mirror of
https://github.com/saymrwulf/fips205-slhdsa-verified.git
synced 2026-09-04 20:03:44 +00:00
mrwulf
522d8b2092
Addresses the round-2 reviewer punch-list. No theorem statement, proof term,
or fold definition changed; the eleven cones are unchanged (independent
collectAxioms dump in verification/RECORDED-RUN.md).
AUDIT GATE (both reviewers, the critical one)
- Retire the bash #print-axioms text parser (fail-open on empty/truncated
reports, and only a SUBSET check). Replace with verification/Proofs/Audit.lean:
reads each certificate's cone from the kernel via collectAxioms and asserts
EXACT set equality against its expected boundary. Extra axiom, dropped
oracle, renamed/deleted cert, or an axiom/opaque sham each throw -> non-zero
Lean exit. No text to misparse; nothing fails open. check.sh Phase 3 now just
compiles it (and still requires the explicit PASSED line).
- check-selftest.sh rewritten to attack the new gate: dead-file, smuggled extra
axiom (named), dropped-oracle (subset would pass, exact must not), and a
vanished certificate (the collectAxioms-returns-[] trap). All four rejected.
REPRODUCIBILITY (GPT B1.4 / B1.5)
- extract.sh refuses a wrong-commit or dirty source tree (fail-closed), takes
an optional source-path arg, and pins the source commit.
- verification/PROVENANCE.json: single machine-readable pin set (source +
charon + aeneas commits/channel + lean + ocaml) with generated-file sha256.
- Re-running extract.sh reproduces gen/SlhVerify/{Types,Funs}.lean
byte-identically (companion fips205-source commit adds Cargo.lock +
rust-toolchain.toml; verified not to perturb the model).
DOC HONESTY (both reviewers)
- README: fix the self-contradiction (apex "not yet proven" trailer vs the
proven apex), the false "oracles kept OUTSIDE every cone" (they are INSIDE,
by design), "deployed monomorphic path" and "semantics-identical for every
parameter set" overclaims, "only two lines changed", stale snapshot head;
retitle the stale future-tense "what will be claimed" section.
- TRUSTED-BASE: drop "nothing proven yet"; add base_2b-inner and deployment-
bridge non-claims explicitly; current pin.
- ChainSpec header: "deployed monomorphic path" -> private verify_mono facade
(comment only).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
47 lines
2.7 KiB
Markdown
47 lines
2.7 KiB
Markdown
# TRUSTED-BASE — what the certificates do NOT cover
|
|
|
|
Eleven certificates over the extracted `verify_mono` model are now proven
|
|
(`verification/check.sh` green; the apex is
|
|
`fips205.slh_verify_128s_accepts_iff`). This file states what those
|
|
certificates deliberately do NOT establish; it is maintained as the campaign
|
|
proceeds and is part of every claim.
|
|
|
|
1. **The five verify-path hash oracles.** `h_msg, f, h, t_l, t_len`
|
|
(SLH-DSA-SHA2-128s instantiations over SHA-256; `prf`/`prf_msg` are
|
|
sign-side only and do not appear in the cone) are modeled as opaque
|
|
functions with assumed functional behavior. Their correctness against
|
|
FIPS 180-4 is NOT proven here — the same standing boundary as SHA-512
|
|
in the ed25519 apex. A collision or misimplementation inside the hash
|
|
layer is invisible to these certificates.
|
|
2. **Signing and key generation.** Out of extraction scope entirely. A
|
|
verified verify path says nothing about the safety of signature or key
|
|
production (including randomness).
|
|
3. **The transpilation pair.** Charon and Aeneas (pinned versions in the
|
|
toolchain) are trusted to preserve semantics from Rust (MIR) to the
|
|
Lean model. Divergence between rustc's semantics and the extracted
|
|
model is trusted base.
|
|
4. **The Lean kernel and its three axioms**
|
|
(`propext, Classical.choice, Quot.sound`).
|
|
5. **Build correspondence.** No reproducible-builds claim: the proof is
|
|
about the pinned source, not about any particular compiled binary
|
|
(the estate's R5 gap, stated everywhere it matters).
|
|
6. **Parameter-set scope.** Claims will bind SLH-DSA-SHA2-128s only;
|
|
other parameter sets are unverified until separately extracted and
|
|
proven (R2).
|
|
7. **Aeneas-compat + de-plumbing patch surface.** The fn-pointer-to-named-
|
|
oracle rewrite in `fips205-source` (phase 1) and the two de-plumbing
|
|
rounds (index-loop rewrites of the iterator adapters on the verify path,
|
|
de-plumbing round 2 at `bea1051`; current snapshot head `797b4ef`) are
|
|
part of the verified surface: the
|
|
certificates cover the *patched* verify path, and the patch commits are
|
|
the auditable delta from upstream `30bac08`. Each rewrite's equivalence
|
|
to upstream is argued in its commit and checked, for SHA2-128s, by the
|
|
snapshot differential test — it is not itself machine-checked.
|
|
8. **The `base_2b` inner loop.** `helpers.base_2b_loop0_loop0` (which
|
|
determines the FORS indices and WOTS digits) is threaded opaquely and
|
|
has no certificate; a defect there could change the recomputed root while
|
|
all eleven theorems still hold.
|
|
9. **The deployed generic verifier.** The proved subject is the private
|
|
`verify_mono` facade. The bridge to upstream's generic `pk.verify()` is
|
|
the finite in-snapshot differential test, not a machine-checked
|
|
refinement.
|