saymrwulf/fips205-slhdsa-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/fips205-slhdsa-verified.git synced 2026-09-03 19:53:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
fips205-slhdsa-verified/verification/RECORDED-RUN.md
mrwulf 522d8b2092 review round 2: in-Lean exact-cone audit + reproducibility + doc honesty 
Addresses the round-2 reviewer punch-list. No theorem statement, proof term,
or fold definition changed; the eleven cones are unchanged (independent
collectAxioms dump in verification/RECORDED-RUN.md).

AUDIT GATE (both reviewers, the critical one)
- Retire the bash #print-axioms text parser (fail-open on empty/truncated
  reports, and only a SUBSET check). Replace with verification/Proofs/Audit.lean:
  reads each certificate's cone from the kernel via collectAxioms and asserts
  EXACT set equality against its expected boundary. Extra axiom, dropped
  oracle, renamed/deleted cert, or an axiom/opaque sham each throw -> non-zero
  Lean exit. No text to misparse; nothing fails open. check.sh Phase 3 now just
  compiles it (and still requires the explicit PASSED line).
- check-selftest.sh rewritten to attack the new gate: dead-file, smuggled extra
  axiom (named), dropped-oracle (subset would pass, exact must not), and a
  vanished certificate (the collectAxioms-returns-[] trap). All four rejected.

REPRODUCIBILITY (GPT B1.4 / B1.5)
- extract.sh refuses a wrong-commit or dirty source tree (fail-closed), takes
  an optional source-path arg, and pins the source commit.
- verification/PROVENANCE.json: single machine-readable pin set (source +
  charon + aeneas commits/channel + lean + ocaml) with generated-file sha256.
- Re-running extract.sh reproduces gen/SlhVerify/{Types,Funs}.lean
  byte-identically (companion fips205-source commit adds Cargo.lock +
  rust-toolchain.toml; verified not to perturb the model).

DOC HONESTY (both reviewers)
- README: fix the self-contradiction (apex "not yet proven" trailer vs the
  proven apex), the false "oracles kept OUTSIDE every cone" (they are INSIDE,
  by design), "deployed monomorphic path" and "semantics-identical for every
  parameter set" overclaims, "only two lines changed", stale snapshot head;
  retitle the stale future-tense "what will be claimed" section.
- TRUSTED-BASE: drop "nothing proven yet"; add base_2b-inner and deployment-
  bridge non-claims explicitly; current pin.
- ChainSpec header: "deployed monomorphic path" -> private verify_mono facade
  (comment only).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-24 19:13:55 +02:00

2.8 KiB
Raw Blame History

Recorded clean run — check.sh + independent cone dump

External review round 2 asked for a recorded clean run at the current pin by a party with the toolchain, so a reviewer who cannot run Lean has current evidence. Captured 2026-07-24. Pins are in PROVENANCE.json. The cone dump below is an independent collectAxioms read (not the asserted table in Proofs/Audit.lean); it matches each certificate's expected boundary.

RECORDED CLEAN RUN — fips205-slhdsa-verified
date(UTC): 20260724T171145Z
host lean: Lean (version 4.30.0-rc2, x86_64-unknown-linux-gnu, commit 3dc1a088b6d2d8eafe25a7cd7ec7b58d731bd7cc, Release)
source pin: 797b4ef26338e27363683656f93cb065a77daa0e
==============================================
fips205-slhdsa-verified — check
===============================
=== Phase 1: compile the extracted model ===
  · gen/SlhVerify/TypesExternal
  · gen/SlhVerify/Types
  · gen/SlhVerify/FunsExternal
  · gen/SlhVerify/Funs
=== Phase 2: compile the proofs ===
  · ChainSpec
  · WotsSpec
  · XmssSpec
  · HtSpec
  · ForsInnerSpec
  · ForsOuterSpec
  · InputPrepSpec
  · ApexSpec
=== Phase 3: axiom audit (exact cone per certificate — inside Lean) ===
  ✓ exact-cone audit PASSED: each of the 11 certificate cones == its expected boundary set

ALL GREEN — model compiles, proofs compile, and every certificate cone
equals EXACTLY the three kernel axioms plus its documented SHA-2 oracles.
Certificates proven: fips205.chain_free_loop_eq fips205.wots_loop1_eq fips205.xmss_loop_eq fips205.ht_loop_eq fips205.fors_inner_loop_eq fips205.fors_outer_loop_eq fips205.to_int_loop_eq fips205.to_byte_loop_eq fips205.wots_csum_loop_eq fips205.base2b_outer_loop_eq fips205.slh_verify_128s_accepts_iff

=== INDEPENDENT cone dump (collectAxioms, 20260724T171253Z) ===
fips205.chain_free_loop_eq :: propext, Classical.choice, Quot.sound, verify_mono.oracle.f
fips205.wots_loop1_eq :: propext, Classical.choice, Quot.sound, verify_mono.oracle.f
fips205.xmss_loop_eq :: propext, Classical.choice, Quot.sound, verify_mono.oracle.h
fips205.ht_loop_eq :: propext, Classical.choice, Quot.sound, verify_mono.oracle.f, verify_mono.oracle.h, verify_mono.oracle.t_l
fips205.fors_inner_loop_eq :: propext, Classical.choice, Quot.sound, verify_mono.oracle.h
fips205.fors_outer_loop_eq :: propext, Classical.choice, Quot.sound, verify_mono.oracle.f, verify_mono.oracle.h
fips205.to_int_loop_eq :: propext, Classical.choice, Quot.sound
fips205.to_byte_loop_eq :: propext, Classical.choice, Quot.sound
fips205.wots_csum_loop_eq :: propext, Classical.choice, Quot.sound
fips205.base2b_outer_loop_eq :: propext, Classical.choice, Quot.sound
fips205.slh_verify_128s_accepts_iff :: propext, Classical.choice, Quot.sound, verify_mono.oracle.f, verify_mono.oracle.h, verify_mono.oracle.h_msg, verify_mono.oracle.t_l, verify_mono.oracle.t_len