mirror of
https://github.com/saymrwulf/dalek-ed25519-verified.git
synced 2026-09-04 20:24:12 +00:00
mrwulf
32d3c05495
(kernel-audited) - fe_cond_assign_spec: the per-limb constant-time selection on field elements (real extracted code: five index_mut rounds over the u64 select) keeps self iff the choice is 0 - the operation sqrt_ratio_i uses for both the root flip and the sign normalization. Walked with backfun-rewrite hygiene; the u64 model lemma restated locally (Proofs.Basic is a parallel root that clashes with ConstSpecs). - sqrt_core: THE ALGEBRAIC HEART - for square u/v (witness x, v nonzero) the candidate r = (u*v^3)*(u*v^7)^((p-5)/8) satisfies v*r^2 = +/-u. The v-part of the exponent collapses by Fermat (8*(2^253-5) = 2(p-1)); the residual x^((p-1)/2) is +/-1 by factoring its square. Exponent bookkeeping: (p-5)/8 = 2^252-3, (p-1)/2 = 2^254-10, all closed by norm_num after pow_mul merges. Both certificates exact standard three. Full button green fresh. Remaining: the sqrt_ratio_i walk composing these, from_bytes, decompress_of_canonical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| gen | ||
| Proofs | ||
| check-scalar.sh | ||
| check.sh | ||
| CurveField.llbc | ||
| CurveSig.llbc | ||
| extract.sh | ||
| lean-guard | ||