mirror of
https://github.com/saymrwulf/fips205-slhdsa-verified.git
synced 2026-09-03 19:53:49 +00:00
mrwulf
2e48d9c6d0
fips205.slh_verify_128s_accepts_iff (Proofs/ApexSpec.lean): the extracted
top-level SLH-DSA-SHA2-128s verifier returns `ok true` if and only if the
recomputed hypertree root byte-equals the pinned public-key root pk.pk_root.
There is NO acceptance path other than root equality.
slh_verify_128s mprime sig pk
= (do let root ← slhVerifyRoot 63 30 mprime sig pk
ok (decide (root.val = pk.pk_root.val)))
where slhVerifyRoot is byte-for-byte the extracted slh_verify_internal_free
pipeline (H_msg digest -> md/idx_tree/idx_leaf split via to_int + masks ->
fors_pk_from_sig -> hypertree recompute over xmss over wots over chain), with
only the final ht_verify_free comparison factored out.
#print axioms cone = EXACTLY [propext, Classical.choice, Quot.sound,
verify_mono.oracle.{f, h, h_msg, t_l, t_len}] — the three kernel axioms plus
PRECISELY the five SHA-2 hash oracles, and nothing else. No plumbing, no
transpiler artifacts. This is the boundary the whole campaign targeted: the
deployed verify path is machine-checked down to five named hash functions.
Structure:
- arrayEqU8_spec: the library array equality PartialEqArray.eq on two
Array U8 N returns exactly the decidable byte-equality of their lists (a
List.allM induction; the one real lemma). This is what makes "accepts" mean
"root byte-equals pk_root" explicitly, in the spirit of the ed25519
verify_accepts_iff.
- ht_verify_free_split: ht_verify_free = htVerifyRoot >>= (byte-compare to
pk_root), via arrayEqU8_spec on the tail; bind_congr threads the setup.
- slh_verify_internal_accepts_iff (generic, all param sets) + the 128s
corollary: unfold the internal, rewrite the ht tail with the split, flatten
with bind_assoc; both sides become the identical do-block (simp closes
structurally — no whnf of the nested ht_verify_free_loop, the ForsOuter
lesson).
Honest scope: the apex is an ACCEPTANCE characterization — it pins that the
top-level accept is exactly root equality over the extracted recomputation,
whose every loop is individually fidelity-certified by the ten preceding
theorems (chain/wots/xmss/ht/fors/input-prep). It does NOT re-derive the
recomputation as a closed-form mathematical hypertree value; that composition
of all ten fold-fidelity theorems into one expression is a further step, not
claimed here. The security-relevant statement — an accepted signature means
the verifier recomputed a root matching the pinned key, down to five hash
oracles — is exactly what is proven.
check.sh: PROOFS += ApexSpec; CERTS += fips205.slh_verify_128s_accepts_iff;
audit imports it. Green over ALL ELEVEN certificates at default caps.
The verify-path proof pyramid is COMPLETE. What remains before any LTL
attestation is operator-gated and NOT started (the big halt): the pacta
allowed-cone table entry + the append ceremony with the operator signing key.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
113 lines
5 KiB
Bash
Executable file
113 lines
5 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# The one-button claim for this repository (rigor invariant R3).
|
|
# Green output == the full claim. This script is the ONLY source of the
|
|
# word "proven" for this repo.
|
|
#
|
|
# Phase 1 — compile the extracted Lean model (gen/SlhVerify).
|
|
# Phase 2 — compile the proof files (Proofs/).
|
|
# Phase 3 — axiom audit: every certificate's #print axioms cone must be a
|
|
# subset of {propext, Classical.choice, Quot.sound} plus the five
|
|
# SHA-2 hash oracles (the documented boundary) — nothing else.
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
source ~/aeneas-toolchain/env.sh
|
|
AENEAS_LEAN="$AENEAS_HOME/backends/lean"
|
|
TIMEOUT="${LEAN_TIMEOUT:-400}"
|
|
MEM="${LEAN_MEM_MB:-4096}"
|
|
|
|
GEN_MODULES=(
|
|
"SlhVerify/TypesExternal"
|
|
"SlhVerify/Types"
|
|
"SlhVerify/FunsExternal"
|
|
"SlhVerify/Funs"
|
|
)
|
|
# Proof files, in dependency order.
|
|
PROOFS=(
|
|
"ChainSpec"
|
|
"WotsSpec"
|
|
"XmssSpec"
|
|
"HtSpec"
|
|
"ForsInnerSpec"
|
|
"ForsOuterSpec"
|
|
"InputPrepSpec"
|
|
"ApexSpec"
|
|
)
|
|
# Certificates whose axiom cones are audited, and the allowed extras beyond
|
|
# the three kernel axioms: the five SHA-2 verify-path oracles. A certificate
|
|
# is listed here only once it is genuinely proven.
|
|
CERTS=(
|
|
"fips205.chain_free_loop_eq"
|
|
"fips205.wots_loop1_eq"
|
|
"fips205.xmss_loop_eq"
|
|
"fips205.ht_loop_eq"
|
|
"fips205.fors_inner_loop_eq"
|
|
"fips205.fors_outer_loop_eq"
|
|
"fips205.to_int_loop_eq"
|
|
"fips205.to_byte_loop_eq"
|
|
"fips205.wots_csum_loop_eq"
|
|
"fips205.base2b_outer_loop_eq"
|
|
"fips205.slh_verify_128s_accepts_iff"
|
|
)
|
|
ORACLES="verify_mono.oracle.f, verify_mono.oracle.h, verify_mono.oracle.t_l, verify_mono.oracle.t_len, verify_mono.oracle.h_msg"
|
|
ALLOWED="[propext, Classical.choice, Quot.sound, ${ORACLES}]"
|
|
|
|
echo "fips205-slhdsa-verified — check"
|
|
echo "==============================="
|
|
|
|
# ── Phase 1: model ──────────────────────────────────────────────────────────
|
|
echo "=== Phase 1: compile the extracted model ==="
|
|
cd "$AENEAS_LEAN"
|
|
lake env bash -c "
|
|
set -euo pipefail
|
|
cd '$HERE' && export LEAN_PATH=\"\$LEAN_PATH:\$PWD/gen:\$PWD\"
|
|
compile() { echo \" · \$1\"; LEAN_TIMEOUT=$TIMEOUT LEAN_MEM_MB=$MEM '$HERE/lean-guard' \"\${1}.lean\" >/dev/null || { echo \"FAIL: \$1\"; exit 1; }; }
|
|
for m in ${GEN_MODULES[*]}; do compile \"gen/\$m\"; done
|
|
"
|
|
|
|
# ── Phase 2: proofs ─────────────────────────────────────────────────────────
|
|
echo "=== Phase 2: compile the proofs ==="
|
|
cd "$AENEAS_LEAN"
|
|
lake env bash -c "
|
|
set -euo pipefail
|
|
cd '$HERE' && export LEAN_PATH=\"\$LEAN_PATH:\$PWD/gen:\$PWD\"
|
|
compile() { echo \" · \$1\"; LEAN_TIMEOUT=$TIMEOUT LEAN_MEM_MB=$MEM '$HERE/lean-guard' \"Proofs/\${1}.lean\" >/dev/null || { echo \"FAIL: Proofs/\$1\"; exit 1; }; }
|
|
for m in ${PROOFS[*]}; do compile \"\$m\"; done
|
|
# no dead proof files: everything under Proofs/ must be in the manifest
|
|
for f in Proofs/*.lean; do b=\$(basename \"\$f\" .lean)
|
|
case \" ${PROOFS[*]} \" in *\" \$b \"*) ;; *) echo \"DEAD FILE: Proofs/\$b.lean not in manifest\"; exit 1 ;; esac
|
|
done
|
|
"
|
|
|
|
# ── Phase 3: axiom audit ────────────────────────────────────────────────────
|
|
echo "=== Phase 3: axiom audit (cone ⊆ kernel-3 + 5 oracles) ==="
|
|
cd "$AENEAS_LEAN"
|
|
AUD="$HERE/Proofs/.audit.lean"
|
|
{ echo "import Proofs.ChainSpec"; echo "import Proofs.WotsSpec"
|
|
echo "import Proofs.XmssSpec"; echo "import Proofs.HtSpec"
|
|
echo "import Proofs.ForsInnerSpec"; echo "import Proofs.ForsOuterSpec"; echo "import Proofs.InputPrepSpec"; echo "import Proofs.ApexSpec"
|
|
for c in "${CERTS[@]}"; do echo "#print axioms $c"; done
|
|
} > "$AUD"
|
|
OUT=$(lake env bash -c "cd '$HERE' && export LEAN_PATH=\"\$LEAN_PATH:\$PWD/gen:\$PWD\" && LEAN_TIMEOUT=$TIMEOUT LEAN_MEM_MB=$MEM '$HERE/lean-guard' 'Proofs/.audit.lean'" 2>&1)
|
|
rm -f "$AUD"
|
|
fail=0
|
|
for c in "${CERTS[@]}"; do
|
|
line=$(echo "$OUT" | grep -F "'$c' depends on axioms:" || true)
|
|
if [ -z "$line" ]; then echo " ✗ $c — no axiom report"; fail=1; continue; fi
|
|
cone=$(echo "$line" | sed "s/.*depends on axioms: //")
|
|
# every axiom in the cone must be in ALLOWED
|
|
bad=$(echo "$cone" | tr -d '[]' | tr ',' '\n' | sed 's/^ *//;s/ *$//' | while read -r ax; do
|
|
[ -z "$ax" ] && continue
|
|
case " propext Classical.choice Quot.sound verify_mono.oracle.f verify_mono.oracle.h verify_mono.oracle.t_l verify_mono.oracle.t_len verify_mono.oracle.h_msg " in
|
|
*" $ax "*) ;; *) echo "$ax" ;;
|
|
esac
|
|
done)
|
|
if [ -n "$bad" ]; then echo " ✗ $c — DISALLOWED axioms: $bad"; fail=1
|
|
else echo " ✓ $c cone ⊆ allowed"; fi
|
|
done
|
|
[ "$fail" = 0 ] || { echo "AXIOM AUDIT FAILED"; exit 1; }
|
|
|
|
echo
|
|
echo "ALL GREEN — model compiles, proofs compile, every certificate cone is"
|
|
echo "the three kernel axioms plus (at most) the SHA-2 hash oracles."
|
|
echo "Certificates proven: ${CERTS[*]}"
|