2026-07-02 19:24:39 +00:00
|
|
|
-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS
|
|
|
|
|
-- [curve25519_dalek]: external functions.
|
|
|
|
|
-- This is a template file: rename it to "FunsExternal.lean" and fill the holes.
|
|
|
|
|
import Aeneas
|
|
|
|
|
import CurveScalar.Types
|
|
|
|
|
open Aeneas Aeneas.Std Result ControlFlow Error
|
|
|
|
|
set_option linter.dupNamespace false
|
|
|
|
|
set_option linter.hashCommand false
|
|
|
|
|
set_option linter.unusedVariables false
|
|
|
|
|
|
|
|
|
|
/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/
|
|
|
|
|
set_option maxHeartbeats 1000000
|
|
|
|
|
|
|
|
|
|
/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/
|
|
|
|
|
set_option maxRecDepth 2048
|
|
|
|
|
open curve25519_dalek
|
|
|
|
|
|
|
|
|
|
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub::black_box]:
|
Signature layer, first bricks: canonicity closure + hash-to-scalar foundation
Canonicity pass (the layer is now closed under its own preconditions):
- sub_val_spec post carries the exact value equation
(exists beta <= 1, scVal r + scVal b = scVal a + ell*beta, with the
underflow guard beta = 1 -> scVal a < scVal b)
- add/montgomery_reduce/mul/aggregate posts all carry scVal r < ell:
canonical inputs give canonical outputs everywhere. Needed because
from_bytes_wide (hash-to-scalar) feeds Montgomery outputs into add.
Hash-to-scalar foundation (toward Scalar::from_hash / EdDSA verify):
- extraction scope + from_bytes_wide (brings constants::R); regenerated gen
- source repos carry a documented Aeneas-compat patch: the bare
`hi[4] = words[7] >> 20` extracts ill-typed at pin bf13c42e; masked
(semantic no-op, words[7] >> 20 < 2^44)
- Proofs/ScalarWideSpec.lean: R constant lemmas (R = 2^260 mod ell,
witness 2^260 = R + 255*ell) and montgomery_mul_spec, the single
Montgomery round: [r]*2^260 = [a]*[b], canonical bounded output
check-scalar.sh: 10 proof files, 11 kernel audits, all exactly
[propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
2026-07-03 21:18:32 +00:00
|
|
|
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 182:8-186:9 -/
|
2026-07-02 19:24:39 +00:00
|
|
|
axiom backend.serial.u64.scalar.Scalar52.sub.black_box
|
|
|
|
|
: Std.U64 → Result Std.U64
|
|
|
|
|
|