mirror of
https://github.com/saymrwulf/dalek-ed25519-verified.git
synced 2026-09-04 20:24:12 +00:00
mrwulf
480e5538be
(from_bytes_mod_order_wide_spec, kernel-audited) Proofs/ScalarPackSpec.lean: - scalar52_to_bytes_spec: Scalar52::to_bytes (the PACK step - pure bit-packing at radix 2^52, no reduction) serializes canonical limbs to exactly their value: bytesVal s = scVal a. Second application of the ToBytesSpec walk generator; boundary bytes 6 and 19 only (the two non-byte-aligned 52j offsets), disjoint ORs to additions as before. - from_bytes_mod_order_wide_spec: the verifier's k = SHA-512-to-scalar entry composes from_bytes_wide_spec (the proven mod-l reduction) with the pack: for 64 input bytes of value T, the returned Scalar's 32 bytes denote V with V < l and V = T (mod l) - precisely the scalar premises vartime_double_base_mul_spec consumes (V < l < 2^253). - byte_split_52_4: the offset-4 chunk split for 52-bit limbs; the five ToBytesMath byte_split_* lemmas shed their unused 2^51 premises (pure telescopes, valid for all f). Both certificates exact-standard-three. Full button green fresh. Half-lift remaining (mapped in memory): dsm dispatch wrapper, recompute bind-chain inversion, bytesVal injectivity, assembly in PointLiftSpec. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| gen | ||
| Proofs | ||
| check-scalar.sh | ||
| check.sh | ||
| CurveField.llbc | ||
| CurveSig.llbc | ||
| extract.sh | ||
| lean-guard | ||