saymrwulf/dalek-ed25519-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/dalek-ed25519-verified.git synced 2026-09-04 20:24:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
dalek-ed25519-verified/verification/Proofs
History
mrwulf 7f166eee12 Phase 2, half-lift prerequisite: the hash-to-scalar entry is canonical 
(from_bytes_mod_order_wide_spec, kernel-audited)

Proofs/ScalarPackSpec.lean:
- scalar52_to_bytes_spec: Scalar52::to_bytes (the PACK step - pure
  bit-packing at radix 2^52, no reduction) serializes canonical limbs to
  exactly their value: bytesVal s = scVal a. Second application of the
  ToBytesSpec walk generator; boundary bytes 6 and 19 only (the two
  non-byte-aligned 52j offsets), disjoint ORs to additions as before.
- from_bytes_mod_order_wide_spec: the verifier's k = SHA-512-to-scalar
  entry composes from_bytes_wide_spec (the proven mod-l reduction) with
  the pack: for 64 input bytes of value T, the returned Scalar's 32
  bytes denote V with V < l and V = T (mod l) - precisely the scalar
  premises vartime_double_base_mul_spec consumes (V < l < 2^253).
- byte_split_52_4: the offset-4 chunk split for 52-bit limbs; the five
  ToBytesMath byte_split_* lemmas shed their unused 2^51 premises (pure
  telescopes, valid for all f).

Both certificates exact-standard-three. Full button green fresh.

Half-lift remaining (mapped in memory): dsm dispatch wrapper, recompute
bind-chain inversion, bytesVal injectivity, assembly in PointLiftSpec.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-05 14:10:09 +02:00
..
AddSpec.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
Basic.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
CompressSpec.lean Phase 2, brick 1 complete: ed_compress_spec - compress emits the canonical 2026-07-05 13:33:58 +02:00
ConstSpecs.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
Denote.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
DsmLoopSpec.lean Double-scalar-mul proof campaign, bricks 1-3: table, digit step, loop 2026-07-04 15:30:18 +02:00
DsmMulSpec.lean NAF encoder proven end-to-end + the phase-1 double-scalar-mul apex 2026-07-04 16:52:06 +02:00
DsmNafLoadSpec.lean NAF campaign stages 1-2: LE load walks + the digit loop's arithmetic core 2026-07-04 15:30:18 +02:00
DsmNafLoopSpec.lean NAF encoder proven end-to-end + the phase-1 double-scalar-mul apex 2026-07-04 16:52:06 +02:00
DsmNafMath.lean NAF campaign stages 1-2: LE load walks + the digit loop's arithmetic core 2026-07-04 15:30:18 +02:00
DsmNafSpec.lean NAF encoder proven end-to-end + the phase-1 double-scalar-mul apex 2026-07-04 16:52:06 +02:00
DsmStepSpec.lean Double-scalar-mul proof campaign, bricks 1-3: table, digit step, loop 2026-07-04 15:30:18 +02:00
DsmTableSpec.lean Double-scalar-mul proof campaign, bricks 1-3: table, digit step, loop 2026-07-04 15:30:18 +02:00
EdAddAffNiels.lean group-law layer: complete twisted Edwards addition law proven 2026-07-02 14:50:42 +02:00
EdAddProjNiels.lean group-law layer: complete twisted Edwards addition law proven 2026-07-02 14:50:42 +02:00
EdConvert.lean group-law layer: complete twisted Edwards addition law proven 2026-07-02 14:50:42 +02:00
EdCurve.lean group-law layer: complete twisted Edwards addition law proven 2026-07-02 14:50:42 +02:00
EdDenote.lean group-law layer: complete twisted Edwards addition law proven 2026-07-02 14:50:42 +02:00
EdDouble.lean group-law layer: complete twisted Edwards addition law proven 2026-07-02 14:50:42 +02:00
EdMain.lean group-law layer: complete twisted Edwards addition law proven 2026-07-02 14:50:42 +02:00
FeQ.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
Field.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
FieldMain.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
InvertSpec.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
MulSpec.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
P25519.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
ReduceSpec.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
ScalarAddSpec.lean Signature layer, first bricks: canonicity closure + hash-to-scalar foundation 2026-07-03 23:18:29 +02:00
ScalarBytesSpec.lean Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l 2026-07-04 10:31:32 +02:00
ScalarDenote.lean Merge scalar into CurveField; integrate the verify glue against the model 2026-07-04 18:13:58 +02:00
ScalarFromBytesSpec.lean Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l 2026-07-04 10:31:32 +02:00
ScalarFullMulSpec.lean Signature layer, first bricks: canonicity closure + hash-to-scalar foundation 2026-07-03 23:18:29 +02:00
ScalarLoop.lean scalar: generic loop-combinator lemmas (loop_step, range_next_lt/ge_spec) 2026-07-02 21:47:47 +02:00
ScalarMain.lean Signature layer, first bricks: canonicity closure + hash-to-scalar foundation 2026-07-03 23:18:29 +02:00
ScalarMontSpec.lean Signature layer, first bricks: canonicity closure + hash-to-scalar foundation 2026-07-03 23:18:29 +02:00
ScalarMulSpec.lean scalar layer: mul_internal proven — Montgomery frontier phase A down 2026-07-03 18:56:04 +02:00
ScalarPackSpec.lean Phase 2, half-lift prerequisite: the hash-to-scalar entry is canonical 2026-07-05 14:10:09 +02:00
ScalarReduceSpec.lean Signature layer, first bricks: canonicity closure + hash-to-scalar foundation 2026-07-03 23:18:29 +02:00
ScalarSubSpec.lean Signature layer, first bricks: canonicity closure + hash-to-scalar foundation 2026-07-03 23:18:29 +02:00
ScalarUnpackSpec.lean Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l 2026-07-04 10:31:32 +02:00
ScalarWideSpec.lean Signature layer, first bricks: canonicity closure + hash-to-scalar foundation 2026-07-03 23:18:29 +02:00
SigApexSpec.lean THE SIGNATURE APEX: the EdDSA verification equation, proven and audited 2026-07-04 19:45:55 +02:00
Square2Spec.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
SquareSpec.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
SubNegSpec.lean field layer: 14 proofs pass, fieldImplementation axiom-clean 2026-07-02 14:17:44 +02:00
ToBytesMath.lean Phase 2, half-lift prerequisite: the hash-to-scalar entry is canonical 2026-07-05 14:10:09 +02:00
ToBytesSpec.lean Phase 2, brick 1a: to_bytes canonicity proven (to_bytes_spec, kernel-audited) 2026-07-05 13:10:43 +02:00