saymrwulf/pasta-pallas-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/pasta-pallas-verified.git synced 2026-09-04 20:03:39 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
pasta-pallas-verified/verification/Proofs/PPallas.lean
mrwulf 75ae21df06 pasta field: foundation + helper + sub/neg proofs against REAL extraction 
- extract.sh: scoped Charon/Aeneas extraction of fields::fp (pow_vartime
  patched upstream to index loops — semantics-preserving, crate tests pass;
  sqrt/cmp/sum/random/... opaque, documented)
- gen/: real transpiled model; subtle/CtOption hand-modeled (Choice := U8,
  CtOption := value × is_some), all other externals are axioms outside
  certificate cones
- Proofs/PPallas: Lucas/Pratt primality certificate (reused — it was the one
  genuine piece of the previous attempt)
- Proofs/Denote: Montgomery denotation ⟪a⟫ = feVal a · R⁻¹, Canon invariant
- Proofs/HelperSpecs: adc/sbb/mac exact ℕ specs (step-registered)
- Proofs/SubNegSpec: sub_spec (general two-case identity covering the
  t<2P reduction shape) and neg_spec, proven, no axioms

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-02 15:51:57 +02:00

415 lines
25 KiB
Text
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

/-
═══════════════════════════════════════════════════════════════════════════════
Proofs/PPallas.lean — primality of the Pallas (Pasta) base-field modulus
p = 0x40000000000000000000000000000000224698fc094cf91b992d30ed00000001
═══════════════════════════════════════════════════════════════════════════════
WHAT THIS FILE PROVES
`pallas_prime : Nat.Prime P` where P is the 255-bit modulus of the Pallas
curve base field F_p. Axiom-free Lucas/Pratt certificate.
CERTIFICATE TREE (p−1 factorization, leaves first)
p − 1 = 2³² · 3 · 463 · f1 · f2
where f1 = 539204044132271846773 (69 bits)
f2 = 8999194758858563409123804352480028797519453 (143 bits)
f1 − 1 = 2² · 3⁵ · 89 · 14923 · 417677162933
f2 − 1 = 2² · 3⁴ · 11 · 2531 · 115603 · 1197907 · 22160661629 · 325086459374267
Sub-leaves (all norm_num-certifiable):
417677162933 − 1 = 2² · 59 · 1973 · 897019
22160661629 − 1 = 2² · 7 · 19 · 41655379
14923 − 1 = 2 · 3² · 829
115603 − 1 = 2 · 3 · 19267
1197907 − 1 = 2 · 3 · 53 · 3767
325086459374267 − 1 = 2 · 509 · 413527 · 772231
463 − 1 = 2 · 3 · 7 · 11
2531 − 1 = 2 · 5 · 11 · 23
-/
import Mathlib.NumberTheory.LucasPrimality
import Mathlib.Data.ZMod.Basic
import Mathlib.Tactic.NormNum.Prime
set_option maxHeartbeats 8000000
set_option maxRecDepth 8000
namespace PPallas
-- ═════════════════════════════════════════════════════════════════════════════
-- Kernel-checkable modular exponentiation
-- ═════════════════════════════════════════════════════════════════════════════
/-- Fuel-based binary modular exponentiation, kernel-reducible (GMP-fast `decide`).
MATH (for sufficient fuel; made precise by `powModAux_eq`):
`powModAux fuel a k n = a^k mod n`.
Algorithm: square-and-multiply on binary digits of k. -/
def powModAux : Nat → Nat → Nat → Nat → Nat
| 0, _, _, n => 1 % n
| fuel + 1, a, k, n =>
if k = 0 then 1 % n
else if k % 2 = 1 then powModAux fuel (a * a % n) (k / 2) n * a % n
else powModAux fuel (a * a % n) (k / 2) n
/- Correctness of powModAux. k < 2^fuel ⇒ powModAux fuel a k n = a^k % n -/
theorem powModAux_eq : ∀ (fuel a k n : ℕ), k < 2 ^ fuel → powModAux fuel a k n = a ^ k % n := by
intro fuel
induction fuel with
| zero =>
intro a k n hk
rw [pow_zero] at hk
have hk0 : k = 0 := by omega
subst hk0
simp [powModAux]
| succ f ih =>
intro a k n hk
by_cases hk0 : k = 0
· subst hk0; simp [powModAux]
· have hk2 : k / 2 < 2 ^ f := by
rw [pow_succ] at hk
omega
have hrec := ih (a * a % n) (k / 2) n hk2
have haa : a * a = a ^ 2 := (pow_two a).symm
simp only [powModAux, if_neg hk0]
by_cases hodd : k % 2 = 1
· rw [if_pos hodd, hrec, ← Nat.pow_mod, Nat.mod_mul_mod, haa, ← pow_mul, ← pow_succ,
show 2 * (k / 2) + 1 = k by omega]
· rw [if_neg hodd, hrec, ← Nat.pow_mod, haa, ← pow_mul,
show 2 * (k / 2) = k by omega]
/-- powMod a k n = a^k % n for all k < 2^256. Fuel fixed at 256 — enough for
all exponents in the certificate (n ≤ p < 2^255). -/
def powMod (a k n : ℕ) : ℕ := powModAux 256 a k n
theorem cast_pow_eq (a k n : ℕ) (hk : k < 2 ^ 256) :
(a : ZMod n) ^ k = ((powMod a k n : ℕ) : ZMod n) := by
rw [powMod, powModAux_eq 256 a k n hk, ZMod.natCast_mod, Nat.cast_pow]
theorem pow_eq_one_of_powMod (a k n : ℕ) (hk : k < 2 ^ 256) (h : powMod a k n = 1) :
(a : ZMod n) ^ k = 1 := by
rw [cast_pow_eq a k n hk, h, Nat.cast_one]
theorem pow_ne_one_of_powMod (a k n : ℕ) (hk : k < 2 ^ 256) (hn : 1 < n)
(h1 : powMod a k n ≠ 1) (h2 : powMod a k n < n) :
(a : ZMod n) ^ k ≠ 1 := by
rw [cast_pow_eq a k n hk]
intro hcon
rw [show (1 : ZMod n) = ((1 : ℕ) : ZMod n) by rw [Nat.cast_one],
ZMod.natCast_eq_natCast_iff'] at hcon
rw [Nat.mod_eq_of_lt h2, Nat.mod_eq_of_lt hn] at hcon
exact h1 hcon
-- ═════════════════════════════════════════════════════════════════════════════
-- The certificate chain (leaves first, building up to the root)
-- ═════════════════════════════════════════════════════════════════════════════
/-- Leaf: 14923 is prime. Witness g = 2. 14923−1 = 2 · 3² · 829 -/
theorem prime_14923 : Nat.Prime 14923 := by
refine lucas_primality 14923 ((2 : ℕ) : ZMod 14923) ?_ ?_
· exact pow_eq_one_of_powMod 2 (14923 - 1) 14923 (by decide) (by decide)
· intro q hq hqd
have hfac : (14923 : ℕ) - 1 = 2 * (3 ^ 2 * (829)) := by decide
rw [hfac] at hqd
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((14923 - 1) / 2) 14923 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 3 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp (hq.dvd_of_dvd_pow h)
subst he
exact pow_ne_one_of_powMod 2 ((14923 - 1) / 3) 14923 (by decide) (by decide) (by decide) (by decide)
have he : q = 829 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp hqd
subst he
exact pow_ne_one_of_powMod 2 ((14923 - 1) / 829) 14923 (by decide) (by decide) (by decide) (by decide)
/-- Leaf: 115603 is prime. Witness g = 2. 115603−1 = 2 · 3 · 19267 -/
theorem prime_115603 : Nat.Prime 115603 := by
refine lucas_primality 115603 ((2 : ℕ) : ZMod 115603) ?_ ?_
· exact pow_eq_one_of_powMod 2 (115603 - 1) 115603 (by decide) (by decide)
· intro q hq hqd
have hfac : (115603 : ℕ) - 1 = 2 * (3 * (19267)) := by decide
rw [hfac] at hqd
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((115603 - 1) / 2) 115603 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 3 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((115603 - 1) / 3) 115603 (by decide) (by decide) (by decide) (by decide)
have he : q = 19267 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp hqd
subst he
exact pow_ne_one_of_powMod 2 ((115603 - 1) / 19267) 115603 (by decide) (by decide) (by decide) (by decide)
/-- Leaf: 1197907 is prime. Witness g = 3. 1197907−1 = 2 · 3 · 53 · 3767 -/
theorem prime_1197907 : Nat.Prime 1197907 := by
refine lucas_primality 1197907 ((3 : ℕ) : ZMod 1197907) ?_ ?_
· exact pow_eq_one_of_powMod 3 (1197907 - 1) 1197907 (by decide) (by decide)
· intro q hq hqd
have hfac : (1197907 : ℕ) - 1 = 2 * (3 * (53 * (3767))) := by decide
rw [hfac] at hqd
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 3 ((1197907 - 1) / 2) 1197907 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 3 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 3 ((1197907 - 1) / 3) 1197907 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 53 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 3 ((1197907 - 1) / 53) 1197907 (by decide) (by decide) (by decide) (by decide)
have he : q = 3767 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp hqd
subst he
exact pow_ne_one_of_powMod 3 ((1197907 - 1) / 3767) 1197907 (by decide) (by decide) (by decide) (by decide)
/-- Leaf: 463 is prime. Witness g = 3. 463−1 = 2 · 3 · 7 · 11 -/
theorem prime_463 : Nat.Prime 463 := by
refine lucas_primality 463 ((3 : ℕ) : ZMod 463) ?_ ?_
· exact pow_eq_one_of_powMod 3 (463 - 1) 463 (by decide) (by decide)
· intro q hq hqd
have hfac : (463 : ℕ) - 1 = 2 * (3 * (7 * (11))) := by decide
rw [hfac] at hqd
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 3 ((463 - 1) / 2) 463 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 3 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 3 ((463 - 1) / 3) 463 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 7 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 3 ((463 - 1) / 7) 463 (by decide) (by decide) (by decide) (by decide)
have he : q = 11 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp hqd
subst he
exact pow_ne_one_of_powMod 3 ((463 - 1) / 11) 463 (by decide) (by decide) (by decide) (by decide)
/-- Leaf: 2531 is prime. Witness g = 2. 2531−1 = 2 · 5 · 11 · 23 -/
theorem prime_2531 : Nat.Prime 2531 := by
refine lucas_primality 2531 ((2 : ℕ) : ZMod 2531) ?_ ?_
· exact pow_eq_one_of_powMod 2 (2531 - 1) 2531 (by decide) (by decide)
· intro q hq hqd
have hfac : (2531 : ℕ) - 1 = 2 * (5 * (11 * (23))) := by decide
rw [hfac] at hqd
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((2531 - 1) / 2) 2531 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 5 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((2531 - 1) / 5) 2531 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 11 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((2531 - 1) / 11) 2531 (by decide) (by decide) (by decide) (by decide)
have he : q = 23 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp hqd
subst he
exact pow_ne_one_of_powMod 2 ((2531 - 1) / 23) 2531 (by decide) (by decide) (by decide) (by decide)
/-- Node: 417677162933 is prime. Witness g = 2.
417677162933−1 = 2² · 59 · 1973 · 897019 -/
theorem prime_417677162933 : Nat.Prime 417677162933 := by
refine lucas_primality 417677162933 ((2 : ℕ) : ZMod 417677162933) ?_ ?_
· exact pow_eq_one_of_powMod 2 (417677162933 - 1) 417677162933 (by decide) (by decide)
· intro q hq hqd
have hfac : (417677162933 : ℕ) - 1 = 2 ^ 2 * (59 * (1973 * (897019))) := by decide
rw [hfac] at hqd
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp (hq.dvd_of_dvd_pow h)
subst he
exact pow_ne_one_of_powMod 2 ((417677162933 - 1) / 2) 417677162933 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 59 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((417677162933 - 1) / 59) 417677162933 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 1973 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((417677162933 - 1) / 1973) 417677162933 (by decide) (by decide) (by decide) (by decide)
have he : q = 897019 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp hqd
subst he
exact pow_ne_one_of_powMod 2 ((417677162933 - 1) / 897019) 417677162933 (by decide) (by decide) (by decide) (by decide)
/-- Node: 22160661629 is prime. Witness g = 3.
22160661629−1 = 2² · 7 · 19 · 41655379 -/
theorem prime_22160661629 : Nat.Prime 22160661629 := by
refine lucas_primality 22160661629 ((3 : ℕ) : ZMod 22160661629) ?_ ?_
· exact pow_eq_one_of_powMod 3 (22160661629 - 1) 22160661629 (by decide) (by decide)
· intro q hq hqd
have hfac : (22160661629 : ℕ) - 1 = 2 ^ 2 * (7 * (19 * (41655379))) := by decide
rw [hfac] at hqd
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp (hq.dvd_of_dvd_pow h)
subst he
exact pow_ne_one_of_powMod 3 ((22160661629 - 1) / 2) 22160661629 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 7 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 3 ((22160661629 - 1) / 7) 22160661629 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 19 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 3 ((22160661629 - 1) / 19) 22160661629 (by decide) (by decide) (by decide) (by decide)
have he : q = 41655379 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp hqd
subst he
exact pow_ne_one_of_powMod 3 ((22160661629 - 1) / 41655379) 22160661629 (by decide) (by decide) (by decide) (by decide)
/-- Node: 325086459374267 is prime. Witness g = 2.
325086459374267−1 = 2 · 509 · 413527 · 772231 -/
theorem prime_325086459374267 : Nat.Prime 325086459374267 := by
refine lucas_primality 325086459374267 ((2 : ℕ) : ZMod 325086459374267) ?_ ?_
· exact pow_eq_one_of_powMod 2 (325086459374267 - 1) 325086459374267 (by decide) (by decide)
· intro q hq hqd
have hfac : (325086459374267 : ℕ) - 1 = 2 * (509 * (413527 * (772231))) := by decide
rw [hfac] at hqd
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((325086459374267 - 1) / 2) 325086459374267 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 509 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((325086459374267 - 1) / 509) 325086459374267 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 413527 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((325086459374267 - 1) / 413527) 325086459374267 (by decide) (by decide) (by decide) (by decide)
have he : q = 772231 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp hqd
subst he
exact pow_ne_one_of_powMod 2 ((325086459374267 - 1) / 772231) 325086459374267 (by decide) (by decide) (by decide) (by decide)
/-- Node f1 = 539204044132271846773 (69 bits). Witness g = 5.
f1−1 = 2² · 3⁵ · 89 · 14923 · 417677162933
Recursive: 14923 and 417677162933 certified above. -/
theorem prime_539204044132271846773 : Nat.Prime 539204044132271846773 := by
refine lucas_primality 539204044132271846773 ((5 : ℕ) : ZMod 539204044132271846773) ?_ ?_
· exact pow_eq_one_of_powMod 5 (539204044132271846773 - 1) 539204044132271846773 (by decide) (by decide)
· intro q hq hqd
have hfac : (539204044132271846773 : ℕ) - 1 = 2 ^ 2 * (3 ^ 5 * (89 * (14923 * (417677162933)))) := by decide
rw [hfac] at hqd
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp (hq.dvd_of_dvd_pow h)
subst he
exact pow_ne_one_of_powMod 5 ((539204044132271846773 - 1) / 2) 539204044132271846773 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 3 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp (hq.dvd_of_dvd_pow h)
subst he
exact pow_ne_one_of_powMod 5 ((539204044132271846773 - 1) / 3) 539204044132271846773 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 89 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 5 ((539204044132271846773 - 1) / 89) 539204044132271846773 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 14923 := (Nat.prime_dvd_prime_iff_eq hq prime_14923).mp h
subst he
exact pow_ne_one_of_powMod 5 ((539204044132271846773 - 1) / 14923) 539204044132271846773 (by decide) (by decide) (by decide) (by decide)
have he : q = 417677162933 := (Nat.prime_dvd_prime_iff_eq hq prime_417677162933).mp hqd
subst he
exact pow_ne_one_of_powMod 5 ((539204044132271846773 - 1) / 417677162933) 539204044132271846773 (by decide) (by decide) (by decide) (by decide)
/-- Node f2 = 8999194758858563409123804352480028797519453 (143 bits). Witness g = 2.
f2−1 = 2² · 3⁴ · 11 · 2531 · 115603 · 1197907 · 22160661629 · 325086459374267
Recursive: large factors certified above. -/
theorem prime_8999194758858563409123804352480028797519453 : Nat.Prime 8999194758858563409123804352480028797519453 := by
refine lucas_primality 8999194758858563409123804352480028797519453 ((2 : ℕ) : ZMod 8999194758858563409123804352480028797519453) ?_ ?_
· exact pow_eq_one_of_powMod 2 (8999194758858563409123804352480028797519453 - 1) 8999194758858563409123804352480028797519453 (by decide) (by decide)
· intro q hq hqd
have hfac : (8999194758858563409123804352480028797519453 : ℕ) - 1 =
2 ^ 2 * (3 ^ 4 * (11 * (2531 * (115603 * (1197907 * (22160661629 * (325086459374267))))))) := by decide
rw [hfac] at hqd
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp (hq.dvd_of_dvd_pow h)
subst he
exact pow_ne_one_of_powMod 2 ((8999194758858563409123804352480028797519453 - 1) / 2) 8999194758858563409123804352480028797519453 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 3 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp (hq.dvd_of_dvd_pow h)
subst he
exact pow_ne_one_of_powMod 2 ((8999194758858563409123804352480028797519453 - 1) / 3) 8999194758858563409123804352480028797519453 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 11 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 2 ((8999194758858563409123804352480028797519453 - 1) / 11) 8999194758858563409123804352480028797519453 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2531 := (Nat.prime_dvd_prime_iff_eq hq prime_2531).mp h
subst he
exact pow_ne_one_of_powMod 2 ((8999194758858563409123804352480028797519453 - 1) / 2531) 8999194758858563409123804352480028797519453 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 115603 := (Nat.prime_dvd_prime_iff_eq hq prime_115603).mp h
subst he
exact pow_ne_one_of_powMod 2 ((8999194758858563409123804352480028797519453 - 1) / 115603) 8999194758858563409123804352480028797519453 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 1197907 := (Nat.prime_dvd_prime_iff_eq hq prime_1197907).mp h
subst he
exact pow_ne_one_of_powMod 2 ((8999194758858563409123804352480028797519453 - 1) / 1197907) 8999194758858563409123804352480028797519453 (by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 22160661629 := (Nat.prime_dvd_prime_iff_eq hq prime_22160661629).mp h
subst he
exact pow_ne_one_of_powMod 2 ((8999194758858563409123804352480028797519453 - 1) / 22160661629) 8999194758858563409123804352480028797519453 (by decide) (by decide) (by decide) (by decide)
have he : q = 325086459374267 := (Nat.prime_dvd_prime_iff_eq hq prime_325086459374267).mp hqd
subst he
exact pow_ne_one_of_powMod 2 ((8999194758858563409123804352480028797519453 - 1) / 325086459374267) 8999194758858563409123804352480028797519453 (by decide) (by decide) (by decide) (by decide)
/-- ROOT: Pallas base-field modulus P is prime. Witness g = 5.
P−1 = 2³² · 3 · 463 · f1 · f2
with f1, f2 certified recursively above. -/
theorem prime_Pallas : Nat.Prime 28948022309329048855892746252171976963363056481941560715954676764349967630337 := by
refine lucas_primality 28948022309329048855892746252171976963363056481941560715954676764349967630337
((5 : ℕ) : ZMod 28948022309329048855892746252171976963363056481941560715954676764349967630337) ?_ ?_
· exact pow_eq_one_of_powMod 5
(28948022309329048855892746252171976963363056481941560715954676764349967630337 - 1)
28948022309329048855892746252171976963363056481941560715954676764349967630337
(by decide) (by decide)
· intro q hq hqd
have hfac : (28948022309329048855892746252171976963363056481941560715954676764349967630337 : ℕ) - 1 =
2 ^ 32 * (3 * (463 * (539204044132271846773 * (8999194758858563409123804352480028797519453)))) := by decide
rw [hfac] at hqd
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 2 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp (hq.dvd_of_dvd_pow h)
subst he
exact pow_ne_one_of_powMod 5
((28948022309329048855892746252171976963363056481941560715954676764349967630337 - 1) / 2)
28948022309329048855892746252171976963363056481941560715954676764349967630337
(by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 3 := (Nat.prime_dvd_prime_iff_eq hq (by norm_num)).mp h
subst he
exact pow_ne_one_of_powMod 5
((28948022309329048855892746252171976963363056481941560715954676764349967630337 - 1) / 3)
28948022309329048855892746252171976963363056481941560715954676764349967630337
(by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 463 := (Nat.prime_dvd_prime_iff_eq hq prime_463).mp h
subst he
exact pow_ne_one_of_powMod 5
((28948022309329048855892746252171976963363056481941560715954676764349967630337 - 1) / 463)
28948022309329048855892746252171976963363056481941560715954676764349967630337
(by decide) (by decide) (by decide) (by decide)
rcases (Nat.Prime.dvd_mul hq).mp hqd with h | hqd
· have he : q = 539204044132271846773 := (Nat.prime_dvd_prime_iff_eq hq prime_539204044132271846773).mp h
subst he
exact pow_ne_one_of_powMod 5
((28948022309329048855892746252171976963363056481941560715954676764349967630337 - 1) / 539204044132271846773)
28948022309329048855892746252171976963363056481941560715954676764349967630337
(by decide) (by decide) (by decide) (by decide)
have he : q = 8999194758858563409123804352480028797519453 :=
(Nat.prime_dvd_prime_iff_eq hq prime_8999194758858563409123804352480028797519453).mp hqd
subst he
exact pow_ne_one_of_powMod 5
((28948022309329048855892746252171976963363056481941560715954676764349967630337 - 1) / 8999194758858563409123804352480028797519453)
28948022309329048855892746252171976963363056481941560715954676764349967630337
(by decide) (by decide) (by decide) (by decide)
end PPallas
-- ═════════════════════════════════════════════════════════════════════════════
-- Exported result
-- ═════════════════════════════════════════════════════════════════════════════
/-- The Pallas curve base field modulus is prime.
This is the only theorem from this file used downstream. -/
theorem pallas_prime : Nat.Prime 28948022309329048855892746252171976963363056481941560715954676764349967630337 :=
PPallas.prime_Pallas
Reference in a new issue View git blame Copy permalink