List.cons.{0} Aeneas.Std.U64 v2 (@List.cons.{0} Aeneas.Std.U64 v3 (@List.cons.{0} Aeneas.Std.U64 (Aeneas.Std.U64.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) (@List.nil.{0} Aeneas.Std.U64))))))) (hVdef : @Eq.{1} Nat V (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v1) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v2) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v3) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))))))))))) (hV : @LT.lt.{0} Nat instLTNat V (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 253) (instOfNatNat (nat_lit 253))))) (m : Nat) (naf : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (pos : Aeneas.Std.Usize) (carry : Aeneas.Std.U64), @LE.le.{0} Nat instLENat (@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize pos)) m → @LE.le.{0} Nat instLENat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 carry) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) → (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 carry) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) → @LE.le.{0} Nat instLENat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize pos) (@OfNat.ofNat.{0} Nat (nat_lit 254) (instOfNatNat (nat_lit 254)))) → (∀ (k : Nat), @LE.le.{0} Nat instLENat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize pos) k → @LT.lt.{0} Nat instLTNat k (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) → @Eq.{1} Int (CurveFieldProofs.nafDigit naf k) (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0)))) → (∀ (k : Nat), @LT.lt.{0} Nat instLTNat k (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) → And (Or (@Eq.{1} Int (CurveFieldProofs.nafDigit naf k) (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0)))) (@Eq.{1} Int (@HMod.hMod.{0, 0, 0} Int Int Int (@instHMod.{0} Int Int.instMod) (CurveFieldProofs.nafDigit naf k) (@OfNat.ofNat.{0} Int (nat_lit 2) (@instOfNat (nat_lit 2)))) (@OfNat.ofNat.{0} Int (nat_lit 1) (@instOfNat (nat_lit 1))))) (And (@LT.lt.{0} Int Int.instLTInt (@Neg.neg.{0} Int Int.instNegInt (@OfNat.ofNat.{0} Int (nat_lit 16) (@instOfNat (nat_lit 16)))) (CurveFieldProofs.nafDigit naf k)) (@LT.lt.{0} Int Int.instLTInt (CurveFieldProofs.nafDigit naf k) (@OfNat.ofNat.{0} Int (nat_lit 16) (@instOfNat (nat_lit 16)))))) → @Eq.{1} Int (@HAdd.hAdd.{0, 0, 0} Int Int Int (@instHAdd.{0} Int Int.instAdd) (CurveFieldProofs.nafSum naf (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))) (@HMul.hMul.{0, 0, 0} Int Int Int (@instHMul.{0} Int Int.instMul) (@Nat.cast.{0} Int instNatCastInt (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 carry)) (@HPow.hPow.{0, 0, 0} Int Nat Int (@instHPow.{0, 0} Int Nat (@Monoid.toPow.{0} Int Int.instMonoid)) (@OfNat.ofNat.{0} Int (nat_lit 2) (@instOfNat (nat_lit 2))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize pos)))) (@Nat.cast.{0} Int instNatCastInt (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) V (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize pos)))) → @Aeneas.Std.WP.spec.{0} (Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (curve25519_dalek.scalar.Scalar.non_adjacent_form_loop1 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) naf x_u64 (Aeneas.Std.U64.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) (Aeneas.Std.U64.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 31) (instOfNatNat (nat_lit 31))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 31) (instOfNatNat (nat_lit 31))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 31) (instOfNatNat (nat_lit 31))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 31) (instOfNatNat (nat_lit 31))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 31) (instOfNatNat (nat_lit 31))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) pos carry) fun (res : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) => And (CurveFieldProofs.NafDigits res) (@Eq.{1} Int (CurveFieldProofs.nafSum res (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))) (@Nat.cast.{0} Int instNatCastInt V)) +cert|CurveFieldProofs.non_adjacent_form_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (self : curve25519_dalek.scalar.Scalar) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes self)) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (V : Nat) (hVbytes : @Eq.{1} Nat V (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 72) (instOfNatNat (nat_lit 72)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 80) (instOfNatNat (nat_lit 80)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 88) (instOfNatNat (nat_lit 88)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 96) (instOfNatNat (nat_lit 96)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 112) (instOfNatNat (nat_lit 112)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 120) (instOfNatNat (nat_lit 120)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b16) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 128) (instOfNatNat (nat_lit 128)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 136) (instOfNatNat (nat_lit 136)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 144) (instOfNatNat (nat_lit 144)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 152) (instOfNatNat (nat_lit 152)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 160) (instOfNatNat (nat_lit 160)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 168) (instOfNatNat (nat_lit 168)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 176) (instOfNatNat (nat_lit 176)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 184) (instOfNatNat (nat_lit 184)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b24) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 192) (instOfNatNat (nat_lit 192)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 200) (instOfNatNat (nat_lit 200)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 216) (instOfNatNat (nat_lit 216)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 224) (instOfNatNat (nat_lit 224)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 232) (instOfNatNat (nat_lit 232)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 240) (instOfNatNat (nat_lit 240)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 248) (instOfNatNat (nat_lit 248))))))) (hV : @LT.lt.{0} Nat instLTNat V (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 253) (instOfNatNat (nat_lit 253))))), @Aeneas.Std.WP.spec.{0} (Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (curve25519_dalek.scalar.Scalar.non_adjacent_form self (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) fun (res : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) => And (CurveFieldProofs.NafDigits res) (@Eq.{1} Int (CurveFieldProofs.nafSum res (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))) (@Nat.cast.{0} Int instNatCastInt V)) +cert|CurveFieldProofs.run_basepoint|cone=Classical.choice,Quot.sound,propext|type=@Exists.{1} CurveFieldProofs.EdPoint fun (B : CurveFieldProofs.EdPoint) => And (@Eq.{1} (Aeneas.Std.Result.{0} curve25519_dalek.edwards.EdwardsPoint) curve25519_dalek.backend.serial.u64.constants.ED25519_BASEPOINT_POINT (@Aeneas.Std.Result.ok.{0} CurveFieldProofs.EdPoint B)) (And (CurveFieldProofs.ExtValid B) (And (CurveFieldProofs.OnCurveExt B) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (CurveFieldProofs.edPt B) CurveFieldProofs.edBasePt))) +cert|CurveFieldProofs.vartime_double_base_mul_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : curve25519_dalek.scalar.Scalar) (A : CurveFieldProofs.EdPoint) (a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 a10 a11 a12 a13 a14 a15 a16 a17 a18 a19 a20 a21 a22 a23 a24 a25 a26 a27 a28 a29 a30 a31 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hab : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes a)) (@List.cons.{0} Aeneas.Std.U8 a0 (@List.cons.{0} Aeneas.Std.U8 a1 (@List.cons.{0} Aeneas.Std.U8 a2 (@List.cons.{0} Aeneas.Std.U8 a3 (@List.cons.{0} Aeneas.Std.U8 a4 (@List.cons.{0} Aeneas.Std.U8 a5 (@List.cons.{0} Aeneas.Std.U8 a6 (@List.cons.{0} Aeneas.Std.U8 a7 (@List.cons.{0} Aeneas.Std.U8 a8 (@List.cons.{0} Aeneas.Std.U8 a9 (@List.cons.{0} Aeneas.Std.U8 a10 (@List.cons.{0} Aeneas.Std.U8 a11 (@List.cons.{0} Aeneas.Std.U8 a12 (@List.cons.{0} Aeneas.Std.U8 a13 (@List.cons.{0} Aeneas.Std.U8 a14 (@List.cons.{0} Aeneas.Std.U8 a15 (@List.cons.{0} Aeneas.Std.U8 a16 (@List.cons.{0} Aeneas.Std.U8 a17 (@List.cons.{0} Aeneas.Std.U8 a18 (@List.cons.{0} Aeneas.Std.U8 a19 (@List.cons.{0} Aeneas.Std.U8 a20 (@List.cons.{0} Aeneas.Std.U8 a21 (@List.cons.{0} Aeneas.Std.U8 a22 (@List.cons.{0} Aeneas.Std.U8 a23 (@List.cons.{0} Aeneas.Std.U8 a24 (@List.cons.{0} Aeneas.Std.U8 a25 (@List.cons.{0} Aeneas.Std.U8 a26 (@List.cons.{0} Aeneas.Std.U8 a27 (@List.cons.{0} Aeneas.Std.U8 a28 (@List.cons.{0} Aeneas.Std.U8 a29 (@List.cons.{0} Aeneas.Std.U8 a30 (@List.cons.{0} Aeneas.Std.U8 a31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (hbb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes b)) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (Va Vb : Nat) (hVa : @Eq.{1} Nat Va (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 72) (instOfNatNat (nat_lit 72)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 80) (instOfNatNat (nat_lit 80)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 88) (instOfNatNat (nat_lit 88)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 96) (instOfNatNat (nat_lit 96)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 112) (instOfNatNat (nat_lit 112)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 120) (instOfNatNat (nat_lit 120)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a16) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 128) (instOfNatNat (nat_lit 128)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 136) (instOfNatNat (nat_lit 136)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 144) (instOfNatNat (nat_lit 144)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 152) (instOfNatNat (nat_lit 152)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 160) (instOfNatNat (nat_lit 160)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 168) (instOfNatNat (nat_lit 168)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 176) (instOfNatNat (nat_lit 176)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 184) (instOfNatNat (nat_lit 184)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a24) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 192) (instOfNatNat (nat_lit 192)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 200) (instOfNatNat (nat_lit 200)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 216) (instOfNatNat (nat_lit 216)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 224) (instOfNatNat (nat_lit 224)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 232) (instOfNatNat (nat_lit 232)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 240) (instOfNatNat (nat_lit 240)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 248) (instOfNatNat (nat_lit 248))))))) (hVb : @Eq.{1} Nat Vb (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 72) (instOfNatNat (nat_lit 72)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 80) (instOfNatNat (nat_lit 80)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 88) (instOfNatNat (nat_lit 88)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 96) (instOfNatNat (nat_lit 96)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 112) (instOfNatNat (nat_lit 112)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 120) (instOfNatNat (nat_lit 120)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b16) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 128) (instOfNatNat (nat_lit 128)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 136) (instOfNatNat (nat_lit 136)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 144) (instOfNatNat (nat_lit 144)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 152) (instOfNatNat (nat_lit 152)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 160) (instOfNatNat (nat_lit 160)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 168) (instOfNatNat (nat_lit 168)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 176) (instOfNatNat (nat_lit 176)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 184) (instOfNatNat (nat_lit 184)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b24) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 192) (instOfNatNat (nat_lit 192)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 200) (instOfNatNat (nat_lit 200)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 216) (instOfNatNat (nat_lit 216)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 224) (instOfNatNat (nat_lit 224)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 232) (instOfNatNat (nat_lit 232)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 240) (instOfNatNat (nat_lit 240)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 248) (instOfNatNat (nat_lit 248))))))) (hValt : @LT.lt.{0} Nat instLTNat Va (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 253) (instOfNatNat (nat_lit 253))))) (hVblt : @LT.lt.{0} Nat instLTNat Vb (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 253) (instOfNatNat (nat_lit 253))))) (hAv : CurveFieldProofs.ExtValid A) (hAc : CurveFieldProofs.OnCurveExt A), @Aeneas.Std.WP.spec.{0} curve25519_dalek.edwards.EdwardsPoint (curve25519_dalek.backend.serial.scalar_mul.vartime_double_base.mul a A b) fun (R : curve25519_dalek.edwards.EdwardsPoint) => And (CurveFieldProofs.ExtValid R) (And (CurveFieldProofs.OnCurveExt R) (@Exists.{1} (Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) fun (na : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) => @Exists.{1} (Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) fun (nb : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) => And (CurveFieldProofs.NafDigits na) (And (CurveFieldProofs.NafDigits nb) (And (@Eq.{1} Int (CurveFieldProofs.nafSum na (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))) (@Nat.cast.{0} Int instNatCastInt Va)) (And (@Eq.{1} Int (CurveFieldProofs.nafSum nb (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))) (@Nat.cast.{0} Int instNatCastInt Vb)) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (CurveFieldProofs.edPt R) (CurveFieldProofs.dsmFold (CurveFieldProofs.nafDigit na) (CurveFieldProofs.nafDigit nb) (CurveFieldProofs.edPt A) CurveFieldProofs.edBasePt CurveFieldProofs.edId (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))))))))) +cert|CurveFieldProofs.verify_loop_full|cone=Classical.choice,Quot.sound,propext|type=∀ (e r : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))), @Aeneas.Std.WP.spec.{0} Bool (ed25519_dalek.verifying.verify_sha512_loop e r Bool.true (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) fun (res : Bool) => @Eq.{1} Bool res (@Decidable.decide (CurveFieldProofs.rangeEq e r (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (CurveFieldProofs.instDecidableRangeEq e r (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))))) +cert|CurveFieldProofs.to_bytes_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a : CurveFieldProofs.Fe) (l0 l1 l2 l3 l4 : Aeneas.Std.U64) (hl : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (@List.cons.{0} Aeneas.Std.U64 l0 (@List.cons.{0} Aeneas.Std.U64 l1 (@List.cons.{0} Aeneas.Std.U64 l2 (@List.cons.{0} Aeneas.Std.U64 l3 (@List.cons.{0} Aeneas.Std.U64 l4 (@List.nil.{0} Aeneas.Std.U64))))))), @Aeneas.Std.WP.spec.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (CurveFieldProofs.fe_to_bytes a) fun (s : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) => @Eq.{1} Nat (CurveFieldProofs.bytesVal s) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (CurveFieldProofs.feVal a) CurveFieldProofs.P) +cert|CurveFieldProofs.ed_compress_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (Pt : CurveFieldProofs.EdPoint) (hv : CurveFieldProofs.ExtValid Pt), @Aeneas.Std.WP.spec.{0} curve25519_dalek.edwards.CompressedEdwardsY (curve25519_dalek.edwards.EdwardsPoint.compress Pt) fun (s : curve25519_dalek.edwards.CompressedEdwardsY) => @Eq.{1} Nat (CurveFieldProofs.bytesVal s) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edY Pt)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edX Pt)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255)))))) +cert|ScalarProofs.from_bytes_mod_order_wide_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (input : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Aeneas.Std.U8) (hb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) input) (have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b60 (@List.cons.{0} Aeneas.Std.U8 b61 (@List.cons.{0} Aeneas.Std.U8 b62 (@List.cons.{0} Aeneas.Std.U8 b63 (@List.nil.{0} Aeneas.Std.U8)))); @List.cons.{0} Aeneas.Std.U8 b56 (@List.cons.{0} Aeneas.Std.U8 b57 (@List.cons.{0} Aeneas.Std.U8 b58 (@List.cons.{0} Aeneas.Std.U8 b59 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b52 (@List.cons.{0} Aeneas.Std.U8 b53 (@List.cons.{0} Aeneas.Std.U8 b54 (@List.cons.{0} Aeneas.Std.U8 b55 y))); @List.cons.{0} Aeneas.Std.U8 b48 (@List.cons.{0} Aeneas.Std.U8 b49 (@List.cons.{0} Aeneas.Std.U8 b50 (@List.cons.{0} Aeneas.Std.U8 b51 y))); have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b44 (@List.cons.{0} Aeneas.Std.U8 b45 (@List.cons.{0} Aeneas.Std.U8 b46 (@List.cons.{0} Aeneas.Std.U8 b47 y))); @List.cons.{0} Aeneas.Std.U8 b40 (@List.cons.{0} Aeneas.Std.U8 b41 (@List.cons.{0} Aeneas.Std.U8 b42 (@List.cons.{0} Aeneas.Std.U8 b43 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b36 (@List.cons.{0} Aeneas.Std.U8 b37 (@List.cons.{0} Aeneas.Std.U8 b38 (@List.cons.{0} Aeneas.Std.U8 b39 y))); @List.cons.{0} Aeneas.Std.U8 b32 (@List.cons.{0} Aeneas.Std.U8 b33 (@List.cons.{0} Aeneas.Std.U8 b34 (@List.cons.{0} Aeneas.Std.U8 b35 y))); have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 y))); @List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 y))); @List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 y))); have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 y))); @List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 y))); @List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 y))))) (T : Nat) (hT : @Eq.{1} Nat T (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 72) (instOfNatNat (nat_lit 72)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 80) (instOfNatNat (nat_lit 80)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 88) (instOfNatNat (nat_lit 88)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 96) (instOfNatNat (nat_lit 96)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 112) (instOfNatNat (nat_lit 112)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 120) (instOfNatNat (nat_lit 120)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b16) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 128) (instOfNatNat (nat_lit 128)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 136) (instOfNatNat (nat_lit 136)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 144) (instOfNatNat (nat_lit 144)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 152) (instOfNatNat (nat_lit 152)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 160) (instOfNatNat (nat_lit 160)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 168) (instOfNatNat (nat_lit 168)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 176) (instOfNatNat (nat_lit 176)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 184) (instOfNatNat (nat_lit 184)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b24) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 192) (instOfNatNat (nat_lit 192)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 200) (instOfNatNat (nat_lit 200)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 216) (instOfNatNat (nat_lit 216)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 224) (instOfNatNat (nat_lit 224)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 232) (instOfNatNat (nat_lit 232)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 240) (instOfNatNat (nat_lit 240)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 248) (instOfNatNat (nat_lit 248)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b32) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b33) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 264) (instOfNatNat (nat_lit 264)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b34) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 272) (instOfNatNat (nat_lit 272)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b35) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 280) (instOfNatNat (nat_lit 280)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b36) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 288) (instOfNatNat (nat_lit 288)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b37) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 296) (instOfNatNat (nat_lit 296)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b38) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 304) (instOfNatNat (nat_lit 304)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b39) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 312) (instOfNatNat (nat_lit 312)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b40) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 320) (instOfNatNat (nat_lit 320)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b41) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 328) (instOfNatNat (nat_lit 328)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b42) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 336) (instOfNatNat (nat_lit 336)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b43) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 344) (instOfNatNat (nat_lit 344)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b44) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 352) (instOfNatNat (nat_lit 352)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b45) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 360) (instOfNatNat (nat_lit 360)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b46) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 368) (instOfNatNat (nat_lit 368)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b47) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 376) (instOfNatNat (nat_lit 376)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b48) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 384) (instOfNatNat (nat_lit 384)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b49) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 392) (instOfNatNat (nat_lit 392)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b50) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 400) (instOfNatNat (nat_lit 400)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b51) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 408) (instOfNatNat (nat_lit 408)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b52) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 416) (instOfNatNat (nat_lit 416)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b53) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 424) (instOfNatNat (nat_lit 424)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b54) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 432) (instOfNatNat (nat_lit 432)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b55) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 440) (instOfNatNat (nat_lit 440)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b56) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 448) (instOfNatNat (nat_lit 448)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b57) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 456) (instOfNatNat (nat_lit 456)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b58) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 464) (instOfNatNat (nat_lit 464)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b59) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 472) (instOfNatNat (nat_lit 472)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b60) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 480) (instOfNatNat (nat_lit 480)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b61) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 488) (instOfNatNat (nat_lit 488)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b62) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 496) (instOfNatNat (nat_lit 496)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b63) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 504) (instOfNatNat (nat_lit 504))))))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.scalar.Scalar (curve25519_dalek.scalar.Scalar.from_bytes_mod_order_wide input) fun (k : curve25519_dalek.scalar.Scalar) => And (@LT.lt.{0} Nat instLTNat (CurveFieldProofs.bytesVal (curve25519_dalek.scalar.Scalar.bytes k)) ScalarProofs.Ell) (@Eq.{1} (ZMod ScalarProofs.Ell) (@Nat.cast.{0} (ZMod ScalarProofs.Ell) (@AddMonoidWithOne.toNatCast.{0} (ZMod ScalarProofs.Ell) (@AddGroupWithOne.toAddMonoidWithOne.{0} (ZMod ScalarProofs.Ell) (@Ring.toAddGroupWithOne.{0} (ZMod ScalarProofs.Ell) (@CommRing.toRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell))))) (CurveFieldProofs.bytesVal (curve25519_dalek.scalar.Scalar.bytes k))) (@Nat.cast.{0} (ZMod ScalarProofs.Ell) (@AddMonoidWithOne.toNatCast.{0} (ZMod ScalarProofs.Ell) (@AddGroupWithOne.toAddMonoidWithOne.{0} (ZMod ScalarProofs.Ell) (@Ring.toAddGroupWithOne.{0} (ZMod ScalarProofs.Ell) (@CommRing.toRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell))))) T)) +cert|CurveFieldProofs.vartime_dsm_basepoint_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : curve25519_dalek.scalar.Scalar) (A : CurveFieldProofs.EdPoint) (a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 a10 a11 a12 a13 a14 a15 a16 a17 a18 a19 a20 a21 a22 a23 a24 a25 a26 a27 a28 a29 a30 a31 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hab : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes a)) (@List.cons.{0} Aeneas.Std.U8 a0 (@List.cons.{0} Aeneas.Std.U8 a1 (@List.cons.{0} Aeneas.Std.U8 a2 (@List.cons.{0} Aeneas.Std.U8 a3 (@List.cons.{0} Aeneas.Std.U8 a4 (@List.cons.{0} Aeneas.Std.U8 a5 (@List.cons.{0} Aeneas.Std.U8 a6 (@List.cons.{0} Aeneas.Std.U8 a7 (@List.cons.{0} Aeneas.Std.U8 a8 (@List.cons.{0} Aeneas.Std.U8 a9 (@List.cons.{0} Aeneas.Std.U8 a10 (@List.cons.{0} Aeneas.Std.U8 a11 (@List.cons.{0} Aeneas.Std.U8 a12 (@List.cons.{0} Aeneas.Std.U8 a13 (@List.cons.{0} Aeneas.Std.U8 a14 (@List.cons.{0} Aeneas.Std.U8 a15 (@List.cons.{0} Aeneas.Std.U8 a16 (@List.cons.{0} Aeneas.Std.U8 a17 (@List.cons.{0} Aeneas.Std.U8 a18 (@List.cons.{0} Aeneas.Std.U8 a19 (@List.cons.{0} Aeneas.Std.U8 a20 (@List.cons.{0} Aeneas.Std.U8 a21 (@List.cons.{0} Aeneas.Std.U8 a22 (@List.cons.{0} Aeneas.Std.U8 a23 (@List.cons.{0} Aeneas.Std.U8 a24 (@List.cons.{0} Aeneas.Std.U8 a25 (@List.cons.{0} Aeneas.Std.U8 a26 (@List.cons.{0} Aeneas.Std.U8 a27 (@List.cons.{0} Aeneas.Std.U8 a28 (@List.cons.{0} Aeneas.Std.U8 a29 (@List.cons.{0} Aeneas.Std.U8 a30 (@List.cons.{0} Aeneas.Std.U8 a31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (hbb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes b)) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (Va Vb : Nat) (hVa : @Eq.{1} Nat Va (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 72) (instOfNatNat (nat_lit 72)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 80) (instOfNatNat (nat_lit 80)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 88) (instOfNatNat (nat_lit 88)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 96) (instOfNatNat (nat_lit 96)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 112) (instOfNatNat (nat_lit 112)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 120) (instOfNatNat (nat_lit 120)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a16) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 128) (instOfNatNat (nat_lit 128)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 136) (instOfNatNat (nat_lit 136)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 144) (instOfNatNat (nat_lit 144)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 152) (instOfNatNat (nat_lit 152)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 160) (instOfNatNat (nat_lit 160)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 168) (instOfNatNat (nat_lit 168)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 176) (instOfNatNat (nat_lit 176)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 184) (instOfNatNat (nat_lit 184)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a24) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 192) (instOfNatNat (nat_lit 192)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 200) (instOfNatNat (nat_lit 200)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 216) (instOfNatNat (nat_lit 216)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 224) (instOfNatNat (nat_lit 224)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 232) (instOfNatNat (nat_lit 232)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 240) (instOfNatNat (nat_lit 240)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 a31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 248) (instOfNatNat (nat_lit 248))))))) (hVb : @Eq.{1} Nat Vb (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 72) (instOfNatNat (nat_lit 72)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 80) (instOfNatNat (nat_lit 80)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 88) (instOfNatNat (nat_lit 88)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 96) (instOfNatNat (nat_lit 96)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 112) (instOfNatNat (nat_lit 112)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 120) (instOfNatNat (nat_lit 120)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b16) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 128) (instOfNatNat (nat_lit 128)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 136) (instOfNatNat (nat_lit 136)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 144) (instOfNatNat (nat_lit 144)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 152) (instOfNatNat (nat_lit 152)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 160) (instOfNatNat (nat_lit 160)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 168) (instOfNatNat (nat_lit 168)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 176) (instOfNatNat (nat_lit 176)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 184) (instOfNatNat (nat_lit 184)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b24) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 192) (instOfNatNat (nat_lit 192)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 200) (instOfNatNat (nat_lit 200)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 216) (instOfNatNat (nat_lit 216)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 224) (instOfNatNat (nat_lit 224)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 232) (instOfNatNat (nat_lit 232)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 240) (instOfNatNat (nat_lit 240)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 248) (instOfNatNat (nat_lit 248))))))) (hValt : @LT.lt.{0} Nat instLTNat Va (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 253) (instOfNatNat (nat_lit 253))))) (hVblt : @LT.lt.{0} Nat instLTNat Vb (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 253) (instOfNatNat (nat_lit 253))))) (hAv : CurveFieldProofs.ExtValid A) (hAc : CurveFieldProofs.OnCurveExt A), @Aeneas.Std.WP.spec.{0} curve25519_dalek.edwards.EdwardsPoint (curve25519_dalek.edwards.EdwardsPoint.vartime_double_scalar_mul_basepoint a A b) fun (R : curve25519_dalek.edwards.EdwardsPoint) => And (CurveFieldProofs.ExtValid R) (And (CurveFieldProofs.OnCurveExt R) (@Exists.{1} (Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) fun (na : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) => @Exists.{1} (Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) fun (nb : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) => And (CurveFieldProofs.NafDigits na) (And (CurveFieldProofs.NafDigits nb) (And (@Eq.{1} Int (CurveFieldProofs.nafSum na (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))) (@Nat.cast.{0} Int instNatCastInt Va)) (And (@Eq.{1} Int (CurveFieldProofs.nafSum nb (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))) (@Nat.cast.{0} Int instNatCastInt Vb)) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (CurveFieldProofs.edPt R) (CurveFieldProofs.dsmFold (CurveFieldProofs.nafDigit na) (CurveFieldProofs.nafDigit nb) (CurveFieldProofs.edPt A) CurveFieldProofs.edBasePt CurveFieldProofs.edId (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))))))))) +cert|CurveFieldProofs.enc_point_inj|cone=Classical.choice,Quot.sound,propext|type=∀ (Pt Q : CurveFieldProofs.EdPoint) (hPv : CurveFieldProofs.ExtValid Pt) (hPc : CurveFieldProofs.OnCurveExt Pt) (hQv : CurveFieldProofs.ExtValid Q) (hQc : CurveFieldProofs.OnCurveExt Q) (h : @Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edY Pt)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edX Pt)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255)))))) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edY Q)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edX Q)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255))))))), @Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (CurveFieldProofs.edPt Pt) (CurveFieldProofs.edPt Q) +cert|CurveFieldProofs.pow_p58_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a : CurveFieldProofs.Fe) (hba : CurveFieldProofs.Bnd a (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.field.FieldElement51 (curve25519_dalek.field.FieldElement51.pow_p58 a) fun (r : curve25519_dalek.backend.serial.u64.field.FieldElement51) => And (CurveFieldProofs.Bnd r (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote r) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (CurveFieldProofs.denote a) (@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 252) (instOfNatNat (nat_lit 252)))) (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3)))))) +cert|CurveFieldProofs.fe_ct_eq_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : CurveFieldProofs.Fe), @Aeneas.Std.WP.spec.{0} subtle.Choice (curve25519_dalek.backend.serial.u64.field.FieldElement51.Insts.SubtleConstantTimeEq.ct_eq a b) fun (c : subtle.Choice) => And (Or (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 c) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 c) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))))) (Iff (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 c) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote a) (CurveFieldProofs.denote b))) +cert|CurveFieldProofs.sqrt_core|cone=Classical.choice,Quot.sound,propext|type=∀ (u v x : CurveFieldProofs.Fp) (hv : @Ne.{1} CurveFieldProofs.Fp v (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (hx : @Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) x (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) v) u), Or (@Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) v (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) u (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) v (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) u (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) v (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7))))) (@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 252) (instOfNatNat (nat_lit 252)))) (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3)))))) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))))) u) (@Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) v (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) u (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) v (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) u (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) v (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7))))) (@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 252) (instOfNatNat (nat_lit 252)))) (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3)))))) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))))) (@Neg.neg.{0} CurveFieldProofs.Fp (@NegZeroClass.toNeg.{0} CurveFieldProofs.Fp (@SubNegZeroMonoid.toNegZeroClass.{0} CurveFieldProofs.Fp (@SubtractionMonoid.toSubNegZeroMonoid.{0} CurveFieldProofs.Fp (@SubtractionCommMonoid.toSubtractionMonoid.{0} CurveFieldProofs.Fp (@AddCommGroup.toDivisionAddCommMonoid.{0} CurveFieldProofs.Fp (@Ring.toAddCommGroup.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))))))) u)) +cert|CurveFieldProofs.sqrt_ratio_i_sq_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (u v : CurveFieldProofs.Fe) (hbu : CurveFieldProofs.Bnd u (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hbv : CurveFieldProofs.Bnd v (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 54) (instOfNatNat (nat_lit 54))))) (hvne : @Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote v) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (x : CurveFieldProofs.Fp) (hx : @Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) x (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (CurveFieldProofs.denote v)) (CurveFieldProofs.denote u)), @Aeneas.Std.WP.spec.{0} (Prod.{0, 0} subtle.Choice curve25519_dalek.backend.serial.u64.field.FieldElement51) (curve25519_dalek.field.FieldElement51.sqrt_ratio_i u v) fun (cr : Prod.{0, 0} subtle.Choice curve25519_dalek.backend.serial.u64.field.FieldElement51) => And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 (@Prod.fst.{0, 0} subtle.Choice curve25519_dalek.backend.serial.u64.field.FieldElement51 cr)) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (CurveFieldProofs.Bnd (@Prod.snd.{0, 0} subtle.Choice curve25519_dalek.backend.serial.u64.field.FieldElement51 cr) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (CurveFieldProofs.denote (@Prod.snd.{0, 0} subtle.Choice curve25519_dalek.backend.serial.u64.field.FieldElement51 cr)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (CurveFieldProofs.denote v)) (CurveFieldProofs.denote u)) (@Eq.{1} Nat (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.denote (@Prod.snd.{0, 0} subtle.Choice curve25519_dalek.backend.serial.u64.field.FieldElement51 cr))) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))))) +cert|CurveFieldProofs.from_bytes_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (bytes : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hbl : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) bytes) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.field.FieldElement51 (curve25519_dalek.backend.serial.u64.field.FieldElement51.from_bytes bytes) fun (r : curve25519_dalek.backend.serial.u64.field.FieldElement51) => And (CurveFieldProofs.Bnd r (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 51) (instOfNatNat (nat_lit 51))))) (@Eq.{1} Nat (CurveFieldProofs.feVal r) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (CurveFieldProofs.bytesVal bytes) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255)))))) +cert|CurveFieldProofs.decompress_of_canonical|cone=Classical.choice,Quot.sound,propext|type=∀ (Q : CurveFieldProofs.EdPoint) (hQv : CurveFieldProofs.ExtValid Q) (hQc : CurveFieldProofs.OnCurveExt Q) (rb : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hbl : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) rb) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (henc : @Eq.{1} Nat (CurveFieldProofs.bytesVal rb) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edY Q)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edX Q)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255))))))), @Aeneas.Std.WP.spec.{0} (Option.{0} curve25519_dalek.edwards.EdwardsPoint) (curve25519_dalek.edwards.CompressedEdwardsY.decompress rb) fun (o : Option.{0} curve25519_dalek.edwards.EdwardsPoint) => @Exists.{1} CurveFieldProofs.EdPoint fun (Pt : CurveFieldProofs.EdPoint) => And (@Eq.{1} (Option.{0} curve25519_dalek.edwards.EdwardsPoint) o (@Option.some.{0} CurveFieldProofs.EdPoint Pt)) (And (CurveFieldProofs.ExtValid Pt) (And (CurveFieldProofs.OnCurveExt Pt) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (CurveFieldProofs.edPt Pt) (CurveFieldProofs.edPt Q)))) +cert|CurveFieldProofs.verify_accepts_iff|cone=Classical.choice,Quot.sound,ed25519.Signature,ed25519.Signature.to_bytes,propext,signature.error.Error,signature.error.Error.new,verifying.sha512_hash3|type=∀ (key : ed25519_dalek.verifying.VerifyingKey) (msg : Aeneas.Std.Slice.{0} Aeneas.Std.U8) (sig : ed25519.Signature) (val : ed25519_dalek.signature.InternalSignature) (er : curve25519_dalek.edwards.CompressedEdwardsY) (e r1 : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (hparse : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error)) (ed25519_dalek.signature.InternalSignature.Insts.CoreConvertTryFromShared0SignatureError.try_from sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error val))) (hrec : @Eq.{1} (Aeneas.Std.Result.{0} curve25519_dalek.edwards.CompressedEdwardsY) (ed25519_dalek.verifying.recompute_r_sha512 key val msg) (@Aeneas.Std.Result.ok.{0} curve25519_dalek.edwards.CompressedEdwardsY er)) (he : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes er) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) e)) (hr1 : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes (ed25519_dalek.signature.InternalSignature.R val)) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) r1)), Iff (@Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} Unit signature.error.Error)) (ed25519_dalek.verifying.verify_sha512 key msg sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} Unit signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} Unit signature.error.Error Unit.unit))) (CurveFieldProofs.rangeEq e r1 (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) +cert|CurveFieldProofs.verify_accepts_iff_point|cone=Classical.choice,Quot.sound,ed25519.Signature,ed25519.Signature.to_bytes,propext,signature.error.Error,signature.error.Error.new,verifying.sha512_hash3|type=∀ (key : ed25519_dalek.verifying.VerifyingKey) (msg : Aeneas.Std.Slice.{0} Aeneas.Std.U8) (sig : ed25519.Signature) (val : ed25519_dalek.signature.InternalSignature) (er : curve25519_dalek.edwards.CompressedEdwardsY) (e r1 : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (hparse : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error)) (ed25519_dalek.signature.InternalSignature.Insts.CoreConvertTryFromShared0SignatureError.try_from sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error val))) (hrec : @Eq.{1} (Aeneas.Std.Result.{0} curve25519_dalek.edwards.CompressedEdwardsY) (ed25519_dalek.verifying.recompute_r_sha512 key val msg) (@Aeneas.Std.Result.ok.{0} curve25519_dalek.edwards.CompressedEdwardsY er)) (he : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes er) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) e)) (hr1 : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes (ed25519_dalek.signature.InternalSignature.R val)) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) r1)) (hkv : CurveFieldProofs.ExtValid (ed25519_dalek.verifying.VerifyingKey.point key)) (hkc : CurveFieldProofs.OnCurveExt (ed25519_dalek.verifying.VerifyingKey.point key)) (t0 t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t13 t14 t15 t16 t17 t18 t19 t20 t21 t22 t23 t24 t25 t26 t27 t28 t29 t30 t31 : Aeneas.Std.U8) (hsb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes (ed25519_dalek.signature.InternalSignature.s val))) (@List.cons.{0} Aeneas.Std.U8 t0 (@List.cons.{0} Aeneas.Std.U8 t1 (@List.cons.{0} Aeneas.Std.U8 t2 (@List.cons.{0} Aeneas.Std.U8 t3 (@List.cons.{0} Aeneas.Std.U8 t4 (@List.cons.{0} Aeneas.Std.U8 t5 (@List.cons.{0} Aeneas.Std.U8 t6 (@List.cons.{0} Aeneas.Std.U8 t7 (@List.cons.{0} Aeneas.Std.U8 t8 (@List.cons.{0} Aeneas.Std.U8 t9 (@List.cons.{0} Aeneas.Std.U8 t10 (@List.cons.{0} Aeneas.Std.U8 t11 (@List.cons.{0} Aeneas.Std.U8 t12 (@List.cons.{0} Aeneas.Std.U8 t13 (@List.cons.{0} Aeneas.Std.U8 t14 (@List.cons.{0} Aeneas.Std.U8 t15 (@List.cons.{0} Aeneas.Std.U8 t16 (@List.cons.{0} Aeneas.Std.U8 t17 (@List.cons.{0} Aeneas.Std.U8 t18 (@List.cons.{0} Aeneas.Std.U8 t19 (@List.cons.{0} Aeneas.Std.U8 t20 (@List.cons.{0} Aeneas.Std.U8 t21 (@List.cons.{0} Aeneas.Std.U8 t22 (@List.cons.{0} Aeneas.Std.U8 t23 (@List.cons.{0} Aeneas.Std.U8 t24 (@List.cons.{0} Aeneas.Std.U8 t25 (@List.cons.{0} Aeneas.Std.U8 t26 (@List.cons.{0} Aeneas.Std.U8 t27 (@List.cons.{0} Aeneas.Std.U8 t28 (@List.cons.{0} Aeneas.Std.U8 t29 (@List.cons.{0} Aeneas.Std.U8 t30 (@List.cons.{0} Aeneas.Std.U8 t31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (Vs : Nat) (hVs : @Eq.{1} Nat Vs (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 72) (instOfNatNat (nat_lit 72)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 80) (instOfNatNat (nat_lit 80)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 88) (instOfNatNat (nat_lit 88)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 96) (instOfNatNat (nat_lit 96)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 112) (instOfNatNat (nat_lit 112)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 120) (instOfNatNat (nat_lit 120)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t16) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 128) (instOfNatNat (nat_lit 128)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 136) (instOfNatNat (nat_lit 136)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 144) (instOfNatNat (nat_lit 144)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 152) (instOfNatNat (nat_lit 152)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 160) (instOfNatNat (nat_lit 160)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 168) (instOfNatNat (nat_lit 168)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 176) (instOfNatNat (nat_lit 176)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 184) (instOfNatNat (nat_lit 184)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t24) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 192) (instOfNatNat (nat_lit 192)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 200) (instOfNatNat (nat_lit 200)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 216) (instOfNatNat (nat_lit 216)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 224) (instOfNatNat (nat_lit 224)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 232) (instOfNatNat (nat_lit 232)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 240) (instOfNatNat (nat_lit 240)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 248) (instOfNatNat (nat_lit 248))))))) (hVslt : @LT.lt.{0} Nat instLTNat Vs (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 253) (instOfNatNat (nat_lit 253))))), @Exists.{1} CurveFieldProofs.EdPoint fun (R' : CurveFieldProofs.EdPoint) => And (CurveFieldProofs.ExtValid R') (And (CurveFieldProofs.OnCurveExt R') (Iff (@Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} Unit signature.error.Error)) (ed25519_dalek.verifying.verify_sha512 key msg sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} Unit signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} Unit signature.error.Error Unit.unit))) (@Eq.{1} Nat (CurveFieldProofs.bytesVal r1) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edY R')) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edX R')) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255))))))))) +cert|CurveFieldProofs.verify_accepts_iff_point_eq|cone=Classical.choice,Quot.sound,ed25519.Signature,ed25519.Signature.to_bytes,propext,signature.error.Error,signature.error.Error.new,verifying.sha512_hash3|type=∀ (key : ed25519_dalek.verifying.VerifyingKey) (msg : Aeneas.Std.Slice.{0} Aeneas.Std.U8) (sig : ed25519.Signature) (val : ed25519_dalek.signature.InternalSignature) (er : curve25519_dalek.edwards.CompressedEdwardsY) (e r1 : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (hparse : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error)) (ed25519_dalek.signature.InternalSignature.Insts.CoreConvertTryFromShared0SignatureError.try_from sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error val))) (hrec : @Eq.{1} (Aeneas.Std.Result.{0} curve25519_dalek.edwards.CompressedEdwardsY) (ed25519_dalek.verifying.recompute_r_sha512 key val msg) (@Aeneas.Std.Result.ok.{0} curve25519_dalek.edwards.CompressedEdwardsY er)) (he : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes er) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) e)) (hr1 : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes (ed25519_dalek.signature.InternalSignature.R val)) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) r1)) (hkv : CurveFieldProofs.ExtValid (ed25519_dalek.verifying.VerifyingKey.point key)) (hkc : CurveFieldProofs.OnCurveExt (ed25519_dalek.verifying.VerifyingKey.point key)) (t0 t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t13 t14 t15 t16 t17 t18 t19 t20 t21 t22 t23 t24 t25 t26 t27 t28 t29 t30 t31 : Aeneas.Std.U8) (hsb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes (ed25519_dalek.signature.InternalSignature.s val))) (@List.cons.{0} Aeneas.Std.U8 t0 (@List.cons.{0} Aeneas.Std.U8 t1 (@List.cons.{0} Aeneas.Std.U8 t2 (@List.cons.{0} Aeneas.Std.U8 t3 (@List.cons.{0} Aeneas.Std.U8 t4 (@List.cons.{0} Aeneas.Std.U8 t5 (@List.cons.{0} Aeneas.Std.U8 t6 (@List.cons.{0} Aeneas.Std.U8 t7 (@List.cons.{0} Aeneas.Std.U8 t8 (@List.cons.{0} Aeneas.Std.U8 t9 (@List.cons.{0} Aeneas.Std.U8 t10 (@List.cons.{0} Aeneas.Std.U8 t11 (@List.cons.{0} Aeneas.Std.U8 t12 (@List.cons.{0} Aeneas.Std.U8 t13 (@List.cons.{0} Aeneas.Std.U8 t14 (@List.cons.{0} Aeneas.Std.U8 t15 (@List.cons.{0} Aeneas.Std.U8 t16 (@List.cons.{0} Aeneas.Std.U8 t17 (@List.cons.{0} Aeneas.Std.U8 t18 (@List.cons.{0} Aeneas.Std.U8 t19 (@List.cons.{0} Aeneas.Std.U8 t20 (@List.cons.{0} Aeneas.Std.U8 t21 (@List.cons.{0} Aeneas.Std.U8 t22 (@List.cons.{0} Aeneas.Std.U8 t23 (@List.cons.{0} Aeneas.Std.U8 t24 (@List.cons.{0} Aeneas.Std.U8 t25 (@List.cons.{0} Aeneas.Std.U8 t26 (@List.cons.{0} Aeneas.Std.U8 t27 (@List.cons.{0} Aeneas.Std.U8 t28 (@List.cons.{0} Aeneas.Std.U8 t29 (@List.cons.{0} Aeneas.Std.U8 t30 (@List.cons.{0} Aeneas.Std.U8 t31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (Vs : Nat) (hVs : @Eq.{1} Nat Vs (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 72) (instOfNatNat (nat_lit 72)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 80) (instOfNatNat (nat_lit 80)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 88) (instOfNatNat (nat_lit 88)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 96) (instOfNatNat (nat_lit 96)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 112) (instOfNatNat (nat_lit 112)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 120) (instOfNatNat (nat_lit 120)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t16) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 128) (instOfNatNat (nat_lit 128)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 136) (instOfNatNat (nat_lit 136)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 144) (instOfNatNat (nat_lit 144)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 152) (instOfNatNat (nat_lit 152)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 160) (instOfNatNat (nat_lit 160)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 168) (instOfNatNat (nat_lit 168)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 176) (instOfNatNat (nat_lit 176)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 184) (instOfNatNat (nat_lit 184)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t24) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 192) (instOfNatNat (nat_lit 192)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 200) (instOfNatNat (nat_lit 200)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 216) (instOfNatNat (nat_lit 216)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 224) (instOfNatNat (nat_lit 224)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 232) (instOfNatNat (nat_lit 232)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 240) (instOfNatNat (nat_lit 240)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 248) (instOfNatNat (nat_lit 248))))))) (hVslt : @LT.lt.{0} Nat instLTNat Vs (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 253) (instOfNatNat (nat_lit 253))))) (Q : CurveFieldProofs.EdPoint) (hQv : CurveFieldProofs.ExtValid Q) (hQc : CurveFieldProofs.OnCurveExt Q) (henc : @Eq.{1} Nat (CurveFieldProofs.bytesVal r1) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edY Q)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edX Q)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255))))))), @Exists.{1} CurveFieldProofs.EdPoint fun (R' : CurveFieldProofs.EdPoint) => And (CurveFieldProofs.ExtValid R') (And (CurveFieldProofs.OnCurveExt R') (Iff (@Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} Unit signature.error.Error)) (ed25519_dalek.verifying.verify_sha512 key msg sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} Unit signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} Unit signature.error.Error Unit.unit))) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (CurveFieldProofs.edPt Q) (CurveFieldProofs.edPt R')))) +cert|CurveFieldProofs.verify_accepts_iff_decompress|cone=Classical.choice,Quot.sound,ed25519.Signature,ed25519.Signature.to_bytes,propext,signature.error.Error,signature.error.Error.new,verifying.sha512_hash3|type=∀ (key : ed25519_dalek.verifying.VerifyingKey) (msg : Aeneas.Std.Slice.{0} Aeneas.Std.U8) (sig : ed25519.Signature) (val : ed25519_dalek.signature.InternalSignature) (er : curve25519_dalek.edwards.CompressedEdwardsY) (e r1 : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (hparse : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error)) (ed25519_dalek.signature.InternalSignature.Insts.CoreConvertTryFromShared0SignatureError.try_from sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} ed25519_dalek.signature.InternalSignature signature.error.Error val))) (hrec : @Eq.{1} (Aeneas.Std.Result.{0} curve25519_dalek.edwards.CompressedEdwardsY) (ed25519_dalek.verifying.recompute_r_sha512 key val msg) (@Aeneas.Std.Result.ok.{0} curve25519_dalek.edwards.CompressedEdwardsY er)) (he : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes er) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) e)) (hr1 : @Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.edwards.CompressedEdwardsY.as_bytes (ed25519_dalek.signature.InternalSignature.R val)) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) r1)) (hkv : CurveFieldProofs.ExtValid (ed25519_dalek.verifying.VerifyingKey.point key)) (hkc : CurveFieldProofs.OnCurveExt (ed25519_dalek.verifying.VerifyingKey.point key)) (t0 t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t13 t14 t15 t16 t17 t18 t19 t20 t21 t22 t23 t24 t25 t26 t27 t28 t29 t30 t31 : Aeneas.Std.U8) (hsb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) (curve25519_dalek.scalar.Scalar.bytes (ed25519_dalek.signature.InternalSignature.s val))) (@List.cons.{0} Aeneas.Std.U8 t0 (@List.cons.{0} Aeneas.Std.U8 t1 (@List.cons.{0} Aeneas.Std.U8 t2 (@List.cons.{0} Aeneas.Std.U8 t3 (@List.cons.{0} Aeneas.Std.U8 t4 (@List.cons.{0} Aeneas.Std.U8 t5 (@List.cons.{0} Aeneas.Std.U8 t6 (@List.cons.{0} Aeneas.Std.U8 t7 (@List.cons.{0} Aeneas.Std.U8 t8 (@List.cons.{0} Aeneas.Std.U8 t9 (@List.cons.{0} Aeneas.Std.U8 t10 (@List.cons.{0} Aeneas.Std.U8 t11 (@List.cons.{0} Aeneas.Std.U8 t12 (@List.cons.{0} Aeneas.Std.U8 t13 (@List.cons.{0} Aeneas.Std.U8 t14 (@List.cons.{0} Aeneas.Std.U8 t15 (@List.cons.{0} Aeneas.Std.U8 t16 (@List.cons.{0} Aeneas.Std.U8 t17 (@List.cons.{0} Aeneas.Std.U8 t18 (@List.cons.{0} Aeneas.Std.U8 t19 (@List.cons.{0} Aeneas.Std.U8 t20 (@List.cons.{0} Aeneas.Std.U8 t21 (@List.cons.{0} Aeneas.Std.U8 t22 (@List.cons.{0} Aeneas.Std.U8 t23 (@List.cons.{0} Aeneas.Std.U8 t24 (@List.cons.{0} Aeneas.Std.U8 t25 (@List.cons.{0} Aeneas.Std.U8 t26 (@List.cons.{0} Aeneas.Std.U8 t27 (@List.cons.{0} Aeneas.Std.U8 t28 (@List.cons.{0} Aeneas.Std.U8 t29 (@List.cons.{0} Aeneas.Std.U8 t30 (@List.cons.{0} Aeneas.Std.U8 t31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (Vs : Nat) (hVs : @Eq.{1} Nat Vs (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 72) (instOfNatNat (nat_lit 72)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 80) (instOfNatNat (nat_lit 80)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 88) (instOfNatNat (nat_lit 88)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 96) (instOfNatNat (nat_lit 96)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 112) (instOfNatNat (nat_lit 112)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 120) (instOfNatNat (nat_lit 120)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t16) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 128) (instOfNatNat (nat_lit 128)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 136) (instOfNatNat (nat_lit 136)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 144) (instOfNatNat (nat_lit 144)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 152) (instOfNatNat (nat_lit 152)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 160) (instOfNatNat (nat_lit 160)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 168) (instOfNatNat (nat_lit 168)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 176) (instOfNatNat (nat_lit 176)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 184) (instOfNatNat (nat_lit 184)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t24) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 192) (instOfNatNat (nat_lit 192)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 200) (instOfNatNat (nat_lit 200)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 216) (instOfNatNat (nat_lit 216)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 224) (instOfNatNat (nat_lit 224)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 232) (instOfNatNat (nat_lit 232)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 240) (instOfNatNat (nat_lit 240)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 t31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 248) (instOfNatNat (nat_lit 248))))))) (hVslt : @LT.lt.{0} Nat instLTNat Vs (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 253) (instOfNatNat (nat_lit 253))))) (Q : CurveFieldProofs.EdPoint) (hQv : CurveFieldProofs.ExtValid Q) (hQc : CurveFieldProofs.OnCurveExt Q) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) (hbl : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) r1) (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (henc : @Eq.{1} Nat (CurveFieldProofs.bytesVal r1) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edY Q)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HMod.hMod.{0, 0, 0} Nat Nat Nat (@instHMod.{0} Nat Nat.instMod) (@ZMod.val CurveFieldProofs.P (CurveFieldProofs.edX Q)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255))))))), @Exists.{1} CurveFieldProofs.EdPoint fun (R' : CurveFieldProofs.EdPoint) => @Exists.{1} CurveFieldProofs.EdPoint fun (Pt : CurveFieldProofs.EdPoint) => And (CurveFieldProofs.ExtValid R') (And (CurveFieldProofs.OnCurveExt R') (And (@Eq.{1} (Aeneas.Std.Result.{0} (Option.{0} curve25519_dalek.edwards.EdwardsPoint)) (curve25519_dalek.edwards.CompressedEdwardsY.decompress r1) (@Aeneas.Std.Result.ok.{0} (Option.{0} CurveFieldProofs.EdPoint) (@Option.some.{0} CurveFieldProofs.EdPoint Pt))) (And (CurveFieldProofs.ExtValid Pt) (And (CurveFieldProofs.OnCurveExt Pt) (Iff (@Eq.{1} (Aeneas.Std.Result.{0} (Aeneas.Std.core.result.Result.{0, 0} Unit signature.error.Error)) (ed25519_dalek.verifying.verify_sha512 key msg sig) (@Aeneas.Std.Result.ok.{0} (Aeneas.Std.core.result.Result.{0, 0} Unit signature.error.Error) (@Aeneas.Std.core.result.Result.Ok.{0, 0} Unit signature.error.Error Unit.unit))) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (CurveFieldProofs.edPt Pt) (CurveFieldProofs.edPt R'))))))) +spec|CurveFieldProofs.Bnd|def|value=fun (a : CurveFieldProofs.Fe) (c : Nat) => CurveFieldProofs.feVal.match_1.{1} (fun (x : List.{0} Aeneas.Std.U64) => Prop) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (fun (a0 a1 a2 a3 a4 : Aeneas.Std.U64) => And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) c) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) c) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) c) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) c) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) c))))) fun (x : List.{0} Aeneas.Std.U64) => False +spec|CurveFieldProofs.ComplPoint|def|value=curve25519_dalek.backend.serial.curve_models.CompletedPoint +spec|CurveFieldProofs.EdPoint|def|value=curve25519_dalek.edwards.EdwardsPoint +spec|CurveFieldProofs.ExtValid|def|value=fun (Pt : CurveFieldProofs.EdPoint) => And (CurveFieldProofs.Bnd (curve25519_dalek.edwards.EdwardsPoint.X Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.edwards.EdwardsPoint.Y Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.edwards.EdwardsPoint.Z Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.edwards.EdwardsPoint.T Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Z Pt)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))) (@Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.X Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Y Pt))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Z Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.T Pt)))))))) +spec|CurveFieldProofs.Fe|def|value=curve25519_dalek.backend.serial.u64.field.FieldElement51 +spec|CurveFieldProofs.Fp|def|value=ZMod CurveFieldProofs.P +spec|CurveFieldProofs.IsEdwardsImplementation|other|type=Prop +spec|CurveFieldProofs.IsFieldImplementation|other|type=Prop +spec|CurveFieldProofs.IsNielsOf|def|value=fun (N : CurveFieldProofs.ProjNiels) (Pt : CurveFieldProofs.EdPoint) => And (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Y_plus_X N)) (@HAdd.hAdd.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHAdd.{0} CurveFieldProofs.Fp (@Distrib.toAdd.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Y Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.X Pt)))) (And (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Y_minus_X N)) (@HSub.hSub.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHSub.{0} CurveFieldProofs.Fp (@SubNegMonoid.toSub.{0} CurveFieldProofs.Fp (@AddGroup.toSubNegMonoid.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddGroup.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Y Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.X Pt)))) (And (@Eq.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Z N)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Z Pt))) (@Eq.{1} CurveFieldProofs.Fp (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 121666) (@instOfNatAtLeastTwo.{0} CurveFieldProofs.Fp (nat_lit 121666) (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))) CurveFieldProofs.IsNielsOf._proof_1)) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.T2d N))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@Neg.neg.{0} CurveFieldProofs.Fp (@NegZeroClass.toNeg.{0} CurveFieldProofs.Fp (@SubNegZeroMonoid.toNegZeroClass.{0} CurveFieldProofs.Fp (@SubtractionMonoid.toSubNegZeroMonoid.{0} CurveFieldProofs.Fp (@SubtractionCommMonoid.toSubtractionMonoid.{0} CurveFieldProofs.Fp (@AddCommGroup.toDivisionAddCommMonoid.{0} CurveFieldProofs.Fp (@Ring.toAddCommGroup.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 243330) (@instOfNatAtLeastTwo.{0} CurveFieldProofs.Fp (nat_lit 243330) (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))) CurveFieldProofs.IsNielsOf._proof_2))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.T Pt)))))) +spec|CurveFieldProofs.IsNielsOf._proof_1|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 121665) (instOfNatNat (nat_lit 121665))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) +spec|CurveFieldProofs.IsNielsOf._proof_2|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 243329) (instOfNatNat (nat_lit 243329))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) +spec|CurveFieldProofs.NafDigits|def|value=fun (a : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) CurveFieldProofs.nafDigit._proof_1)) => ∀ (k : Nat), @LT.lt.{0} Nat instLTNat k (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) → And (Or (@Eq.{1} Int (CurveFieldProofs.nafDigit a k) (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0)))) (@Eq.{1} Int (@HMod.hMod.{0, 0, 0} Int Int Int (@instHMod.{0} Int Int.instMod) (CurveFieldProofs.nafDigit a k) (@OfNat.ofNat.{0} Int (nat_lit 2) (@instOfNat (nat_lit 2)))) (@OfNat.ofNat.{0} Int (nat_lit 1) (@instOfNat (nat_lit 1))))) (And (@LT.lt.{0} Int Int.instLTInt (@Neg.neg.{0} Int Int.instNegInt (@OfNat.ofNat.{0} Int (nat_lit 16) (@instOfNat (nat_lit 16)))) (CurveFieldProofs.nafDigit a k)) (@LT.lt.{0} Int Int.instLTInt (CurveFieldProofs.nafDigit a k) (@OfNat.ofNat.{0} Int (nat_lit 16) (@instOfNat (nat_lit 16))))) +spec|CurveFieldProofs.NafEntryOf|def|value=fun (e : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (A : CurveFieldProofs.EdPoint) (k : Nat) => And (CurveFieldProofs.ProjNielsValid e) (@Exists.{1} CurveFieldProofs.EdPoint fun (Q : CurveFieldProofs.EdPoint) => And (CurveFieldProofs.IsNielsOf e Q) (And (CurveFieldProofs.ExtValid Q) (And (CurveFieldProofs.OnCurveExt Q) (@Eq.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (CurveFieldProofs.edPt Q) (CurveFieldProofs.edOdd k (CurveFieldProofs.edPt A)))))) +spec|CurveFieldProofs.NafTableOf|def|value=fun (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (A : CurveFieldProofs.EdPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e0 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e1 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e2 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e3 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e4 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e5 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e6 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Exists.{1} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint fun (e7 : curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => And (@Eq.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (CurveFieldProofs.tblEntries tbl) (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e0 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e1 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e2 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e3 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e4 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e5 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e6 (@List.cons.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint e7 (@List.nil.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint)))))))))) (And (CurveFieldProofs.NafEntryOf e0 A (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (And (CurveFieldProofs.NafEntryOf e1 A (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (CurveFieldProofs.NafEntryOf e2 A (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) (And (CurveFieldProofs.NafEntryOf e3 A (@OfNat.ofNat.{0} Nat (nat_lit 3) (instOfNatNat (nat_lit 3)))) (And (CurveFieldProofs.NafEntryOf e4 A (@OfNat.ofNat.{0} Nat (nat_lit 4) (instOfNatNat (nat_lit 4)))) (And (CurveFieldProofs.NafEntryOf e5 A (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5)))) (And (CurveFieldProofs.NafEntryOf e6 A (@OfNat.ofNat.{0} Nat (nat_lit 6) (instOfNatNat (nat_lit 6)))) (CurveFieldProofs.NafEntryOf e7 A (@OfNat.ofNat.{0} Nat (nat_lit 7) (instOfNatNat (nat_lit 7))))))))))) +spec|CurveFieldProofs.OnCurve|def|value=fun (x y : CurveFieldProofs.Fp) => @Eq.{1} CurveFieldProofs.Fp (@HAdd.hAdd.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHAdd.{0} CurveFieldProofs.Fp (@Distrib.toAdd.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@Neg.neg.{0} CurveFieldProofs.Fp (@NegZeroClass.toNeg.{0} CurveFieldProofs.Fp (@SubNegZeroMonoid.toNegZeroClass.{0} CurveFieldProofs.Fp (@SubtractionMonoid.toSubNegZeroMonoid.{0} CurveFieldProofs.Fp (@SubtractionCommMonoid.toSubtractionMonoid.{0} CurveFieldProofs.Fp (@AddCommGroup.toDivisionAddCommMonoid.{0} CurveFieldProofs.Fp (@Ring.toAddCommGroup.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) x (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) y (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))))) (@HAdd.hAdd.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHAdd.{0} CurveFieldProofs.Fp (@Distrib.toAdd.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 1) (@One.toOfNat1.{0} CurveFieldProofs.Fp (@AddMonoidWithOne.toOne.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) CurveFieldProofs.edD (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) x (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))))) (@HPow.hPow.{0, 0, 0} CurveFieldProofs.Fp Nat CurveFieldProofs.Fp (@instHPow.{0, 0} CurveFieldProofs.Fp Nat (@Monoid.toPow.{0} CurveFieldProofs.Fp (@MonoidWithZero.toMonoid.{0} CurveFieldProofs.Fp (@Semiring.toMonoidWithZero.{0} CurveFieldProofs.Fp (@DivisionSemiring.toSemiring.{0} CurveFieldProofs.Fp (@Semifield.toDivisionSemiring.{0} CurveFieldProofs.Fp (@Field.toSemifield.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) y (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))))) +spec|CurveFieldProofs.OnCurveExt|def|value=fun (P : CurveFieldProofs.EdPoint) => CurveFieldProofs.OnCurve (CurveFieldProofs.edX P) (CurveFieldProofs.edY P) +spec|CurveFieldProofs.P|def|value=@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 255) (instOfNatNat (nat_lit 255)))) (@OfNat.ofNat.{0} Nat (nat_lit 19) (instOfNatNat (nat_lit 19))) +spec|CurveFieldProofs.ProjNiels|def|value=curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint +spec|CurveFieldProofs.ProjNielsValid|def|value=fun (N : CurveFieldProofs.ProjNiels) => And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Y_plus_X N) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 53) (instOfNatNat (nat_lit 53))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Y_minus_X N) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 53) (instOfNatNat (nat_lit 53))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Z N) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.T2d N) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint.Z N)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P))))))))))))) +spec|CurveFieldProofs.ProjPoint|def|value=curve25519_dalek.backend.serial.curve_models.ProjectivePoint +spec|CurveFieldProofs.ProjValid|def|value=fun (Pt : CurveFieldProofs.ProjPoint) => And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.X Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Y Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (CurveFieldProofs.Bnd (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Z Pt) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@Ne.{1} CurveFieldProofs.Fp (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Z Pt)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))))))) +spec|CurveFieldProofs.bytesVal|def|value=fun (s : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.bytesVal._proof_1)) => CurveFieldProofs.bytesVal.match_1.{1} (fun (x : List.{0} Aeneas.Std.U8) => Nat) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.bytesVal._proof_1))) s) (fun (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) => @HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 72) (instOfNatNat (nat_lit 72)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 80) (instOfNatNat (nat_lit 80)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 88) (instOfNatNat (nat_lit 88)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 96) (instOfNatNat (nat_lit 96)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 112) (instOfNatNat (nat_lit 112)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 120) (instOfNatNat (nat_lit 120)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b16) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 128) (instOfNatNat (nat_lit 128)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 136) (instOfNatNat (nat_lit 136)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 144) (instOfNatNat (nat_lit 144)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 152) (instOfNatNat (nat_lit 152)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 160) (instOfNatNat (nat_lit 160)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 168) (instOfNatNat (nat_lit 168)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 176) (instOfNatNat (nat_lit 176)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 184) (instOfNatNat (nat_lit 184)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b24) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 192) (instOfNatNat (nat_lit 192)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 200) (instOfNatNat (nat_lit 200)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 216) (instOfNatNat (nat_lit 216)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 224) (instOfNatNat (nat_lit 224)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 232) (instOfNatNat (nat_lit 232)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 240) (instOfNatNat (nat_lit 240)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 248) (instOfNatNat (nat_lit 248)))))) fun (x : List.{0} Aeneas.Std.U8) => @OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)) +spec|CurveFieldProofs.bytesVal._proof_1|prop|type=@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize) +spec|CurveFieldProofs.bytesVal._sparseCasesOn_1|def|value=fun {α : Type u} {motive : (t : List.{u} α) → Sort u_1} (t : List.{u} α) (cons : (head : α) → (tail : List.{u} α) → motive (@List.cons.{u} α head tail)) => @List.rec.{u_1, u} α (fun (t : List.{u} α) => ((h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α t)) → motive t) → motive t) (fun («else» : (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α (@List.nil.{u} α))) → motive (@List.nil.{u} α)) => «else» (@Nat.ne_of_beq_eq_false (Nat.land (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (Nat.shiftRight (nat_lit 2) (nat_lit 0))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Eq.refl.{1} Bool Bool.false))) (fun (head : α) (tail : List.{u} α) (tail_ih : ((h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α tail)) → motive tail) → motive tail) («else» : (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α (@List.cons.{u} α head tail))) → motive (@List.cons.{u} α head tail)) => cons head tail) t +spec|CurveFieldProofs.bytesVal._sparseCasesOn_2|def|value=fun {α : Type u} {motive : (t : List.{u} α) → Sort u_1} (t : List.{u} α) (nil : motive (@List.nil.{u} α)) => @List.rec.{u_1, u} α (fun (t : List.{u} α) => ((h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α t)) → motive t) → motive t) (fun («else» : (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α (@List.nil.{u} α))) → motive (@List.nil.{u} α)) => nil) (fun (head : α) (tail : List.{u} α) (tail_ih : ((h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α tail)) → motive tail) → motive tail) («else» : (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α (@List.cons.{u} α head tail))) → motive (@List.cons.{u} α head tail)) => «else» (@Nat.ne_of_beq_eq_false (Nat.land (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (Nat.shiftRight (nat_lit 1) (nat_lit 1))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Eq.refl.{1} Bool Bool.false))) t +spec|CurveFieldProofs.bytesVal.match_1|def|value=fun (motive : List.{0} Aeneas.Std.U8 → Sort u_1) (x : List.{0} Aeneas.Std.U8) (h_1 : (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 : Aeneas.Std.U8) → motive (@List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 (@List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 (@List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 (@List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 (@List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 (@List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 (@List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 (@List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 (@List.nil.{0} Aeneas.Std.U8)))))))))))))))))))))))))))))))))) (h_2 : (x : List.{0} Aeneas.Std.U8) → motive x) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive x) x (fun (head : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head x)) tail (fun (head_1 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 x))) tail (fun (head_2 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 x)))) tail (fun (head_3 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 x))))) tail (fun (head_4 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 x)))))) tail (fun (head_5 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 x))))))) tail (fun (head_6 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 x)))))))) tail (fun (head_7 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 x))))))))) tail (fun (head_8 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 x)))))))))) tail (fun (head_9 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 x))))))))))) tail (fun (head_10 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 x)))))))))))) tail (fun (head_11 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 x))))))))))))) tail (fun (head_12 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 x)))))))))))))) tail (fun (head_13 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 x))))))))))))))) tail (fun (head_14 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 x)))))))))))))))) tail (fun (head_15 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 x))))))))))))))))) tail (fun (head_16 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 x)))))))))))))))))) tail (fun (head_17 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 x))))))))))))))))))) tail (fun (head_18 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 x)))))))))))))))))))) tail (fun (head_19 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 x))))))))))))))))))))) tail (fun (head_20 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 x)))))))))))))))))))))) tail (fun (head_21 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 x))))))))))))))))))))))) tail (fun (head_22 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 x)))))))))))))))))))))))) tail (fun (head_23 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 x))))))))))))))))))))))))) tail (fun (head_24 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 x)))))))))))))))))))))))))) tail (fun (head_25 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 x))))))))))))))))))))))))))) tail (fun (head_26 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 x)))))))))))))))))))))))))))) tail (fun (head_27 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 (@List.cons.{0} Aeneas.Std.U8 head_27 x))))))))))))))))))))))))))))) tail (fun (head_28 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 (@List.cons.{0} Aeneas.Std.U8 head_27 (@List.cons.{0} Aeneas.Std.U8 head_28 x)))))))))))))))))))))))))))))) tail (fun (head_29 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 (@List.cons.{0} Aeneas.Std.U8 head_27 (@List.cons.{0} Aeneas.Std.U8 head_28 (@List.cons.{0} Aeneas.Std.U8 head_29 x))))))))))))))))))))))))))))))) tail (fun (head_30 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 (@List.cons.{0} Aeneas.Std.U8 head_27 (@List.cons.{0} Aeneas.Std.U8 head_28 (@List.cons.{0} Aeneas.Std.U8 head_29 (@List.cons.{0} Aeneas.Std.U8 head_30 x)))))))))))))))))))))))))))))))) tail (fun (head_31 : Aeneas.Std.U8) (tail : List.{0} Aeneas.Std.U8) => @CurveFieldProofs.bytesVal._sparseCasesOn_2.{u_1, 0} Aeneas.Std.U8 (fun (x : List.{0} Aeneas.Std.U8) => motive (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 (@List.cons.{0} Aeneas.Std.U8 head_27 (@List.cons.{0} Aeneas.Std.U8 head_28 (@List.cons.{0} Aeneas.Std.U8 head_29 (@List.cons.{0} Aeneas.Std.U8 head_30 (@List.cons.{0} Aeneas.Std.U8 head_31 x))))))))))))))))))))))))))))))))) tail (h_1 head head_1 head_2 head_3 head_4 head_5 head_6 head_7 head_8 head_9 head_10 head_11 head_12 head_13 head_14 head_15 head_16 head_17 head_18 head_19 head_20 head_21 head_22 head_23 head_24 head_25 head_26 head_27 head_28 head_29 head_30 head_31) fun (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 (@List.cons.{0} Aeneas.Std.U8 head_27 (@List.cons.{0} Aeneas.Std.U8 head_28 (@List.cons.{0} Aeneas.Std.U8 head_29 (@List.cons.{0} Aeneas.Std.U8 head_30 (@List.cons.{0} Aeneas.Std.U8 head_31 tail))))))))))))))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 (@List.cons.{0} Aeneas.Std.U8 head_27 (@List.cons.{0} Aeneas.Std.U8 head_28 (@List.cons.{0} Aeneas.Std.U8 head_29 (@List.cons.{0} Aeneas.Std.U8 head_30 tail)))))))))))))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 (@List.cons.{0} Aeneas.Std.U8 head_27 (@List.cons.{0} Aeneas.Std.U8 head_28 (@List.cons.{0} Aeneas.Std.U8 head_29 tail))))))))))))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 (@List.cons.{0} Aeneas.Std.U8 head_27 (@List.cons.{0} Aeneas.Std.U8 head_28 tail)))))))))))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 (@List.cons.{0} Aeneas.Std.U8 head_27 tail))))))))))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 (@List.cons.{0} Aeneas.Std.U8 head_26 tail)))))))))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 (@List.cons.{0} Aeneas.Std.U8 head_25 tail))))))))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 (@List.cons.{0} Aeneas.Std.U8 head_24 tail)))))))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 (@List.cons.{0} Aeneas.Std.U8 head_23 tail))))))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 (@List.cons.{0} Aeneas.Std.U8 head_22 tail)))))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 (@List.cons.{0} Aeneas.Std.U8 head_21 tail))))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 (@List.cons.{0} Aeneas.Std.U8 head_20 tail)))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 (@List.cons.{0} Aeneas.Std.U8 head_19 tail))))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 (@List.cons.{0} Aeneas.Std.U8 head_18 tail)))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 (@List.cons.{0} Aeneas.Std.U8 head_17 tail))))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 (@List.cons.{0} Aeneas.Std.U8 head_16 tail)))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 (@List.cons.{0} Aeneas.Std.U8 head_15 tail))))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 (@List.cons.{0} Aeneas.Std.U8 head_14 tail)))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 (@List.cons.{0} Aeneas.Std.U8 head_13 tail))))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 (@List.cons.{0} Aeneas.Std.U8 head_12 tail)))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 (@List.cons.{0} Aeneas.Std.U8 head_11 tail))))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 (@List.cons.{0} Aeneas.Std.U8 head_10 tail)))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 (@List.cons.{0} Aeneas.Std.U8 head_9 tail))))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 (@List.cons.{0} Aeneas.Std.U8 head_8 tail)))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 (@List.cons.{0} Aeneas.Std.U8 head_7 tail))))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 (@List.cons.{0} Aeneas.Std.U8 head_6 tail)))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 (@List.cons.{0} Aeneas.Std.U8 head_5 tail))))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 (@List.cons.{0} Aeneas.Std.U8 head_4 tail)))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 (@List.cons.{0} Aeneas.Std.U8 head_3 tail))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 (@List.cons.{0} Aeneas.Std.U8 head_2 tail)))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head (@List.cons.{0} Aeneas.Std.U8 head_1 tail))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U8 head tail)) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U8 x)) => h_2 x +spec|CurveFieldProofs.complX|def|value=fun (Pt : CurveFieldProofs.ComplPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.X Pt)) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Z Pt)) +spec|CurveFieldProofs.complY|def|value=fun (Pt : CurveFieldProofs.ComplPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.Y Pt)) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.CompletedPoint.T Pt)) +spec|CurveFieldProofs.denote|def|value=fun (a : CurveFieldProofs.Fe) => @Nat.cast.{0} CurveFieldProofs.Fp (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@CommRing.toRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P))))) (CurveFieldProofs.feVal a) +spec|CurveFieldProofs.dsmFold|def|value=fun (aD bD : Nat → Int) (pA pB x : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x_1 : Nat) => @Nat.brecOn.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x_1 (CurveFieldProofs.dsmFold._f aD bD pA pB) x +spec|CurveFieldProofs.dsmFold._f|def|value=fun (aD bD : Nat → Int) (pA pB : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x : Nat) (f : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x) (x_1 : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => CurveFieldProofs.dsmFold.match_1.{1} (fun (x : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x_2 : Nat) => @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x_2 → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x_1 x (fun (P : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) => P) (fun (P : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (j : Nat) (x : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (Nat.succ j)) => x.1 (CurveFieldProofs.edDigit pB (bD j) (CurveFieldProofs.edDigit pA (aD j) (CurveFieldProofs.edAdd P P)))) f +spec|CurveFieldProofs.dsmFold.match_1|def|value=fun (motive : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Nat → Sort u_1) (x : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x_1 : Nat) (h_1 : (P : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) → motive P (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (h_2 : (P : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) → (j : Nat) → motive P (Nat.succ j)) => @Nat.casesOn.{u_1} (fun (x_2 : Nat) => motive x x_2) x_1 (h_1 x) fun (n : Nat) => h_2 x n +spec|CurveFieldProofs.edAdd|def|value=fun (p q : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => @Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (@HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (@HAdd.hAdd.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHAdd.{0} CurveFieldProofs.Fp (@Distrib.toAdd.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp q)) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp q) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p))) (@HAdd.hAdd.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHAdd.{0} CurveFieldProofs.Fp (@Distrib.toAdd.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 1) (@One.toOfNat1.{0} CurveFieldProofs.Fp (@AddMonoidWithOne.toOne.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) CurveFieldProofs.edD (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p)) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp q)) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p)) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp q)))) (@HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (@HAdd.hAdd.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHAdd.{0} CurveFieldProofs.Fp (@Distrib.toAdd.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp q)) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp q))) (@HSub.hSub.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHSub.{0} CurveFieldProofs.Fp (@SubNegMonoid.toSub.{0} CurveFieldProofs.Fp (@AddGroup.toSubNegMonoid.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddGroup.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 1) (@One.toOfNat1.{0} CurveFieldProofs.Fp (@AddMonoidWithOne.toOne.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) (@HMul.hMul.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHMul.{0} CurveFieldProofs.Fp (@Distrib.toMul.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toDistrib.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P)))))))) CurveFieldProofs.edD (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p)) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp q)) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p)) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp q)))) +spec|CurveFieldProofs.edBasePt|def|value=@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 15112221349535400772501151409588531511454012693041857206046113283949847762202) (@instOfNatAtLeastTwo.{0} CurveFieldProofs.Fp (nat_lit 15112221349535400772501151409588531511454012693041857206046113283949847762202) (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))) CurveFieldProofs.edBasePt._proof_1)) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 46316835694926478169428394003475163141307993866256225615783033603165251855960) (@instOfNatAtLeastTwo.{0} CurveFieldProofs.Fp (nat_lit 46316835694926478169428394003475163141307993866256225615783033603165251855960) (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))) CurveFieldProofs.edBasePt._proof_2)) +spec|CurveFieldProofs.edBasePt._proof_1|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 15112221349535400772501151409588531511454012693041857206046113283949847762201) (instOfNatNat (nat_lit 15112221349535400772501151409588531511454012693041857206046113283949847762201))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) +spec|CurveFieldProofs.edBasePt._proof_2|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 46316835694926478169428394003475163141307993866256225615783033603165251855959) (instOfNatNat (nat_lit 46316835694926478169428394003475163141307993866256225615783033603165251855959))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) +spec|CurveFieldProofs.edD|def|value=@HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (@Neg.neg.{0} CurveFieldProofs.Fp (@NegZeroClass.toNeg.{0} CurveFieldProofs.Fp (@SubNegZeroMonoid.toNegZeroClass.{0} CurveFieldProofs.Fp (@SubtractionMonoid.toSubNegZeroMonoid.{0} CurveFieldProofs.Fp (@SubtractionCommMonoid.toSubtractionMonoid.{0} CurveFieldProofs.Fp (@AddCommGroup.toDivisionAddCommMonoid.{0} CurveFieldProofs.Fp (@Ring.toAddCommGroup.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 121665) (@instOfNatAtLeastTwo.{0} CurveFieldProofs.Fp (nat_lit 121665) (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))) CurveFieldProofs.edD._proof_1))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 121666) (@instOfNatAtLeastTwo.{0} CurveFieldProofs.Fp (nat_lit 121666) (@AddMonoidWithOne.toNatCast.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))) CurveFieldProofs.edD._proof_2)) +spec|CurveFieldProofs.edD._proof_1|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 121664) (instOfNatNat (nat_lit 121664))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) +spec|CurveFieldProofs.edD._proof_2|prop|type=Nat.AtLeastTwo (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@OfNat.ofNat.{0} Nat (nat_lit 121665) (instOfNatNat (nat_lit 121665))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) +spec|CurveFieldProofs.edDigit|def|value=fun (aPt : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (d : Int) (P : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => @ite.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@LT.lt.{0} Int Int.instLTInt (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0))) d) (Int.decLt (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0))) d) (CurveFieldProofs.edAdd P (CurveFieldProofs.edOdd (@HDiv.hDiv.{0, 0, 0} Nat Nat Nat (@instHDiv.{0} Nat Nat.instDiv) (@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (Int.toNat d) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) aPt)) (@ite.{1} (Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@LT.lt.{0} Int Int.instLTInt d (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0)))) (Int.decLt d (@OfNat.ofNat.{0} Int (nat_lit 0) (@instOfNat (nat_lit 0)))) (CurveFieldProofs.edAdd P (CurveFieldProofs.edNeg (CurveFieldProofs.edOdd (@HDiv.hDiv.{0, 0, 0} Nat Nat Nat (@instHDiv.{0} Nat Nat.instDiv) (@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (Int.toNat (@Neg.neg.{0} Int Int.instNegInt d)) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2)))) aPt))) P) +spec|CurveFieldProofs.edId|def|value=@Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 0) (@Zero.toOfNat0.{0} CurveFieldProofs.Fp (@MulZeroClass.toZero.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocSemiring.toMulZeroClass.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} CurveFieldProofs.Fp (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} CurveFieldProofs.Fp (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} CurveFieldProofs.Fp (@CommRing.toNonUnitalCommRing.{0} CurveFieldProofs.Fp (ZMod.commRing CurveFieldProofs.P))))))))) (@OfNat.ofNat.{0} CurveFieldProofs.Fp (nat_lit 1) (@One.toOfNat1.{0} CurveFieldProofs.Fp (@AddMonoidWithOne.toOne.{0} CurveFieldProofs.Fp (@AddGroupWithOne.toAddMonoidWithOne.{0} CurveFieldProofs.Fp (@Ring.toAddGroupWithOne.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP)))))))) +spec|CurveFieldProofs.edNeg|def|value=fun (p : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => @Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (@Neg.neg.{0} CurveFieldProofs.Fp (@NegZeroClass.toNeg.{0} CurveFieldProofs.Fp (@SubNegZeroMonoid.toNegZeroClass.{0} CurveFieldProofs.Fp (@SubtractionMonoid.toSubNegZeroMonoid.{0} CurveFieldProofs.Fp (@SubtractionCommMonoid.toSubtractionMonoid.{0} CurveFieldProofs.Fp (@AddCommGroup.toDivisionAddCommMonoid.{0} CurveFieldProofs.Fp (@Ring.toAddCommGroup.{0} CurveFieldProofs.Fp (@DivisionRing.toRing.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))))))) (@Prod.fst.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p)) (@Prod.snd.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp p) +spec|CurveFieldProofs.edOdd|def|value=fun (x : Nat) (x_1 : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => @Nat.brecOn.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x CurveFieldProofs.edOdd._f x_1 +spec|CurveFieldProofs.edOdd._f|def|value=fun (x : Nat) (f : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x) (x_1 : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => CurveFieldProofs.edOdd.match_1.{1} (fun (x : Nat) (x_2 : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) => @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) x x_1 (fun (p : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) => p) (fun (k : Nat) (p : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (x : @Nat.below.{1} (fun (x : Nat) => Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (Nat.succ k)) => CurveFieldProofs.edAdd (CurveFieldProofs.edAdd p p) (x.1 p)) f +spec|CurveFieldProofs.edOdd.match_1|def|value=fun (motive : Nat → Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp → Sort u_1) (x : Nat) (x_1 : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) (h_1 : (p : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) → motive (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) p) (h_2 : (k : Nat) → (p : Prod.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp) → motive (Nat.succ k) p) => @Nat.casesOn.{u_1} (fun (x : Nat) => motive x x_1) x (h_1 x_1) fun (n : Nat) => h_2 n x_1 +spec|CurveFieldProofs.edPt|def|value=fun (P : CurveFieldProofs.EdPoint) => @Prod.mk.{0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp (CurveFieldProofs.edX P) (CurveFieldProofs.edY P) +spec|CurveFieldProofs.edX|def|value=fun (Pt : CurveFieldProofs.EdPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.X Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Z Pt)) +spec|CurveFieldProofs.edY|def|value=fun (Pt : CurveFieldProofs.EdPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Y Pt)) (CurveFieldProofs.denote (curve25519_dalek.edwards.EdwardsPoint.Z Pt)) +spec|CurveFieldProofs.feVal|def|value=fun (a : CurveFieldProofs.Fe) => CurveFieldProofs.feVal.match_1.{1} (fun (x : List.{0} Aeneas.Std.U64) => Nat) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (fun (a0 a1 a2 a3 a4 : Aeneas.Std.U64) => CurveFieldProofs.limbsVal a0 a1 a2 a3 a4) fun (x : List.{0} Aeneas.Std.U64) => @OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)) +spec|CurveFieldProofs.feVal._sparseCasesOn_1|def|value=fun {α : Type u} {motive : (t : List.{u} α) → Sort u_1} (t : List.{u} α) (cons : (head : α) → (tail : List.{u} α) → motive (@List.cons.{u} α head tail)) => @List.rec.{u_1, u} α (fun (t : List.{u} α) => ((h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α t)) → motive t) → motive t) (fun («else» : (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α (@List.nil.{u} α))) → motive (@List.nil.{u} α)) => «else» (@Nat.ne_of_beq_eq_false (Nat.land (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (Nat.shiftRight (nat_lit 2) (nat_lit 0))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Eq.refl.{1} Bool Bool.false))) (fun (head : α) (tail : List.{u} α) (tail_ih : ((h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α tail)) → motive tail) → motive tail) («else» : (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α (@List.cons.{u} α head tail))) → motive (@List.cons.{u} α head tail)) => cons head tail) t +spec|CurveFieldProofs.feVal._sparseCasesOn_2|def|value=fun {α : Type u} {motive : (t : List.{u} α) → Sort u_1} (t : List.{u} α) (nil : motive (@List.nil.{u} α)) => @List.rec.{u_1, u} α (fun (t : List.{u} α) => ((h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α t)) → motive t) → motive t) (fun («else» : (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α (@List.nil.{u} α))) → motive (@List.nil.{u} α)) => nil) (fun (head : α) (tail : List.{u} α) (tail_ih : ((h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α tail)) → motive tail) → motive tail) («else» : (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α (@List.cons.{u} α head tail))) → motive (@List.cons.{u} α head tail)) => «else» (@Nat.ne_of_beq_eq_false (Nat.land (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (Nat.shiftRight (nat_lit 1) (nat_lit 1))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Eq.refl.{1} Bool Bool.false))) t +spec|CurveFieldProofs.feVal.match_1|def|value=fun (motive : List.{0} Aeneas.Std.U64 → Sort u_1) (x : List.{0} Aeneas.Std.U64) (h_1 : (a0 a1 a2 a3 a4 : Aeneas.Std.U64) → motive (@List.cons.{0} Aeneas.Std.U64 a0 (@List.cons.{0} Aeneas.Std.U64 a1 (@List.cons.{0} Aeneas.Std.U64 a2 (@List.cons.{0} Aeneas.Std.U64 a3 (@List.cons.{0} Aeneas.Std.U64 a4 (@List.nil.{0} Aeneas.Std.U64))))))) (h_2 : (x : List.{0} Aeneas.Std.U64) → motive x) => @CurveFieldProofs.feVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive x) x (fun (head : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @CurveFieldProofs.feVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head x)) tail (fun (head_1 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @CurveFieldProofs.feVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 x))) tail (fun (head_2 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @CurveFieldProofs.feVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 x)))) tail (fun (head_3 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @CurveFieldProofs.feVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 x))))) tail (fun (head_4 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @CurveFieldProofs.feVal._sparseCasesOn_2.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 (@List.cons.{0} Aeneas.Std.U64 head_4 x)))))) tail (h_1 head head_1 head_2 head_3 head_4) fun (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 (@List.cons.{0} Aeneas.Std.U64 head_4 tail)))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 tail))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 tail)))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 tail))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head tail)) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 x)) => h_2 x +spec|CurveFieldProofs.fe_to_bytes|def|value=curve25519_dalek.backend.serial.u64.field.FieldElement51.as_bytes +spec|CurveFieldProofs.instDecidableRangeEq|def|value=fun (e r : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1)) (n : Nat) => have this : Iff (CurveFieldProofs.rangeEq e r n) (∀ (j : Nat), @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j)) := CurveFieldProofs.instDecidableRangeEq._proof_1 e r n; @decidable_of_iff (CurveFieldProofs.rangeEq e r n) (∀ (j : Nat), @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j)) (CurveFieldProofs.instDecidableRangeEq._proof_2 e r n this) (@Nat.decidableBallLT (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (fun (j : Nat) (a : @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))) => @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j)) fun (n_1 : Nat) (h : @LT.lt.{0} Nat instLTNat n_1 (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))) => (fun (n_2 : Nat) => @forall_prop_decidable (@LE.le.{0} Nat instLENat n n_2) (fun (a : @LE.le.{0} Nat instLENat n n_2) => @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) n_2) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) n_2)) (Nat.decLe n n_2) fun (h : @LE.le.{0} Nat instLENat n n_2) => (fun (n : Nat) => Aeneas.Std.instDecidableEqUScalar_1 Aeneas.Std.UScalarTy.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) n) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) n)) n_2) n_1) +spec|CurveFieldProofs.instDecidableRangeEq._proof_1|prop|type=∀ (e r : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (n : Nat), Iff (CurveFieldProofs.rangeEq e r n) (∀ (j : Nat), @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j)) +spec|CurveFieldProofs.instDecidableRangeEq._proof_2|prop|type=∀ (e r : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1)) (n : Nat) (this : Iff (CurveFieldProofs.rangeEq e r n) (∀ (j : Nat), @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j))), Iff (∀ (j : Nat), @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @LE.le.{0} Nat instLENat n j → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j)) (CurveFieldProofs.rangeEq e r n) +spec|CurveFieldProofs.instFactPrimeP|prop|type=Fact (Nat.Prime CurveFieldProofs.P) +spec|CurveFieldProofs.limbsVal|def|value=fun (a0 a1 a2 a3 a4 : Aeneas.Std.U64) => @HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 51) (instOfNatNat (nat_lit 51)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 102) (instOfNatNat (nat_lit 102)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 153) (instOfNatNat (nat_lit 153)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 204) (instOfNatNat (nat_lit 204)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4)) +spec|CurveFieldProofs.nafDigit|def|value=fun (a : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) CurveFieldProofs.nafDigit._proof_1)) (k : Nat) => @Aeneas.Std.IScalar.val Aeneas.Std.IScalarTy.I8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.I8) Nat Aeneas.Std.I8 (fun («as» : List.{0} Aeneas.Std.I8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.I8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.I8) (Aeneas.Std.instInhabitedIScalar Aeneas.Std.IScalarTy.I8) (@Subtype.val.{1} (List.{0} Aeneas.Std.I8) (fun (l : List.{0} Aeneas.Std.I8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.I8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) CurveFieldProofs.nafDigit._proof_1))) a) k) +spec|CurveFieldProofs.nafDigit._proof_1|prop|type=@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize) +spec|CurveFieldProofs.nafSum|def|value=fun (naf : Aeneas.Std.Array.{0} Aeneas.Std.I8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) CurveFieldProofs.nafSum._proof_1)) (m : Nat) => @Finset.sum.{0, 0} Nat Int Int.instAddCommMonoid (Finset.range m) fun (k : Nat) => @HMul.hMul.{0, 0, 0} Int Int Int (@instHMul.{0} Int Int.instMul) (CurveFieldProofs.nafDigit naf k) (@HPow.hPow.{0, 0, 0} Int Nat Int (@instHPow.{0, 0} Int Nat (@Monoid.toPow.{0} Int Int.instMonoid)) (@OfNat.ofNat.{0} Int (nat_lit 2) (@instOfNat (nat_lit 2))) k) +spec|CurveFieldProofs.nafSum._proof_1|prop|type=@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize) +spec|CurveFieldProofs.projX|def|value=fun (Pt : CurveFieldProofs.ProjPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.X Pt)) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Z Pt)) +spec|CurveFieldProofs.projY|def|value=fun (Pt : CurveFieldProofs.ProjPoint) => @HDiv.hDiv.{0, 0, 0} CurveFieldProofs.Fp CurveFieldProofs.Fp CurveFieldProofs.Fp (@instHDiv.{0} CurveFieldProofs.Fp (@DivInvMonoid.toDiv.{0} CurveFieldProofs.Fp (@DivisionRing.toDivInvMonoid.{0} CurveFieldProofs.Fp (@Field.toDivisionRing.{0} CurveFieldProofs.Fp (@ZMod.instField CurveFieldProofs.P CurveFieldProofs.instFactPrimeP))))) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Y Pt)) (CurveFieldProofs.denote (curve25519_dalek.backend.serial.curve_models.ProjectivePoint.Z Pt)) +spec|CurveFieldProofs.rangeEq|def|value=fun (e r : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1)) (n : Nat) => ∀ (j : Nat), @LE.le.{0} Nat instLENat n j → @LT.lt.{0} Nat instLTNat j (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) → @Eq.{1} Aeneas.Std.U8 (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) e) j) (@GetElem?.getElem!.{0, 0, 0} (List.{0} Aeneas.Std.U8) Nat Aeneas.Std.U8 (fun («as» : List.{0} Aeneas.Std.U8) (i : Nat) => @LT.lt.{0} Nat instLTNat i (@List.length.{0} Aeneas.Std.U8 «as»)) (@List.instGetElem?NatLtLength.{0} Aeneas.Std.U8) (Aeneas.Std.instInhabitedUScalar Aeneas.Std.UScalarTy.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) CurveFieldProofs.rangeEq._proof_1))) r) j) +spec|CurveFieldProofs.rangeEq._proof_1|prop|type=@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize) +spec|CurveFieldProofs.tblEntries|def|value=fun (tbl : curve25519_dalek.window.NafLookupTable5 curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Subtype.val.{1} (List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) (fun (l : List.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint) => @Eq.{1} Nat (@List.length.{0} curve25519_dalek.backend.serial.curve_models.ProjectiveNielsPoint l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) curve25519_dalek.window.NafLookupTable5._proof_1))) tbl +spec|ScalarProofs.Ell|def|value=@OfNat.ofNat.{0} Nat (nat_lit 7237005577332262213973186563042994240857116359379907606001950938285454250989) (instOfNatNat (nat_lit 7237005577332262213973186563042994240857116359379907606001950938285454250989)) diff --git a/verification/GEN-MODEL.sha256 b/verification/GEN-MODEL.sha256 new file mode 100644 index 0000000..86f83a5 --- /dev/null +++ b/verification/GEN-MODEL.sha256 @@ -0,0 +1,12 @@ +cf0761191d3f69794c9d74884dc9d93a3e7958cb0d8d5ef378b9bdf1f14e893f CurveField/FunsExternal.lean +85c6056c35d4d02bbd56ce51e3b448c759d302000a7ecbc4074a218990459ea1 CurveField/FunsExternal_Template.lean +cd49ea057b48b78294b2ca857575738af60d5cdd68506146411a83251c6c4648 CurveField/Funs.lean +d197d7b9fe515863784eeee59a2fbb69735d10ebcf5cc4e03feb3afbeb53a2b7 CurveField/TypesExternal.lean +4560fc87c6156df16c34117db0817dc0926709f884728d9ca907985cbf931c6c CurveField/TypesExternal_Template.lean +35752d7506b1e1391c80be62a6d51568104a6964aba079fd02cb2d05e9a333bf CurveField/Types.lean +11e90fcaf1a33a7f66b1d9eaebcd4b69db23837a027ff56f64941084d223512b CurveSig/FunsExternal.lean +3fa865dca7f03dcfdd68533321a6669d73e8698f2780b6934ff135cef0cd8f38 CurveSig/FunsExternal_Template.lean +28ed4991ccf04ffaf66d0f47bd1cc90dec9029ba7381d54ad1d8a3d684d074b3 CurveSig/Funs.lean +2358490d0b10aa95cfd951e65f9d52988da52740a5c8af209cd9e0bc45a26734 CurveSig/TypesExternal.lean +fe94bba57cba8a40aa6195f505eb56107c06f92be7dfc04931a7c05d104ae76a CurveSig/TypesExternal_Template.lean +29e72d1c365464b009a38e2310cebbf285e96c296e59ed098e06e647bbc5ffe6 CurveSig/Types.lean diff --git a/verification/Proofs/Audit.lean b/verification/Proofs/Audit.lean new file mode 100644 index 0000000..a809b1a --- /dev/null +++ b/verification/Proofs/Audit.lean @@ -0,0 +1,234 @@ +/- ────────────────────────────────────────────────────────────────────────── + Proofs/Audit.lean — statement + specification binding (P1-a). + + WHAT THIS ADDS over check.sh Phases 2b/3/3b. Those establish that each + certificate is a theorem and rests on exactly the declared axioms. None + of them establishes WHAT THE THEOREM SAYS. A certificate gutted to a + tautology keeps its name, its kind, and its axiom cone, and passes every + one of them. Worse, the reference definitions the statements are stated + AGAINST can be redefined to be the extracted code itself, at which point + the certificate says `loop = loop` and every cone is unchanged. + + So this file emits a canonical AUDIT-MANIFEST block covering: + · the POLICY constants (both cone tiers, and the module prefix that + defines what counts as a specification); + · every certificate's fully-elaborated STATEMENT (`pp.all`); + · every specification constant transitively reachable from those + statements, with its fully-elaborated DEFINITION BODY. A Prop-valued + constant contributes its statement rather than its proof term, by + proof irrelevance — the proof term is not what fidelity lives in. + + check.sh binds the SHA-256 of that block, and the block itself is + committed, so a mismatch can be DIFFED against a reference rather than + merely reported. + + TWO TIERS, NOT ONE. This repository has an arithmetic tier that must + stay oracle-free and an apex tier that legitimately carries this fork's + hash and wire-format axioms. The boundary differs BETWEEN FORKS. A + single global allowed-axiom list would silently widen the arithmetic + tier to accept hash oracles, which is the most valuable property these + repositories have. Hence a per-certificate expected cone below. + + NO HAND-KEPT STATEMENT FINGERPRINTS. The companion SLH-DSA auditor pins + a 32-bit `Expr.hash` per certificate as a diagnostic. That table is one + more thing that can fall out of sync, and the canonical block already + covers every statement at full fidelity — a diff of the block says more + than a changed integer does. Membership is derived, not listed. + + STANDING LIMIT: an audit executed by a harness cannot defend against an + author who edits that harness. The consumer defence is, and remains, the + pinned commit reviewed at the pin. +────────────────────────────────────────────────────────────────────────── -/ +import Proofs.FieldMain +import Proofs.EdMain +import Proofs.DsmTableSpec +import Proofs.DsmStepSpec +import Proofs.DsmLoopSpec +import Proofs.DsmNafSpec +import Proofs.DsmMulSpec +import Proofs.SigApexSpec +import Proofs.ToBytesSpec +import Proofs.CompressSpec +import Proofs.ScalarPackSpec +import Proofs.PointLiftSpec +import Proofs.PointEqSpec +import Proofs.DecompressSpec +import Proofs.FromBytesSpec +import Proofs.DecompressMain +import Lean +open Lean Elab Command + +namespace Ed25519Audit + +/-- Lean's three kernel axioms. -/ +def kernel3 : List Name := [`propext, `Classical.choice, `Quot.sound] + +/-- This fork's apex boundary: the hash oracle and wire-format symbols the + signature-level certificates are permitted to rest on, and nothing else. + POLICY CONSTANT — folded into the digest, so widening it moves the hash + and fails the build. -/ +def apexExtra : List Name := + [`ed25519.Signature, `verifying.sha512_hash3, `ed25519.Signature.to_bytes, `signature.error.Error, `signature.error.Error.new] + +def apexBoundary : List Name := kernel3 ++ apexExtra + +/-- A constant counts as SPECIFICATION if it was declared in a `Proofs.` + module — i.e. hand-written by us, as opposed to the extracted model in + `gen/` (pinned separately by Phase 0). Derived from the environment, not + from a list, so a new specification module cannot appear unnoticed. -/ +def specPrefix : String := "Proofs." + +/-- Per-certificate expected cone. Arithmetic tier first, apex tier last. -/ +def manifest : List (Name × List Name) := + [ (`CurveFieldProofs.fieldImplementation, kernel3) + , (`CurveFieldProofs.edwardsImplementation, kernel3) + , (`CurveFieldProofs.naf_table_spec, kernel3) + , (`CurveFieldProofs.naf_select_spec, kernel3) + , (`CurveFieldProofs.proj_double_law, kernel3) + , (`CurveFieldProofs.compl_as_projective_law, kernel3) + , (`CurveFieldProofs.dsm_step_p_law, kernel3) + , (`CurveFieldProofs.dsm_step_b_law, kernel3) + , (`CurveFieldProofs.dsm_loop_spec, kernel3) + , (`CurveFieldProofs.naf_load_spec, kernel3) + , (`CurveFieldProofs.naf_exit, kernel3) + , (`CurveFieldProofs.naf_digit_loop_spec, kernel3) + , (`CurveFieldProofs.non_adjacent_form_spec, kernel3) + , (`CurveFieldProofs.run_basepoint, kernel3) + , (`CurveFieldProofs.vartime_double_base_mul_spec, kernel3) + , (`CurveFieldProofs.verify_loop_full, kernel3) + , (`CurveFieldProofs.to_bytes_spec, kernel3) + , (`CurveFieldProofs.ed_compress_spec, kernel3) + , (`ScalarProofs.from_bytes_mod_order_wide_spec, kernel3) + , (`CurveFieldProofs.vartime_dsm_basepoint_spec, kernel3) + , (`CurveFieldProofs.enc_point_inj, kernel3) + , (`CurveFieldProofs.pow_p58_spec, kernel3) + , (`CurveFieldProofs.fe_ct_eq_spec, kernel3) + , (`CurveFieldProofs.sqrt_core, kernel3) + , (`CurveFieldProofs.sqrt_ratio_i_sq_spec, kernel3) + , (`CurveFieldProofs.from_bytes_spec, kernel3) + , (`CurveFieldProofs.decompress_of_canonical, kernel3) + , (`CurveFieldProofs.verify_accepts_iff, apexBoundary) + , (`CurveFieldProofs.verify_accepts_iff_point, apexBoundary) + , (`CurveFieldProofs.verify_accepts_iff_point_eq, apexBoundary) + , (`CurveFieldProofs.verify_accepts_iff_decompress, apexBoundary) + ] + +/-- Deterministic name ordering for the canonical serialization. -/ +def sortNames (l : List Name) : List Name := + ((l.map toString).toArray.qsort (· < ·)).toList.map (·.toName) + +/-- Whitespace-canonical: every whitespace run collapses to one space, so the + pretty-printer's line wrapping cannot perturb the digest. -/ +def normWs (s : String) : String := + (s.foldl (fun (acc : String × Bool) c => + let c := if c.isWhitespace then ' ' else c + if c == ' ' then (if acc.2 then acc else (acc.1.push ' ', true)) + else (acc.1.push c, false)) + ("", true)).1 + +/-- Was `n` hand-written by us, in a `Proofs.` module? -/ +def isSpecConst (env : Environment) (n : Name) : Bool := + match env.getModuleIdxFor? n with + | some idx => (toString env.header.moduleNames[idx.toNat]!).startsWith specPrefix + | none => false + +/-- Transitive closure over specification constants, starting from a + certificate's STATEMENT and following DEFINITION bodies (a theorem + contributes its statement only). This discovers the reference definitions — + and any future one — automatically, so a new specification cannot be + introduced, or an existing one redefined, without moving the digest. -/ +partial def closureOf (env : Environment) (seen : NameSet) (work : List Name) : NameSet := + match work with + | [] => seen + | n :: rest => + if seen.contains n || !isSpecConst env n then closureOf env seen rest + else + let seen := seen.insert n + let more := match env.find? n with + | some (.defnInfo v) => v.value.getUsedConstants.toList ++ v.type.getUsedConstants.toList + | some ci => ci.type.getUsedConstants.toList + | none => [] + closureOf env seen (more ++ rest) + +/-- Fully-explicit (`pp.all`) rendering, whitespace-canonicalized. Implicit + arguments, instances and universe levels are all made visible, so two + statements that merely LOOK alike cannot share a rendering. -/ +def ppAll (e : Expr) : CommandElabM String := do + let s ← Command.liftCoreM <| Meta.MetaM.run' <| + withOptions (fun o => o.setBool `pp.all true) do + return (← Meta.ppExpr e).pretty + return normWs s + +elab "auditStatements" : command => do + let env ← getEnv + let mut errs : Array String := #[] + + -- (0) The manifest may not permit an axiom outside the two declared tiers. + -- Without this, widening a cone in the manifest would be invisible. + for (cert, cone) in manifest do + for a in cone do + unless apexBoundary.contains a do + errs := errs.push s!"manifest permits {a} for {cert}, which is outside every declared tier" + + -- (1) Each certificate must EXIST, be a THEOREM, and have EXACTLY its cone. + -- Exact, not subset: a certificate that stopped depending on the hash + -- oracle is as wrong as one that acquired a new axiom. + for (cert, expected) in manifest do + match env.find? cert with + | none => errs := errs.push s!"{cert}: NOT FOUND (renamed or deleted?)" + | some (.thmInfo _) => + let got := (← collectAxioms cert).toList + let extras := got.filter (fun a => !expected.contains a) + let missing := expected.filter (fun a => !got.contains a) + unless extras.isEmpty && missing.isEmpty do + errs := errs.push s!"{cert}: cone extra={extras} missing={missing}" + | some (.axiomInfo _) => errs := errs.push s!"{cert}: is an AXIOM, not a proven theorem" + | some (.opaqueInfo _) => errs := errs.push s!"{cert}: is OPAQUE, not a proven theorem" + | some _ => errs := errs.push s!"{cert}: is not a theorem" + + unless errs.isEmpty do + throwError "AUDIT FAILED (fail-closed):\n{String.intercalate "\n" errs.toList}" + + -- (2) CANONICAL BLOCK: policy, then statements, then specification bodies. + let mut lines : Array String := #[] + lines := lines.push + s!"policy|kernel3={String.intercalate "," ((sortNames kernel3).map toString)}|apexExtra={String.intercalate "," ((sortNames apexExtra).map toString)}|specPrefix={specPrefix}" + let mut specs : NameSet := {} + for (cert, cone) in manifest do + let ci := (env.find? cert).get! + specs := (closureOf env {} ci.type.getUsedConstants.toList).toList.foldl (·.insert ·) specs + lines := lines.push + s!"cert|{cert}|cone={String.intercalate "," ((sortNames cone).map toString)}|type={← ppAll ci.type}" + for nm in sortNames specs.toList do + match env.find? nm with + | none => errs := errs.push s!"specification constant vanished mid-audit: {nm}" + | some ci => + let isProp ← Command.liftCoreM <| Meta.MetaM.run' <| Meta.isProp ci.type + -- Proof irrelevance: a Prop-valued constant contributes its STATEMENT; a + -- data definition contributes its BODY, which is where fidelity lives. + if isProp then + lines := lines.push s!"spec|{nm}|prop|type={← ppAll ci.type}" + else + match ci with + | .defnInfo v => lines := lines.push s!"spec|{nm}|def|value={← ppAll v.value}" + | _ => lines := lines.push s!"spec|{nm}|other|type={← ppAll ci.type}" + + unless errs.isEmpty do + throwError "AUDIT FAILED (fail-closed):\n{String.intercalate "\n" errs.toList}" + + -- FAIL CLOSED ON ABSENCE: a manifest that somehow produced no specification + -- constants would emit a block that binds statements only. That is a weaker + -- claim than this file advertises, so it is an error, not a quiet pass. + if specs.toList.isEmpty then + throwError "AUDIT FAILED: statements reached ZERO specification constants — the closure is not doing its job" + + logInfo ("AUDIT-MANIFEST-BEGIN\n" ++ String.intercalate "\n" lines.toList ++ "\nAUDIT-MANIFEST-END") + -- check.sh cross-checks its own CERTS array against THIS line, so the two + -- cannot drift apart without the build noticing. + logInfo s!"AUDITED-CERTIFICATES: {String.intercalate " " ((manifest.map (·.1)).map toString)}" + logInfo s!"statement audit PASSED: {manifest.length} certificates (exact cones + elaborated statements), {specs.toList.length} specification constants pinned" + +end Ed25519Audit + +open Ed25519Audit in +auditStatements diff --git a/verification/check.sh b/verification/check.sh index adb433c..b0293f0 100755 --- a/verification/check.sh +++ b/verification/check.sh @@ -19,6 +19,15 @@ # set of compiled modules does not match the set of shipped sources. # 3. axiom audit: #print axioms for every certificate in CERTS; each must # report exactly [propext, Classical.choice, Quot.sound] +# 3b. signature-apex audit: the four apex certificates against this fork's +# documented SHA-512 + wire-format boundary, exactly. +# 3c. statement + specification binding: Proofs/Audit.lean emits a canonical +# block of the policy constants, every certificate's fully-elaborated +# statement, and the body of every specification constant reachable from +# those statements. Its SHA-256 is pinned here and the block itself is +# committed, so a mismatch is diffable. This is the phase that makes a +# gutted statement, or a reference definition redefined to BE the +# extracted code, fail — neither moves any axiom cone. # ───────────────────────────────────────────────────────────────────────────── set -euo pipefail source ~/aeneas-toolchain/env.sh @@ -78,6 +87,7 @@ PROOFS=( DecompressSpec FromBytesSpec DecompressMain + Audit # LAST: imports the certificate corpus and runs the audit ) # Fully-qualified certificate names; each must be axiom-clean. CERTS=( @@ -141,6 +151,41 @@ for f in "$HERE"/gen/CurveField/*.lean "$HERE"/Proofs/*.lean; do done echo " all sources valid" +# ── Phase 0b: pin the extracted model ─────────────────────────────────────── +# WHY. The certificates are stated ABOUT the extracted model in gen/. Phase 3c +# binds their statements and the specification definitions those statements are +# stated against — but a statement mentions an extracted function BY NAME, so +# editing that function's BODY changes what the theorem is about while leaving +# every statement, every cone and the audit digest byte-identical. +# +# This is not hypothetical. On 2026-07-28 the risc0 and betrusted repositories +# were observed to produce byte-identical AUDIT-MANIFEST digests despite +# shipping demonstrably different extracted models (a different operation order +# in the point-doubling routine). The statements could not tell them apart. +# Only a byte pin can. +# +# Membership is derived from the filesystem, not from a list: every .lean under +# gen/ must appear in GEN-MODEL.sha256 and vice versa, so adding a model file +# fails closed rather than passing unnoticed. +echo "=== Phase 0b: extracted-model byte pin ===" +if [ ! -s "$HERE/GEN-MODEL.sha256" ]; then + echo "FATAL: GEN-MODEL.sha256 is missing or empty — the extracted model is unpinned." + exit 1 +fi +GEN_OBSERVED=$(cd "$HERE/gen" && find . -name '*.lean' -type f | sed 's|^\./||' | sort) +GEN_PINNED=$(awk '{print $2}' "$HERE/GEN-MODEL.sha256" | sort) +if [ "$GEN_OBSERVED" != "$GEN_PINNED" ]; then + echo "FATAL: the set of extracted-model files does not match GEN-MODEL.sha256." + echo " (< pinned, > present on disk)" + diff <(echo "$GEN_PINNED") <(echo "$GEN_OBSERVED") | sed 's/^/ /' + exit 1 +fi +if ! ( cd "$HERE/gen" && sha256sum -c --quiet "$HERE/GEN-MODEL.sha256" ) ; then + echo "FATAL: an extracted-model file does not match its pin. The proofs are" + echo "about a model that is no longer the one that was reviewed." + exit 1 +fi +echo " $(wc -l < "$HERE/GEN-MODEL.sha256") extracted-model files match their pins" # ── Phase 1: stub + axiom-smuggling audit ─────────────────────────────────── echo "=== Phase 1: stub audit ===" if grep -rn 'by trivial' "$HERE"/Proofs/*Spec*.lean 2>/dev/null; then @@ -310,5 +355,103 @@ lake env bash -c " fi " + +# ── Phase 3c: statement + specification binding ───────────────────────────── +# WHAT THE EARLIER PHASES DO NOT ESTABLISH. Phase 3 proves each certificate +# rests on exactly the declared axioms; 3b does the same for the apex tier. +# Neither says WHAT THE THEOREM SAYS. A certificate gutted to a tautology of +# the same cone passes both. So does one whose reference definition has been +# redefined to BE the extracted code, at which point the theorem reads +# `loop = loop` and every cone is byte-identical. +# +# Proofs/Audit.lean emits a canonical block holding the policy constants, +# every certificate's fully-elaborated statement, and the body of every +# specification constant transitively reachable from those statements. This +# phase binds the SHA-256 of that block, and the block's INPUT is committed +# too, so a mismatch can be DIFFED rather than merely reported. +# +# To rotate deliberately: run check.sh, take the printed OBSERVED digest, and +# update the constant below AND AUDIT-MANIFEST.txt in the same reviewable +# commit. That the rotation is visible in review is the whole point — an +# author who edits a statement and refreshes the digest in one commit is +# caught by reading the diff, not by this script. +EXPECTED_AUDIT_SHA256="6c821b8e465d3b394cb3cbb4bb3757791ace064b6d1b273ba9a41402dac74e24" +echo "=== Phase 3c: statement + specification binding ===" +cd "$AENEAS_LEAN" +# The compiler's own exit code is the primary signal; the transcript is only +# corroboration. A timeout or a memory clamp exits non-zero WITHOUT printing +# "error:", so grepping the text alone would let it through. +AUD_RC=0 +AUD_OUT=$(lake env bash -c " + set -uo pipefail + cd '$HERE/gen' && export LEAN_PATH=\"\$LEAN_PATH:\$PWD:$HERE\" + cd '$HERE' + LEAN_TIMEOUT=$TIMEOUT LEAN_MEM_MB=8192 '$HERE/lean-guard' Proofs/Audit.lean 2>&1 +" ) || AUD_RC=$? +if [ "$AUD_RC" -ne 0 ]; then + echo "AUDIT FAILED — Proofs/Audit.lean exited $AUD_RC:" + tail -20 <<<"$AUD_OUT" | sed 's/^/ /' + exit 1 +fi +if grep -q 'error:' <<<"$AUD_OUT"; then + echo "AUDIT FAILED — Proofs/Audit.lean did not elaborate cleanly:" + grep 'error:' <<<"$AUD_OUT" | head -20 | sed 's/^/ /' + exit 1 +fi +BLOCK=$(awk '/AUDIT-MANIFEST-BEGIN/{f=1;next} /AUDIT-MANIFEST-END/{f=0} f' <<<"$AUD_OUT") +# FAIL CLOSED ON ABSENCE: no block and a matching block must not share a path. +if [ -z "$BLOCK" ]; then + echo "AUDIT FAILED — no AUDIT-MANIFEST block was emitted (fail-closed)."; exit 1 +fi +GOT_SHA=$(printf '%s\n' "$BLOCK" | sha256sum | cut -d' ' -f1) +if [ "$GOT_SHA" != "$EXPECTED_AUDIT_SHA256" ]; then + printf '%s\n' "$BLOCK" > "$HERE/.audit-manifest.observed" + echo "AUDIT FAILED — audit-manifest digest mismatch." + echo " expected: $EXPECTED_AUDIT_SHA256" + echo " observed: $GOT_SHA" + echo " A statement, a specification body, or a policy constant changed." + echo " First differences against the committed block:" + diff -u "$HERE/AUDIT-MANIFEST.txt" "$HERE/.audit-manifest.observed" 2>/dev/null \ + | head -30 | sed 's/^/ /' || echo " (AUDIT-MANIFEST.txt absent — cannot diff)" + rm -f "$HERE/.audit-manifest.observed" + exit 1 +fi +# The digest's INPUT must be committed and current, or the diff above would +# compare against a stale reference and quietly mislead the next reader. +if ! printf '%s\n' "$BLOCK" | cmp -s - "$HERE/AUDIT-MANIFEST.txt"; then + echo "AUDIT FAILED — the committed AUDIT-MANIFEST.txt does not match the emitted block." + echo " (the digest matched, so the committed copy is stale — refresh it)"; exit 1 +fi +# CROSS-CHECK the certificate list against its OTHER two sources in this file: +# the CERTS array (Phase 3) and the apex names Phase 3b actually asks about. +# The apex names are read back out of this script rather than retyped, so a +# fourth copy cannot drift. Without this, a certificate could be dropped from +# the auditor's manifest and nothing would notice. +# Match only the QUOTED commands Phase 3b actually emits. An unquoted match +# also hits this file's own prose ("#print axioms for every certificate...") +# and silently contributes the word "for" as a certificate name. +# NOT "$0": this phase runs after `cd "$AENEAS_LEAN"`, and $0 is the relative +# path the caller used ("./check.sh"), which no longer resolves from there. +# $HERE was resolved absolutely at the top of the script. +APEX_FROM_3B=$(grep -oE "'#print axioms [A-Za-z0-9_.]+'" "$HERE/check.sh" | tr -d "'" | awk '{print $3}' | sort -u) +if [ -z "$APEX_FROM_3B" ]; then + echo "AUDIT FAILED — could not recover the apex certificate names from Phase 3b."; exit 1 +fi +# Every recovered name must be namespace-qualified; a bare word means the +# pattern drifted onto prose again rather than onto a command. +while read -r n; do + case "$n" in *.*) ;; *) echo "AUDIT FAILED — recovered apex name '$n' is not qualified."; exit 1;; esac +done <<<"$APEX_FROM_3B" +AUD_CERTS=$(grep -o 'AUDITED-CERTIFICATES:.*' <<<"$AUD_OUT" | sed 's/AUDITED-CERTIFICATES: //' | tr ' ' '\n' | sort -u) +BASH_CERTS=$(printf '%s\n' "${CERTS[@]}" $APEX_FROM_3B | sort -u) +if [ "$AUD_CERTS" != "$BASH_CERTS" ]; then + echo "AUDIT FAILED — the auditor's certificate list and this script's have drifted:" + diff <(echo "$BASH_CERTS") <(echo "$AUD_CERTS") | sed 's/^/ /' + exit 1 +fi +grep -o 'statement audit PASSED:.*' <<<"$AUD_OUT" | sed 's/^/ /' +echo " audit-manifest sha256 = $GOT_SHA (matches the committed block byte-for-byte)" + echo "" echo "ALL PROOFS PASS. ALL CERTIFICATES AXIOM-CLEAN. NO DEAD FILES." +echo "STATEMENTS AND SPECIFICATIONS BOUND TO THE COMMITTED AUDIT MANIFEST." diff --git a/verification/selftest-axgate.sh b/verification/selftest-axgate.sh index 367a740..b214926 100755 --- a/verification/selftest-axgate.sh +++ b/verification/selftest-axgate.sh @@ -23,6 +23,9 @@ CORES="${LEAN_MAX_CORES:-0-3}" ATTACK="$HERE/Proofs/ZZSelftestAttack.lean" STASH="$(mktemp -d)" FAILURES=0 +# Recorded before anything is touched, so the restore check compares against +# reality rather than assuming a pristine checkout. +TREE_AT_START="$(cd "$(dirname "$0")/.." && git status --porcelain -- verification/Proofs)" cleanup() { rm -f "$ATTACK" "${ATTACK%.lean}.olean" @@ -106,12 +109,18 @@ else echo " ok no litter left by either the green or the red path" fi -# ── 5. Restored: the self-test must leave the working tree exactly as found. -DIRT=$(cd "$HERE/.." && git status --porcelain -- verification/Proofs | wc -l) -if [ "$DIRT" -ne 0 ]; then - echo " FAIL restore: $DIRT file(s) under Proofs/ left modified"; FAILURES=$((FAILURES+1)) +# ── 5. Restored: the self-test must leave the working tree exactly as it found +# it. Compared against the state recorded at START, not against a pristine +# checkout — files can be legitimately uncommitted while work is in flight, +# and a test that assumes otherwise reports its own premise as a failure. +if ! diff -q <(echo "$TREE_AT_START") \ + <(cd "$HERE/.." && git status --porcelain -- verification/Proofs) >/dev/null; then + echo " FAIL restore: Proofs/ differs from how this test found it:" + diff <(echo "$TREE_AT_START") \ + <(cd "$HERE/.." && git status --porcelain -- verification/Proofs) | sed 's/^/ /' + FAILURES=$((FAILURES+1)) else - echo " ok working tree restored" + echo " ok working tree restored to its starting state" fi echo "" diff --git a/verification/selftest-statements.sh b/verification/selftest-statements.sh new file mode 100755 index 0000000..9750ca6 --- /dev/null +++ b/verification/selftest-statements.sh @@ -0,0 +1,261 @@ +#!/usr/bin/env bash +# ───────────────────────────────────────────────────────────────────────────── +# selftest-statements.sh — adversarial self-test for the BINDING phases, +# check.sh 0b (the extracted model) and 3c (statements and specifications). +# +# These phases exist because Phases 2b/3/3b establish what a certificate RESTS +# ON and never what it SAYS, nor what it is ABOUT. This script performs the +# attacks that move no axiom cone at all, and asserts each is rejected FOR THE +# STATED REASON. +# +# It lifts Phase 3c out of check.sh at run time, so it attacks the shipping +# gate rather than a copy that can drift away from it. +# +# Requires a prior green build (Proofs/*.olean present). The cheap cases each +# recompile only Proofs/Audit.lean (~10 s). The gutted-statement case also +# recompiles one certificate module and is therefore slower; skip it with +# SKIP_SLOW=1 if you only want the fast gates exercised. +# ───────────────────────────────────────────────────────────────────────────── +set -uo pipefail +source ~/aeneas-toolchain/env.sh +HERE="$(cd "$(dirname "$0")" && pwd)" +AENEAS_LEAN="$AENEAS_HOME/backends/lean" +TIMEOUT="${LEAN_TIMEOUT:-900}" +export LEAN_MEM_MB="${LEAN_MEM_MB:-8192}" +CORES="${LEAN_MAX_CORES:-0-3}" +SKIP_SLOW="${SKIP_SLOW:-0}" + +STASH="$(mktemp -d)" +FAILURES=0 +# Recorded before anything is touched, so the restore check compares against +# reality rather than assuming a pristine checkout. +TREE_AT_START="$(cd "$(dirname "$0")/.." && git status --porcelain)" + +cleanup() { + [ -f "$STASH/Audit.lean" ] && cp "$STASH/Audit.lean" "$HERE/Proofs/Audit.lean" + [ -f "$STASH/AUDIT-MANIFEST.txt" ] && cp "$STASH/AUDIT-MANIFEST.txt" "$HERE/AUDIT-MANIFEST.txt" + [ -f "$STASH/check.sh" ] && cp "$STASH/check.sh" "$HERE/check.sh" + [ -n "${GUT_MOD:-}" ] && [ -f "$STASH/gut.lean" ] && cp "$STASH/gut.lean" "$HERE/Proofs/$GUT_MOD.lean" + [ -n "${GENF:-}" ] && [ -f "$STASH/genfile.bak" ] && cp "$STASH/genfile.bak" "$HERE/gen/$GENF" + [ -n "${GENF:-}" ] && rm -f "$HERE/gen/$(dirname "$GENF")/ZZExtra.lean" + rm -rf "$STASH" +} +trap cleanup EXIT INT TERM + +cp "$HERE/Proofs/Audit.lean" "$STASH/Audit.lean" +cp "$HERE/AUDIT-MANIFEST.txt" "$STASH/AUDIT-MANIFEST.txt" +cp "$HERE/check.sh" "$STASH/check.sh" + +DRIVER0B="$STASH/phase0b.sh" +{ + echo 'set -uo pipefail' + echo "HERE=\"$HERE\"" + sed -n '/^# ── Phase 0b/,/^# ── Phase 1/p' "$HERE/check.sh" | sed '$d' +} > "$DRIVER0B" +if [ "$(wc -l < "$DRIVER0B")" -lt 20 ]; then + echo "FATAL: could not lift Phase 0b out of check.sh."; exit 1 +fi + +DRIVER="$STASH/phase3c.sh" +build_driver() { + { + echo 'set -uo pipefail' + echo 'source ~/aeneas-toolchain/env.sh' + echo "HERE=\"$HERE\"" + echo 'AENEAS_LEAN="$AENEAS_HOME/backends/lean"' + echo "TIMEOUT=$TIMEOUT; CORES=\"$CORES\"" + # CERTS is referenced by the cross-check inside Phase 3c. + sed -n '/^CERTS=(/,/^)/p' "$HERE/check.sh" + # `$0` inside Phase 3c must resolve to the shipping check.sh, not to this + # driver, or the apex-name recovery would read the wrong file. + sed -n '/^# ── Phase 3c/,/^echo ""$/p' "$HERE/check.sh" | sed '$d' \ + | sed "s|\"\$0\"|\"$HERE/check.sh\"|g" + } > "$DRIVER" + if [ "$(wc -l < "$DRIVER")" -lt 60 ]; then + echo "FATAL: could not lift Phase 3c out of check.sh — the phase markers moved." + echo "This self-test must attack the shipping gate; refusing to run against nothing." + exit 1 + fi +} +build_driver + +recompile_audit() { + ( cd "$AENEAS_LEAN" && lake env bash -c " + set -uo pipefail + cd '$HERE/gen' && export LEAN_PATH=\"\$LEAN_PATH:\$PWD:$HERE\" + cd '$HERE' + LEAN_TIMEOUT=$TIMEOUT '$HERE/lean-guard' Proofs/Audit.lean + " ) >/dev/null 2>&1 +} + +expect() { # expect + local name="$1" want_rc="$2" want_txt="$3" out rc + out=$(bash "$DRIVER" 2>&1); rc=$? + if [ "$rc" -ne "$want_rc" ]; then + echo " FAIL $name: exit $rc, expected $want_rc"; FAILURES=$((FAILURES+1)); return + fi + if ! grep -qF "$want_txt" <<<"$out"; then + echo " FAIL $name: exit code right, diagnostic wrong (rejected for the wrong reason)" + echo " wanted: $want_txt" + echo " got: $(tr '\n' '|' <<<"$out" | cut -c1-260)" + FAILURES=$((FAILURES+1)); return + fi + echo " ok $name" +} + +echo "=== selftest-statements: attacking check.sh Phases 0b and 3c ===" + +# ── 0. THE SUBJECT. The certificates are stated ABOUT the extracted model in +# gen/. A statement names an extracted function; editing that function's +# BODY changes what the theorem is about while leaving every statement, +# every cone and the Phase 3c digest byte-identical. Demonstrated on +# 2026-07-28: risc0 and betrusted ship different extracted models and +# produce the SAME audit-manifest digest. Only the byte pin separates them. +expect0b() { + local name="$1" want_rc="$2" want_txt="$3" out rc + out=$(bash "$DRIVER0B" 2>&1); rc=$? + if [ "$rc" -ne "$want_rc" ]; then + echo " FAIL $name: exit $rc, expected $want_rc"; FAILURES=$((FAILURES+1)); return + fi + if ! grep -qF "$want_txt" <<<"$out"; then + echo " FAIL $name: exit code right, diagnostic wrong (rejected for the wrong reason)" + echo " wanted: $want_txt"; FAILURES=$((FAILURES+1)); return + fi + echo " ok $name" +} +expect0b "model pin: baseline green" 0 "match their pins" +GENF=$(awk 'NR==1{print $2}' "$HERE/GEN-MODEL.sha256") +cp "$HERE/gen/$GENF" "$STASH/genfile.bak" +printf '\n-- edited\n' >> "$HERE/gen/$GENF" +expect0b "model pin: edited model body caught" 1 "does not match its pin" +cp "$STASH/genfile.bak" "$HERE/gen/$GENF" +cp "$HERE/gen/$GENF" "$HERE/gen/$(dirname "$GENF")/ZZExtra.lean" +expect0b "model pin: an unlisted model file caught" 1 "does not match GEN-MODEL.sha256" +rm -f "$HERE/gen/$(dirname "$GENF")/ZZExtra.lean" + +# ── 1. Baseline: untouched repository passes and reports what it bound. +expect "baseline green, manifest digest matches" 0 "audit-manifest sha256" + +# ── 2. WIDEN THE POLICY. Add one name to the apex boundary. +# The policy IS inside the digest, but this attack never reaches the +# digest: because the apex tier requires EXACT cone equality, a widened +# boundary immediately shows up as `missing=` on all four apex +# certificates. That is a strictly stronger rejection than a digest +# mismatch — it names which certificates stopped matching instead of +# merely reporting that some byte moved. Asserted here as such, because a +# test that demanded the weaker diagnostic would go red the day the +# stronger guard started working. +python3 - "$HERE/Proofs/Audit.lean" <<'PY' +import sys, re +f = sys.argv[1]; s = open(f).read() +m = re.search(r'^def apexExtra : List Name :=\n \[(.*)\]$', s, re.M) +assert m, "apexExtra not found" +s = s.replace(m.group(0), m.group(0)[:-1] + ", `Classical.byContradiction]", 1) +open(f, "w").write(s) +PY +recompile_audit +expect "widened policy caught by the exact-cone requirement" 1 "missing=[Classical.byContradiction]" +cp "$STASH/Audit.lean" "$HERE/Proofs/Audit.lean"; recompile_audit + +# ── 3. HAND-EDIT THE COMMITTED BLOCK. The digest still matches the emitted +# block, so only the byte-comparison against the committed input can see +# this. Without it the diff printed on a future failure would silently +# compare against a doctored reference. +sed -i '2s/$/ TAMPERED/' "$HERE/AUDIT-MANIFEST.txt" +expect "hand-edited committed block caught" 1 "does not match the emitted block" +cp "$STASH/AUDIT-MANIFEST.txt" "$HERE/AUDIT-MANIFEST.txt" + +# ── 4. DROP A CERTIFICATE FROM THE AUDITOR — AND REFRESH THE DIGEST TO MATCH, +# exactly as an author covering their tracks would. The digest and the +# committed block are now perfectly consistent with each other. The only +# thing that can still object is the cross-check against the certificate +# list this script derives from its OWN two sources. +python3 - "$HERE/Proofs/Audit.lean" <<'PY' +import sys, re +f = sys.argv[1]; s = open(f).read() +lines = s.splitlines(True) +i = next(k for k, l in enumerate(lines) if l.strip().startswith(', (`') and 'kernel3)' in l) +del lines[i] +open(f, "w").write("".join(lines)) +PY +recompile_audit +# Regenerate the committed block and re-pin the digest from the tampered run. +TAMPERED_OUT=$(cd "$AENEAS_LEAN" && lake env bash -c " + set -uo pipefail + cd '$HERE/gen' && export LEAN_PATH=\"\$LEAN_PATH:\$PWD:$HERE\" + cd '$HERE' + LEAN_TIMEOUT=$TIMEOUT '$HERE/lean-guard' Proofs/Audit.lean 2>&1") +awk '/AUDIT-MANIFEST-BEGIN/{f=1;next} /AUDIT-MANIFEST-END/{f=0} f' <<<"$TAMPERED_OUT" > "$HERE/AUDIT-MANIFEST.txt" +NEWSHA=$(sha256sum "$HERE/AUDIT-MANIFEST.txt" | cut -d' ' -f1) +sed -i "s/^EXPECTED_AUDIT_SHA256=.*/EXPECTED_AUDIT_SHA256=\"$NEWSHA\"/" "$HERE/check.sh" +build_driver +expect "dropped certificate caught by the cross-check, digest refreshed or not" 1 "have drifted" +cp "$STASH/Audit.lean" "$HERE/Proofs/Audit.lean" +cp "$STASH/AUDIT-MANIFEST.txt" "$HERE/AUDIT-MANIFEST.txt" +cp "$STASH/check.sh" "$HERE/check.sh" +build_driver +recompile_audit + +# ── 5. THE REAL ONE: gut a certificate's STATEMENT while preserving its axiom +# cone. Every earlier phase passes this; only the statement binding sees it. +if [ "$SKIP_SLOW" = "1" ]; then + echo " skip gutted-statement case (SKIP_SLOW=1) — the fast gates above do not cover it" +else + # A TERMINAL certificate: nothing else in the corpus consumes it. Gutting a + # load-bearing one simply breaks its consumers and the module stops + # compiling, which demonstrates the compiler working, not this gate. + GUT_MOD=FieldMain + GUT_CERT=CurveFieldProofs.fieldImplementation + cp "$HERE/Proofs/$GUT_MOD.lean" "$STASH/gut.lean" + python3 - "$HERE/Proofs/$GUT_MOD.lean" "$GUT_CERT" <<'PY' +import sys, re +f, cert = sys.argv[1], sys.argv[2] +short = cert.split('.')[-1] +s = open(f).read() +m = re.search(r'^theorem %s\b' % re.escape(short), s, re.M) +assert m, f"certificate {short} not found in {f}" +i = m.start() +# find the next top-level declaration after it +nxt = re.search(r'^(theorem|lemma|def|noncomputable def|end|/--|@\[)', s[i+10:], re.M) +assert nxt, "no following declaration" +j = i + 10 + nxt.start() +# Same cone (Classical.em pulls in Classical.choice/propext), utterly different claim. +gut = "theorem %s : (∀ p : Prop, p ∨ ¬p) := Classical.em\n\n" % short +open(f, "w").write(s[:i] + gut + s[j:]) +PY + ( cd "$AENEAS_LEAN" && lake env bash -c " + set -uo pipefail + cd '$HERE/gen' && export LEAN_PATH=\"\$LEAN_PATH:\$PWD:$HERE\" + cd '$HERE' + LEAN_TIMEOUT=$TIMEOUT '$HERE/lean-guard' Proofs/$GUT_MOD.lean + " ) >/dev/null 2>&1 || { echo " FAIL setup: the gutted module did not compile"; FAILURES=$((FAILURES+1)); } + recompile_audit + expect "gutted statement caught (cone unchanged)" 1 "audit-manifest digest mismatch" + cp "$STASH/gut.lean" "$HERE/Proofs/$GUT_MOD.lean" + ( cd "$AENEAS_LEAN" && lake env bash -c " + set -uo pipefail + cd '$HERE/gen' && export LEAN_PATH=\"\$LEAN_PATH:\$PWD:$HERE\" + cd '$HERE' + LEAN_TIMEOUT=$TIMEOUT '$HERE/lean-guard' Proofs/$GUT_MOD.lean + " ) >/dev/null 2>&1 + recompile_audit +fi + +# ── 6. Restored: green again, and the working tree is as we found it. +expect "restored to green" 0 "audit-manifest sha256" +if ! diff -q <(echo "$TREE_AT_START") <(cd "$HERE/.." && git status --porcelain) >/dev/null; then + echo " FAIL restore: the working tree differs from how this test found it:" + diff <(echo "$TREE_AT_START") <(cd "$HERE/.." && git status --porcelain) | sed 's/^/ /' + FAILURES=$((FAILURES+1)) +else + echo " ok working tree restored to its starting state" +fi + +echo "" +if [ "$FAILURES" -eq 0 ]; then + echo "SELFTEST PASSED — Phase 3c rejects statement- and specification-level" + echo "tampering that moves no axiom cone, for the stated reason in each case." + exit 0 +fi +echo "SELFTEST FAILED: $FAILURES check(s) did not behave as claimed." +exit 1