mirror of
https://github.com/saymrwulf/fips205-slhdsa-verified.git
synced 2026-09-03 19:53:49 +00:00
mrwulf
476f669f5c
The companion fips205-source commit adds NIST ACVP SHA2-128s verification vectors and a real differential bridge. This repo re-pins to it and replaces the word "finite" with numbers, per external review rounds 4-6. - extract.sh + PROVENANCE re-pinned 797b4ef -> 3153988. The provenance guard did its job first: it REFUSED the moved source until the pin was rotated deliberately. - VERIFIED that the test/vector commit does not perturb the proved model: after re-extraction all four pinned model files are byte-identical (Types db720b4a…, Funs 7b7de55f…, TypesExternal 37958beb…, FunsExternal 5efe551c…), check.sh is ALL GREEN, and the audit digest is unchanged (d83e297a…). The only regenerated difference is the untracked Aeneas *_Template.lean byproduct, which Phase 0 purges. - TRUSTED-BASE item 9 and the README now state the bridge's actual size: 131 assertion points (was 9), of which 20 are NIST ACVP SHA2-128s known-answer tests run against the proved path — 10 from the `internal` group (whose message IS M', exactly what slh_verify_128s consumes) and 10 from `external pure` where mono, the deployed verifier and NIST must all agree, 9 of those with a NON-EMPTY context, which is the first empirical check of the domain-separator byte and context prefix that item 10 declares outside every proof. Both documents keep saying plainly that a passing differential test is evidence, not a proof. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
81 lines
4.1 KiB
Bash
Executable file
81 lines
4.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Regenerate the Lean model in gen/ from the pinned fips205 snapshot.
|
|
#
|
|
# SCOPE: the SLH-DSA verify path, parameter set SLH-DSA-SHA2-128s
|
|
# roots: slh_verify(_internal), fors_pk_from_sig, ht_verify,
|
|
# xmss_pk_from_sig, wots_pk_from_sig, chain
|
|
# (sign/keygen are out of scope; the five verify-path hash oracles
|
|
# (h_msg, f, h, t_l, t_len) are opaque — see TRUSTED-BASE.md.)
|
|
#
|
|
# Rust --charon--> SlhVerify.llbc --aeneas--> gen/SlhVerify/*.lean
|
|
#
|
|
# REPRODUCIBILITY (external review round 2, 2026-07-24): this script now
|
|
# REFUSES to extract from a source tree that is not at the pinned commit or
|
|
# is dirty (a wrong/uncommitted source would silently produce a different
|
|
# model). The full pin set (source + charon + aeneas + lean + ocaml) is in
|
|
# verification/PROVENANCE.json; re-running this against the pinned tree
|
|
# reproduces gen/SlhVerify/{Types,Funs}.lean byte-identically.
|
|
#
|
|
# HISTORY (gate-0 finding, resolved 2026-07-22): upstream models the hash
|
|
# family as `crate::hashers::Hashers`, a struct of plain function pointers,
|
|
# which Aeneas cannot translate. The compat patch in fips205-source provides
|
|
# the additive monomorphic verify_mono module whose hash suite is reached
|
|
# through named free functions — this script roots there.
|
|
#
|
|
# Usage: ./extract.sh [PATH_TO_fips205-source]
|
|
# (default: ~/GitClone/FormalVerification/sources/fips205-source)
|
|
# Override the required commit only for a deliberate re-pin:
|
|
# EXPECTED_SRC_COMMIT=<full-sha> ./extract.sh [PATH]
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
CRATE="${1:-$HOME/GitClone/FormalVerification/sources/fips205-source}"
|
|
|
|
# The pinned source commit this repo's model + proofs were verified against.
|
|
# Keep in lockstep with verification/PROVENANCE.json and the README snapshot.
|
|
EXPECTED_SRC_COMMIT="${EXPECTED_SRC_COMMIT:-3153988c4e89df66c41e698329f2ae5460880875}"
|
|
|
|
# ── Provenance guard: refuse a wrong or dirty source tree (fail-closed) ──────
|
|
[ -d "$CRATE/.git" ] || { echo "ERROR: '$CRATE' is not a git checkout of fips205-source." >&2; exit 2; }
|
|
GOT_COMMIT="$(git -C "$CRATE" rev-parse HEAD)"
|
|
if [ "$GOT_COMMIT" != "$EXPECTED_SRC_COMMIT" ]; then
|
|
echo "ERROR: source is at ${GOT_COMMIT:0:12}, but this repo is pinned to" >&2
|
|
echo " ${EXPECTED_SRC_COMMIT:0:12}. Check out the pin, or set" >&2
|
|
echo " EXPECTED_SRC_COMMIT=<sha> for a deliberate re-pin." >&2
|
|
exit 3
|
|
fi
|
|
if [ -n "$(git -C "$CRATE" status --porcelain)" ]; then
|
|
echo "ERROR: source tree at '$CRATE' is dirty. Extraction must run against" >&2
|
|
echo " a clean, committed tree so the model is reproducible." >&2
|
|
git -C "$CRATE" status --porcelain | sed 's/^/ /' >&2
|
|
exit 4
|
|
fi
|
|
echo "[0/2] provenance OK: fips205-source @ ${EXPECTED_SRC_COMMIT:0:12} (clean)"
|
|
|
|
# Toolchain env is sourced only AFTER the provenance guard, so a party without
|
|
# the aeneas toolchain still gets the clean exit-2/3/4 diagnostics above
|
|
# (round-3 reviewer nit, 2026-07-24).
|
|
source ~/aeneas-toolchain/env.sh
|
|
|
|
echo "[1/2] charon: Rust -> LLBC (monomorphic SHA2-128s verify cone;"
|
|
echo " crate::verify_mono::oracle is the opaque SHA-2 boundary)"
|
|
cd "$CRATE"
|
|
# Single extraction root: the monomorphic entry. The five hash primitives
|
|
# are reached through crate::verify_mono::oracle, marked opaque here — this
|
|
# is the deliberate SHA-2 trust boundary (documented in TRUSTED-BASE.md).
|
|
# The generic Hashers fn-pointer path is NOT in this cone by construction.
|
|
charon cargo --preset=aeneas \
|
|
--start-from 'crate::verify_mono::slh_verify_128s' \
|
|
--opaque 'crate::verify_mono::oracle' \
|
|
--opaque 'sha2' --opaque 'sha3' --opaque 'zeroize' --opaque 'rand_core' \
|
|
--hide-marker-traits \
|
|
--dest-file "$HERE/SlhVerify.llbc" \
|
|
-- --no-default-features --features slh_dsa_sha2_128s
|
|
|
|
echo "[2/2] aeneas: LLBC -> Lean (split files, SlhVerify.* modules;"
|
|
echo " hand-maintained TypesExternal.lean / FunsExternal.lean are"
|
|
echo " NOT overwritten once they exist)"
|
|
cd "$HERE"
|
|
aeneas -backend lean -split-files -subdir SlhVerify -dest gen SlhVerify.llbc
|
|
|
|
echo "Done. Now run ./check.sh (Phase 1: the regenerated model must type-check)."
|