From b4e8a4e7338db54527897972385ff34b21694493 Mon Sep 17 00:00:00 2001 From: mrwulf Date: Mon, 3 Aug 2026 12:15:26 +0200 Subject: [PATCH] audit: bind the scalar statements, and make the accounting identity mean audit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes four round-7/8 findings. Certified by the round-12 sweep: five repositories, both buttons and every self-test, 48/48 GREEN. ── `scalar-statements-unbound` (gpt, round 7, CRITICAL) ──────────────────── The main button bound its 31 certificates' elaborated statements and reachable specification bodies. This button bound NONE of its thirteen, while TRUSTED-BASE item 8 said the audit covers "every certificate" — false across the 44-certificate surface. The finding was raised in round 7, lost from the round-8 work list by an F-number collision between two reviewers, and re-raised in round 8. Proofs/ScalarAudit.lean is generated from each fork's OWN Audit.lean, so the canonicalisation is provably the same code: pp.all rendering, whitespace normalisation, transitive specification closure. check-scalar.sh Phase 3c pins the block's digest, requires the committed copy to match byte-for-byte so a mismatch can be DIFFED, and cross-checks the auditor's certificate set against the button's CERTS array. dalek ecf3a3f8 · anza 0d942e47 · risc0 4b550a61 · betrusted 4b550a61 risc0 and betrusted share a digest and that is correct, not a collision: their ScalarSubSpec.lean differs only in doc prose and in `black_box` entries inside `simp only [...]` lists AFTER `:= by`. Proof scripts. They bind the same statements over the same specifications, which is the documented scope. selftest-scalar-statements.sh ships the two attacks the reviewer asked for: ok gutted statement caught (cone unchanged) ok rewritten specification body caught (name and cone unchanged) The second rewrites a reachable reference body to `id (…)` — DEFINITIONALLY EQUAL, so the corpus compiles and every proof typechecks and the cone is byte-identical. Every earlier phase is blind to it. ── `drv-surface-no-cones` + `accounting-certifies-enumeration` (claude) ──── The round-7 accounting identity proved every kernel constant was ENUMERATED. The reviewer showed enumeration is not audit: their planted claim WAS enumerated, as DRV|LTLAccAudit.bait.smuggled|theorem with a real cone, and nothing examined it — rows had no cone, no allowlist covered them, the statement digest does not reach instruments, and Phase 2b gates DECLARED AXIOMS, a different question. "Progress of one step, not two." DRV rows now carry their axiom cone and are pinned in driver-allowlist.txt by inventory_gate.sh with a DRV tag — the same implementation that pins the corpus, in both directions, because a second copy of a coverage gate is a second thing to drift. The axiom policy is per-surface and enforced per surface: the corpus admits exactly the sanctioned boundary, the instruments admit none, and an instrument axiom fails EVEN WHEN ALLOWLISTED. Verified with the reviewer's own payload, both placements: before the walk -> UNCLASSIFIED: DRV|…|bait.smuggled|theorem|Classical.choice,Quot.sound,propext after the walk -> ACCOUNTING FAILED names it (kernel-side) ── `drv-naming-heuristic` (claude, round 7) ──────────────────────────────── Retired as load-bearing rather than patched. The rule admits a theorem whose name extends a constant declared alongside it, and "breaks in one line" — declare `def bait`, then `theorem bait.smuggled` walks through. It stays as a fast readable first check; membership in a committed allowlist is what now carries the weight, and a new row fails closed whatever it is called. ── what round 11 caught, which was mine ─────────────────────────────────── DRV rows first shipped WITHOUT their originating driver. dalek and anza run two drivers, each declaring its own `corpus`; keyed on name alone those two distinct declarations produced one byte-identical row, `sort -u` collapsed them, and the trailers summed to 37 against 36. The estate had already learned this on the corpus walk — INV rows carry their module because two modules both declare CurveFieldProofs.zero_spec — and I rebuilt the record without it. Rows now carry their driver, and the gate FAILS CLOSED ON DUPLICATE RECORDS naming the collision: two declarations sharing one entry means one is covered by the other's, which is exactly how a real declaration hides. The trailer now checks what the drivers EMITTED, not what survives de-duplication — conflating "the run was truncated" with "two rows were identical" is what let a record-format defect present itself as an arithmetic complaint. Co-Authored-By: Claude Opus 4.8 --- verification/HARNESS.sha256 | 16 +- verification/Proofs/InventoryCore.lean | 32 +++- verification/Proofs/InventoryScalar.lean | 7 +- verification/Proofs/ScalarAudit.lean | 171 +++++++++++++++++ verification/SCALAR-AUDIT-MANIFEST.txt | 23 +++ verification/check-scalar.sh | 92 ++++++++- verification/check.sh | 22 ++- verification/driver-allowlist.txt | 51 +++++ verification/inventory-allowlist-scalar.txt | 24 +++ verification/inventory_gate.sh | 72 ++++++- verification/selftest-scalar-statements.sh | 197 ++++++++++++++++++++ 11 files changed, 687 insertions(+), 20 deletions(-) create mode 100644 verification/Proofs/ScalarAudit.lean create mode 100644 verification/SCALAR-AUDIT-MANIFEST.txt create mode 100644 verification/driver-allowlist.txt create mode 100755 verification/selftest-scalar-statements.sh diff --git a/verification/HARNESS.sha256 b/verification/HARNESS.sha256 index 617e921..1b48800 100644 --- a/verification/HARNESS.sha256 +++ b/verification/HARNESS.sha256 @@ -1,25 +1,29 @@ c0cfe800f41ce6c12420afb97ad40330b14a2aaad232077e7579e376c48e2ae4 AUDIT-MANIFEST.txt -6b25b7e261633f4fa703de0be1dfd3c263d043107e3b3225d4c5079a93b6a64d check-scalar.sh -a556559d7dba1b565aad6724112e4f3aec73ad0b6a29c34855998edbf402f2d1 check.sh +ae93c35dfc96c4bc588ba349eb1099886f419377f95461f97bf4da73aa1c7374 check-scalar.sh +bdaf4842a7644f74afe234a8cdc7b2187ea32f6bdf0ca29fed2f96ac56c9fa74 check.sh +20797552647da51d0646370cf11be1fb86fadb27f28f01fde391b451377a63f9 driver-allowlist.txt 5e582e44dfd210cb5b8e56f6c31907162fc8e1adf7dac7caf3afb435bbaccb53 extract.sh cc7d98732f4629c2178cb10620babe463c6fa090939df913d70f2a81806a8689 GEN-MODEL.sha256 -9acc69d66d0c35a88da6d6d020027e5b66ce992763cef3af8de653319abfbb8c inventory-allowlist-scalar.txt +f14fd3c7ec25e96776c29a3899fe815c8899f70f00e8b820f1985d4ff784647c inventory-allowlist-scalar.txt 8e2950712ce39ace9cffd3bb58a13984832ff7f3f43ba7b68aa2b1eaa2bc2116 inventory-allowlist.txt -0bb01bc4abaafa8537d460682004d1f336980b28bc4fe1968bcc9c3bc3bc71ba inventory_gate.sh +3ebc8027f14c9e037f36322ef4119183c33214658efcc1a7bc985a98a9c32e4e inventory_gate.sh 736ea4be712e1b5bcda10ecb466f0dec7008a2a36eabdfd77563976299c43cce lean-guard b982bd1aa56b0648b10516985a2e0f6a9cacff4e1d19b441dadc5b35d69ec732 lift-guard.sh 1942177f13d6ae229d87a3b0b33f7fbb4b2ae20fe1059cc83010e73f6a156427 model-correspondence.py 1757e9c7d43aacc6d5930af62f6450ac336f7e881350ef0e5af35015442358dd MODEL-CORRESPONDENCE.txt 79a001107928713a22e679e4c4028549df76d0733455bb9937a4f438a0c315c8 Proofs/Audit.lean 18e0cef25366bdcda67e8e347a222c169469654547b87adb01eb5b12aa9a9529 Proofs/InventoryBasic.lean -2b4f2bad2c82c64a1d29c873554b1728b86148f0bc27324c6e0b16defda22ca9 Proofs/InventoryCore.lean +aee121f20c815e21ca60c0238e3401fdd8b4651c7234ace81ef78b6dd1876100 Proofs/InventoryCore.lean 132a1b039c70f4252c43be0ad5823145887e3e8c9f199d7e0f12d184c65ce265 Proofs/Inventory.lean -6fbeb50d3951c7c5ac593f6dec91096fc798123ed0c500fdfa39fb20b118ea78 Proofs/InventoryScalar.lean +32b29ba319003eed5bd837aa604df54550fd0078771f6e07cbe3cf96733bd6d4 Proofs/InventoryScalar.lean +1418f263ea7955ca7aa58b6812e791d8a85d38a8c0f08fb03d4d56182c8e03f6 Proofs/ScalarAudit.lean +ecf3a3f87228f27fdfd25cb5104d04e0d90b7344b2ecee9c0138ca6b373838d0 SCALAR-AUDIT-MANIFEST.txt bf71e8d4eb312ebc687bf7e218d90b910543cd92e782078174868d012aca7250 selftest-auditonly.sh 6de61b2b08ab6e05c7d38377ea8f70178da4a105bb1df21c6ba6bc05a647090d selftest-axgate.sh 7822c007d12d7be70003ea9de234102a2c4165cfab65a108e2960e51b87bee82 selftest-correspondence.sh 41d16df48b15b99512d10a805bb811db301e9d9c8b00e5e3e0186f0110d3b71a selftest-harness.sh 1df031a075fc438c5229d01cbc44ee6ac489a272cd736624f7ca45ef1a4ddb7f selftest-inventory.sh +acfa40b0f45bf7969dd6e2a26ea72e9eaf824cedb695e498f863360772fd7c06 selftest-scalar-statements.sh fc6d2905871500f2ee9c3f308fd8300cfcd1a7fa854d399d13812f7e2282f1fd selftest-shapes.sh eb7367a1494f5203f0cbeace78c9522608d51825fdcbb7ae40962d2380a7bc79 selftest-statements.sh 7603b82c9c29a27f6659b8878d1a2e2365afb6541c3c5b2698ab2fee21bb2bde selftest-tiers.sh diff --git a/verification/Proofs/InventoryCore.lean b/verification/Proofs/InventoryCore.lean index ac6b742..2cb441e 100644 --- a/verification/Proofs/InventoryCore.lean +++ b/verification/Proofs/InventoryCore.lean @@ -159,7 +159,37 @@ def emitDrivers (drivers : Array Name) : MetaM Unit := do the audit infrastructure. An instrument may declare definitions \ and whatever the elaborator generates for them — never a claim \ of its own." - lines := lines.push s!"DRV|{n}|{k}" + -- THE CONE, and it is the second half of the accounting identity. + -- + -- Round-8 review (Claude, register keys `drv-surface-no-cones` and + -- `accounting-certifies-enumeration`). These rows carried name and kind + -- only. The round-7 accounting identity then proved every kernel constant + -- was ENUMERATED by one of the two walks — and the reviewer demonstrated + -- that enumeration is not audit: a claim planted in an instrument WAS + -- enumerated, as `DRV|…bait.smuggled|theorem`, with a real cone of + -- [propext, Classical.choice, Quot.sound], and then nothing looked at it. + -- No allowlist row covered the instrument surface, the statement digest + -- does not reach instruments, and Phase 2b gates DECLARED AXIOMS, which is + -- a different question from cones. Their summary: the identity "converted + -- 36 declarations nobody enumerated into 36 declarations nobody examined. + -- That is progress of one step, not two." + -- + -- With the cone emitted here and the rows pinned in driver-allowlist.txt + -- by the same gate the corpus uses, the identity and the audit coincide: + -- a planted claim is a new row, and a new row fails closed. The + -- name-prefix rule above is kept as a fast first line of defence but is no + -- longer load-bearing — the reviewer showed it breaks in one line. + let cone ← axiomCone n + let coneStr := ",".intercalate (cone.toList.map (·.toString)) + -- THE ORIGINATING DRIVER is part of the record, for the same reason the + -- INV rows carry their module: dalek and anza run TWO drivers, each + -- declaring its own `corpus`, and keyed on name alone those two distinct + -- declarations produced one byte-identical row. `sort -u` then collapsed + -- them, the trailers summed to 37 against 36 unique rows, and the gate + -- reported the surface truncated. Two declarations must never share a + -- record — that is what let a real declaration hide behind another one's + -- entry when this mistake was made on the corpus walk. + lines := lines.push s!"DRV|{env.mainModule}|{n}|{k}|{coneStr}" let sorted := lines.qsort (· < ·) for l in sorted do IO.println l diff --git a/verification/Proofs/InventoryScalar.lean b/verification/Proofs/InventoryScalar.lean index 61e4613..b3f96e5 100644 --- a/verification/Proofs/InventoryScalar.lean +++ b/verification/Proofs/InventoryScalar.lean @@ -20,11 +20,16 @@ import Proofs.ScalarWideSpec import Proofs.ScalarBytesSpec import Proofs.ScalarUnpackSpec import Proofs.ScalarFromBytesSpec +-- The scalar audit driver is in this button's compile manifest, exactly as +-- Proofs.Audit is in the main button's, so the inventory must cover it too: +-- a module that is compiled but enumerated by nothing is the accounting hole +-- the round-7 review found in Proofs/Audit.lean itself. +import Proofs.ScalarAudit open Lean Ed25519Inventory /-- Exactly check-scalar.sh's PROOFS manifest; that script asserts the correspondence in both directions. -/ def corpus : Array Name := - #[`Proofs.ScalarDenote, `Proofs.ScalarLoop, `Proofs.ScalarSubSpec, `Proofs.ScalarAddSpec, `Proofs.ScalarMulSpec, `Proofs.ScalarMontSpec, `Proofs.ScalarReduceSpec, `Proofs.ScalarFullMulSpec, `Proofs.ScalarMain, `Proofs.ScalarWideSpec, `Proofs.ScalarBytesSpec, `Proofs.ScalarUnpackSpec, `Proofs.ScalarFromBytesSpec] + #[`Proofs.ScalarDenote, `Proofs.ScalarLoop, `Proofs.ScalarSubSpec, `Proofs.ScalarAddSpec, `Proofs.ScalarMulSpec, `Proofs.ScalarMontSpec, `Proofs.ScalarReduceSpec, `Proofs.ScalarFullMulSpec, `Proofs.ScalarMain, `Proofs.ScalarWideSpec, `Proofs.ScalarBytesSpec, `Proofs.ScalarUnpackSpec, `Proofs.ScalarFromBytesSpec, `Proofs.ScalarAudit] #eval show MetaM Unit from emitInventory corpus diff --git a/verification/Proofs/ScalarAudit.lean b/verification/Proofs/ScalarAudit.lean new file mode 100644 index 0000000..6c5cb89 --- /dev/null +++ b/verification/Proofs/ScalarAudit.lean @@ -0,0 +1,171 @@ +import Proofs.ScalarDenote +import Proofs.ScalarLoop +import Proofs.ScalarSubSpec +import Proofs.ScalarAddSpec +import Proofs.ScalarMulSpec +import Proofs.ScalarMontSpec +import Proofs.ScalarReduceSpec +import Proofs.ScalarFullMulSpec +import Proofs.ScalarMain +import Proofs.ScalarWideSpec +import Proofs.ScalarBytesSpec +import Proofs.ScalarUnpackSpec +import Proofs.ScalarFromBytesSpec +import Lean +open Lean Elab Command + +namespace Ed25519ScalarAudit + +/-- Lean's three kernel axioms. -/ +def kernel3 : List Name := [`propext, `Classical.choice, `Quot.sound] + +/-- This fork's apex boundary: the hash oracle and wire-format symbols the + signature-level certificates are permitted to rest on, and nothing else. + POLICY CONSTANT — folded into the digest, so widening it moves the hash + and fails the build. -/ +def apexExtra : List Name := [] -- the scalar layer has NO apex tier + +def apexBoundary : List Name := kernel3 ++ apexExtra + +/-- A constant counts as SPECIFICATION if it was declared in a `Proofs.` + module — i.e. hand-written by us, as opposed to the extracted model in + `gen/` (pinned separately by Phase 0). Derived from the environment, not + from a list, so a new specification module cannot appear unnoticed. -/ +def specPrefix : String := "Proofs." + +/-- Per-certificate expected cone. Arithmetic tier first, apex tier last. -/ +def manifest : List (Name × List Name) := + [ (`ScalarProofs.L_val, kernel3) + , (`ScalarProofs.sub_loop_spec, kernel3) + , (`ScalarProofs.cond_add_l_one_spec, kernel3) + , (`ScalarProofs.sub_val_spec, kernel3) + , (`ScalarProofs.add_val_spec, kernel3) + , (`ScalarProofs.mul_internal_spec, kernel3) + , (`ScalarProofs.part1_spec, kernel3) + , (`ScalarProofs.montgomery_reduce_spec, kernel3) + , (`ScalarProofs.mul_spec, kernel3) + , (`ScalarProofs.scalarImplementation, kernel3) + , (`ScalarProofs.montgomery_mul_spec, kernel3) + , (`ScalarProofs.bytes_unpack_spec, kernel3) + , (`ScalarProofs.from_bytes_wide_spec, kernel3) + ] + +/-- Deterministic name ordering for the canonical serialization. -/ +def sortNames (l : List Name) : List Name := + ((l.map toString).toArray.qsort (· < ·)).toList.map (·.toName) + +/-- Whitespace-canonical: every whitespace run collapses to one space, so the + pretty-printer's line wrapping cannot perturb the digest. -/ +def normWs (s : String) : String := + (s.foldl (fun (acc : String × Bool) c => + let c := if c.isWhitespace then ' ' else c + if c == ' ' then (if acc.2 then acc else (acc.1.push ' ', true)) + else (acc.1.push c, false)) + ("", true)).1 + +/-- Was `n` hand-written by us, in a `Proofs.` module? -/ +def isSpecConst (env : Environment) (n : Name) : Bool := + match env.getModuleIdxFor? n with + | some idx => (toString env.header.moduleNames[idx.toNat]!).startsWith specPrefix + | none => false + +/-- Transitive closure over specification constants, starting from a + certificate's STATEMENT and following DEFINITION bodies (a theorem + contributes its statement only). This discovers the reference definitions — + and any future one — automatically, so a new specification cannot be + introduced, or an existing one redefined, without moving the digest. -/ +partial def closureOf (env : Environment) (seen : NameSet) (work : List Name) : NameSet := + match work with + | [] => seen + | n :: rest => + if seen.contains n || !isSpecConst env n then closureOf env seen rest + else + let seen := seen.insert n + let more := match env.find? n with + | some (.defnInfo v) => v.value.getUsedConstants.toList ++ v.type.getUsedConstants.toList + | some ci => ci.type.getUsedConstants.toList + | none => [] + closureOf env seen (more ++ rest) + +/-- Fully-explicit (`pp.all`) rendering, whitespace-canonicalized. Implicit + arguments, instances and universe levels are all made visible, so two + statements that merely LOOK alike cannot share a rendering. -/ +def ppAll (e : Expr) : CommandElabM String := do + let s ← Command.liftCoreM <| Meta.MetaM.run' <| + withOptions (fun o => o.setBool `pp.all true) do + return (← Meta.ppExpr e).pretty + return normWs s + +elab "auditScalarStatements" : command => do + let env ← getEnv + let mut errs : Array String := #[] + + -- (0) The manifest may not permit an axiom outside the two declared tiers. + -- Without this, widening a cone in the manifest would be invisible. + for (cert, cone) in manifest do + for a in cone do + unless apexBoundary.contains a do + errs := errs.push s!"manifest permits {a} for {cert}, which is outside every declared tier" + + -- (1) Each certificate must EXIST, be a THEOREM, and have EXACTLY its cone. + -- Exact, not subset: a certificate that stopped depending on the hash + -- oracle is as wrong as one that acquired a new axiom. + for (cert, expected) in manifest do + match env.find? cert with + | none => errs := errs.push s!"{cert}: NOT FOUND (renamed or deleted?)" + | some (.thmInfo _) => + let got := (← collectAxioms cert).toList + let extras := got.filter (fun a => !expected.contains a) + let missing := expected.filter (fun a => !got.contains a) + unless extras.isEmpty && missing.isEmpty do + errs := errs.push s!"{cert}: cone extra={extras} missing={missing}" + | some (.axiomInfo _) => errs := errs.push s!"{cert}: is an AXIOM, not a proven theorem" + | some (.opaqueInfo _) => errs := errs.push s!"{cert}: is OPAQUE, not a proven theorem" + | some _ => errs := errs.push s!"{cert}: is not a theorem" + + unless errs.isEmpty do + throwError "AUDIT FAILED (fail-closed):\n{String.intercalate "\n" errs.toList}" + + -- (2) CANONICAL BLOCK: policy, then statements, then specification bodies. + let mut lines : Array String := #[] + lines := lines.push + s!"policy|kernel3={String.intercalate "," ((sortNames kernel3).map toString)}|apexExtra={String.intercalate "," ((sortNames apexExtra).map toString)}|specPrefix={specPrefix}" + let mut specs : NameSet := {} + for (cert, cone) in manifest do + let ci := (env.find? cert).get! + specs := (closureOf env {} ci.type.getUsedConstants.toList).toList.foldl (·.insert ·) specs + lines := lines.push + s!"cert|{cert}|cone={String.intercalate "," ((sortNames cone).map toString)}|type={← ppAll ci.type}" + for nm in sortNames specs.toList do + match env.find? nm with + | none => errs := errs.push s!"specification constant vanished mid-audit: {nm}" + | some ci => + let isProp ← Command.liftCoreM <| Meta.MetaM.run' <| Meta.isProp ci.type + -- Proof irrelevance: a Prop-valued constant contributes its STATEMENT; a + -- data definition contributes its BODY, which is where fidelity lives. + if isProp then + lines := lines.push s!"spec|{nm}|prop|type={← ppAll ci.type}" + else + match ci with + | .defnInfo v => lines := lines.push s!"spec|{nm}|def|value={← ppAll v.value}" + | _ => lines := lines.push s!"spec|{nm}|other|type={← ppAll ci.type}" + + unless errs.isEmpty do + throwError "AUDIT FAILED (fail-closed):\n{String.intercalate "\n" errs.toList}" + + -- FAIL CLOSED ON ABSENCE: a manifest that somehow produced no specification + -- constants would emit a block that binds statements only. That is a weaker + -- claim than this file advertises, so it is an error, not a quiet pass. + if specs.toList.isEmpty then + throwError "AUDIT FAILED: statements reached ZERO specification constants — the closure is not doing its job" + + logInfo ("SCALAR-AUDIT-MANIFEST-BEGIN\n" ++ String.intercalate "\n" lines.toList ++ "\nSCALAR-AUDIT-MANIFEST-END") + -- check.sh cross-checks its own CERTS array against THIS line, so the two + -- cannot drift apart without the build noticing. + logInfo s!"AUDITED-SCALAR-CERTIFICATES: {String.intercalate " " ((manifest.map (·.1)).map toString)}" + logInfo s!"statement audit PASSED: {manifest.length} certificates (exact cones + elaborated statements), {specs.toList.length} specification constants pinned" + +end Ed25519ScalarAudit + +open Ed25519ScalarAudit in +auditScalarStatements diff --git a/verification/SCALAR-AUDIT-MANIFEST.txt b/verification/SCALAR-AUDIT-MANIFEST.txt new file mode 100644 index 0000000..1db79b7 --- /dev/null +++ b/verification/SCALAR-AUDIT-MANIFEST.txt @@ -0,0 +1,23 @@ +policy|kernel3=Classical.choice,Quot.sound,propext|apexExtra=|specPrefix=Proofs. +cert|ScalarProofs.L_val|cone=Classical.choice,Quot.sound,propext|type=@Eq.{1} Nat (ScalarProofs.scVal curve25519_dalek.backend.serial.u64.constants.L) ScalarProofs.Ell +cert|ScalarProofs.sub_loop_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : ScalarProofs.Sc) (mask a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 : Aeneas.Std.U64) (ha : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (@List.cons.{0} Aeneas.Std.U64 a0 (@List.cons.{0} Aeneas.Std.U64 a1 (@List.cons.{0} Aeneas.Std.U64 a2 (@List.cons.{0} Aeneas.Std.U64 a3 (@List.cons.{0} Aeneas.Std.U64 a4 (@List.nil.{0} Aeneas.Std.U64))))))) (hb : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) b) (@List.cons.{0} Aeneas.Std.U64 b0 (@List.cons.{0} Aeneas.Std.U64 b1 (@List.cons.{0} Aeneas.Std.U64 b2 (@List.cons.{0} Aeneas.Std.U64 b3 (@List.cons.{0} Aeneas.Std.U64 b4 (@List.nil.{0} Aeneas.Std.U64))))))) (hmask : @Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 mask) (@HSub.hSub.{0, 0, 0} Nat Nat Nat (@instHSub.{0} Nat instSubNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))))) (hbnd : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))))))))))))), @Aeneas.Std.WP.spec.{0} (Prod.{0, 0} curve25519_dalek.backend.serial.u64.scalar.Scalar52 Aeneas.Std.U64) (curve25519_dalek.backend.serial.u64.scalar.Scalar52.sub_loop (@Aeneas.Std.core.ops.range.Range.mk.{0} Aeneas.Std.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) a b curve25519_dalek.backend.serial.u64.scalar.Scalar52.ZERO mask (Aeneas.Std.U64.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.U64))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) fun (dw : Prod.{0, 0} ScalarProofs.Sc Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (d0 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (d1 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (d2 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (d3 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (d4 : Aeneas.Std.U64) => @Exists.{1} Nat fun (β1 : Nat) => @Exists.{1} Nat fun (β2 : Nat) => @Exists.{1} Nat fun (β3 : Nat) => @Exists.{1} Nat fun (β4 : Nat) => @Exists.{1} Nat fun (β5 : Nat) => And (@Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) (@Prod.fst.{0, 0} ScalarProofs.Sc Aeneas.Std.U64 dw)) (@List.cons.{0} Aeneas.Std.U64 d0 (@List.cons.{0} Aeneas.Std.U64 d1 (@List.cons.{0} Aeneas.Std.U64 d2 (@List.cons.{0} Aeneas.Std.U64 d3 (@List.cons.{0} Aeneas.Std.U64 d4 (@List.nil.{0} Aeneas.Std.U64))))))) (And (@LE.le.{0} Nat instLENat β1 (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (@LE.le.{0} Nat instLENat β2 (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (@LE.le.{0} Nat instLENat β3 (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (@LE.le.{0} Nat instLENat β4 (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (@LE.le.{0} Nat instLENat β5 (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 d0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 d1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 d2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 d3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 d4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 d0) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0)) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) β1))) (And (@Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 d1) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1)) β1) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) β2))) (And (@Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 d2) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2)) β2) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) β3))) (And (@Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 d3) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3)) β3) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) β4))) (And (@Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 d4) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4)) β4) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) β5))) (@Eq.{1} Nat (@HShiftRight.hShiftRight.{0, 0, 0} Nat Nat Nat (@instHShiftRightOfShiftRight.{0} Nat Nat.instShiftRight) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 (@Prod.snd.{0, 0} ScalarProofs.Sc Aeneas.Std.U64 dw)) (@OfNat.ofNat.{0} Nat (nat_lit 63) (instOfNatNat (nat_lit 63)))) β5)))))))))))))))) +cert|ScalarProofs.cond_add_l_one_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (s : ScalarProofs.Sc) (c : subtle.Choice) (s0 s1 s2 s3 s4 : Aeneas.Std.U64) (hs : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) s) (@List.cons.{0} Aeneas.Std.U64 s0 (@List.cons.{0} Aeneas.Std.U64 s1 (@List.cons.{0} Aeneas.Std.U64 s2 (@List.cons.{0} Aeneas.Std.U64 s3 (@List.cons.{0} Aeneas.Std.U64 s4 (@List.nil.{0} Aeneas.Std.U64))))))) (hc : @Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 c) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (hbnd : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))))))), @Aeneas.Std.WP.spec.{0} (Prod.{0, 0} Aeneas.Std.U64 curve25519_dalek.backend.serial.u64.scalar.Scalar52) (curve25519_dalek.backend.serial.u64.scalar.Scalar52.conditional_add_l s c) fun (cw : Prod.{0, 0} Aeneas.Std.U64 ScalarProofs.Sc) => @Exists.{1} Aeneas.Std.U64 fun (r0 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (r1 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (r2 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (r3 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (r4 : Aeneas.Std.U64) => @Exists.{1} Nat fun (γ1 : Nat) => @Exists.{1} Nat fun (γ2 : Nat) => @Exists.{1} Nat fun (γ3 : Nat) => @Exists.{1} Nat fun (γ4 : Nat) => @Exists.{1} Nat fun (γ5 : Nat) => And (@Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) (@Prod.snd.{0, 0} Aeneas.Std.U64 ScalarProofs.Sc cw)) (@List.cons.{0} Aeneas.Std.U64 r0 (@List.cons.{0} Aeneas.Std.U64 r1 (@List.cons.{0} Aeneas.Std.U64 r2 (@List.cons.{0} Aeneas.Std.U64 r3 (@List.cons.{0} Aeneas.Std.U64 r4 (@List.nil.{0} Aeneas.Std.U64))))))) (And (@LE.le.{0} Nat instLENat γ1 (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (@LE.le.{0} Nat instLENat γ2 (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (@LE.le.{0} Nat instLENat γ3 (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (@LE.le.{0} Nat instLENat γ4 (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (@LE.le.{0} Nat instLENat γ5 (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 r0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 r1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 r2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 r3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 r4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 r0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) γ1)) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s0) (@OfNat.ofNat.{0} Nat (nat_lit 671914833335277) (instOfNatNat (nat_lit 671914833335277))))) (And (@Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 r1) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) γ2)) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s1) (@OfNat.ofNat.{0} Nat (nat_lit 3916664325105025) (instOfNatNat (nat_lit 3916664325105025)))) γ1)) (And (@Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 r2) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) γ3)) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s2) (@OfNat.ofNat.{0} Nat (nat_lit 1367801) (instOfNatNat (nat_lit 1367801)))) γ2)) (And (@Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 r3) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) γ4)) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s3) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) γ3)) (@Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 r4) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) γ5)) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s4) (@OfNat.ofNat.{0} Nat (nat_lit 17592186044416) (instOfNatNat (nat_lit 17592186044416)))) γ4)))))))))))))))) +cert|ScalarProofs.sub_val_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : ScalarProofs.Sc) (a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 : Aeneas.Std.U64) (ha : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (@List.cons.{0} Aeneas.Std.U64 a0 (@List.cons.{0} Aeneas.Std.U64 a1 (@List.cons.{0} Aeneas.Std.U64 a2 (@List.cons.{0} Aeneas.Std.U64 a3 (@List.cons.{0} Aeneas.Std.U64 a4 (@List.nil.{0} Aeneas.Std.U64))))))) (hb : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) b) (@List.cons.{0} Aeneas.Std.U64 b0 (@List.cons.{0} Aeneas.Std.U64 b1 (@List.cons.{0} Aeneas.Std.U64 b2 (@List.cons.{0} Aeneas.Std.U64 b3 (@List.cons.{0} Aeneas.Std.U64 b4 (@List.nil.{0} Aeneas.Std.U64))))))) (hab : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))))))) (hbb : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))))))) (hcb : @LE.le.{0} Nat instLENat (ScalarProofs.scVal b) ScalarProofs.Ell), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.scalar.Scalar52 (curve25519_dalek.backend.serial.u64.scalar.Scalar52.sub a b) fun (r : curve25519_dalek.backend.serial.u64.scalar.Scalar52) => And (@Exists.{1} Aeneas.Std.U64 fun (s0 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s1 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s2 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s3 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s4 : Aeneas.Std.U64) => And (@Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) r) (@List.cons.{0} Aeneas.Std.U64 s0 (@List.cons.{0} Aeneas.Std.U64 s1 (@List.cons.{0} Aeneas.Std.U64 s2 (@List.cons.{0} Aeneas.Std.U64 s3 (@List.cons.{0} Aeneas.Std.U64 s4 (@List.nil.{0} Aeneas.Std.U64))))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))))))))) (And (@Exists.{1} Nat fun (β : Nat) => And (@LE.le.{0} Nat instLENat β (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1)))) (And (@Eq.{1} Nat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (ScalarProofs.scVal r) (ScalarProofs.scVal b)) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (ScalarProofs.scVal a) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) ScalarProofs.Ell β))) (@Eq.{1} Nat β (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) → @LT.lt.{0} Nat instLTNat (ScalarProofs.scVal a) (ScalarProofs.scVal b)))) (@Eq.{1} (ZMod ScalarProofs.Ell) (ScalarProofs.scDenote r) (@HSub.hSub.{0, 0, 0} (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (@instHSub.{0} (ZMod ScalarProofs.Ell) (@SubNegMonoid.toSub.{0} (ZMod ScalarProofs.Ell) (@AddGroup.toSubNegMonoid.{0} (ZMod ScalarProofs.Ell) (@AddGroupWithOne.toAddGroup.{0} (ZMod ScalarProofs.Ell) (@Ring.toAddGroupWithOne.{0} (ZMod ScalarProofs.Ell) (@CommRing.toRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell))))))) (ScalarProofs.scDenote a) (ScalarProofs.scDenote b)))) +cert|ScalarProofs.add_val_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : ScalarProofs.Sc) (a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 : Aeneas.Std.U64) (ha : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (@List.cons.{0} Aeneas.Std.U64 a0 (@List.cons.{0} Aeneas.Std.U64 a1 (@List.cons.{0} Aeneas.Std.U64 a2 (@List.cons.{0} Aeneas.Std.U64 a3 (@List.cons.{0} Aeneas.Std.U64 a4 (@List.nil.{0} Aeneas.Std.U64))))))) (hb : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) b) (@List.cons.{0} Aeneas.Std.U64 b0 (@List.cons.{0} Aeneas.Std.U64 b1 (@List.cons.{0} Aeneas.Std.U64 b2 (@List.cons.{0} Aeneas.Std.U64 b3 (@List.cons.{0} Aeneas.Std.U64 b4 (@List.nil.{0} Aeneas.Std.U64))))))) (hab : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))))))) (hbb : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))))))) (hca : @LT.lt.{0} Nat instLTNat (ScalarProofs.scVal a) ScalarProofs.Ell) (hcb : @LT.lt.{0} Nat instLTNat (ScalarProofs.scVal b) ScalarProofs.Ell), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.scalar.Scalar52 (curve25519_dalek.backend.serial.u64.scalar.Scalar52.add a b) fun (r : curve25519_dalek.backend.serial.u64.scalar.Scalar52) => And (@Exists.{1} Aeneas.Std.U64 fun (s0 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s1 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s2 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s3 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s4 : Aeneas.Std.U64) => And (@Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) r) (@List.cons.{0} Aeneas.Std.U64 s0 (@List.cons.{0} Aeneas.Std.U64 s1 (@List.cons.{0} Aeneas.Std.U64 s2 (@List.cons.{0} Aeneas.Std.U64 s3 (@List.cons.{0} Aeneas.Std.U64 s4 (@List.nil.{0} Aeneas.Std.U64))))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))))))))) (And (@LT.lt.{0} Nat instLTNat (ScalarProofs.scVal r) ScalarProofs.Ell) (@Eq.{1} (ZMod ScalarProofs.Ell) (ScalarProofs.scDenote r) (@HAdd.hAdd.{0, 0, 0} (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (@instHAdd.{0} (ZMod ScalarProofs.Ell) (@Distrib.toAdd.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocSemiring.toDistrib.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} (ZMod ScalarProofs.Ell) (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} (ZMod ScalarProofs.Ell) (@CommRing.toNonUnitalCommRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell)))))))) (ScalarProofs.scDenote a) (ScalarProofs.scDenote b)))) +cert|ScalarProofs.mul_internal_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : ScalarProofs.Sc) (a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 : Aeneas.Std.U64) (ha : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (@List.cons.{0} Aeneas.Std.U64 a0 (@List.cons.{0} Aeneas.Std.U64 a1 (@List.cons.{0} Aeneas.Std.U64 a2 (@List.cons.{0} Aeneas.Std.U64 a3 (@List.cons.{0} Aeneas.Std.U64 a4 (@List.nil.{0} Aeneas.Std.U64))))))) (hb : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) b) (@List.cons.{0} Aeneas.Std.U64 b0 (@List.cons.{0} Aeneas.Std.U64 b1 (@List.cons.{0} Aeneas.Std.U64 b2 (@List.cons.{0} Aeneas.Std.U64 b3 (@List.cons.{0} Aeneas.Std.U64 b4 (@List.nil.{0} Aeneas.Std.U64))))))) (hbnd : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))))))))))))), @Aeneas.Std.WP.spec.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U128 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (curve25519_dalek.backend.serial.u64.scalar.Scalar52.mul_internal a b) fun (zz : Aeneas.Std.Array.{0} Aeneas.Std.U128 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) => @Exists.{1} Aeneas.Std.U128 fun (z0 : Aeneas.Std.U128) => @Exists.{1} Aeneas.Std.U128 fun (z1 : Aeneas.Std.U128) => @Exists.{1} Aeneas.Std.U128 fun (z2 : Aeneas.Std.U128) => @Exists.{1} Aeneas.Std.U128 fun (z3 : Aeneas.Std.U128) => @Exists.{1} Aeneas.Std.U128 fun (z4 : Aeneas.Std.U128) => @Exists.{1} Aeneas.Std.U128 fun (z5 : Aeneas.Std.U128) => @Exists.{1} Aeneas.Std.U128 fun (z6 : Aeneas.Std.U128) => @Exists.{1} Aeneas.Std.U128 fun (z7 : Aeneas.Std.U128) => @Exists.{1} Aeneas.Std.U128 fun (z8 : Aeneas.Std.U128) => And (@Eq.{1} (List.{0} Aeneas.Std.U128) (@Subtype.val.{1} (List.{0} Aeneas.Std.U128) (fun (l : List.{0} Aeneas.Std.U128) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U128 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) zz) (@List.cons.{0} Aeneas.Std.U128 z0 (@List.cons.{0} Aeneas.Std.U128 z1 (@List.cons.{0} Aeneas.Std.U128 z2 (@List.cons.{0} Aeneas.Std.U128 z3 (@List.cons.{0} Aeneas.Std.U128 z4 (@List.cons.{0} Aeneas.Std.U128 z5 (@List.cons.{0} Aeneas.Std.U128 z6 (@List.cons.{0} Aeneas.Std.U128 z7 (@List.cons.{0} Aeneas.Std.U128 z8 (@List.nil.{0} Aeneas.Std.U128))))))))))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z1) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z2) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z3) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z4) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z5) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z6) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z7) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3)))) (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z8) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4))))))))))) +cert|ScalarProofs.part1_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (sum : Aeneas.Std.U128) (hs : @LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 sum) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 124) (instOfNatNat (nat_lit 124))))), @Aeneas.Std.WP.spec.{0} (Prod.{0, 0} Aeneas.Std.U128 Aeneas.Std.U64) (curve25519_dalek.backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 sum) fun (cw : Prod.{0, 0} Aeneas.Std.U128 Aeneas.Std.U64) => And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 (@Prod.snd.{0, 0} Aeneas.Std.U128 Aeneas.Std.U64 cw)) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@Eq.{1} Nat (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 (@Prod.fst.{0, 0} Aeneas.Std.U128 Aeneas.Std.U64 cw)) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 sum) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 (@Prod.snd.{0, 0} Aeneas.Std.U128 Aeneas.Std.U64 cw)) (@OfNat.ofNat.{0} Nat (nat_lit 671914833335277) (instOfNatNat (nat_lit 671914833335277)))))) +cert|ScalarProofs.montgomery_reduce_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (limbs : Aeneas.Std.Array.{0} Aeneas.Std.U128 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (z0 z1 z2 z3 z4 z5 z6 z7 z8 : Aeneas.Std.U128) (hl : @Eq.{1} (List.{0} Aeneas.Std.U128) (@Subtype.val.{1} (List.{0} Aeneas.Std.U128) (fun (l : List.{0} Aeneas.Std.U128) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U128 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 9) (instOfNatNat (nat_lit 9))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) limbs) (@List.cons.{0} Aeneas.Std.U128 z0 (@List.cons.{0} Aeneas.Std.U128 z1 (@List.cons.{0} Aeneas.Std.U128 z2 (@List.cons.{0} Aeneas.Std.U128 z3 (@List.cons.{0} Aeneas.Std.U128 z4 (@List.cons.{0} Aeneas.Std.U128 z5 (@List.cons.{0} Aeneas.Std.U128 z6 (@List.cons.{0} Aeneas.Std.U128 z7 (@List.cons.{0} Aeneas.Std.U128 z8 (@List.nil.{0} Aeneas.Std.U128))))))))))) (hzb : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 107) (instOfNatNat (nat_lit 107))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 107) (instOfNatNat (nat_lit 107))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 107) (instOfNatNat (nat_lit 107))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 107) (instOfNatNat (nat_lit 107))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 107) (instOfNatNat (nat_lit 107))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 107) (instOfNatNat (nat_lit 107))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 107) (instOfNatNat (nat_lit 107))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 107) (instOfNatNat (nat_lit 107))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 107) (instOfNatNat (nat_lit 107))))))))))))) (hZ : @LT.lt.{0} Nat instLTNat (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z1))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z2))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 156) (instOfNatNat (nat_lit 156)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z3))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z4))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 260) (instOfNatNat (nat_lit 260)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z5))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 312) (instOfNatNat (nat_lit 312)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z6))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 364) (instOfNatNat (nat_lit 364)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z7))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 416) (instOfNatNat (nat_lit 416)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z8))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 260) (instOfNatNat (nat_lit 260)))) ScalarProofs.Ell)), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.scalar.Scalar52 (curve25519_dalek.backend.serial.u64.scalar.Scalar52.montgomery_reduce limbs) fun (r : curve25519_dalek.backend.serial.u64.scalar.Scalar52) => And (@Exists.{1} Aeneas.Std.U64 fun (s0 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s1 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s2 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s3 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s4 : Aeneas.Std.U64) => And (@Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) r) (@List.cons.{0} Aeneas.Std.U64 s0 (@List.cons.{0} Aeneas.Std.U64 s1 (@List.cons.{0} Aeneas.Std.U64 s2 (@List.cons.{0} Aeneas.Std.U64 s3 (@List.cons.{0} Aeneas.Std.U64 s4 (@List.nil.{0} Aeneas.Std.U64))))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))))))))) (And (@LT.lt.{0} Nat instLTNat (ScalarProofs.scVal r) ScalarProofs.Ell) (@Eq.{1} (ZMod ScalarProofs.Ell) (@HMul.hMul.{0, 0, 0} (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (@instHMul.{0} (ZMod ScalarProofs.Ell) (@Distrib.toMul.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocSemiring.toDistrib.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} (ZMod ScalarProofs.Ell) (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} (ZMod ScalarProofs.Ell) (@CommRing.toNonUnitalCommRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell)))))))) (ScalarProofs.scDenote r) (@HPow.hPow.{0, 0, 0} (ZMod ScalarProofs.Ell) Nat (ZMod ScalarProofs.Ell) (@instHPow.{0, 0} (ZMod ScalarProofs.Ell) Nat (@Monoid.toPow.{0} (ZMod ScalarProofs.Ell) (@MonoidWithZero.toMonoid.{0} (ZMod ScalarProofs.Ell) (@Semiring.toMonoidWithZero.{0} (ZMod ScalarProofs.Ell) (@CommSemiring.toSemiring.{0} (ZMod ScalarProofs.Ell) (@CommRing.toCommSemiring.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell))))))) (@OfNat.ofNat.{0} (ZMod ScalarProofs.Ell) (nat_lit 2) (@instOfNatAtLeastTwo.{0} (ZMod ScalarProofs.Ell) (nat_lit 2) (@AddMonoidWithOne.toNatCast.{0} (ZMod ScalarProofs.Ell) (@AddGroupWithOne.toAddMonoidWithOne.{0} (ZMod ScalarProofs.Ell) (@Ring.toAddGroupWithOne.{0} (ZMod ScalarProofs.Ell) (@CommRing.toRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell))))) (@Nat.instAtLeastTwoHAddOfNat (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Nat.instNeZeroSucc (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))))))) (@OfNat.ofNat.{0} Nat (nat_lit 260) (instOfNatNat (nat_lit 260))))) (@Nat.cast.{0} (ZMod ScalarProofs.Ell) (@AddMonoidWithOne.toNatCast.{0} (ZMod ScalarProofs.Ell) (@AddGroupWithOne.toAddMonoidWithOne.{0} (ZMod ScalarProofs.Ell) (@Ring.toAddGroupWithOne.{0} (ZMod ScalarProofs.Ell) (@CommRing.toRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell))))) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z1))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z2))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 156) (instOfNatNat (nat_lit 156)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z3))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z4))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 260) (instOfNatNat (nat_lit 260)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z5))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 312) (instOfNatNat (nat_lit 312)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z6))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 364) (instOfNatNat (nat_lit 364)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z7))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 416) (instOfNatNat (nat_lit 416)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U128 z8)))))) +cert|ScalarProofs.mul_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : ScalarProofs.Sc) (a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 : Aeneas.Std.U64) (ha : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (@List.cons.{0} Aeneas.Std.U64 a0 (@List.cons.{0} Aeneas.Std.U64 a1 (@List.cons.{0} Aeneas.Std.U64 a2 (@List.cons.{0} Aeneas.Std.U64 a3 (@List.cons.{0} Aeneas.Std.U64 a4 (@List.nil.{0} Aeneas.Std.U64))))))) (hb : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) b) (@List.cons.{0} Aeneas.Std.U64 b0 (@List.cons.{0} Aeneas.Std.U64 b1 (@List.cons.{0} Aeneas.Std.U64 b2 (@List.cons.{0} Aeneas.Std.U64 b3 (@List.cons.{0} Aeneas.Std.U64 b4 (@List.nil.{0} Aeneas.Std.U64))))))) (hab : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))))))) (hbb : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))))))) (hcab : @LT.lt.{0} Nat instLTNat (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (ScalarProofs.scVal a) (ScalarProofs.scVal b)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 260) (instOfNatNat (nat_lit 260)))) ScalarProofs.Ell)), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.scalar.Scalar52 (curve25519_dalek.backend.serial.u64.scalar.Scalar52.mul a b) fun (r : curve25519_dalek.backend.serial.u64.scalar.Scalar52) => And (@Exists.{1} Aeneas.Std.U64 fun (s0 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s1 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s2 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s3 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s4 : Aeneas.Std.U64) => And (@Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) r) (@List.cons.{0} Aeneas.Std.U64 s0 (@List.cons.{0} Aeneas.Std.U64 s1 (@List.cons.{0} Aeneas.Std.U64 s2 (@List.cons.{0} Aeneas.Std.U64 s3 (@List.cons.{0} Aeneas.Std.U64 s4 (@List.nil.{0} Aeneas.Std.U64))))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))))))))) (And (@LT.lt.{0} Nat instLTNat (ScalarProofs.scVal r) ScalarProofs.Ell) (@Eq.{1} (ZMod ScalarProofs.Ell) (ScalarProofs.scDenote r) (@HMul.hMul.{0, 0, 0} (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (@instHMul.{0} (ZMod ScalarProofs.Ell) (@Distrib.toMul.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocSemiring.toDistrib.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} (ZMod ScalarProofs.Ell) (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} (ZMod ScalarProofs.Ell) (@CommRing.toNonUnitalCommRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell)))))))) (ScalarProofs.scDenote a) (ScalarProofs.scDenote b)))) +cert|ScalarProofs.scalarImplementation|cone=Classical.choice,Quot.sound,propext|type=And (∀ (a b : ScalarProofs.Sc), ScalarProofs.ScBnd a → ScalarProofs.ScBnd b → @LT.lt.{0} Nat instLTNat (ScalarProofs.scVal a) ScalarProofs.Ell → @LT.lt.{0} Nat instLTNat (ScalarProofs.scVal b) ScalarProofs.Ell → @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.scalar.Scalar52 (curve25519_dalek.backend.serial.u64.scalar.Scalar52.add a b) fun (r : curve25519_dalek.backend.serial.u64.scalar.Scalar52) => And (ScalarProofs.ScBnd r) (And (@LT.lt.{0} Nat instLTNat (ScalarProofs.scVal r) ScalarProofs.Ell) (@Eq.{1} (ZMod ScalarProofs.Ell) (ScalarProofs.scDenote r) (@HAdd.hAdd.{0, 0, 0} (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (@instHAdd.{0} (ZMod ScalarProofs.Ell) (@Distrib.toAdd.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocSemiring.toDistrib.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} (ZMod ScalarProofs.Ell) (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} (ZMod ScalarProofs.Ell) (@CommRing.toNonUnitalCommRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell)))))))) (ScalarProofs.scDenote a) (ScalarProofs.scDenote b))))) (And (∀ (a b : ScalarProofs.Sc), ScalarProofs.ScBnd a → ScalarProofs.ScBnd b → @LT.lt.{0} Nat instLTNat (ScalarProofs.scVal a) ScalarProofs.Ell → @LE.le.{0} Nat instLENat (ScalarProofs.scVal b) ScalarProofs.Ell → @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.scalar.Scalar52 (curve25519_dalek.backend.serial.u64.scalar.Scalar52.sub a b) fun (r : curve25519_dalek.backend.serial.u64.scalar.Scalar52) => And (ScalarProofs.ScBnd r) (And (@LT.lt.{0} Nat instLTNat (ScalarProofs.scVal r) ScalarProofs.Ell) (@Eq.{1} (ZMod ScalarProofs.Ell) (ScalarProofs.scDenote r) (@HSub.hSub.{0, 0, 0} (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (@instHSub.{0} (ZMod ScalarProofs.Ell) (@SubNegMonoid.toSub.{0} (ZMod ScalarProofs.Ell) (@AddGroup.toSubNegMonoid.{0} (ZMod ScalarProofs.Ell) (@AddGroupWithOne.toAddGroup.{0} (ZMod ScalarProofs.Ell) (@Ring.toAddGroupWithOne.{0} (ZMod ScalarProofs.Ell) (@CommRing.toRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell))))))) (ScalarProofs.scDenote a) (ScalarProofs.scDenote b))))) (∀ (a b : ScalarProofs.Sc), ScalarProofs.ScBnd a → ScalarProofs.ScBnd b → @LT.lt.{0} Nat instLTNat (ScalarProofs.scVal a) ScalarProofs.Ell → @LT.lt.{0} Nat instLTNat (ScalarProofs.scVal b) ScalarProofs.Ell → @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.scalar.Scalar52 (curve25519_dalek.backend.serial.u64.scalar.Scalar52.mul a b) fun (r : curve25519_dalek.backend.serial.u64.scalar.Scalar52) => And (ScalarProofs.ScBnd r) (And (@LT.lt.{0} Nat instLTNat (ScalarProofs.scVal r) ScalarProofs.Ell) (@Eq.{1} (ZMod ScalarProofs.Ell) (ScalarProofs.scDenote r) (@HMul.hMul.{0, 0, 0} (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (@instHMul.{0} (ZMod ScalarProofs.Ell) (@Distrib.toMul.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocSemiring.toDistrib.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} (ZMod ScalarProofs.Ell) (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} (ZMod ScalarProofs.Ell) (@CommRing.toNonUnitalCommRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell)))))))) (ScalarProofs.scDenote a) (ScalarProofs.scDenote b)))))) +cert|ScalarProofs.montgomery_mul_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (a b : ScalarProofs.Sc) (a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 : Aeneas.Std.U64) (ha : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (@List.cons.{0} Aeneas.Std.U64 a0 (@List.cons.{0} Aeneas.Std.U64 a1 (@List.cons.{0} Aeneas.Std.U64 a2 (@List.cons.{0} Aeneas.Std.U64 a3 (@List.cons.{0} Aeneas.Std.U64 a4 (@List.nil.{0} Aeneas.Std.U64))))))) (hb : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) b) (@List.cons.{0} Aeneas.Std.U64 b0 (@List.cons.{0} Aeneas.Std.U64 b1 (@List.cons.{0} Aeneas.Std.U64 b2 (@List.cons.{0} Aeneas.Std.U64 b3 (@List.cons.{0} Aeneas.Std.U64 b4 (@List.nil.{0} Aeneas.Std.U64))))))) (hab : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))))))) (hbb : And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))))))) (hcab : @LT.lt.{0} Nat instLTNat (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (ScalarProofs.scVal a) (ScalarProofs.scVal b)) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 260) (instOfNatNat (nat_lit 260)))) ScalarProofs.Ell)), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.scalar.Scalar52 (curve25519_dalek.backend.serial.u64.scalar.Scalar52.montgomery_mul a b) fun (r : curve25519_dalek.backend.serial.u64.scalar.Scalar52) => And (@Exists.{1} Aeneas.Std.U64 fun (s0 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s1 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s2 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s3 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s4 : Aeneas.Std.U64) => And (@Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) r) (@List.cons.{0} Aeneas.Std.U64 s0 (@List.cons.{0} Aeneas.Std.U64 s1 (@List.cons.{0} Aeneas.Std.U64 s2 (@List.cons.{0} Aeneas.Std.U64 s3 (@List.cons.{0} Aeneas.Std.U64 s4 (@List.nil.{0} Aeneas.Std.U64))))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))))))))) (And (@LT.lt.{0} Nat instLTNat (ScalarProofs.scVal r) ScalarProofs.Ell) (@Eq.{1} (ZMod ScalarProofs.Ell) (@HMul.hMul.{0, 0, 0} (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (@instHMul.{0} (ZMod ScalarProofs.Ell) (@Distrib.toMul.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocSemiring.toDistrib.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} (ZMod ScalarProofs.Ell) (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} (ZMod ScalarProofs.Ell) (@CommRing.toNonUnitalCommRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell)))))))) (ScalarProofs.scDenote r) (@HPow.hPow.{0, 0, 0} (ZMod ScalarProofs.Ell) Nat (ZMod ScalarProofs.Ell) (@instHPow.{0, 0} (ZMod ScalarProofs.Ell) Nat (@Monoid.toPow.{0} (ZMod ScalarProofs.Ell) (@MonoidWithZero.toMonoid.{0} (ZMod ScalarProofs.Ell) (@Semiring.toMonoidWithZero.{0} (ZMod ScalarProofs.Ell) (@CommSemiring.toSemiring.{0} (ZMod ScalarProofs.Ell) (@CommRing.toCommSemiring.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell))))))) (@OfNat.ofNat.{0} (ZMod ScalarProofs.Ell) (nat_lit 2) (@instOfNatAtLeastTwo.{0} (ZMod ScalarProofs.Ell) (nat_lit 2) (@AddMonoidWithOne.toNatCast.{0} (ZMod ScalarProofs.Ell) (@AddGroupWithOne.toAddMonoidWithOne.{0} (ZMod ScalarProofs.Ell) (@Ring.toAddGroupWithOne.{0} (ZMod ScalarProofs.Ell) (@CommRing.toRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell))))) (@Nat.instAtLeastTwoHAddOfNat (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Nat.instNeZeroSucc (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))))))) (@OfNat.ofNat.{0} Nat (nat_lit 260) (instOfNatNat (nat_lit 260))))) (@HMul.hMul.{0, 0, 0} (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (ZMod ScalarProofs.Ell) (@instHMul.{0} (ZMod ScalarProofs.Ell) (@Distrib.toMul.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocSemiring.toDistrib.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocRing.toNonUnitalNonAssocSemiring.{0} (ZMod ScalarProofs.Ell) (@NonUnitalNonAssocCommRing.toNonUnitalNonAssocRing.{0} (ZMod ScalarProofs.Ell) (@NonUnitalCommRing.toNonUnitalNonAssocCommRing.{0} (ZMod ScalarProofs.Ell) (@CommRing.toNonUnitalCommRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell)))))))) (ScalarProofs.scDenote a) (ScalarProofs.scDenote b)))) +cert|ScalarProofs.bytes_unpack_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (bytes : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (words : Aeneas.Std.Array.{0} Aeneas.Std.U64 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Aeneas.Std.U8) (w0 w1 w2 w3 w4 w5 w6 w7 : Aeneas.Std.U64) (hb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) bytes) (have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b60 (@List.cons.{0} Aeneas.Std.U8 b61 (@List.cons.{0} Aeneas.Std.U8 b62 (@List.cons.{0} Aeneas.Std.U8 b63 (@List.nil.{0} Aeneas.Std.U8)))); @List.cons.{0} Aeneas.Std.U8 b56 (@List.cons.{0} Aeneas.Std.U8 b57 (@List.cons.{0} Aeneas.Std.U8 b58 (@List.cons.{0} Aeneas.Std.U8 b59 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b52 (@List.cons.{0} Aeneas.Std.U8 b53 (@List.cons.{0} Aeneas.Std.U8 b54 (@List.cons.{0} Aeneas.Std.U8 b55 y))); @List.cons.{0} Aeneas.Std.U8 b48 (@List.cons.{0} Aeneas.Std.U8 b49 (@List.cons.{0} Aeneas.Std.U8 b50 (@List.cons.{0} Aeneas.Std.U8 b51 y))); have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b44 (@List.cons.{0} Aeneas.Std.U8 b45 (@List.cons.{0} Aeneas.Std.U8 b46 (@List.cons.{0} Aeneas.Std.U8 b47 y))); @List.cons.{0} Aeneas.Std.U8 b40 (@List.cons.{0} Aeneas.Std.U8 b41 (@List.cons.{0} Aeneas.Std.U8 b42 (@List.cons.{0} Aeneas.Std.U8 b43 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b36 (@List.cons.{0} Aeneas.Std.U8 b37 (@List.cons.{0} Aeneas.Std.U8 b38 (@List.cons.{0} Aeneas.Std.U8 b39 y))); @List.cons.{0} Aeneas.Std.U8 b32 (@List.cons.{0} Aeneas.Std.U8 b33 (@List.cons.{0} Aeneas.Std.U8 b34 (@List.cons.{0} Aeneas.Std.U8 b35 y))); have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 y))); @List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 y))); @List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 y))); have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 y))); @List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 y))); @List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 y))))) (hw : @Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) words) (@List.cons.{0} Aeneas.Std.U64 w0 (@List.cons.{0} Aeneas.Std.U64 w1 (@List.cons.{0} Aeneas.Std.U64 w2 (@List.cons.{0} Aeneas.Std.U64 w3 (@List.cons.{0} Aeneas.Std.U64 w4 (@List.cons.{0} Aeneas.Std.U64 w5 (@List.cons.{0} Aeneas.Std.U64 w6 (@List.cons.{0} Aeneas.Std.U64 w7 (@List.nil.{0} Aeneas.Std.U64)))))))))) (hz : And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 w0) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 w1) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 w2) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 w3) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 w4) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 w5) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 w6) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)))) (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 w7) (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))))))))))), @Aeneas.Std.WP.spec.{0} (Aeneas.Std.Array.{0} Aeneas.Std.U64 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (curve25519_dalek.backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0 (@Aeneas.Std.core.ops.range.Range.mk.{0} Aeneas.Std.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))) (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) bytes words) fun (ws : Aeneas.Std.Array.{0} Aeneas.Std.U64 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) => @Exists.{1} Aeneas.Std.U64 fun (v0 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (v1 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (v2 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (v3 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (v4 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (v5 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (v6 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (v7 : Aeneas.Std.U64) => And (@Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) ws) (@List.cons.{0} Aeneas.Std.U64 v0 (@List.cons.{0} Aeneas.Std.U64 v1 (@List.cons.{0} Aeneas.Std.U64 v2 (@List.cons.{0} Aeneas.Std.U64 v3 (@List.cons.{0} Aeneas.Std.U64 v4 (@List.cons.{0} Aeneas.Std.U64 v5 (@List.cons.{0} Aeneas.Std.U64 v6 (@List.cons.{0} Aeneas.Std.U64 v7 (@List.nil.{0} Aeneas.Std.U64)))))))))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v0) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56))))))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v1) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b8) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56))))))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v2) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b16) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56))))))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v3) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b24) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56))))))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v4) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b32) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b33) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b34) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b35) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b36) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b37) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b38) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b39) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56))))))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v5) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b40) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b41) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b42) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b43) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b44) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b45) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b46) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b47) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56))))))) (And (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v6) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b48) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b49) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b50) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b51) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b52) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b53) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b54) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b55) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56))))))) (@Eq.{1} Nat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 v7) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b56) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b57) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b58) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b59) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b60) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b61) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b62) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b63) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))))))))))) +cert|ScalarProofs.from_bytes_wide_spec|cone=Classical.choice,Quot.sound,propext|type=∀ (bytes : Aeneas.Std.Array.{0} Aeneas.Std.U8 (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true))))) (b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Aeneas.Std.U8) (hb : @Eq.{1} (List.{0} Aeneas.Std.U8) (@Subtype.val.{1} (List.{0} Aeneas.Std.U8) (fun (l : List.{0} Aeneas.Std.U8) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U8 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (@of_decide_eq_true (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (@id.{0} (@Eq.{1} Bool (@Decidable.decide (@LE.le.{0} Nat instLENat (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize)) (Nat.decLe (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64))) (Aeneas.Std.UScalar.cMax Aeneas.Std.UScalarTy.Usize))) Bool.true) (@Eq.refl.{1} Bool Bool.true)))))) bytes) (have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b60 (@List.cons.{0} Aeneas.Std.U8 b61 (@List.cons.{0} Aeneas.Std.U8 b62 (@List.cons.{0} Aeneas.Std.U8 b63 (@List.nil.{0} Aeneas.Std.U8)))); @List.cons.{0} Aeneas.Std.U8 b56 (@List.cons.{0} Aeneas.Std.U8 b57 (@List.cons.{0} Aeneas.Std.U8 b58 (@List.cons.{0} Aeneas.Std.U8 b59 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b52 (@List.cons.{0} Aeneas.Std.U8 b53 (@List.cons.{0} Aeneas.Std.U8 b54 (@List.cons.{0} Aeneas.Std.U8 b55 y))); @List.cons.{0} Aeneas.Std.U8 b48 (@List.cons.{0} Aeneas.Std.U8 b49 (@List.cons.{0} Aeneas.Std.U8 b50 (@List.cons.{0} Aeneas.Std.U8 b51 y))); have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b44 (@List.cons.{0} Aeneas.Std.U8 b45 (@List.cons.{0} Aeneas.Std.U8 b46 (@List.cons.{0} Aeneas.Std.U8 b47 y))); @List.cons.{0} Aeneas.Std.U8 b40 (@List.cons.{0} Aeneas.Std.U8 b41 (@List.cons.{0} Aeneas.Std.U8 b42 (@List.cons.{0} Aeneas.Std.U8 b43 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b36 (@List.cons.{0} Aeneas.Std.U8 b37 (@List.cons.{0} Aeneas.Std.U8 b38 (@List.cons.{0} Aeneas.Std.U8 b39 y))); @List.cons.{0} Aeneas.Std.U8 b32 (@List.cons.{0} Aeneas.Std.U8 b33 (@List.cons.{0} Aeneas.Std.U8 b34 (@List.cons.{0} Aeneas.Std.U8 b35 y))); have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b28 (@List.cons.{0} Aeneas.Std.U8 b29 (@List.cons.{0} Aeneas.Std.U8 b30 (@List.cons.{0} Aeneas.Std.U8 b31 y))); @List.cons.{0} Aeneas.Std.U8 b24 (@List.cons.{0} Aeneas.Std.U8 b25 (@List.cons.{0} Aeneas.Std.U8 b26 (@List.cons.{0} Aeneas.Std.U8 b27 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b20 (@List.cons.{0} Aeneas.Std.U8 b21 (@List.cons.{0} Aeneas.Std.U8 b22 (@List.cons.{0} Aeneas.Std.U8 b23 y))); @List.cons.{0} Aeneas.Std.U8 b16 (@List.cons.{0} Aeneas.Std.U8 b17 (@List.cons.{0} Aeneas.Std.U8 b18 (@List.cons.{0} Aeneas.Std.U8 b19 y))); have y : List.{0} Aeneas.Std.U8 := have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b12 (@List.cons.{0} Aeneas.Std.U8 b13 (@List.cons.{0} Aeneas.Std.U8 b14 (@List.cons.{0} Aeneas.Std.U8 b15 y))); @List.cons.{0} Aeneas.Std.U8 b8 (@List.cons.{0} Aeneas.Std.U8 b9 (@List.cons.{0} Aeneas.Std.U8 b10 (@List.cons.{0} Aeneas.Std.U8 b11 y))); have y : List.{0} Aeneas.Std.U8 := @List.cons.{0} Aeneas.Std.U8 b4 (@List.cons.{0} Aeneas.Std.U8 b5 (@List.cons.{0} Aeneas.Std.U8 b6 (@List.cons.{0} Aeneas.Std.U8 b7 y))); @List.cons.{0} Aeneas.Std.U8 b0 (@List.cons.{0} Aeneas.Std.U8 b1 (@List.cons.{0} Aeneas.Std.U8 b2 (@List.cons.{0} Aeneas.Std.U8 b3 y))))) (T : Nat) (hT : @Eq.{1} Nat T (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 8) (instOfNatNat (nat_lit 8)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 16) (instOfNatNat (nat_lit 16)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 24) (instOfNatNat (nat_lit 24)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 32) (instOfNatNat (nat_lit 32)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b5) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 40) (instOfNatNat (nat_lit 40)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b6) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 48) (instOfNatNat (nat_lit 48)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b7) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 56) (instOfNatNat (nat_lit 56)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b8) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 64) (instOfNatNat (nat_lit 64)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b9) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 72) (instOfNatNat (nat_lit 72)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b10) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 80) (instOfNatNat (nat_lit 80)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b11) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 88) (instOfNatNat (nat_lit 88)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b12) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 96) (instOfNatNat (nat_lit 96)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b13) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b14) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 112) (instOfNatNat (nat_lit 112)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b15) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 120) (instOfNatNat (nat_lit 120)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b16) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 128) (instOfNatNat (nat_lit 128)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b17) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 136) (instOfNatNat (nat_lit 136)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b18) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 144) (instOfNatNat (nat_lit 144)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b19) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 152) (instOfNatNat (nat_lit 152)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b20) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 160) (instOfNatNat (nat_lit 160)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b21) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 168) (instOfNatNat (nat_lit 168)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b22) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 176) (instOfNatNat (nat_lit 176)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b23) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 184) (instOfNatNat (nat_lit 184)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b24) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 192) (instOfNatNat (nat_lit 192)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b25) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 200) (instOfNatNat (nat_lit 200)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b26) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b27) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 216) (instOfNatNat (nat_lit 216)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b28) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 224) (instOfNatNat (nat_lit 224)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b29) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 232) (instOfNatNat (nat_lit 232)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b30) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 240) (instOfNatNat (nat_lit 240)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b31) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 248) (instOfNatNat (nat_lit 248)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b32) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 256) (instOfNatNat (nat_lit 256)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b33) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 264) (instOfNatNat (nat_lit 264)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b34) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 272) (instOfNatNat (nat_lit 272)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b35) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 280) (instOfNatNat (nat_lit 280)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b36) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 288) (instOfNatNat (nat_lit 288)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b37) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 296) (instOfNatNat (nat_lit 296)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b38) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 304) (instOfNatNat (nat_lit 304)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b39) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 312) (instOfNatNat (nat_lit 312)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b40) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 320) (instOfNatNat (nat_lit 320)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b41) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 328) (instOfNatNat (nat_lit 328)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b42) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 336) (instOfNatNat (nat_lit 336)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b43) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 344) (instOfNatNat (nat_lit 344)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b44) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 352) (instOfNatNat (nat_lit 352)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b45) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 360) (instOfNatNat (nat_lit 360)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b46) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 368) (instOfNatNat (nat_lit 368)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b47) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 376) (instOfNatNat (nat_lit 376)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b48) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 384) (instOfNatNat (nat_lit 384)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b49) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 392) (instOfNatNat (nat_lit 392)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b50) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 400) (instOfNatNat (nat_lit 400)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b51) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 408) (instOfNatNat (nat_lit 408)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b52) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 416) (instOfNatNat (nat_lit 416)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b53) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 424) (instOfNatNat (nat_lit 424)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b54) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 432) (instOfNatNat (nat_lit 432)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b55) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 440) (instOfNatNat (nat_lit 440)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b56) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 448) (instOfNatNat (nat_lit 448)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b57) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 456) (instOfNatNat (nat_lit 456)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b58) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 464) (instOfNatNat (nat_lit 464)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b59) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 472) (instOfNatNat (nat_lit 472)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b60) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 480) (instOfNatNat (nat_lit 480)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b61) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 488) (instOfNatNat (nat_lit 488)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b62) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 496) (instOfNatNat (nat_lit 496)))))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U8 b63) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 504) (instOfNatNat (nat_lit 504))))))), @Aeneas.Std.WP.spec.{0} curve25519_dalek.backend.serial.u64.scalar.Scalar52 (curve25519_dalek.backend.serial.u64.scalar.Scalar52.from_bytes_wide bytes) fun (r : curve25519_dalek.backend.serial.u64.scalar.Scalar52) => And (@Exists.{1} Aeneas.Std.U64 fun (s0 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s1 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s2 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s3 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (s4 : Aeneas.Std.U64) => And (@Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) r) (@List.cons.{0} Aeneas.Std.U64 s0 (@List.cons.{0} Aeneas.Std.U64 s1 (@List.cons.{0} Aeneas.Std.U64 s2 (@List.cons.{0} Aeneas.Std.U64 s3 (@List.cons.{0} Aeneas.Std.U64 s4 (@List.nil.{0} Aeneas.Std.U64))))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 s4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))))))))) (And (@LT.lt.{0} Nat instLTNat (ScalarProofs.scVal r) ScalarProofs.Ell) (@Eq.{1} (ZMod ScalarProofs.Ell) (ScalarProofs.scDenote r) (@Nat.cast.{0} (ZMod ScalarProofs.Ell) (@AddMonoidWithOne.toNatCast.{0} (ZMod ScalarProofs.Ell) (@AddGroupWithOne.toAddMonoidWithOne.{0} (ZMod ScalarProofs.Ell) (@Ring.toAddGroupWithOne.{0} (ZMod ScalarProofs.Ell) (@CommRing.toRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell))))) T))) +spec|ScalarProofs.Ell|def|value=@OfNat.ofNat.{0} Nat (nat_lit 7237005577332262213973186563042994240857116359379907606001950938285454250989) (instOfNatNat (nat_lit 7237005577332262213973186563042994240857116359379907606001950938285454250989)) +spec|ScalarProofs.Sc|def|value=curve25519_dalek.backend.serial.u64.scalar.Scalar52 +spec|ScalarProofs.ScBnd|def|value=fun (a : ScalarProofs.Sc) => @Exists.{1} Aeneas.Std.U64 fun (a0 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (a1 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (a2 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (a3 : Aeneas.Std.U64) => @Exists.{1} Aeneas.Std.U64 fun (a4 : Aeneas.Std.U64) => And (@Eq.{1} (List.{0} Aeneas.Std.U64) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (@List.cons.{0} Aeneas.Std.U64 a0 (@List.cons.{0} Aeneas.Std.U64 a1 (@List.cons.{0} Aeneas.Std.U64 a2 (@List.cons.{0} Aeneas.Std.U64 a3 (@List.cons.{0} Aeneas.Std.U64 a4 (@List.nil.{0} Aeneas.Std.U64))))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (And (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))) (@LT.lt.{0} Nat instLTNat (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52))))))))) +spec|ScalarProofs.scDenote|def|value=fun (a : ScalarProofs.Sc) => @Nat.cast.{0} (ZMod ScalarProofs.Ell) (@AddMonoidWithOne.toNatCast.{0} (ZMod ScalarProofs.Ell) (@AddGroupWithOne.toAddMonoidWithOne.{0} (ZMod ScalarProofs.Ell) (@Ring.toAddGroupWithOne.{0} (ZMod ScalarProofs.Ell) (@CommRing.toRing.{0} (ZMod ScalarProofs.Ell) (ZMod.commRing ScalarProofs.Ell))))) (ScalarProofs.scVal a) +spec|ScalarProofs.scLimbs|def|value=fun (a0 a1 a2 a3 a4 : Aeneas.Std.U64) => @HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@HAdd.hAdd.{0, 0, 0} Nat Nat Nat (@instHAdd.{0} Nat instAddNat) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a0) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 52) (instOfNatNat (nat_lit 52)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a1))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 104) (instOfNatNat (nat_lit 104)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a2))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 156) (instOfNatNat (nat_lit 156)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a3))) (@HMul.hMul.{0, 0, 0} Nat Nat Nat (@instHMul.{0} Nat instMulNat) (@HPow.hPow.{0, 0, 0} Nat Nat Nat (@instHPow.{0, 0} Nat Nat (@Monoid.toPow.{0} Nat Nat.instMonoid)) (@OfNat.ofNat.{0} Nat (nat_lit 2) (instOfNatNat (nat_lit 2))) (@OfNat.ofNat.{0} Nat (nat_lit 208) (instOfNatNat (nat_lit 208)))) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.U64 a4)) +spec|ScalarProofs.scVal|def|value=fun (a : ScalarProofs.Sc) => ScalarProofs.scVal.match_1.{1} (fun (x : List.{0} Aeneas.Std.U64) => Nat) (@Subtype.val.{1} (List.{0} Aeneas.Std.U64) (fun (l : List.{0} Aeneas.Std.U64) => @Eq.{1} Nat (@List.length.{0} Aeneas.Std.U64 l) (@Aeneas.Std.UScalar.val Aeneas.Std.UScalarTy.Usize (Aeneas.Std.Usize.ofNat (@OfNat.ofNat.{0} Nat (nat_lit 5) (instOfNatNat (nat_lit 5))) curve25519_dalek.backend.serial.u64.field.FieldElement51._proof_1))) a) (fun (a0 a1 a2 a3 a4 : Aeneas.Std.U64) => ScalarProofs.scLimbs a0 a1 a2 a3 a4) fun (x : List.{0} Aeneas.Std.U64) => @OfNat.ofNat.{0} Nat (nat_lit 0) (instOfNatNat (nat_lit 0)) +spec|ScalarProofs.scVal._sparseCasesOn_1|def|value=fun {α : Type u} {motive : (t : List.{u} α) → Sort u_1} (t : List.{u} α) (cons : (head : α) → (tail : List.{u} α) → motive (@List.cons.{u} α head tail)) => @List.rec.{u_1, u} α (fun (t : List.{u} α) => ((h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α t)) → motive t) → motive t) (fun («else» : (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α (@List.nil.{u} α))) → motive (@List.nil.{u} α)) => «else» (@Nat.ne_of_beq_eq_false (Nat.land (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (Nat.shiftRight (nat_lit 2) (nat_lit 0))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Eq.refl.{1} Bool Bool.false))) (fun (head : α) (tail : List.{u} α) (tail_ih : ((h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α tail)) → motive tail) → motive tail) («else» : (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{u} α (@List.cons.{u} α head tail))) → motive (@List.cons.{u} α head tail)) => cons head tail) t +spec|ScalarProofs.scVal._sparseCasesOn_2|def|value=fun {α : Type u} {motive : (t : List.{u} α) → Sort u_1} (t : List.{u} α) (nil : motive (@List.nil.{u} α)) => @List.rec.{u_1, u} α (fun (t : List.{u} α) => ((h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α t)) → motive t) → motive t) (fun («else» : (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α (@List.nil.{u} α))) → motive (@List.nil.{u} α)) => nil) (fun (head : α) (tail : List.{u} α) (tail_ih : ((h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α tail)) → motive tail) → motive tail) («else» : (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{u} α (@List.cons.{u} α head tail))) → motive (@List.cons.{u} α head tail)) => «else» (@Nat.ne_of_beq_eq_false (Nat.land (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (Nat.shiftRight (nat_lit 1) (nat_lit 1))) (@OfNat.ofNat.{0} Nat (nat_lit 1) (instOfNatNat (nat_lit 1))) (@Eq.refl.{1} Bool Bool.false))) t +spec|ScalarProofs.scVal.match_1|def|value=fun (motive : List.{0} Aeneas.Std.U64 → Sort u_1) (x : List.{0} Aeneas.Std.U64) (h_1 : (a0 a1 a2 a3 a4 : Aeneas.Std.U64) → motive (@List.cons.{0} Aeneas.Std.U64 a0 (@List.cons.{0} Aeneas.Std.U64 a1 (@List.cons.{0} Aeneas.Std.U64 a2 (@List.cons.{0} Aeneas.Std.U64 a3 (@List.cons.{0} Aeneas.Std.U64 a4 (@List.nil.{0} Aeneas.Std.U64))))))) (h_2 : (x : List.{0} Aeneas.Std.U64) → motive x) => @ScalarProofs.scVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive x) x (fun (head : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @ScalarProofs.scVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head x)) tail (fun (head_1 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @ScalarProofs.scVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 x))) tail (fun (head_2 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @ScalarProofs.scVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 x)))) tail (fun (head_3 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @ScalarProofs.scVal._sparseCasesOn_1.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 x))))) tail (fun (head_4 : Aeneas.Std.U64) (tail : List.{0} Aeneas.Std.U64) => @ScalarProofs.scVal._sparseCasesOn_2.{u_1, 0} Aeneas.Std.U64 (fun (x : List.{0} Aeneas.Std.U64) => motive (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 (@List.cons.{0} Aeneas.Std.U64 head_4 x)))))) tail (h_1 head head_1 head_2 head_3 head_4) fun (h : Nat.hasNotBit (nat_lit 1) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 (@List.cons.{0} Aeneas.Std.U64 head_4 tail)))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 (@List.cons.{0} Aeneas.Std.U64 head_3 tail))))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 (@List.cons.{0} Aeneas.Std.U64 head_2 tail)))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head (@List.cons.{0} Aeneas.Std.U64 head_1 tail))) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 tail)) => h_2 (@List.cons.{0} Aeneas.Std.U64 head tail)) fun (h : Nat.hasNotBit (nat_lit 2) (@List.ctorIdx.{0} Aeneas.Std.U64 x)) => h_2 x diff --git a/verification/check-scalar.sh b/verification/check-scalar.sh index fcbfb3f..a6c057b 100755 --- a/verification/check-scalar.sh +++ b/verification/check-scalar.sh @@ -29,7 +29,7 @@ AENEAS_LEAN="$AENEAS_HOME/backends/lean" TIMEOUT="${LEAN_TIMEOUT:-300}" CORES="${LEAN_MAX_CORES:-0-3}" GEN=(CurveField/TypesExternal CurveField/Types CurveField/FunsExternal CurveField/Funs) -PROOFS=(ScalarDenote ScalarLoop ScalarSubSpec ScalarAddSpec ScalarMulSpec ScalarMontSpec ScalarReduceSpec ScalarFullMulSpec ScalarMain ScalarWideSpec ScalarBytesSpec ScalarUnpackSpec ScalarFromBytesSpec) +PROOFS=(ScalarDenote ScalarLoop ScalarSubSpec ScalarAddSpec ScalarMulSpec ScalarMontSpec ScalarReduceSpec ScalarFullMulSpec ScalarMain ScalarWideSpec ScalarBytesSpec ScalarUnpackSpec ScalarFromBytesSpec ScalarAudit ) # Fully-qualified scalar certificates. Each must report EXACTLY the standard # three axioms — asserted per certificate, not by counting how many lines of # output happened to match. A count cannot tell you WHICH certificate is clean. @@ -226,6 +226,96 @@ if [ "$AUDFAIL" != 0 ]; then fi echo " ${#CERTS[@]}/${#CERTS[@]} scalar certificates report exactly $EXPECTED" +# ── Phase 3c: statement + specification binding ───────────────────────────── +# WHAT PHASE 3 DOES NOT ESTABLISH — and why this repository claimed something +# false for four rounds. Round-7 review (GPT-5.6, register key +# `scalar-statements-unbound`, CRITICAL): the main button bound its 31 +# certificates' elaborated statements and reachable specification bodies; this +# button bound NONE of its thirteen. Meanwhile TRUSTED-BASE item 8 said the +# audit covers "every certificate" and each README said check.sh audits every +# certificate. Both were false across the 44-certificate repository surface. +# +# The finding was raised in round 7, was lost from the round-8 work list by an +# F-number collision between two reviewers, and was re-raised in round 8. It is +# closed here. +# +# Phase 3 proves each scalar certificate rests on exactly the standard three +# axioms. It does not say WHAT THE THEOREM SAYS. A certificate gutted to a +# tautology of the same cone passes it, and so does one whose reference +# definition has been redefined to BE the extracted code — at which point the +# theorem reads `loop = loop` and the cone is byte-identical. +# +# Proofs/ScalarAudit.lean emits a canonical block holding the policy constants, +# every scalar certificate's fully-elaborated statement (`pp.all`, so implicit +# arguments, instances and universes are all visible), and the body of every +# specification constant transitively reachable from those statements. This +# phase binds its SHA-256, and the block's INPUT is committed too, so a +# mismatch can be DIFFED rather than merely reported. +# +# To rotate deliberately: run this button, take the printed OBSERVED digest, +# and update the constant below AND SCALAR-AUDIT-MANIFEST.txt in the same +# reviewable commit. An author who edits a statement and refreshes the digest +# together is caught by reading the diff, not by this script. +EXPECTED_SCALAR_AUDIT_SHA256="ecf3a3f87228f27fdfd25cb5104d04e0d90b7344b2ecee9c0138ca6b373838d0" +echo "=== Phase 3c: scalar statement + specification binding ===" +cd "$AENEAS_LEAN" +# The compiler's own exit code is the primary signal; the transcript is only +# corroboration. A timeout or a memory clamp exits non-zero WITHOUT printing +# "error:", so grepping the text alone would let it through. +SAUD_RC=0 +SAUD_OUT=$(lake env bash -c " + set -uo pipefail + cd '$HERE/gen' && export LEAN_PATH=\"\$LEAN_PATH:\$PWD:$HERE\" + cd '$HERE' + LEAN_TIMEOUT=$TIMEOUT LEAN_MEM_MB=8192 '$HERE/lean-guard' Proofs/ScalarAudit.lean 2>&1 +" ) || SAUD_RC=$? +if [ "$SAUD_RC" -ne 0 ]; then + echo "SCALAR AUDIT FAILED — Proofs/ScalarAudit.lean exited $SAUD_RC:" + tail -20 <<<"$SAUD_OUT" | sed 's/^/ /' + exit 1 +fi +if grep -q 'error:' <<<"$SAUD_OUT"; then + echo "SCALAR AUDIT FAILED — Proofs/ScalarAudit.lean did not elaborate cleanly:" + grep 'error:' <<<"$SAUD_OUT" | head -20 | sed 's/^/ /' + exit 1 +fi +SBLOCK=$(awk '/SCALAR-AUDIT-MANIFEST-BEGIN/{f=1;next} /SCALAR-AUDIT-MANIFEST-END/{f=0} f' <<<"$SAUD_OUT") +# FAIL CLOSED ON ABSENCE: no block and a matching block must not share a path. +if [ -z "$SBLOCK" ]; then + echo "SCALAR AUDIT FAILED — no SCALAR-AUDIT-MANIFEST block was emitted (fail-closed)."; exit 1 +fi +SGOT_SHA=$(printf '%s\n' "$SBLOCK" | sha256sum | cut -d' ' -f1) +if [ "$SGOT_SHA" != "$EXPECTED_SCALAR_AUDIT_SHA256" ]; then + printf '%s\n' "$SBLOCK" > "$HERE/.scalar-audit-manifest.observed" + echo "SCALAR AUDIT FAILED — audit-manifest digest mismatch." + echo " expected: $EXPECTED_SCALAR_AUDIT_SHA256" + echo " observed: $SGOT_SHA" + echo " A statement, a specification body, or a policy constant changed." + echo " First differences against the committed block:" + diff -u "$HERE/SCALAR-AUDIT-MANIFEST.txt" "$HERE/.scalar-audit-manifest.observed" 2>/dev/null \ + | head -30 | sed 's/^/ /' || echo " (SCALAR-AUDIT-MANIFEST.txt absent — cannot diff)" + rm -f "$HERE/.scalar-audit-manifest.observed" + exit 1 +fi +# The digest's INPUT must be committed and current, or the diff above would +# compare against a stale reference and quietly mislead the next reader. +if ! printf '%s\n' "$SBLOCK" | cmp -s - "$HERE/SCALAR-AUDIT-MANIFEST.txt"; then + echo "SCALAR AUDIT FAILED — the committed SCALAR-AUDIT-MANIFEST.txt does not match the emitted block." + echo " (the digest matched, so the committed copy is stale — refresh it)"; exit 1 +fi +# CROSS-CHECK the certificate list against the CERTS array Phase 3 audits, so a +# certificate cannot be dropped from the auditor's manifest unnoticed. +SAUD_CERTS=$(grep -o 'AUDITED-SCALAR-CERTIFICATES:.*' <<<"$SAUD_OUT" \ + | sed 's/AUDITED-SCALAR-CERTIFICATES: //' | tr ' ' '\n' | sort -u | sed '/^$/d') +SBASH_CERTS=$(printf '%s\n' "${CERTS[@]}" | sort -u) +if [ "$SAUD_CERTS" != "$SBASH_CERTS" ]; then + echo "SCALAR AUDIT FAILED — the auditor's certificate set differs from this button's CERTS array:" + diff <(echo "$SBASH_CERTS") <(echo "$SAUD_CERTS") | sed 's/^/ /' + exit 1 +fi +echo " ${#CERTS[@]} scalar statements + reachable specification bodies bound, sha256 = $SGOT_SHA" +cd "$HERE" + echo "" echo "SCALAR LAYER COMPLETE: add, sub, mul (Montgomery reduction, double round" echo "through RR) proven mod ℓ; aggregate certificate scalarImplementation" diff --git a/verification/check.sh b/verification/check.sh index d179c7d..c50d590 100755 --- a/verification/check.sh +++ b/verification/check.sh @@ -328,6 +328,13 @@ HARNESS_EXTRA=( inventory-allowlist.txt # the audit surface Phase 2c diffs against inventory-allowlist-scalar.txt # the scalar layer's audit surface (second button) Proofs/Audit.lean # the audit driver: it computes the digest it is judged by + driver-allowlist.txt # the INSTRUMENTS' own declaration surface, with cones. + # Not executable, so it would otherwise sit outside the + # harness set — and an allowlist an attacker may rewrite + # pins nothing. + Proofs/ScalarAudit.lean # the scalar audit driver, likewise + SCALAR-AUDIT-MANIFEST.txt # the block the scalar digest is taken over, committed + # so a mismatch can be DIFFED and not merely reported Proofs/InventoryCore.lean # inventory machinery Proofs/InventoryScalar.lean # inventory driver: the scalar layer Proofs/Inventory.lean # inventory driver: main chain @@ -778,6 +785,19 @@ done # fails closed: a declaration missing from both walks leaves the sum short, and # one counted twice leaves it long. A future mismatch must be explained — as # this one finally was — never absorbed into a constant. +# PIN THE INSTRUMENTS' OWN SURFACE, in both directions, with the SAME gate the +# corpus uses (round-8 review, Claude, register keys `drv-surface-no-cones`, +# `accounting-certifies-enumeration`, and it retires `drv-naming-heuristic` as +# load-bearing). +# +# The accounting identity below proves every kernel constant is ENUMERATED by +# one of the two walks. The reviewer demonstrated that enumeration is not +# audit: their planted claim WAS enumerated, carried a real axiom cone, and +# nothing examined it — DRV rows had no cone and no allowlist covered them. +# They now carry the cone, and this gate pins them exactly as the corpus is, so +# a claim smuggled into an instrument is a NEW ROW and a new row fails closed +# whatever it is called. +"$HERE/inventory_gate.sh" "$INVLOG" "$HERE/driver-allowlist.txt" DRV || ACCTFAIL=1 N_DRV=$(grep -c '^DRV|' "$INVLOG" || true) DRV_TRAILERS=$(grep -c '^DRV-COUNT|' "$INVLOG" || true) DRV_SUM=$(grep '^DRV-COUNT|' "$INVLOG" | cut -d'|' -f2 | paste -sd+ - | bc) @@ -785,7 +805,7 @@ KERN_NAMES=$(mktemp /tmp/check-kernnames-XXXX.txt) ACCT_NAMES=$(mktemp /tmp/check-acctnames-XXXX.txt) LC_ALL=C grep '^KERNEL-NAME|' "$KERNLOG" | cut -d'|' -f2 | LC_ALL=C sort -u > "$KERN_NAMES" { LC_ALL=C awk -F'|' '/^INV\|/{print $3}' "$HERE/inventory-allowlist.txt" - LC_ALL=C grep '^DRV|' "$INVLOG" | cut -d'|' -f2 + LC_ALL=C grep '^DRV|' "$INVLOG" | cut -d'|' -f3 } | LC_ALL=C sort -u > "$ACCT_NAMES" UNACCOUNTED=$(LC_ALL=C comm -23 "$KERN_NAMES" "$ACCT_NAMES") if [ "$DRV_TRAILERS" -ne "$N_DRIVERS" ]; then diff --git a/verification/driver-allowlist.txt b/verification/driver-allowlist.txt new file mode 100644 index 0000000..c815334 --- /dev/null +++ b/verification/driver-allowlist.txt @@ -0,0 +1,51 @@ +# driver-allowlist.txt — THE AUDIT INSTRUMENTS' OWN DECLARATION SURFACE, +# pinned with axiom cones, gated by inventory_gate.sh with the DRV tag: +# the same implementation that pins the corpus, in both directions. +# +# Round-8 review (Claude, register keys drv-surface-no-cones and +# accounting-certifies-enumeration). The accounting identity proved every +# kernel constant was ENUMERATED. It did not prove any of them was +# EXAMINED: a claim planted in an instrument was enumerated, carried a +# real cone, and nothing looked at it. These rows close that gap. +# +# Regenerate deliberately, never by hand: +# scratchpad/gen-driver-allowlists.sh +# and read the diff — a new row is a declaration that appeared in an +# instrument, which is exactly the event this file exists to surface. +DRV|Proofs.InventoryBasic|corpus|def| +DRV|Proofs.Inventory|Ed25519Audit._aux_Proofs_Audit___elabRules_Ed25519Audit_commandAuditStatements_1._sparseCasesOn_3|def|propext +DRV|Proofs.Inventory|Ed25519Audit._aux_Proofs_Audit___elabRules_Ed25519Audit_commandAuditStatements_1.match_10|def| +DRV|Proofs.Inventory|Ed25519Audit._aux_Proofs_Audit___elabRules_Ed25519Audit_commandAuditStatements_1.match_12|def|Classical.choice,Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Audit._aux_Proofs_Audit___elabRules_Ed25519Audit_commandAuditStatements_1.match_1|def| +DRV|Proofs.Inventory|Ed25519Audit._aux_Proofs_Audit___elabRules_Ed25519Audit_commandAuditStatements_1.match_3|def|propext +DRV|Proofs.Inventory|Ed25519Audit._aux_Proofs_Audit___elabRules_Ed25519Audit_commandAuditStatements_1.match_6|def|propext +DRV|Proofs.Inventory|Ed25519Audit._aux_Proofs_Audit___elabRules_Ed25519Audit_commandAuditStatements_1.match_8|def| +DRV|Proofs.Inventory|Ed25519Audit._aux_Proofs_Audit___elabRules_Ed25519Audit_commandAuditStatements_1|def|Classical.choice,Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Audit.apexBoundary|def| +DRV|Proofs.Inventory|Ed25519Audit.apexExtra|def| +DRV|Proofs.Inventory|Ed25519Audit.closureOf._sparseCasesOn_1|def|propext +DRV|Proofs.Inventory|Ed25519Audit.closureOf._unsafe_rec|def|Classical.choice,Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Audit.closureOf.match_1|def|propext +DRV|Proofs.Inventory|Ed25519Audit.closureOf.match_4|def| +DRV|Proofs.Inventory|Ed25519Audit.closureOf|opaque|Classical.choice,Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Audit.commandAuditStatements|def| +DRV|Proofs.Inventory|Ed25519Audit.isSpecConst.match_1|def| +DRV|Proofs.Inventory|Ed25519Audit.isSpecConst|def|Classical.choice,Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Audit.kernel3|def| +DRV|Proofs.Inventory|Ed25519Audit.manifest|def| +DRV|Proofs.Inventory|Ed25519Audit.normWs|def|Classical.choice,Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Audit.ppAll|def|Classical.choice,Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Audit.sortNames|def|Classical.choice,Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Audit.specPrefix|def| +DRV|Proofs.Inventory|Ed25519Inventory.axiomCone|def|Classical.choice,Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Inventory.emitDrivers.match_1|def|Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Inventory.emitDrivers|def|Classical.choice,Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Inventory.emitInventory._sparseCasesOn_3|def|propext +DRV|Proofs.Inventory|Ed25519Inventory.emitInventory.match_1|def| +DRV|Proofs.Inventory|Ed25519Inventory.emitInventory.match_3|def|propext +DRV|Proofs.Inventory|Ed25519Inventory.emitInventory.match_6|def| +DRV|Proofs.Inventory|Ed25519Inventory.emitInventory|def|Classical.choice,Quot.sound,propext +DRV|Proofs.Inventory|Ed25519Inventory.kindOf.match_1|def| +DRV|Proofs.Inventory|Ed25519Inventory.kindOf|def| +DRV|Proofs.Inventory|corpus|def| +DRV|Proofs.Inventory|drivers|def| diff --git a/verification/inventory-allowlist-scalar.txt b/verification/inventory-allowlist-scalar.txt index 109680a..f74deec 100644 --- a/verification/inventory-allowlist-scalar.txt +++ b/verification/inventory-allowlist-scalar.txt @@ -1875,3 +1875,27 @@ INV|Proofs.ScalarWideSpec|ScalarProofs.montgomery_mul_spec._proof_1_7|theorem|Cl INV|Proofs.ScalarWideSpec|ScalarProofs.montgomery_mul_spec._proof_1_8|theorem|Classical.choice,Quot.sound,propext INV|Proofs.ScalarWideSpec|ScalarProofs.montgomery_mul_spec._proof_1_9|theorem|Classical.choice,Quot.sound,propext INV|Proofs.ScalarWideSpec|ScalarProofs.montgomery_mul_spec|theorem|Classical.choice,Quot.sound,propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.apexBoundary|def| +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.apexExtra|def| +INV|Proofs.ScalarAudit|Ed25519ScalarAudit._aux_Proofs_ScalarAudit___elabRules_Ed25519ScalarAudit_commandAuditScalarStatements_1|def|Classical.choice,Quot.sound,propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit._aux_Proofs_ScalarAudit___elabRules_Ed25519ScalarAudit_commandAuditScalarStatements_1.match_1|def| +INV|Proofs.ScalarAudit|Ed25519ScalarAudit._aux_Proofs_ScalarAudit___elabRules_Ed25519ScalarAudit_commandAuditScalarStatements_1.match_10|def| +INV|Proofs.ScalarAudit|Ed25519ScalarAudit._aux_Proofs_ScalarAudit___elabRules_Ed25519ScalarAudit_commandAuditScalarStatements_1.match_12|def|Classical.choice,Quot.sound,propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit._aux_Proofs_ScalarAudit___elabRules_Ed25519ScalarAudit_commandAuditScalarStatements_1.match_3|def|propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit._aux_Proofs_ScalarAudit___elabRules_Ed25519ScalarAudit_commandAuditScalarStatements_1.match_6|def|propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit._aux_Proofs_ScalarAudit___elabRules_Ed25519ScalarAudit_commandAuditScalarStatements_1.match_8|def| +INV|Proofs.ScalarAudit|Ed25519ScalarAudit._aux_Proofs_ScalarAudit___elabRules_Ed25519ScalarAudit_commandAuditScalarStatements_1._sparseCasesOn_3|def|propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.closureOf|opaque|Classical.choice,Quot.sound,propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.closureOf.match_1|def|propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.closureOf.match_4|def| +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.closureOf._sparseCasesOn_1|def|propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.closureOf._unsafe_rec|def|Classical.choice,Quot.sound,propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.commandAuditScalarStatements|def| +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.isSpecConst|def|Classical.choice,Quot.sound,propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.isSpecConst.match_1|def| +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.kernel3|def| +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.manifest|def| +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.normWs|def|Classical.choice,Quot.sound,propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.ppAll|def|Classical.choice,Quot.sound,propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.sortNames|def|Classical.choice,Quot.sound,propext +INV|Proofs.ScalarAudit|Ed25519ScalarAudit.specPrefix|def| diff --git a/verification/inventory_gate.sh b/verification/inventory_gate.sh index a5e59d0..b0de821 100755 --- a/verification/inventory_gate.sh +++ b/verification/inventory_gate.sh @@ -9,7 +9,35 @@ # self-test exercises this exact script — the tested logic IS the shipping # logic. # -# Usage: inventory_gate.sh +# Usage: inventory_gate.sh [] +# +# defaults to INV — the CORPUS walk. Pass DRV to gate the INSTRUMENTS' +# OWN SURFACE with this same implementation. +# +# WHY THE TAG EXISTS — round-8 review (Claude, register keys +# `drv-surface-no-cones`, `accounting-certifies-enumeration`). +# +# The accounting identity added in round 7 proved every constant the kernel +# sees is ENUMERATED by one of the two walks. The reviewer showed that +# enumeration is not audit: a claim planted in an instrument WAS enumerated — +# `DRV|LTLAccAudit.bait.smuggled|theorem` — and then nothing looked at it, +# because DRV rows carried name and kind and NO CONE, and no allowlist covered +# them. In their words, the identity "converted 36 declarations nobody +# enumerated into 36 declarations nobody examined. That is progress of one +# step, not two." +# +# The second step is here: DRV rows now carry their axiom cone and are pinned +# in a committed allowlist, by THIS gate, in both directions — exactly as the +# corpus is. One implementation, not two, because a second copy of a coverage +# gate is a second thing to drift. +# +# It also retires a heuristic. The driver-surface rule permits a theorem whose +# name extends a constant declared alongside it, since that is what the +# elaborator generates for a definition; the reviewer showed it "breaks in one +# line" — declare `def bait`, then `theorem bait.smuggled` passes. That rule is +# kept as a fast, readable first line of defence, but it is NO LONGER +# LOAD-BEARING: a planted claim now has to appear in the pinned allowlist, and +# a new row fails closed whatever it is named. # # Fail-closed in BOTH directions: # UNCLASSIFIED — constant in the environment, absent from the allowlist @@ -21,17 +49,41 @@ # ───────────────────────────────────────────────────────────────────────────── set -uo pipefail export LC_ALL=C # byte-order collation: sort/comm must agree with Lean's String order -obs_file="$1"; allow_file="$2" +obs_file="$1"; allow_file="$2"; TAG="${3:-INV}" +case "$TAG" in + INV) WHAT="the audited corpus"; TRAILER_TAG="INV-COUNT"; LABEL="inventory gate"; TRUNCLABEL="INVENTORY TRUNCATED" ;; + DRV) WHAT="the audit instruments"; TRAILER_TAG="DRV-COUNT"; LABEL="driver-surface gate"; TRUNCLABEL="DRIVER SURFACE TRUNCATED" ;; + *) echo " GATE MISUSE: unknown tag '$TAG' (expected INV or DRV)"; exit 1 ;; +esac -OBS=$(grep '^INV|' "$obs_file" | sort -u) -N_OBS=$(printf '%s' "$OBS" | grep -c '^INV|' || true) -TRAILER=$(grep '^INV-COUNT|' "$obs_file" | tail -1 | cut -d'|' -f2) -if [ -z "$TRAILER" ] || [ "$TRAILER" != "$N_OBS" ]; then - echo " INVENTORY TRUNCATED: trailer=${TRAILER:-absent}, observed $N_OBS lines" +# The trailer is an OUTPUT-INTEGRITY check: it must equal the number of rows +# the driver(s) actually emitted, BEFORE de-duplication. Comparing it to the +# de-duplicated count conflates "a run was truncated" with "two rows were +# identical", and the second is a record-format defect that must be fixed at +# the source, not absorbed here. (It was: DRV rows now carry their driver.) +N_RAW=$(grep -c "^$TAG|" "$obs_file" || true) +OBS=$(grep "^$TAG|" "$obs_file" | sort -u) +N_OBS=$(printf '%s' "$OBS" | grep -c "^$TAG|" || true) +if [ "$N_RAW" -ne "$N_OBS" ]; then + echo " DUPLICATE $TAG RECORDS: $N_RAW rows collapse to $N_OBS distinct ones." + echo " Two declarations share a record, so one is covered by the other's entry:" + grep "^$TAG|" "$obs_file" | sort | uniq -d | head -5 | sed 's/^/ /' + exit 1 +fi +# Each driver emits its own trailer, so DRV trailers are SUMMED; the corpus +# walk emits one and the last is taken. Either way a truncated or crashed run +# must never pass as an empty diff. +if [ "$TAG" = DRV ]; then + TRAILER=$(grep "^$TRAILER_TAG|" "$obs_file" | cut -d'|' -f2 | paste -sd+ - | bc) +else + TRAILER=$(grep "^$TRAILER_TAG|" "$obs_file" | tail -1 | cut -d'|' -f2) +fi +if [ -z "$TRAILER" ] || [ "$TRAILER" != "$N_RAW" ]; then + echo " $TRUNCLABEL: trailer=${TRAILER:-absent}, observed $N_RAW lines" exit 1 fi -ALLOW=$(grep '^INV|' "$allow_file" | sort -u) +ALLOW=$(grep "^$TAG|" "$allow_file" | sort -u) FAILGATE=0 UNCLASS=$(comm -23 <(printf '%s\n' "$OBS") <(printf '%s\n' "$ALLOW")) STALE=$(comm -13 <(printf '%s\n' "$OBS") <(printf '%s\n' "$ALLOW")) @@ -51,7 +103,7 @@ fi # two independent gates on the same property, deliberately. AXLINES=$(printf '%s\n' "$OBS" | grep '|axiom|' || true) if [ -n "$AXLINES" ]; then - echo " AXIOM SURFACE DRIFT: the audited corpus must declare no axioms; observed:" + echo " AXIOM SURFACE DRIFT: $WHAT must declare no axioms; observed:" printf '%s\n' "$AXLINES" | sed 's/^/ /' FAILGATE=1 fi @@ -60,5 +112,5 @@ fi # sanctioned axiom" when ported, which is the accumulator's policy; here the # audited corpus permits NONE, and a success line describing a different rule # is how an assertion quietly stops meaning anything. -[ "$FAILGATE" = 0 ] && echo " inventory gate: $N_OBS constants, environment == allowlist, zero axioms declared in the audited corpus" +[ "$FAILGATE" = 0 ] && echo " $LABEL: $N_OBS constants, environment == allowlist, zero axioms declared in $WHAT" exit "$FAILGATE" diff --git a/verification/selftest-scalar-statements.sh b/verification/selftest-scalar-statements.sh new file mode 100755 index 0000000..f32713e --- /dev/null +++ b/verification/selftest-scalar-statements.sh @@ -0,0 +1,197 @@ +#!/usr/bin/env bash +# ───────────────────────────────────────────────────────────────────────────── +# selftest-scalar-statements.sh — adversarial self-test for check-scalar.sh +# Phase 3c, the scalar statement + specification binding. +# +# WHY THIS EXISTS. Round-7 review (GPT-5.6, register key +# `scalar-statements-unbound`, CRITICAL): the main button bound its 31 +# certificates' elaborated statements and reachable specification bodies; this +# repository's scalar button bound NONE of its thirteen, while TRUSTED-BASE +# item 8 said the audit covers "every certificate". The binding was added in +# the same commit as this file. The reviewer asked for exactly two shipping +# attacks, and this file is those two: +# +# 1. same-cone theorem statement gutting; +# 2. a reachable reference body rewritten while name and cone remain fixed. +# +# Both are invisible to every earlier phase by construction. Phase 2b sees no +# new axiom; Phase 3's exact-cone audit sees the same three axioms; only the +# statement binding sees them. +# +# It extracts Phase 3c out of check-scalar.sh at run time, so it attacks THE +# SHIPPING GATE rather than a copy that can drift away from it. +# +# Requires a prior green scalar build. Recompiling the corpus is the expensive +# part; SKIP_SLOW=1 runs only the fast cases and SAYS SO rather than passing +# quietly over the two that matter. +# ───────────────────────────────────────────────────────────────────────────── +set -uo pipefail +source ~/aeneas-toolchain/env.sh +HERE="$(cd "$(dirname "$0")" && pwd)" +AENEAS_LEAN="$AENEAS_HOME/backends/lean" +TIMEOUT="${LEAN_TIMEOUT:-900}" +export LEAN_MEM_MB="${LEAN_MEM_MB:-8192}" +CORES="${LEAN_MAX_CORES:-0-3}" +SKIP_SLOW="${SKIP_SLOW:-0}" + +STASH="$(mktemp -d)" +FAILURES=0 +TREE_AT_START="$(cd "$HERE/.." && git status --porcelain)" + +cleanup() { + [ -f "$STASH/gut.lean" ] && cp "$STASH/gut.lean" "$HERE/Proofs/ScalarMain.lean" + [ -f "$STASH/den.lean" ] && cp "$STASH/den.lean" "$HERE/Proofs/ScalarDenote.lean" + rm -rf "$STASH" + rm -f "$HERE"/.scalar-audit-manifest.observed +} +trap cleanup EXIT INT TERM + +DRIVER="$STASH/phase3c.sh" +PAYLOAD="$STASH/payload.sh" +build_driver() { + awk '/^# ── Phase 3c/{f=1} f&&/^# ── (Phase |Phases end)/&&!/Phase 3c/{exit} f{print}' \ + "$HERE/check-scalar.sh" > "$PAYLOAD" + { echo 'set -uo pipefail' + echo 'source ~/aeneas-toolchain/env.sh' + echo "HERE=\"$HERE\"" + echo 'AENEAS_LEAN="$AENEAS_HOME/backends/lean"' + echo "TIMEOUT=$TIMEOUT; CORES=\"$CORES\"" + # CERTS is referenced by the cross-check inside Phase 3c. Lifted VERBATIM + # rather than re-derived, so this test cannot drift from the button's set. + sed -n '/^CERTS=(/,/^)/p' "$HERE/check-scalar.sh" + cat "$PAYLOAD" + } > "$DRIVER" + if [ "$(wc -l < "$PAYLOAD")" -lt 40 ]; then + echo "FATAL: could not lift Phase 3c out of check-scalar.sh — the markers moved." + exit 1 + fi + grep -qF 'SCALAR-AUDIT-MANIFEST-BEGIN' "$PAYLOAD" || { + echo "FATAL: the lifted payload does not read the scalar audit block."; exit 1; } + "$HERE/lift-guard.sh" "$PAYLOAD" "$DRIVER" "check-scalar.sh Phase 3c" || exit 1 +} + +recompile() { # recompile + ( cd "$AENEAS_LEAN" && lake env bash -c " + set -uo pipefail + cd '$HERE/gen' && export LEAN_PATH=\"\$LEAN_PATH:\$PWD:$HERE\" + cd '$HERE' + LEAN_TIMEOUT=$TIMEOUT LEAN_MAX_CORES=$CORES '$HERE/lean-guard' Proofs/$1.lean + " ) >/dev/null 2>&1 +} + +expect() { # expect + local name="$1" want_rc="$2" want_txt="$3" out rc + out=$(bash "$DRIVER" 2>&1); rc=$? + if [ "$rc" -ne "$want_rc" ]; then + echo " FAIL $name: exit $rc, expected $want_rc" + tail -6 <<<"$out" | sed 's/^/ /'; FAILURES=$((FAILURES+1)); return + fi + if ! grep -qF "$want_txt" <<<"$out"; then + echo " FAIL $name: exit code right but diagnostic wrong (rejected for the wrong reason)" + echo " wanted substring: $want_txt" + echo " got: $(tr '\n' '|' <<<"$out" | cut -c1-260)" + FAILURES=$((FAILURES+1)); return + fi + echo " ok $name" +} + +echo "=== selftest-scalar-statements: attacking check-scalar.sh Phase 3c ===" +build_driver + +# ── 1. Baseline: the untouched repository passes and reports what it bound. +expect "baseline green, statements bound" 0 "statements + reachable specification bodies bound" + +# ── 2. HAND-EDIT THE COMMITTED BLOCK. The digest still matches what Lean +# emits, so only the committed-copy comparison can see this. +cp "$HERE/SCALAR-AUDIT-MANIFEST.txt" "$STASH/manifest.bak" +sed -i '2s/$/ TAMPERED/' "$HERE/SCALAR-AUDIT-MANIFEST.txt" +expect "hand-edited committed block caught" 1 "does not match the emitted block" +cp "$STASH/manifest.bak" "$HERE/SCALAR-AUDIT-MANIFEST.txt" + +if [ "$SKIP_SLOW" = "1" ]; then + echo " SKIPPED (SKIP_SLOW=1): the two attacks this file exists for — gutted" + echo " statement and rewritten specification body — were NOT run. The fast" + echo " case above does not cover either of them." +else + # ── 3. ATTACK ONE: gut a certificate's STATEMENT, preserving its axiom cone. + # ScalarProofs.scalarImplementation is the aggregate and is TERMINAL — + # nothing outside its own module consumes it. Gutting a load-bearing + # certificate would simply break its consumers, which demonstrates the + # compiler working, not this gate. + cp "$HERE/Proofs/ScalarMain.lean" "$STASH/gut.lean" + python3 - "$HERE/Proofs/ScalarMain.lean" <<'PY' +import sys, re +f = sys.argv[1] +s = open(f).read() +m = re.search(r'^theorem scalarImplementation\b', s, re.M) +assert m, "scalarImplementation not found" +i = m.start() +nxt = re.search(r'^(theorem|lemma|def|noncomputable def|end|/--|@\[)', s[i+10:], re.M) +assert nxt, "no following declaration" +j = i + 10 + nxt.start() +# Same cone (Classical.em pulls in Classical.choice/propext), utterly different +# claim. Every earlier phase is satisfied; only the statement binding is not. +gut = "theorem scalarImplementation : (∀ p : Prop, p ∨ ¬p) := Classical.em\n\n" +open(f, "w").write(s[:i] + gut + s[j:]) +PY + recompile ScalarMain || { echo " FAIL setup: the gutted module did not compile"; FAILURES=$((FAILURES+1)); } + recompile ScalarAudit + expect "gutted statement caught (cone unchanged)" 1 "audit-manifest digest mismatch" + cp "$STASH/gut.lean" "$HERE/Proofs/ScalarMain.lean"; rm -f "$STASH/gut.lean" + recompile ScalarMain; recompile ScalarAudit + + # ── 4. ATTACK TWO: rewrite a REACHABLE SPECIFICATION BODY while the + # certificate's name and cone stay fixed. This is the attack the whole + # block exists for: if a reference definition can be edited without + # notice, a certificate can be made to say `loop = loop` and every cone + # stays byte-identical. + # + # scDenote is reachable from the scalar statements and its body is + # rewritten here to `id (…)`, which is DEFINITIONALLY EQUAL — so the + # corpus still compiles and every proof still typechecks. That is the + # point: the binding must be sensitive to the body AS WRITTEN, not + # merely to what it evaluates to. If the setup fails to compile this + # case reports FAIL rather than passing quietly. + cp "$HERE/Proofs/ScalarDenote.lean" "$STASH/den.lean" + python3 - "$HERE/Proofs/ScalarDenote.lean" <<'PY' +import sys +f = sys.argv[1] +s = open(f).read() +old = "def scDenote (a : Sc) : ZMod Ell := (scVal a : ZMod Ell)" +assert old in s, "scDenote body not in the expected form" +new = "def scDenote (a : Sc) : ZMod Ell := id (scVal a : ZMod Ell)" +open(f, "w").write(s.replace(old, new, 1)) +PY + if recompile ScalarDenote; then + recompile ScalarAudit + expect "rewritten specification body caught (name and cone unchanged)" 1 \ + "audit-manifest digest mismatch" + else + echo " FAIL setup: the rewritten specification body did not compile —" + echo " this attack did NOT exercise the gate. Do not read the" + echo " surrounding passes as covering it." + FAILURES=$((FAILURES+1)) + fi + cp "$STASH/den.lean" "$HERE/Proofs/ScalarDenote.lean"; rm -f "$STASH/den.lean" + recompile ScalarDenote; recompile ScalarAudit +fi + +# ── 5. Restored: green again, and the working tree is as we found it. +expect "restored to green" 0 "statements + reachable specification bodies bound" +TREE_NOW="$(cd "$HERE/.." && git status --porcelain)" +if [ "$TREE_AT_START" != "$TREE_NOW" ]; then + echo " FAIL restore: the working tree differs from how this test found it:" + diff <(printf '%s\n' "$TREE_AT_START") <(printf '%s\n' "$TREE_NOW") | sed 's/^/ /' + FAILURES=$((FAILURES+1)) +else + echo " ok working tree restored to its starting state" +fi + +echo "" +if [ "$FAILURES" -eq 0 ]; then + echo "SELFTEST PASSED — scalar Phase 3c rejects statement- and specification-" + echo "level tampering that moves no axiom cone, for the stated reason." + exit 0 +fi +echo "SELFTEST FAILED: $FAILURES check(s) did not behave as claimed." +exit 1