mirror of
https://github.com/saymrwulf/dalek-ed25519-verified.git
synced 2026-09-04 20:24:12 +00:00
mrwulf
5faaa3226a
Phase B - montgomery_reduce (Proofs/ScalarMontSpec.lean + Proofs/ScalarReduceSpec.lean): - mont_key: LFACTOR*L0 + 1 = 214835089243030*2^52 (the -1 inverse identity, norm_num) - mont_cancel: (s + ((s*LFACTOR) % 2^52)*L0) % 2^52 = 0 via Nat.ModEq - every part1 shift is an EXACT division, nothing discarded - part1_spec / part2_spec: per-round helpers (carry*2^52 = sum + p*L0; exact split) - mont_head_telescope (E0-E4) and mont_tail_telescope (E5-E8): linear_combination certificates with weights 2^52k; mont_bound: X' < 2*ell from Z < 2^260*ell - montgomery_reduce_spec: post `scDenote r * 2^260 = Z` in ZMod ell + 52-bit bounds. METHOD-4 split at the round-4/5 boundary: the 74-step monolith is elaboration-pathological; each half compiles in ~25s/3GB. - The single death-spiral line: an omega for the nonce-sum bound with ~110 hypotheses in context never returns; extracted to nonce_sum_bound (5 hypotheses, instant). Bisected with fail-probes; documented in control-repo FAILURES.md. Phase C - mul (Proofs/ScalarFullMulSpec.lean): - RR_limbs/RR_scVal/RR_lt; RR_denote: RR = 2^520 - K*ell kernel-checked, so ⟦RR⟧ = R^2; R_isUnit: 2^260 unit of ZMod ell (coprime oddness witness) - mul_spec: mul_internal -> montgomery_reduce -> mul_internal(*, RR) -> montgomery_reduce composed; column values folded by `ring`; R cancelled via IsUnit.mul_right_cancel. Hypothesis scVal a * scVal b < 2^260*ell (honest Montgomery bound; canonical inputs satisfy it). Aggregate (Proofs/ScalarMain.lean): scalar_add/sub/mul_correct on ScBnd interfaces + canonical_mul_bound + scalarImplementation bundling all three. sub_val_spec/add_val_spec posts strengthened with result-limb 52-bit bounds (the montgomery tail feeds sub's output back into mul_internal). check-scalar.sh: 9 proof files, 10 kernel audits (was 6), all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green. |
||
|---|---|---|
| .. | ||
| gen | ||
| Proofs | ||
| check-scalar.sh | ||
| check.sh | ||
| CurveField.llbc | ||
| CurveScalar.llbc | ||
| extract-scalar.sh | ||
| extract.sh | ||
| lean-guard | ||