saymrwulf/fips205-slhdsa-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/fips205-slhdsa-verified.git synced 2026-09-03 19:53:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
fips205-slhdsa-verified/verification/SlhVerify.llbc

1 line
1.6 MiB
Text
Raw Normal View History

llbc: commit the artifact the claim depended on, and verify the pin block Round-9 review (GPT-5.6, R9-F2, BLOCKER). TRUSTED-BASE said: "The .llbc is committed, so the SECOND step can be re-run by anyone with the pinned Aeneas and this repository" .gitignore excluded it. `git ls-files` had no LLBC. The file existed only on the author's disk. I ran `ls`, saw it, and wrote the claim without running `git ls-files` — so a sentence that reads as an independent-reproducibility guarantee was true for exactly one person. The experiment itself was real: re-running Aeneas on that LLBC did reproduce Types.lean and Funs.lean byte-identically. What was false is that anyone else could repeat it. CHASING IT FOUND WORSE. `generated_artifacts_sha256` was read by NOTHING — check.sh had zero references to it. Its Types.lean and Funs.lean entries matched only because those files are ALSO pinned in model_integrity_sha256, which is checked. The .llbc entry, the one nothing else covered, had been stale since review round 2 (522d8b2): the source was re-extracted on 2026-07-28, the model files and their pins were updated, and this pin was not. It named d8ec0b00…, an artifact that did NOT produce the committed model. The file that did is 69666ddc… — timestamped nine seconds before Types.lean and Funs.lean, and demonstrably regenerating them byte-for-byte. A pin nothing verifies drifts, and nobody notices. That is the finding, and it is a sharper instance of the pattern than the one the reviewer reported. · .gitignore no longer excludes SlhVerify.llbc; it is committed (1.6 MB) · its pin corrected to the artifact that actually produced the model · check.sh Phase 0 now verifies generated_artifacts_sha256, so the block stops being decorative. Negative-tested: one appended byte gives `✗ SlhVerify.llbc: sha256 dd5925770bc7 ≠ pinned 69666ddc43a4`, exit 1 · TRUSTED-BASE item 3 rewritten. It now says what committing the LLBC does and does NOT buy: the Lean model is the faithful Aeneas image of THAT intermediate, and whether the intermediate is the faithful Charon image of fips205-source@a3ce8e8 rests on the author alone. Verifying the committed LLBC against itself establishes nothing about Charon. "Do not read the second half as evidence for the first." · README qualified AT THE CLAIM SITE, not via a later link Button green after every edit; accounting still closes at 300 with no residual. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-08-03 18:36:19 +00:00
{"charon_version":"0.1.212","translated":{"crate_name":"fips205","options":{"ullbc":false,"precise_drops":false,"skip_borrowck":false,"mir":null,"rustc_args":[],"targets":[],"monomorphize":false,"monomorphize_mut":null,"start_from":["crate::verify_mono::slh_verify_128s"],"start_from_if_exists":[],"start_from_attribute":null,"start_from_pub":false,"include":[],"opaque":["crate::verify_mono::oracle","sha2","sha3","zeroize","rand_core"],"exclude":[],"extract_opaque_bodies":false,"translate_all_methods":false,"duplicate_defaulted_methods":true,"lift_associated_types":["*"],"hide_marker_traits":true,"remove_adt_clauses":true,"hide_allocator":true,"remove_unused_self_clauses":true,"desugar_drops":false,"ops_to_function_calls":true,"index_to_function_calls":true,"treat_box_as_builtin":true,"raw_consts":false,"unsized_strings":false,"reconstruct_fallible_operations":true,"reconstruct_asserts":true,"unbind_item_vars":true,"print_original_ullbc":false,"print_ullbc":false,"print_built_llbc":false,"print_llbc":false,"dest_dir":null,"dest_file":"/home/oho/GitClone/Claude/FormalVerification/fips205-slhdsa-verified/verification/SlhVerify.llbc","no_dedup_serialized_ast":false,"format":null,"no_serialize":false,"no_typecheck":false,"no_normalize":false,"abort_on_error":false,"error_on_warnings":false,"preset":"Aeneas"},"target_information":[{"key":"x86_64-unknown-linux-gnu","value":{"target_pointer_size":8,"is_little_endian":true}}],"files":[{"id":0,"name":{"Local":"src/verify_mono.rs"},"crate_name":"fips205","contents":"// verify_mono.rs — Aeneas-compat monomorphic SLH-DSA verify path (SHA2-128s).\n//\n// WHY THIS FILE EXISTS (formal-verification campaign, additive & inert):\n// The generic verify path threads the six hash primitives through\n// `crate::hashers::Hashers`, a struct of `fn(...)` POINTERS. The Aeneas\n// transpiler (Rust -> Lean 4) cannot translate function-pointer values, so\n// the generic path is not directly extractable. This module reproduces the\n// verify cone with:\n// (1) the hash suite reached through NAMED free functions in `oracle`\n// (marked opaque at the Charon boundary — the deliberate SHA-2\n// trust boundary of the proof), instead of fn-pointer dereferences;\n// (2) a monomorphic entry point `slh_verify_128s` fixing the SLH-DSA-\n// SHA2-128s constants.\n// The const-generic function bodies are otherwise copied VERBATIM from\n// wots.rs / xmss.rs / hypertree.rs / fors.rs / slh.rs so the extracted Lean\n// model is faithful to the deployed algorithm. Nothing here changes the\n// generic code: all twelve parameter sets are untouched, and this module is\n// compiled only when the `slh_dsa_sha2_128s` feature is enabled. The unit\n// test at the bottom pins fidelity by pitting this path against the\n// deployed `Verifier::verify` on freshly generated signatures.\n//\n// This is the exact pattern used for the ed25519 verify glue\n// (curve25519-dalek-source: monomorphic `verify_sha512` calling opaque\n// `sha512_*` wrappers).\n\n#![cfg(feature = \"slh_dsa_sha2_128s\")]\n#![allow(clippy::similar_names)]\n// This module is a campaign extraction root and is exercised by its own\n// differential unit test; it is intentionally not called from the library's\n// public API, so `dead_code` (measured from that API) does not apply.\n#![allow(dead_code)]\n\nuse crate::helpers::{base_2b, to_byte, to_int};\nuse crate::types::{\n Adrs, ForsPk, ForsSig, HtSig, SlhDsaSig, SlhPublicKey, WotsPk, WotsSig, XmssSig, FORS_ROOTS,\n FORS_TREE, TREE, WOTS_HASH, WOTS_PK,\n};\n\n// ---------------------------------------------------------------------------\n// oracle — the SHA-2 boundary, reached by name (Charon marks this module\n// opaque; Aeneas emits these as opaque axioms in the Lean external model).\n// Each is exactly the corresponding `sha2_cat_1` primitive; behavioural\n// identity is what the differential test below checks.\n// ---------------------------------------------------------------------------\npub(crate) mod oracle {\n use crate::types::Adrs;\n\n #[inline(never)]\n pub(crate
Reference in a new issue Copy permalink