saymrwulf/risc0-ed25519-verified
1
0
Fork 0
mirror of https://github.com/saymrwulf/risc0-ed25519-verified.git synced 2026-09-03 19:53:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Hash-to-scalar PROVEN: from_bytes_wide_spec - Scalar::from_hash's reduction is exact mod l

Browse source 
The apex brick of the scalar layer: for any 64 bytes (the opaque SHA-512
digest), [from_bytes_wide bytes] = (LE 512-bit value) mod l, with
canonical 52-bit-bounded output. Composition: bytes_unpack_spec (8x8
loops) -> split_words_lo/hi_spec (exact div/mod per limb, disjoint ORs
as additions) -> wide_split_telescope (isolated omega) -> montgomery_mul
by R and RR (R cancels as a unit, RR restores it) -> the canonical add.

The two kernel-capacity walls found and crossed en route (control repo
FAILURES.md updated):
- a montgomery_mul inside any walk motive replays its 400-line body at
  every kernel step (fix: named prefix functions in the pinned source);
- straight-line IndexMut closure chains make kernel defeq exponential in
  depth (fix: struct-literal construction - the split halves now build
  Scalar52([...]) directly). Full certificate: 77 s kernel-inclusive.

Regenerated gen (sources factor from_bytes_wide -> from_bytes_wide_parts
-> split_words_lo/hi; documented pure refactors, cargo-checked).
check-scalar.sh: 13 proof files, 13 kernel audits, all exactly
[propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
This commit is contained in:
mrwulf 2026-07-04 11:00:50 +02:00
parent a691a39426
commit 0b1fa12e15
7 changed files with 765 additions and 316 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
verification/CurveScalar.llbc
View file

File diff suppressed because one or more lines are too long

224
verification/Proofs/ScalarBytesSpec.lean
View file

@ -29,7 +29,7 @@ theorem bytes_word_loop_tail_0
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w0.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter bytes words 0#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 0#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [v, w1, w2, w3, w4, w5, w6, w7] ∧
v.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 + b7.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -41,10 +41,10 @@ theorem bytes_word_loop_tail_0
have hbb5 : b5.val < 2^8 := by scalar_tac
have hbb6 : b6.val < 2^8 := by scalar_tac
have hbb7 : b7.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 4: byte 4
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
@ -88,7 +88,7 @@ theorem bytes_word_loop_tail_0
try simp only [spec_ok]
-- j = 5: byte 5
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
@ -132,7 +132,7 @@ theorem bytes_word_loop_tail_0
try simp only [spec_ok]
-- j = 6: byte 6
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
@ -176,7 +176,7 @@ theorem bytes_word_loop_tail_0
try simp only [spec_ok]
-- j = 7: byte 7
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
@ -220,7 +220,7 @@ theorem bytes_word_loop_tail_0
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
@ -239,7 +239,7 @@ theorem bytes_word_loop_spec_0
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w0.val = 0) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 0#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 0#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [v, w1, w2, w3, w4, w5, w6, w7] ∧
v.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 + b7.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -247,10 +247,10 @@ theorem bytes_word_loop_spec_0
have hbb1 : b1.val < 2^8 := by scalar_tac
have hbb2 : b2.val < 2^8 := by scalar_tac
have hbb3 : b3.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 0: byte 0
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
@ -284,7 +284,7 @@ theorem bytes_word_loop_spec_0
try simp only [spec_ok]
-- j = 1: byte 1
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
@ -328,7 +328,7 @@ theorem bytes_word_loop_spec_0
try simp only [spec_ok]
-- j = 2: byte 2
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
@ -372,7 +372,7 @@ theorem bytes_word_loop_spec_0
try simp only [spec_ok]
-- j = 3: byte 3
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
@ -415,7 +415,7 @@ theorem bytes_word_loop_spec_0
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter3 bytes wn3 0#usize
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 0#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [v, w1, w2, w3, w4, w5, w6, w7] ∧
v.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 + b7.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [y3, w1, w2, w3, w4, w5, w6, w7] := by
@ -440,7 +440,7 @@ theorem bytes_word_loop_tail_1
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w1.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter bytes words 1#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 1#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, v, w2, w3, w4, w5, w6, w7] ∧
v.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 + b14.val * 2^48 + b15.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -452,10 +452,10 @@ theorem bytes_word_loop_tail_1
have hbb13 : b13.val < 2^8 := by scalar_tac
have hbb14 : b14.val < 2^8 := by scalar_tac
have hbb15 : b15.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 4: byte 12
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
@ -499,7 +499,7 @@ theorem bytes_word_loop_tail_1
try simp only [spec_ok]
-- j = 5: byte 13
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
@ -543,7 +543,7 @@ theorem bytes_word_loop_tail_1
try simp only [spec_ok]
-- j = 6: byte 14
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
@ -587,7 +587,7 @@ theorem bytes_word_loop_tail_1
try simp only [spec_ok]
-- j = 7: byte 15
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
@ -631,7 +631,7 @@ theorem bytes_word_loop_tail_1
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
@ -650,7 +650,7 @@ theorem bytes_word_loop_spec_1
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w1.val = 0) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 1#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 1#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, v, w2, w3, w4, w5, w6, w7] ∧
v.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 + b14.val * 2^48 + b15.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -658,10 +658,10 @@ theorem bytes_word_loop_spec_1
have hbb9 : b9.val < 2^8 := by scalar_tac
have hbb10 : b10.val < 2^8 := by scalar_tac
have hbb11 : b11.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 0: byte 8
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
@ -695,7 +695,7 @@ theorem bytes_word_loop_spec_1
try simp only [spec_ok]
-- j = 1: byte 9
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
@ -739,7 +739,7 @@ theorem bytes_word_loop_spec_1
try simp only [spec_ok]
-- j = 2: byte 10
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
@ -783,7 +783,7 @@ theorem bytes_word_loop_spec_1
try simp only [spec_ok]
-- j = 3: byte 11
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
@ -826,7 +826,7 @@ theorem bytes_word_loop_spec_1
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter3 bytes wn3 1#usize
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 1#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, v, w2, w3, w4, w5, w6, w7] ∧
v.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 + b14.val * 2^48 + b15.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, y3, w2, w3, w4, w5, w6, w7] := by
@ -851,7 +851,7 @@ theorem bytes_word_loop_tail_2
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w2.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter bytes words 2#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 2#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, v, w3, w4, w5, w6, w7] ∧
v.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 + b22.val * 2^48 + b23.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -863,10 +863,10 @@ theorem bytes_word_loop_tail_2
have hbb21 : b21.val < 2^8 := by scalar_tac
have hbb22 : b22.val < 2^8 := by scalar_tac
have hbb23 : b23.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 4: byte 20
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
@ -910,7 +910,7 @@ theorem bytes_word_loop_tail_2
try simp only [spec_ok]
-- j = 5: byte 21
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
@ -954,7 +954,7 @@ theorem bytes_word_loop_tail_2
try simp only [spec_ok]
-- j = 6: byte 22
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
@ -998,7 +998,7 @@ theorem bytes_word_loop_tail_2
try simp only [spec_ok]
-- j = 7: byte 23
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
@ -1042,7 +1042,7 @@ theorem bytes_word_loop_tail_2
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
@ -1061,7 +1061,7 @@ theorem bytes_word_loop_spec_2
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w2.val = 0) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 2#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 2#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, v, w3, w4, w5, w6, w7] ∧
v.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 + b22.val * 2^48 + b23.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -1069,10 +1069,10 @@ theorem bytes_word_loop_spec_2
have hbb17 : b17.val < 2^8 := by scalar_tac
have hbb18 : b18.val < 2^8 := by scalar_tac
have hbb19 : b19.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 0: byte 16
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
@ -1106,7 +1106,7 @@ theorem bytes_word_loop_spec_2
try simp only [spec_ok]
-- j = 1: byte 17
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
@ -1150,7 +1150,7 @@ theorem bytes_word_loop_spec_2
try simp only [spec_ok]
-- j = 2: byte 18
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
@ -1194,7 +1194,7 @@ theorem bytes_word_loop_spec_2
try simp only [spec_ok]
-- j = 3: byte 19
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
@ -1237,7 +1237,7 @@ theorem bytes_word_loop_spec_2
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter3 bytes wn3 2#usize
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 2#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, v, w3, w4, w5, w6, w7] ∧
v.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 + b22.val * 2^48 + b23.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, y3, w3, w4, w5, w6, w7] := by
@ -1262,7 +1262,7 @@ theorem bytes_word_loop_tail_3
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w3.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter bytes words 3#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 3#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, v, w4, w5, w6, w7] ∧
v.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 + b30.val * 2^48 + b31.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -1274,10 +1274,10 @@ theorem bytes_word_loop_tail_3
have hbb29 : b29.val < 2^8 := by scalar_tac
have hbb30 : b30.val < 2^8 := by scalar_tac
have hbb31 : b31.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 4: byte 28
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
@ -1321,7 +1321,7 @@ theorem bytes_word_loop_tail_3
try simp only [spec_ok]
-- j = 5: byte 29
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
@ -1365,7 +1365,7 @@ theorem bytes_word_loop_tail_3
try simp only [spec_ok]
-- j = 6: byte 30
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
@ -1409,7 +1409,7 @@ theorem bytes_word_loop_tail_3
try simp only [spec_ok]
-- j = 7: byte 31
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
@ -1453,7 +1453,7 @@ theorem bytes_word_loop_tail_3
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
@ -1472,7 +1472,7 @@ theorem bytes_word_loop_spec_3
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w3.val = 0) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 3#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 3#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, v, w4, w5, w6, w7] ∧
v.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 + b30.val * 2^48 + b31.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -1480,10 +1480,10 @@ theorem bytes_word_loop_spec_3
have hbb25 : b25.val < 2^8 := by scalar_tac
have hbb26 : b26.val < 2^8 := by scalar_tac
have hbb27 : b27.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 0: byte 24
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
@ -1517,7 +1517,7 @@ theorem bytes_word_loop_spec_3
try simp only [spec_ok]
-- j = 1: byte 25
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
@ -1561,7 +1561,7 @@ theorem bytes_word_loop_spec_3
try simp only [spec_ok]
-- j = 2: byte 26
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
@ -1605,7 +1605,7 @@ theorem bytes_word_loop_spec_3
try simp only [spec_ok]
-- j = 3: byte 27
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
@ -1648,7 +1648,7 @@ theorem bytes_word_loop_spec_3
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter3 bytes wn3 3#usize
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 3#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, v, w4, w5, w6, w7] ∧
v.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 + b30.val * 2^48 + b31.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, w2, y3, w4, w5, w6, w7] := by
@ -1673,7 +1673,7 @@ theorem bytes_word_loop_tail_4
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w4.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter bytes words 4#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 4#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, v, w5, w6, w7] ∧
v.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 + b38.val * 2^48 + b39.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -1685,10 +1685,10 @@ theorem bytes_word_loop_tail_4
have hbb37 : b37.val < 2^8 := by scalar_tac
have hbb38 : b38.val < 2^8 := by scalar_tac
have hbb39 : b39.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 4: byte 36
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
@ -1732,7 +1732,7 @@ theorem bytes_word_loop_tail_4
try simp only [spec_ok]
-- j = 5: byte 37
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
@ -1776,7 +1776,7 @@ theorem bytes_word_loop_tail_4
try simp only [spec_ok]
-- j = 6: byte 38
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
@ -1820,7 +1820,7 @@ theorem bytes_word_loop_tail_4
try simp only [spec_ok]
-- j = 7: byte 39
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
@ -1864,7 +1864,7 @@ theorem bytes_word_loop_tail_4
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
@ -1883,7 +1883,7 @@ theorem bytes_word_loop_spec_4
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w4.val = 0) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 4#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 4#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, v, w5, w6, w7] ∧
v.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 + b38.val * 2^48 + b39.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -1891,10 +1891,10 @@ theorem bytes_word_loop_spec_4
have hbb33 : b33.val < 2^8 := by scalar_tac
have hbb34 : b34.val < 2^8 := by scalar_tac
have hbb35 : b35.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 0: byte 32
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
@ -1928,7 +1928,7 @@ theorem bytes_word_loop_spec_4
try simp only [spec_ok]
-- j = 1: byte 33
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
@ -1972,7 +1972,7 @@ theorem bytes_word_loop_spec_4
try simp only [spec_ok]
-- j = 2: byte 34
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
@ -2016,7 +2016,7 @@ theorem bytes_word_loop_spec_4
try simp only [spec_ok]
-- j = 3: byte 35
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
@ -2059,7 +2059,7 @@ theorem bytes_word_loop_spec_4
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter3 bytes wn3 4#usize
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 4#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, v, w5, w6, w7] ∧
v.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 + b38.val * 2^48 + b39.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, w2, w3, y3, w5, w6, w7] := by
@ -2084,7 +2084,7 @@ theorem bytes_word_loop_tail_5
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w5.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter bytes words 5#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 5#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, v, w6, w7] ∧
v.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 + b46.val * 2^48 + b47.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -2096,10 +2096,10 @@ theorem bytes_word_loop_tail_5
have hbb45 : b45.val < 2^8 := by scalar_tac
have hbb46 : b46.val < 2^8 := by scalar_tac
have hbb47 : b47.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 4: byte 44
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
@ -2143,7 +2143,7 @@ theorem bytes_word_loop_tail_5
try simp only [spec_ok]
-- j = 5: byte 45
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
@ -2187,7 +2187,7 @@ theorem bytes_word_loop_tail_5
try simp only [spec_ok]
-- j = 6: byte 46
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
@ -2231,7 +2231,7 @@ theorem bytes_word_loop_tail_5
try simp only [spec_ok]
-- j = 7: byte 47
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
@ -2275,7 +2275,7 @@ theorem bytes_word_loop_tail_5
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
@ -2294,7 +2294,7 @@ theorem bytes_word_loop_spec_5
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w5.val = 0) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 5#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 5#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, v, w6, w7] ∧
v.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 + b46.val * 2^48 + b47.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -2302,10 +2302,10 @@ theorem bytes_word_loop_spec_5
have hbb41 : b41.val < 2^8 := by scalar_tac
have hbb42 : b42.val < 2^8 := by scalar_tac
have hbb43 : b43.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 0: byte 40
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
@ -2339,7 +2339,7 @@ theorem bytes_word_loop_spec_5
try simp only [spec_ok]
-- j = 1: byte 41
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
@ -2383,7 +2383,7 @@ theorem bytes_word_loop_spec_5
try simp only [spec_ok]
-- j = 2: byte 42
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
@ -2427,7 +2427,7 @@ theorem bytes_word_loop_spec_5
try simp only [spec_ok]
-- j = 3: byte 43
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
@ -2470,7 +2470,7 @@ theorem bytes_word_loop_spec_5
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter3 bytes wn3 5#usize
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 5#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, v, w6, w7] ∧
v.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 + b46.val * 2^48 + b47.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, w2, w3, w4, y3, w6, w7] := by
@ -2495,7 +2495,7 @@ theorem bytes_word_loop_tail_6
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w6.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter bytes words 6#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 6#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, v, w7] ∧
v.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 + b54.val * 2^48 + b55.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -2507,10 +2507,10 @@ theorem bytes_word_loop_tail_6
have hbb53 : b53.val < 2^8 := by scalar_tac
have hbb54 : b54.val < 2^8 := by scalar_tac
have hbb55 : b55.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 4: byte 52
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
@ -2554,7 +2554,7 @@ theorem bytes_word_loop_tail_6
try simp only [spec_ok]
-- j = 5: byte 53
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
@ -2598,7 +2598,7 @@ theorem bytes_word_loop_tail_6
try simp only [spec_ok]
-- j = 6: byte 54
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
@ -2642,7 +2642,7 @@ theorem bytes_word_loop_tail_6
try simp only [spec_ok]
-- j = 7: byte 55
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
@ -2686,7 +2686,7 @@ theorem bytes_word_loop_tail_6
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
@ -2705,7 +2705,7 @@ theorem bytes_word_loop_spec_6
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w6.val = 0) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 6#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 6#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, v, w7] ∧
v.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 + b54.val * 2^48 + b55.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -2713,10 +2713,10 @@ theorem bytes_word_loop_spec_6
have hbb49 : b49.val < 2^8 := by scalar_tac
have hbb50 : b50.val < 2^8 := by scalar_tac
have hbb51 : b51.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 0: byte 48
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
@ -2750,7 +2750,7 @@ theorem bytes_word_loop_spec_6
try simp only [spec_ok]
-- j = 1: byte 49
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
@ -2794,7 +2794,7 @@ theorem bytes_word_loop_spec_6
try simp only [spec_ok]
-- j = 2: byte 50
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
@ -2838,7 +2838,7 @@ theorem bytes_word_loop_spec_6
try simp only [spec_ok]
-- j = 3: byte 51
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
@ -2881,7 +2881,7 @@ theorem bytes_word_loop_spec_6
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter3 bytes wn3 6#usize
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 6#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, v, w7] ∧
v.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 + b54.val * 2^48 + b55.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, w2, w3, w4, w5, y3, w7] := by
@ -2906,7 +2906,7 @@ theorem bytes_word_loop_tail_7
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hst : iter.start.val = 4) (hend : iter.«end» = 8#usize)
(hacc : w7.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter bytes words 7#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter bytes words 7#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, w6, v] ∧
v.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 + b62.val * 2^48 + b63.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -2918,10 +2918,10 @@ theorem bytes_word_loop_tail_7
have hbb61 : b61.val < 2^8 := by scalar_tac
have hbb62 : b62.val < 2^8 := by scalar_tac
have hbb63 : b63.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 4: byte 60
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter (by simp [hend, hst]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
step as ⟨p4, hp4⟩
@ -2965,7 +2965,7 @@ theorem bytes_word_loop_tail_7
try simp only [spec_ok]
-- j = 5: byte 61
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter4 (by simp [hs4, he4, hend, hst]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
step as ⟨p5, hp5⟩
@ -3009,7 +3009,7 @@ theorem bytes_word_loop_tail_7
try simp only [spec_ok]
-- j = 6: byte 62
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter5 (by simp [hs4, he4, hs5, he5, hend, hst]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
step as ⟨p6, hp6⟩
@ -3053,7 +3053,7 @@ theorem bytes_word_loop_tail_7
try simp only [spec_ok]
-- j = 7: byte 63
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_lt_spec iter6 (by simp [hs4, he4, hs5, he5, hs6, he6, hend, hst]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
step as ⟨p7, hp7⟩
@ -3097,7 +3097,7 @@ theorem bytes_word_loop_tail_7
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with (range_next_ge_spec iter7 (by simp [he7, he6, he5, he4, hend, hs7, hs6, hs5, hs4]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]
@ -3116,7 +3116,7 @@ theorem bytes_word_loop_spec_7
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w7.val = 0) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 7#usize
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 { start := 0#usize, «end» := 8#usize } bytes words 7#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, w6, v] ∧
v.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 + b62.val * 2^48 + b63.val * 2^56 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
@ -3124,10 +3124,10 @@ theorem bytes_word_loop_spec_7
have hbb57 : b57.val < 2^8 := by scalar_tac
have hbb58 : b58.val < 2^8 := by scalar_tac
have hbb59 : b59.val < 2^8 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
-- j = 0: byte 56
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step as ⟨p0, hp0⟩
@ -3161,7 +3161,7 @@ theorem bytes_word_loop_spec_7
try simp only [spec_ok]
-- j = 1: byte 57
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
step as ⟨p1, hp1⟩
@ -3205,7 +3205,7 @@ theorem bytes_word_loop_spec_7
try simp only [spec_ok]
-- j = 2: byte 58
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
step as ⟨p2, hp2⟩
@ -3249,7 +3249,7 @@ theorem bytes_word_loop_spec_7
try simp only [spec_ok]
-- j = 3: byte 59
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body]
step with range_next_lt_spec as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
step as ⟨p3, hp3⟩
@ -3292,7 +3292,7 @@ theorem bytes_word_loop_spec_7
step as ⟨wn3, hwn3⟩
try simp only [spec_ok]
-- refold and hand over to the tail lemma at the j = 4 boundary
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0 iter3 bytes wn3 7#usize
show backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0 iter3 bytes wn3 7#usize
⦃ ws => ∃ v : U64, (↑ws : List U64) = [w0, w1, w2, w3, w4, w5, w6, v] ∧
v.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 + b62.val * 2^48 + b63.val * 2^56 ⦄
have hwn3l : (↑wn3 : List U64) = [w0, w1, w2, w3, w4, w5, w6, y3] := by

458
verification/Proofs/ScalarFromBytesSpec.lean Normal file
View file

@ -0,0 +1,458 @@
/- Proofs/ScalarFromBytesSpec.lean — hash-to-scalar, the apex brick of the
scalar layer: ⟦from_bytes_wide bytes⟧ = (LE 512-bit value) mod ℓ, the
mathematical content of Scalar::from_hash after the (opaque) SHA-512.
The pinned source factors from_bytes_wide → from_bytes_wide_parts →
split_words_lo/hi (documented pure refactors) so every verification
walk stays at the proven-cheap ~25-step scale and no walk motive ever
carries a Montgomery call — the kernel-replay capacity lesson. -/
import Proofs.ScalarUnpackSpec
import Proofs.ScalarAddSpec
open Aeneas Aeneas.Std Result
open curve25519_dalek
set_option maxHeartbeats 8000000
set_option linter.unusedSimpArgs false
set_option exponentiation.threshold 600
namespace ScalarProofs
open Aeneas.Std.WP
/-- The 512-bit lo/hi split telescope (8 atomic words, isolated omega). -/
theorem wide_split_telescope (v0 v1 v2 v3 v4 v5 v6 v7 : ℕ)
(h0 : v0 < 2^64) (h1 : v1 < 2^64) (h2 : v2 < 2^64) (h3 : v3 < 2^64)
(h4 : v4 < 2^64) (h5 : v5 < 2^64) (h6 : v6 < 2^64) (h7 : v7 < 2^64) :
(v0 % 2^52
+ 2^52 * ((v0 / 2^52 + 2^12 * (v1 % 2^52)) % 2^52)
+ 2^104 * ((v1 / 2^40 + 2^24 * (v2 % 2^40)) % 2^52)
+ 2^156 * ((v2 / 2^28 + 2^36 * (v3 % 2^28)) % 2^52)
+ 2^208 * ((v3 / 2^16 + 2^48 * (v4 % 2^16)) % 2^52))
+ 2^260 *
((v4 / 2^4 % 2^52)
+ 2^52 * ((v4 / 2^56 + 2^8 * (v5 % 2^56)) % 2^52)
+ 2^104 * ((v5 / 2^44 + 2^20 * (v6 % 2^44)) % 2^52)
+ 2^156 * ((v6 / 2^32 + 2^32 * (v7 % 2^32)) % 2^52)
+ 2^208 * (v7 / 2^20 % 2^52))
= v0 + 2^64 * v1 + 2^128 * v2 + 2^192 * v3 + 2^256 * v4
+ 2^320 * v5 + 2^384 * v6 + 2^448 * v7 := by
omega
/-- The lo-half 52-bit split: exact div/mod value per limb. -/
theorem split_words_lo_spec (words : Std.Array Std.U64 8#usize)
(v0 v1 v2 v3 v4 v5 v6 v7 : U64)
(hwsl : (↑words : List U64) = [v0, v1, v2, v3, v4, v5, v6, v7]) :
backend.serial.u64.scalar.Scalar52.split_words_lo words
⦃ s => ∃ i2 i7 i12 i17 i22 : U64,
(↑s : List U64) = [i2, i7, i12, i17, i22] ∧
i2.val = v0.val % 2^52 ∧
i7.val = (v0.val / 2^52 + 2^12 * (v1.val % 2^52)) % 2^52 ∧
i12.val = (v1.val / 2^40 + 2^24 * (v2.val % 2^40)) % 2^52 ∧
i17.val = (v2.val / 2^28 + 2^36 * (v3.val % 2^28)) % 2^52 ∧
i22.val = (v3.val / 2^16 + 2^48 * (v4.val % 2^16)) % 2^52 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.split_words_lo
have hvb0 : v0.val < 2^64 := by scalar_tac
have hvb1 : v1.val < 2^64 := by scalar_tac
have hvb2 : v2.val < 2^64 := by scalar_tac
have hvb3 : v3.val < 2^64 := by scalar_tac
have hvb4 : v4.val < 2^64 := by scalar_tac
have hvb5 : v5.val < 2^64 := by scalar_tac
have hvb6 : v6.val < 2^64 := by scalar_tac
have hvb7 : v7.val < 2^64 := by scalar_tac
step as ⟨sh, hsh⟩
step as ⟨mask, hmask⟩
have hmaskv : mask.val = 2^52 - 1 := by
simp [hmask, hsh, U64.size_def, U64.numBits]
step as ⟨i1, hi1⟩
simp [hwsl] at hi1
have hi1v : i1.val = v0.val := by rw [hi1]
step as ⟨i2, hi2⟩
have hi2v : i2.val = (v0.val) % 2^52 := by
rw [hi2, UScalar.val_and, hmaskv, hi1v, nat_and_mask52]
step as ⟨i3, hi3⟩
have hi3v : i3.val = v0.val / 2^52 := by
rw [hi3, hi1v, Nat.shiftRight_eq_div_pow]
step as ⟨i4, hi4⟩
simp [hwsl] at hi4
have hi4v : i4.val = v1.val := by rw [hi4]
step as ⟨i5, hi5⟩
have hi5v : i5.val = 2^12 * (v1.val % 2^52) := by
rw [hi5]
simp [hi4v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨i6, hi6⟩
have hi6add : i3.val ||| i5.val = i3.val + i5.val := by
have hlt : i3.val < 2^12 := by rw [hi3v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := i3.val) (i := 12) hlt (v1.val % 2^52)
calc i3.val ||| i5.val
= i3.val ||| 2^12 * (v1.val % 2^52) := by rw [hi5v]
_ = 2^12 * (v1.val % 2^52) ||| i3.val := Nat.lor_comm _ _
_ = 2^12 * (v1.val % 2^52) + i3.val := hor.symm
_ = i3.val + i5.val := by rw [hi5v]; ring
have hi6v : i6.val = v0.val / 2^52 + 2^12 * (v1.val % 2^52) := by
rw [hi6, UScalar.val_or, hi6add, hi3v, hi5v]
step as ⟨i7, hi7⟩
have hi7v : i7.val = (v0.val / 2^52 + 2^12 * (v1.val % 2^52)) % 2^52 := by
rw [hi7, UScalar.val_and, hmaskv, hi6v, nat_and_mask52]
step as ⟨i8, hi8⟩
have hi8v : i8.val = v1.val / 2^40 := by
rw [hi8, hi4v, Nat.shiftRight_eq_div_pow]
step as ⟨i9, hi9⟩
simp [hwsl] at hi9
have hi9v : i9.val = v2.val := by rw [hi9]
step as ⟨i10, hi10⟩
have hi10v : i10.val = 2^24 * (v2.val % 2^40) := by
rw [hi10]
simp [hi9v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨i11, hi11⟩
have hi11add : i8.val ||| i10.val = i8.val + i10.val := by
have hlt : i8.val < 2^24 := by rw [hi8v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := i8.val) (i := 24) hlt (v2.val % 2^40)
calc i8.val ||| i10.val
= i8.val ||| 2^24 * (v2.val % 2^40) := by rw [hi10v]
_ = 2^24 * (v2.val % 2^40) ||| i8.val := Nat.lor_comm _ _
_ = 2^24 * (v2.val % 2^40) + i8.val := hor.symm
_ = i8.val + i10.val := by rw [hi10v]; ring
have hi11v : i11.val = v1.val / 2^40 + 2^24 * (v2.val % 2^40) := by
rw [hi11, UScalar.val_or, hi11add, hi8v, hi10v]
step as ⟨i12, hi12⟩
have hi12v : i12.val = (v1.val / 2^40 + 2^24 * (v2.val % 2^40)) % 2^52 := by
rw [hi12, UScalar.val_and, hmaskv, hi11v, nat_and_mask52]
step as ⟨i13, hi13⟩
have hi13v : i13.val = v2.val / 2^28 := by
rw [hi13, hi9v, Nat.shiftRight_eq_div_pow]
step as ⟨i14, hi14⟩
simp [hwsl] at hi14
have hi14v : i14.val = v3.val := by rw [hi14]
step as ⟨i15, hi15⟩
have hi15v : i15.val = 2^36 * (v3.val % 2^28) := by
rw [hi15]
simp [hi14v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨i16, hi16⟩
have hi16add : i13.val ||| i15.val = i13.val + i15.val := by
have hlt : i13.val < 2^36 := by rw [hi13v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := i13.val) (i := 36) hlt (v3.val % 2^28)
calc i13.val ||| i15.val
= i13.val ||| 2^36 * (v3.val % 2^28) := by rw [hi15v]
_ = 2^36 * (v3.val % 2^28) ||| i13.val := Nat.lor_comm _ _
_ = 2^36 * (v3.val % 2^28) + i13.val := hor.symm
_ = i13.val + i15.val := by rw [hi15v]; ring
have hi16v : i16.val = v2.val / 2^28 + 2^36 * (v3.val % 2^28) := by
rw [hi16, UScalar.val_or, hi16add, hi13v, hi15v]
step as ⟨i17, hi17⟩
have hi17v : i17.val = (v2.val / 2^28 + 2^36 * (v3.val % 2^28)) % 2^52 := by
rw [hi17, UScalar.val_and, hmaskv, hi16v, nat_and_mask52]
step as ⟨i18, hi18⟩
have hi18v : i18.val = v3.val / 2^16 := by
rw [hi18, hi14v, Nat.shiftRight_eq_div_pow]
step as ⟨i19, hi19⟩
simp [hwsl] at hi19
have hi19v : i19.val = v4.val := by rw [hi19]
step as ⟨i20, hi20⟩
have hi20v : i20.val = 2^48 * (v4.val % 2^16) := by
rw [hi20]
simp [hi19v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨i21, hi21⟩
have hi21add : i18.val ||| i20.val = i18.val + i20.val := by
have hlt : i18.val < 2^48 := by rw [hi18v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := i18.val) (i := 48) hlt (v4.val % 2^16)
calc i18.val ||| i20.val
= i18.val ||| 2^48 * (v4.val % 2^16) := by rw [hi20v]
_ = 2^48 * (v4.val % 2^16) ||| i18.val := Nat.lor_comm _ _
_ = 2^48 * (v4.val % 2^16) + i18.val := hor.symm
_ = i18.val + i20.val := by rw [hi20v]; ring
have hi21v : i21.val = v3.val / 2^16 + 2^48 * (v4.val % 2^16) := by
rw [hi21, UScalar.val_or, hi21add, hi18v, hi20v]
step as ⟨i22, hi22⟩
have hi22v : i22.val = (v3.val / 2^16 + 2^48 * (v4.val % 2^16)) % 2^52 := by
rw [hi22, UScalar.val_and, hmaskv, hi21v, nat_and_mask52]
have hlist : (↑(Array.make 5#usize [ i2, i7, i12, i17, i22 ]) : List U64) = [i2, i7, i12, i17, i22] := by rfl
try simp only [spec_ok]
exact ⟨i2, i7, i12, i17, i22, hlist, hi2v, hi7v, hi12v, hi17v, hi22v⟩
/-- The hi-half 52-bit split: exact div/mod value per limb. -/
theorem split_words_hi_spec (words : Std.Array Std.U64 8#usize)
(v0 v1 v2 v3 v4 v5 v6 v7 : U64)
(hwsl : (↑words : List U64) = [v0, v1, v2, v3, v4, v5, v6, v7]) :
backend.serial.u64.scalar.Scalar52.split_words_hi words
⦃ s => ∃ i3 i8 i13 i18 i20 : U64,
(↑s : List U64) = [i3, i8, i13, i18, i20] ∧
i3.val = v4.val / 2^4 % 2^52 ∧
i8.val = (v4.val / 2^56 + 2^8 * (v5.val % 2^56)) % 2^52 ∧
i13.val = (v5.val / 2^44 + 2^20 * (v6.val % 2^44)) % 2^52 ∧
i18.val = (v6.val / 2^32 + 2^32 * (v7.val % 2^32)) % 2^52 ∧
i20.val = v7.val / 2^20 % 2^52 ⦄ := by
have hsz64 : (U64.size : ℕ) = 2^64 := by scalar_tac
unfold backend.serial.u64.scalar.Scalar52.split_words_hi
have hvb0 : v0.val < 2^64 := by scalar_tac
have hvb1 : v1.val < 2^64 := by scalar_tac
have hvb2 : v2.val < 2^64 := by scalar_tac
have hvb3 : v3.val < 2^64 := by scalar_tac
have hvb4 : v4.val < 2^64 := by scalar_tac
have hvb5 : v5.val < 2^64 := by scalar_tac
have hvb6 : v6.val < 2^64 := by scalar_tac
have hvb7 : v7.val < 2^64 := by scalar_tac
step as ⟨sh, hsh⟩
step as ⟨mask, hmask⟩
have hmaskv : mask.val = 2^52 - 1 := by
simp [hmask, hsh, U64.size_def, U64.numBits]
step as ⟨i1, hi1⟩
simp [hwsl] at hi1
have hi1v : i1.val = v4.val := by rw [hi1]
step as ⟨i2, hi2⟩
have hi2v : i2.val = v4.val / 2^4 := by
rw [hi2, hi1v, Nat.shiftRight_eq_div_pow]
step as ⟨i3, hi3⟩
have hi3v : i3.val = (v4.val / 2^4) % 2^52 := by
rw [hi3, UScalar.val_and, hmaskv, hi2v, nat_and_mask52]
step as ⟨i4, hi4⟩
have hi4v : i4.val = v4.val / 2^56 := by
rw [hi4, hi1v, Nat.shiftRight_eq_div_pow]
step as ⟨i5, hi5⟩
simp [hwsl] at hi5
have hi5v : i5.val = v5.val := by rw [hi5]
step as ⟨i6, hi6⟩
have hi6v : i6.val = 2^8 * (v5.val % 2^56) := by
rw [hi6]
simp [hi5v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨i7, hi7⟩
have hi7add : i4.val ||| i6.val = i4.val + i6.val := by
have hlt : i4.val < 2^8 := by rw [hi4v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := i4.val) (i := 8) hlt (v5.val % 2^56)
calc i4.val ||| i6.val
= i4.val ||| 2^8 * (v5.val % 2^56) := by rw [hi6v]
_ = 2^8 * (v5.val % 2^56) ||| i4.val := Nat.lor_comm _ _
_ = 2^8 * (v5.val % 2^56) + i4.val := hor.symm
_ = i4.val + i6.val := by rw [hi6v]; ring
have hi7v : i7.val = v4.val / 2^56 + 2^8 * (v5.val % 2^56) := by
rw [hi7, UScalar.val_or, hi7add, hi4v, hi6v]
step as ⟨i8, hi8⟩
have hi8v : i8.val = (v4.val / 2^56 + 2^8 * (v5.val % 2^56)) % 2^52 := by
rw [hi8, UScalar.val_and, hmaskv, hi7v, nat_and_mask52]
step as ⟨i9, hi9⟩
have hi9v : i9.val = v5.val / 2^44 := by
rw [hi9, hi5v, Nat.shiftRight_eq_div_pow]
step as ⟨i10, hi10⟩
simp [hwsl] at hi10
have hi10v : i10.val = v6.val := by rw [hi10]
step as ⟨i11, hi11⟩
have hi11v : i11.val = 2^20 * (v6.val % 2^44) := by
rw [hi11]
simp [hi10v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨i12, hi12⟩
have hi12add : i9.val ||| i11.val = i9.val + i11.val := by
have hlt : i9.val < 2^20 := by rw [hi9v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := i9.val) (i := 20) hlt (v6.val % 2^44)
calc i9.val ||| i11.val
= i9.val ||| 2^20 * (v6.val % 2^44) := by rw [hi11v]
_ = 2^20 * (v6.val % 2^44) ||| i9.val := Nat.lor_comm _ _
_ = 2^20 * (v6.val % 2^44) + i9.val := hor.symm
_ = i9.val + i11.val := by rw [hi11v]; ring
have hi12v : i12.val = v5.val / 2^44 + 2^20 * (v6.val % 2^44) := by
rw [hi12, UScalar.val_or, hi12add, hi9v, hi11v]
step as ⟨i13, hi13⟩
have hi13v : i13.val = (v5.val / 2^44 + 2^20 * (v6.val % 2^44)) % 2^52 := by
rw [hi13, UScalar.val_and, hmaskv, hi12v, nat_and_mask52]
step as ⟨i14, hi14⟩
have hi14v : i14.val = v6.val / 2^32 := by
rw [hi14, hi10v, Nat.shiftRight_eq_div_pow]
step as ⟨i15, hi15⟩
simp [hwsl] at hi15
have hi15v : i15.val = v7.val := by rw [hi15]
step as ⟨i16, hi16⟩
have hi16v : i16.val = 2^32 * (v7.val % 2^32) := by
rw [hi16]
simp [hi15v, Nat.shiftLeft_eq, hsz64]
omega
step as ⟨i17, hi17⟩
have hi17add : i14.val ||| i16.val = i14.val + i16.val := by
have hlt : i14.val < 2^32 := by rw [hi14v]; omega
have hor := Nat.two_pow_add_eq_or_of_lt (b := i14.val) (i := 32) hlt (v7.val % 2^32)
calc i14.val ||| i16.val
= i14.val ||| 2^32 * (v7.val % 2^32) := by rw [hi16v]
_ = 2^32 * (v7.val % 2^32) ||| i14.val := Nat.lor_comm _ _
_ = 2^32 * (v7.val % 2^32) + i14.val := hor.symm
_ = i14.val + i16.val := by rw [hi16v]; ring
have hi17v : i17.val = v6.val / 2^32 + 2^32 * (v7.val % 2^32) := by
rw [hi17, UScalar.val_or, hi17add, hi14v, hi16v]
step as ⟨i18, hi18⟩
have hi18v : i18.val = (v6.val / 2^32 + 2^32 * (v7.val % 2^32)) % 2^52 := by
rw [hi18, UScalar.val_and, hmaskv, hi17v, nat_and_mask52]
step as ⟨i19, hi19⟩
have hi19v : i19.val = v7.val / 2^20 := by
rw [hi19, hi15v, Nat.shiftRight_eq_div_pow]
step as ⟨i20, hi20⟩
have hi20v : i20.val = (v7.val / 2^20) % 2^52 := by
rw [hi20, UScalar.val_and, hmaskv, hi19v, nat_and_mask52]
have hlist : (↑(Array.make 5#usize [ i3, i8, i13, i18, i20 ]) : List U64) = [i3, i8, i13, i18, i20] := by rfl
try simp only [spec_ok]
exact ⟨i3, i8, i13, i18, i20, hlist, hi3v, hi8v, hi13v, hi18v, hi20v⟩
/-- The prefix: bytes → words (bytes_unpack_spec) → the lo/hi pair. -/
theorem fbw_parts_spec (bytes : Std.Array Std.U8 64#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63]) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts bytes
⦃ p => ∃ v0 v1 v2 v3 v4 v5 v6 v7 i2 i7 i12 i17 i22 h0 h1 h2 h3 h4 : U64,
(↑p.1 : List U64) = [i2, i7, i12, i17, i22] ∧
(↑p.2 : List U64) = [h0, h1, h2, h3, h4] ∧
v0.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 + b7.val * 2^56 ∧
v1.val = b8.val + b9.val * 2^8 + b10.val * 2^16 + b11.val * 2^24 + b12.val * 2^32 + b13.val * 2^40 + b14.val * 2^48 + b15.val * 2^56 ∧
v2.val = b16.val + b17.val * 2^8 + b18.val * 2^16 + b19.val * 2^24 + b20.val * 2^32 + b21.val * 2^40 + b22.val * 2^48 + b23.val * 2^56 ∧
v3.val = b24.val + b25.val * 2^8 + b26.val * 2^16 + b27.val * 2^24 + b28.val * 2^32 + b29.val * 2^40 + b30.val * 2^48 + b31.val * 2^56 ∧
v4.val = b32.val + b33.val * 2^8 + b34.val * 2^16 + b35.val * 2^24 + b36.val * 2^32 + b37.val * 2^40 + b38.val * 2^48 + b39.val * 2^56 ∧
v5.val = b40.val + b41.val * 2^8 + b42.val * 2^16 + b43.val * 2^24 + b44.val * 2^32 + b45.val * 2^40 + b46.val * 2^48 + b47.val * 2^56 ∧
v6.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 + b54.val * 2^48 + b55.val * 2^56 ∧
v7.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 + b62.val * 2^48 + b63.val * 2^56 ∧
i2.val = v0.val % 2^52 ∧
i7.val = (v0.val / 2^52 + 2^12 * (v1.val % 2^52)) % 2^52 ∧
i12.val = (v1.val / 2^40 + 2^24 * (v2.val % 2^40)) % 2^52 ∧
i17.val = (v2.val / 2^28 + 2^36 * (v3.val % 2^28)) % 2^52 ∧
i22.val = (v3.val / 2^16 + 2^48 * (v4.val % 2^16)) % 2^52 ∧
h0.val = v4.val / 2^4 % 2^52 ∧
h1.val = (v4.val / 2^56 + 2^8 * (v5.val % 2^56)) % 2^52 ∧
h2.val = (v5.val / 2^44 + 2^20 * (v6.val % 2^44)) % 2^52 ∧
h3.val = (v6.val / 2^32 + 2^32 * (v7.val % 2^32)) % 2^52 ∧
h4.val = v7.val / 2^20 % 2^52 ⦄ := by
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts
have hrep : (↑(Array.repeat 8#usize 0#u64) : List U64)
= [0#u64, 0#u64, 0#u64, 0#u64, 0#u64, 0#u64, 0#u64, 0#u64] := by rfl
step with (bytes_unpack_spec bytes (Array.repeat 8#usize 0#u64)
b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63
0#u64 0#u64 0#u64 0#u64 0#u64 0#u64 0#u64 0#u64 hb hrep
⟨rfl, rfl, rfl, rfl, rfl, rfl, rfl, rfl⟩) as
⟨v0, v1, v2, v3, v4, v5, v6, v7, ws, hwsl, hv0, hv1, hv2, hv3, hv4, hv5, hv6, hv7⟩
step with (split_words_lo_spec ws v0 v1 v2 v3 v4 v5 v6 v7 hwsl) as
⟨i2, i7, i12, i17, i22, slo, hlol, hi2v, hi7v, hi12v, hi17v, hi22v⟩
step with (split_words_hi_spec ws v0 v1 v2 v3 v4 v5 v6 v7 hwsl) as
⟨i3, i8, i13, i18, i20, shi, hhil, hi3v, hi8v, hi13v, hi18v, hi20v⟩
try simp only [spec_ok]
exact ⟨v0, v1, v2, v3, v4, v5, v6, v7, i2, i7, i12, i17, i22, i3, i8, i13, i18, i20,
hlol, hhil, hv0, hv1, hv2, hv3, hv4, hv5, hv6, hv7,
hi2v, hi7v, hi12v, hi17v, hi22v, hi3v, hi8v, hi13v, hi18v, hi20v⟩
/-- **Hash-to-scalar is exact reduction mod ℓ.** -/
theorem from_bytes_wide_spec (bytes : Std.Array Std.U8 64#usize)
(b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 : Std.U8)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(T : ℕ) (hT : T = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 + b7.val * 2^56 + b8.val * 2^64 + b9.val * 2^72 + b10.val * 2^80 + b11.val * 2^88 + b12.val * 2^96 + b13.val * 2^104 + b14.val * 2^112 + b15.val * 2^120 + b16.val * 2^128 + b17.val * 2^136 + b18.val * 2^144 + b19.val * 2^152 + b20.val * 2^160 + b21.val * 2^168 + b22.val * 2^176 + b23.val * 2^184 + b24.val * 2^192 + b25.val * 2^200 + b26.val * 2^208 + b27.val * 2^216 + b28.val * 2^224 + b29.val * 2^232 + b30.val * 2^240 + b31.val * 2^248 + b32.val * 2^256 + b33.val * 2^264 + b34.val * 2^272 + b35.val * 2^280 + b36.val * 2^288 + b37.val * 2^296 + b38.val * 2^304 + b39.val * 2^312 + b40.val * 2^320 + b41.val * 2^328 + b42.val * 2^336 + b43.val * 2^344 + b44.val * 2^352 + b45.val * 2^360 + b46.val * 2^368 + b47.val * 2^376 + b48.val * 2^384 + b49.val * 2^392 + b50.val * 2^400 + b51.val * 2^408 + b52.val * 2^416 + b53.val * 2^424 + b54.val * 2^432 + b55.val * 2^440 + b56.val * 2^448 + b57.val * 2^456 + b58.val * 2^464 + b59.val * 2^472 + b60.val * 2^480 + b61.val * 2^488 + b62.val * 2^496 + b63.val * 2^504) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide bytes
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧
s4.val < 2^52) ∧
scVal r < Ell ∧
scDenote r = (T : ZMod Ell) ⦄ := by
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide
apply spec_bind (fbw_parts_spec bytes b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63 hb)
rintro ⟨lo, hi⟩ ⟨v0, v1, v2, v3, v4, v5, v6, v7, i2, i7, i12, i17, i22, i3, i8, i13, i18, i20,
hlol, hhil, hv0, hv1, hv2, hv3, hv4, hv5, hv6, hv7,
hi2v, hi7v, hi12v, hi17v, hi22v, hi3v, hi8v, hi13v, hi18v, hi20v⟩
simp only at hlol hhil
have hvb0 : v0.val < 2^64 := by scalar_tac
have hvb1 : v1.val < 2^64 := by scalar_tac
have hvb2 : v2.val < 2^64 := by scalar_tac
have hvb3 : v3.val < 2^64 := by scalar_tac
have hvb4 : v4.val < 2^64 := by scalar_tac
have hvb5 : v5.val < 2^64 := by scalar_tac
have hvb6 : v6.val < 2^64 := by scalar_tac
have hvb7 : v7.val < 2^64 := by scalar_tac
have hbndi2 : i2.val < 2^52 := by
rw [hi2v]; exact Nat.mod_lt _ (by norm_num)
have hbndi7 : i7.val < 2^52 := by
rw [hi7v]; exact Nat.mod_lt _ (by norm_num)
have hbndi12 : i12.val < 2^52 := by
rw [hi12v]; exact Nat.mod_lt _ (by norm_num)
have hbndi17 : i17.val < 2^52 := by
rw [hi17v]; exact Nat.mod_lt _ (by norm_num)
have hbndi22 : i22.val < 2^52 := by
rw [hi22v]; exact Nat.mod_lt _ (by norm_num)
have hbndi3 : i3.val < 2^52 := by
rw [hi3v]; exact Nat.mod_lt _ (by norm_num)
have hbndi8 : i8.val < 2^52 := by
rw [hi8v]; exact Nat.mod_lt _ (by norm_num)
have hbndi13 : i13.val < 2^52 := by
rw [hi13v]; exact Nat.mod_lt _ (by norm_num)
have hbndi18 : i18.val < 2^52 := by
rw [hi18v]; exact Nat.mod_lt _ (by norm_num)
have hbndi20 : i20.val < 2^52 := by
rw [hi20v]; exact Nat.mod_lt _ (by norm_num)
have hlov : scVal lo = scLimbs i2 i7 i12 i17 i22 := scVal_eq _ _ _ _ _ _ hlol
have hhiv : scVal hi = scLimbs i3 i8 i13 i18 i20 := scVal_eq _ _ _ _ _ _ hhil
have hlolt : scVal lo < 2^260 := by
rw [hlov]; unfold scLimbs
exact nonce_sum_bound hbndi2 hbndi7 hbndi12 hbndi17 hbndi22
have hhilt : scVal hi < 2^260 := by
rw [hhiv]; unfold scLimbs
exact nonce_sum_bound hbndi3 hbndi8 hbndi13 hbndi18 hbndi20
have hcablo : scVal lo * scVal backend.serial.u64.constants.R < 2^260 * Ell :=
Nat.mul_lt_mul'' hlolt R_lt
have hcabhi : scVal hi * scVal backend.serial.u64.constants.RR < 2^260 * Ell :=
Nat.mul_lt_mul'' hhilt RR_lt
have hRl0 : (4302102966953709#u64).val = 4302102966953709 := by rfl
have hRl1 : (1049714374468698#u64).val = 1049714374468698 := by rfl
have hRl2 : (4503599278581019#u64).val = 4503599278581019 := by rfl
have hRl3 : (4503599627370495#u64).val = 4503599627370495 := by rfl
have hRl4 : (17592186044415#u64).val = 17592186044415 := by rfl
have hRRl0 : (2764609938444603#u64).val = 2764609938444603 := by rfl
have hRRl1 : (3768881411696287#u64).val = 3768881411696287 := by rfl
have hRRl2 : (1616719297148420#u64).val = 1616719297148420 := by rfl
have hRRl3 : (1087343033131391#u64).val = 1087343033131391 := by rfl
have hRRl4 : (10175238647962#u64).val = 10175238647962 := by rfl
step with (montgomery_mul_spec lo backend.serial.u64.constants.R
i2 i7 i12 i17 i22
(4302102966953709#u64) (1049714374468698#u64) (4503599278581019#u64)
(4503599627370495#u64) (17592186044415#u64)
hlol R_limbs
⟨hbndi2, hbndi7, hbndi12, hbndi17, hbndi22⟩
⟨by rw [hRl0]; norm_num, by rw [hRl1]; norm_num, by rw [hRl2]; norm_num,
by rw [hRl3]; norm_num, by rw [hRl4]; norm_num⟩
hcablo) as ⟨lo1, hlo1ex, hlo1c, hlo1d⟩
obtain ⟨p0, p1, p2, p3, p4, hlo1l, hp0, hp1, hp2, hp3, hp4⟩ := hlo1ex
step with (montgomery_mul_spec hi backend.serial.u64.constants.RR
i3 i8 i13 i18 i20
(2764609938444603#u64) (3768881411696287#u64) (1616719297148420#u64)
(1087343033131391#u64) (10175238647962#u64)
hhil RR_limbs
⟨hbndi3, hbndi8, hbndi13, hbndi18, hbndi20⟩
⟨by rw [hRRl0]; norm_num, by rw [hRRl1]; norm_num, by rw [hRRl2]; norm_num,
by rw [hRRl3]; norm_num, by rw [hRRl4]; norm_num⟩
hcabhi) as ⟨hi1, hhi1ex, hhi1c, hhi1d⟩
obtain ⟨q0, q1, q2, q3, q4, hhi1l, hq0, hq1, hq2, hq3, hq4⟩ := hhi1ex
apply spec_mono (add_val_spec hi1 lo1 q0 q1 q2 q3 q4 p0 p1 p2 p3 p4 hhi1l hlo1l
⟨hq0, hq1, hq2, hq3, hq4⟩ ⟨hp0, hp1, hp2, hp3, hp4⟩ hhi1c hlo1c)
intro r hr
refine ⟨hr.1, hr.2.1, ?_⟩
rw [hr.2.2]
have hRd : scDenote backend.serial.u64.constants.R = 2^260 := by
simp only [scDenote, R_scVal]; exact R_denote
have hRRd : scDenote backend.serial.u64.constants.RR = 2^520 := by
simp only [scDenote, RR_scVal]; exact RR_denote
have hlo1v : scDenote lo1 = scDenote lo :=
R_isUnit.mul_right_cancel (by rw [hlo1d, hRd])
have hhi1v : scDenote hi1 = scDenote hi * 2^260 :=
R_isUnit.mul_right_cancel (by rw [hhi1d, hRRd]; ring)
have hLOv : scVal lo = v0.val % 2^52 + 2^52 * ((v0.val / 2^52 + 2^12 * (v1.val % 2^52)) % 2^52) + 2^104 * ((v1.val / 2^40 + 2^24 * (v2.val % 2^40)) % 2^52) + 2^156 * ((v2.val / 2^28 + 2^36 * (v3.val % 2^28)) % 2^52) + 2^208 * ((v3.val / 2^16 + 2^48 * (v4.val % 2^16)) % 2^52) := by
rw [hlov]; unfold scLimbs
rw [hi2v, hi7v, hi12v, hi17v, hi22v]
have hHIv : scVal hi = v4.val / 2^4 % 2^52 + 2^52 * ((v4.val / 2^56 + 2^8 * (v5.val % 2^56)) % 2^52) + 2^104 * ((v5.val / 2^44 + 2^20 * (v6.val % 2^44)) % 2^52) + 2^156 * ((v6.val / 2^32 + 2^32 * (v7.val % 2^32)) % 2^52) + 2^208 * (v7.val / 2^20 % 2^52) := by
rw [hhiv]; unfold scLimbs
rw [hi3v, hi8v, hi13v, hi18v, hi20v]
have htel := wide_split_telescope v0.val v1.val v2.val v3.val v4.val v5.val
v6.val v7.val hvb0 hvb1 hvb2 hvb3 hvb4 hvb5 hvb6 hvb7
have hVB : v0.val + 2^64 * v1.val + 2^128 * v2.val + 2^192 * v3.val + 2^256 * v4.val + 2^320 * v5.val + 2^384 * v6.val + 2^448 * v7.val
= b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 + b7.val * 2^56 + b8.val * 2^64 + b9.val * 2^72 + b10.val * 2^80 + b11.val * 2^88 + b12.val * 2^96 + b13.val * 2^104 + b14.val * 2^112 + b15.val * 2^120 + b16.val * 2^128 + b17.val * 2^136 + b18.val * 2^144 + b19.val * 2^152 + b20.val * 2^160 + b21.val * 2^168 + b22.val * 2^176 + b23.val * 2^184 + b24.val * 2^192 + b25.val * 2^200 + b26.val * 2^208 + b27.val * 2^216 + b28.val * 2^224 + b29.val * 2^232 + b30.val * 2^240 + b31.val * 2^248 + b32.val * 2^256 + b33.val * 2^264 + b34.val * 2^272 + b35.val * 2^280 + b36.val * 2^288 + b37.val * 2^296 + b38.val * 2^304 + b39.val * 2^312 + b40.val * 2^320 + b41.val * 2^328 + b42.val * 2^336 + b43.val * 2^344 + b44.val * 2^352 + b45.val * 2^360 + b46.val * 2^368 + b47.val * 2^376 + b48.val * 2^384 + b49.val * 2^392 + b50.val * 2^400 + b51.val * 2^408 + b52.val * 2^416 + b53.val * 2^424 + b54.val * 2^432 + b55.val * 2^440 + b56.val * 2^448 + b57.val * 2^456 + b58.val * 2^464 + b59.val * 2^472 + b60.val * 2^480 + b61.val * 2^488 + b62.val * 2^496 + b63.val * 2^504 := by
rw [hv0, hv1, hv2, hv3, hv4, hv5, hv6, hv7]; ring
have hT2 : T = 2^260 * scVal hi + scVal lo := by
rw [hT, ← hVB, hHIv, hLOv, ← htel]
exact Nat.add_comm _ _
rw [hhi1v, hlo1v, hT2]
simp only [scDenote]
push_cast
ring
end ScalarProofs

22
verification/Proofs/ScalarUnpackSpec.lean
View file

@ -21,7 +21,7 @@ theorem bytes_unpack_spec (bytes : Std.Array Std.U8 64#usize)
(hb : (↑bytes : List Std.U8) = [b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49, b50, b51, b52, b53, b54, b55, b56, b57, b58, b59, b60, b61, b62, b63])
(hw : (↑words : List U64) = [w0, w1, w2, w3, w4, w5, w6, w7])
(hz : w0.val = 0 ∧ w1.val = 0 ∧ w2.val = 0 ∧ w3.val = 0 ∧ w4.val = 0 ∧ w5.val = 0 ∧ w6.val = 0 ∧ w7.val = 0) :
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0 { start := 0#usize, «end» := 8#usize } bytes words
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0 { start := 0#usize, «end» := 8#usize } bytes words
⦃ ws => ∃ v0 v1 v2 v3 v4 v5 v6 v7 : U64,
(↑ws : List U64) = [v0, v1, v2, v3, v4, v5, v6, v7] ∧
v0.val = b0.val + b1.val * 2^8 + b2.val * 2^16 + b3.val * 2^24 + b4.val * 2^32 + b5.val * 2^40 + b6.val * 2^48 + b7.val * 2^56 ∧
@ -33,10 +33,10 @@ theorem bytes_unpack_spec (bytes : Std.Array Std.U8 64#usize)
v6.val = b48.val + b49.val * 2^8 + b50.val * 2^16 + b51.val * 2^24 + b52.val * 2^32 + b53.val * 2^40 + b54.val * 2^48 + b55.val * 2^56 ∧
v7.val = b56.val + b57.val * 2^8 + b58.val * 2^16 + b59.val * 2^24 + b60.val * 2^32 + b61.val * 2^40 + b62.val * 2^48 + b63.val * 2^56 ⦄ := by
obtain ⟨hz0, hz1, hz2, hz3, hz4, hz5, hz6, hz7⟩ := hz
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0
unfold backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0
-- outer iteration 0
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body]
step with range_next_lt_spec as ⟨o0, iter0, ho0, hs0, he0⟩
simp only [ho0]
step with (bytes_word_loop_spec_0 bytes words b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15 b16 b17 b18 b19 b20 b21 b22 b23 b24 b25 b26 b27 b28 b29 b30 b31 b32 b33 b34 b35 b36 b37 b38 b39 b40 b41 b42 b43 b44 b45 b46 b47 b48 b49 b50 b51 b52 b53 b54 b55 b56 b57 b58 b59 b60 b61 b62 b63
@ -44,7 +44,7 @@ theorem bytes_unpack_spec (bytes : Std.Array Std.U8 64#usize)
try simp only [spec_ok]
-- outer iteration 1
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body]
step with (range_next_lt_spec iter0 (by simp [hs0, he0]; all_goals scalar_tac)) as ⟨o1, iter1, ho1, hs1, he1⟩
simp only [ho1]
have hidx1 : iter0.start = 1#usize := by
@ -56,7 +56,7 @@ theorem bytes_unpack_spec (bytes : Std.Array Std.U8 64#usize)
try simp only [spec_ok]
-- outer iteration 2
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body]
step with (range_next_lt_spec iter1 (by simp [hs0, he0, hs1, he1]; all_goals scalar_tac)) as ⟨o2, iter2, ho2, hs2, he2⟩
simp only [ho2]
have hidx2 : iter1.start = 2#usize := by
@ -68,7 +68,7 @@ theorem bytes_unpack_spec (bytes : Std.Array Std.U8 64#usize)
try simp only [spec_ok]
-- outer iteration 3
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body]
step with (range_next_lt_spec iter2 (by simp [hs0, he0, hs1, he1, hs2, he2]; all_goals scalar_tac)) as ⟨o3, iter3, ho3, hs3, he3⟩
simp only [ho3]
have hidx3 : iter2.start = 3#usize := by
@ -80,7 +80,7 @@ theorem bytes_unpack_spec (bytes : Std.Array Std.U8 64#usize)
try simp only [spec_ok]
-- outer iteration 4
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body]
step with (range_next_lt_spec iter3 (by simp [hs0, he0, hs1, he1, hs2, he2, hs3, he3]; all_goals scalar_tac)) as ⟨o4, iter4, ho4, hs4, he4⟩
simp only [ho4]
have hidx4 : iter3.start = 4#usize := by
@ -92,7 +92,7 @@ theorem bytes_unpack_spec (bytes : Std.Array Std.U8 64#usize)
try simp only [spec_ok]
-- outer iteration 5
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body]
step with (range_next_lt_spec iter4 (by simp [hs0, he0, hs1, he1, hs2, he2, hs3, he3, hs4, he4]; all_goals scalar_tac)) as ⟨o5, iter5, ho5, hs5, he5⟩
simp only [ho5]
have hidx5 : iter4.start = 5#usize := by
@ -104,7 +104,7 @@ theorem bytes_unpack_spec (bytes : Std.Array Std.U8 64#usize)
try simp only [spec_ok]
-- outer iteration 6
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body]
step with (range_next_lt_spec iter5 (by simp [hs0, he0, hs1, he1, hs2, he2, hs3, he3, hs4, he4, hs5, he5]; all_goals scalar_tac)) as ⟨o6, iter6, ho6, hs6, he6⟩
simp only [ho6]
have hidx6 : iter5.start = 6#usize := by
@ -116,7 +116,7 @@ theorem bytes_unpack_spec (bytes : Std.Array Std.U8 64#usize)
try simp only [spec_ok]
-- outer iteration 7
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body]
step with (range_next_lt_spec iter6 (by simp [hs0, he0, hs1, he1, hs2, he2, hs3, he3, hs4, he4, hs5, he5, hs6, he6]; all_goals scalar_tac)) as ⟨o7, iter7, ho7, hs7, he7⟩
simp only [ho7]
have hidx7 : iter6.start = 7#usize := by
@ -128,7 +128,7 @@ theorem bytes_unpack_spec (bytes : Std.Array Std.U8 64#usize)
try simp only [spec_ok]
-- exit (8 ≥ 8)
apply loop_step
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body]
simp only [backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body]
step with (range_next_ge_spec iter7 (by simp [hs0, he0, hs1, he1, hs2, he2, hs3, he3, hs4, he4, hs5, he5, hs6, he6, hs7, he7]; all_goals scalar_tac)) as ⟨oX, iterX, hoX, hrX⟩
simp only [hoX]
try simp only [spec_ok]

8
verification/check-scalar.sh
View file

@ -7,7 +7,7 @@ source ~/aeneas-toolchain/env.sh
HERE="$(cd "$(dirname "$0")" && pwd)"
AENEAS_LEAN="$AENEAS_HOME/backends/lean"
GEN=(CurveScalar/TypesExternal CurveScalar/Types CurveScalar/FunsExternal CurveScalar/Funs)
PROOFS=(ScalarDenote ScalarLoop ScalarSubSpec ScalarAddSpec ScalarMulSpec ScalarMontSpec ScalarReduceSpec ScalarFullMulSpec ScalarMain ScalarWideSpec ScalarBytesSpec ScalarUnpackSpec)
PROOFS=(ScalarDenote ScalarLoop ScalarSubSpec ScalarAddSpec ScalarMulSpec ScalarMontSpec ScalarReduceSpec ScalarFullMulSpec ScalarMain ScalarWideSpec ScalarBytesSpec ScalarUnpackSpec ScalarFromBytesSpec)
echo "=== stub/axiom audit ==="
grep -rnE '^(private |protected |noncomputable )*axiom ' "$HERE"/Proofs/Scalar*.lean 2>/dev/null && { echo "axiom under Proofs/"; exit 1; }
@ -28,15 +28,15 @@ lake env bash -c "
export LEAN_PATH=\"\$LEAN_PATH:$HERE/gen:$HERE\"
cd '$HERE'
AUD=\$(mktemp '$HERE/.audit-scalar-XXXX.lean')
{ echo 'import Proofs.ScalarMain'; echo 'import Proofs.ScalarWideSpec'; echo 'import Proofs.ScalarUnpackSpec'; echo '#print axioms ScalarProofs.L_val'
{ echo 'import Proofs.ScalarMain'; echo 'import Proofs.ScalarWideSpec'; echo 'import Proofs.ScalarUnpackSpec'; echo 'import Proofs.ScalarFromBytesSpec'; echo '#print axioms ScalarProofs.L_val'
echo '#print axioms ScalarProofs.sub_loop_spec'
echo '#print axioms ScalarProofs.sub_loop1_one_spec'; echo '#print axioms ScalarProofs.sub_val_spec'; echo '#print axioms ScalarProofs.add_val_spec'; echo '#print axioms ScalarProofs.mul_internal_spec'
echo '#print axioms ScalarProofs.part1_spec'; echo '#print axioms ScalarProofs.montgomery_reduce_spec'; echo '#print axioms ScalarProofs.mul_spec'; echo '#print axioms ScalarProofs.scalarImplementation'; echo '#print axioms ScalarProofs.montgomery_mul_spec'; echo '#print axioms ScalarProofs.bytes_unpack_spec'; } > \"\$AUD\"
echo '#print axioms ScalarProofs.part1_spec'; echo '#print axioms ScalarProofs.montgomery_reduce_spec'; echo '#print axioms ScalarProofs.mul_spec'; echo '#print axioms ScalarProofs.scalarImplementation'; echo '#print axioms ScalarProofs.montgomery_mul_spec'; echo '#print axioms ScalarProofs.bytes_unpack_spec'; echo '#print axioms ScalarProofs.from_bytes_wide_spec'; } > \"\$AUD\"
OUT=\$(LEAN_TIMEOUT=120 LEAN_MEM_MB=4096 '$HERE/lean-guard' \"\$AUD\" 2>&1)
echo \"\$OUT\"
rm -f \"\$AUD\" \"\${AUD%.lean}.olean\"
N=\$(echo \"\$OUT\" | grep -cF \"depends on axioms: [propext, Classical.choice, Quot.sound]\" || true)
[ \"\$N\" -eq 12 ] || { echo \"AXIOM AUDIT FAILED: \$N/12 clean\"; exit 1; }
[ \"\$N\" -eq 13 ] || { echo \"AXIOM AUDIT FAILED: \$N/13 clean\"; exit 1; }
" || { echo FAIL; exit 1; }
echo " L_val axiom-clean"

365
verification/gen/CurveScalar/Funs.lean
View file

@ -90,8 +90,157 @@ def backend.serial.u64.scalar.Scalar52.ZERO
let a := Array.repeat 5#usize 0#u64
a
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::split_words_lo]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 95:4-104:5 -/
def backend.serial.u64.scalar.Scalar52.split_words_lo
(words : Array Std.U64 8#usize) :
Result backend.serial.u64.scalar.Scalar52
:= do
let i ← 1#u64 <<< 52#i32
let mask ← i - 1#u64
let i1 ← Array.index_usize words 0#usize
let i2 ← lift (i1 &&& mask)
let i3 ← i1 >>> 52#i32
let i4 ← Array.index_usize words 1#usize
let i5 ← i4 <<< 12#i32
let i6 ← lift (i3 ||| i5)
let i7 ← lift (i6 &&& mask)
let i8 ← i4 >>> 40#i32
let i9 ← Array.index_usize words 2#usize
let i10 ← i9 <<< 24#i32
let i11 ← lift (i8 ||| i10)
let i12 ← lift (i11 &&& mask)
let i13 ← i9 >>> 28#i32
let i14 ← Array.index_usize words 3#usize
let i15 ← i14 <<< 36#i32
let i16 ← lift (i13 ||| i15)
let i17 ← lift (i16 &&& mask)
let i18 ← i14 >>> 16#i32
let i19 ← Array.index_usize words 4#usize
let i20 ← i19 <<< 48#i32
let i21 ← lift (i18 ||| i20)
let i22 ← lift (i21 &&& mask)
ok (Array.make 5#usize [ i2, i7, i12, i17, i22 ])
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::split_words_hi]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 107:4-116:5 -/
def backend.serial.u64.scalar.Scalar52.split_words_hi
(words : Array Std.U64 8#usize) :
Result backend.serial.u64.scalar.Scalar52
:= do
let i ← 1#u64 <<< 52#i32
let mask ← i - 1#u64
let i1 ← Array.index_usize words 4#usize
let i2 ← i1 >>> 4#i32
let i3 ← lift (i2 &&& mask)
let i4 ← i1 >>> 56#i32
let i5 ← Array.index_usize words 5#usize
let i6 ← i5 <<< 8#i32
let i7 ← lift (i4 ||| i6)
let i8 ← lift (i7 &&& mask)
let i9 ← i5 >>> 44#i32
let i10 ← Array.index_usize words 6#usize
let i11 ← i10 <<< 20#i32
let i12 ← lift (i9 ||| i11)
let i13 ← lift (i12 &&& mask)
let i14 ← i10 >>> 32#i32
let i15 ← Array.index_usize words 7#usize
let i16 ← i15 <<< 32#i32
let i17 ← lift (i14 ||| i16)
let i18 ← lift (i17 &&& mask)
let i19 ← i15 >>> 20#i32
let i20 ← lift (i19 &&& mask)
ok (Array.make 5#usize [ i3, i8, i13, i18, i20 ])
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide_parts]: loop body 1:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 129:12-131:13 -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body
(bytes : Array Std.U8 64#usize) (i : Std.Usize)
(iter : core.ops.range.Range Std.Usize) (words : Array Std.U64 8#usize) :
Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array Std.U64
8#usize)) (Array Std.U64 8#usize))
:= do
let (o, iter1) ←
core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
match o with
| none => ok (done words)
| some j =>
let i1 ← i * 8#usize
let i2 ← i1 + j
let i3 ← Array.index_usize bytes i2
let i4 ← lift (UScalar.cast .U64 i3)
let i5 ← j * 8#usize
let i6 ← i4 <<< i5
let i7 ← Array.index_usize words i
let i8 ← lift (i7 ||| i6)
let a ← Array.update words i i8
ok (cont (iter1, a))
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide_parts]: loop 1:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 129:12-131:13 -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
(iter : core.ops.range.Range Std.Usize) (bytes : Array Std.U8 64#usize)
(words : Array Std.U64 8#usize) (i : Std.Usize) :
Result (Array Std.U64 8#usize)
:= do
loop
(fun (iter1, words1) =>
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body
bytes i iter1 words1)
(iter, words)
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide_parts]: loop body 0:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 128:8-132:9 -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body
(bytes : Array Std.U8 64#usize) (iter : core.ops.range.Range Std.Usize)
(words : Array Std.U64 8#usize) :
Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array Std.U64
8#usize)) (Array Std.U64 8#usize))
:= do
let (o, iter1) ←
core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
match o with
| none => ok (done words)
| some i =>
let words1 ←
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
{ start := 0#usize, «end» := 8#usize } bytes words i
ok (cont (iter1, words1))
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide_parts]: loop 0:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 128:8-132:9 -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0
(iter : core.ops.range.Range Std.Usize) (bytes : Array Std.U8 64#usize)
(words : Array Std.U64 8#usize) :
Result (Array Std.U64 8#usize)
:= do
loop
(fun (iter1, words1) =>
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body bytes
iter1 words1)
(iter, words)
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide_parts]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 126:4-134:5 -/
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts
(bytes : Array Std.U8 64#usize) :
Result (backend.serial.u64.scalar.Scalar52 ×
backend.serial.u64.scalar.Scalar52)
:= do
let words := Array.repeat 8#usize 0#u64
let words1 ←
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0
{ start := 0#usize, «end» := 8#usize } bytes words
let s ← backend.serial.u64.scalar.Scalar52.split_words_lo words1
let s1 ← backend.serial.u64.scalar.Scalar52.split_words_hi words1
ok (s, s1)
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce::part2]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 266:8-269:9 -/
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 289:8-292:9 -/
def backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2
(sum : Std.U128) : Result (Std.U128 × Std.U64) := do
let i ← lift (UScalar.cast .U64 sum)
@ -102,7 +251,7 @@ def backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2
ok (i3, w)
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce::part1]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 260:8-263:9 -/
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 283:8-286:9 -/
def backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1
(sum : Std.U128) : Result (Std.U128 × Std.U64) := do
let i ← lift (UScalar.cast .U64 sum)
@ -120,7 +269,7 @@ def backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1
ok (i7, p)
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop body 0:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 193:8-196:9
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 216:8-219:9
Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.sub_loop0.body
@ -154,7 +303,7 @@ def backend.serial.u64.scalar.Scalar52.sub_loop0.body
ok (cont (iter1, difference1, borrow1))
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop 0:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 193:8-196:9
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 216:8-219:9
Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.sub_loop0
@ -172,7 +321,7 @@ def backend.serial.u64.scalar.Scalar52.sub_loop0
(iter, difference, borrow)
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop body 1:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 0:0-206:9
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 0:0-229:9
Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.sub_loop1.body
@ -207,7 +356,7 @@ def backend.serial.u64.scalar.Scalar52.sub_loop1.body
ok (cont (iter1, difference1, carry1))
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop 1:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 0:0-206:9
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 0:0-229:9
Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.sub_loop1
@ -223,7 +372,7 @@ def backend.serial.u64.scalar.Scalar52.sub_loop1
(iter, difference, carry)
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 179:4-209:5
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 202:4-232:5
Visibility: public -/
def backend.serial.u64.scalar.Scalar52.sub
(a : backend.serial.u64.scalar.Scalar52)
@ -244,7 +393,7 @@ def backend.serial.u64.scalar.Scalar52.sub
0#u64
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 257:4-290:5 -/
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 280:4-313:5 -/
def backend.serial.u64.scalar.Scalar52.montgomery_reduce
(limbs : Array Std.U128 9#usize) :
Result backend.serial.u64.scalar.Scalar52
@ -328,7 +477,7 @@ def backend.serial.u64.scalar.Scalar52.montgomery_reduce
(Array.make 5#usize [ r0, r1, r2, r3, r4 ]) backend.serial.u64.constants.L
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::mul_internal]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 214:4-228:5 -/
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 237:4-251:5 -/
def backend.serial.u64.scalar.Scalar52.mul_internal
(a : backend.serial.u64.scalar.Scalar52)
(b : backend.serial.u64.scalar.Scalar52) :
@ -417,7 +566,7 @@ def backend.serial.u64.scalar.Scalar52.mul_internal
Array.update z8 8#usize i50
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_mul]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 309:4-311:5
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 332:4-334:5
Visibility: public -/
def backend.serial.u64.scalar.Scalar52.montgomery_mul
(a : backend.serial.u64.scalar.Scalar52)
@ -428,7 +577,7 @@ def backend.serial.u64.scalar.Scalar52.montgomery_mul
backend.serial.u64.scalar.Scalar52.montgomery_reduce a1
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]: loop body 0:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 169:8-172:9
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 192:8-195:9
Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.add_loop.body
@ -462,7 +611,7 @@ def backend.serial.u64.scalar.Scalar52.add_loop.body
ok (cont (iter1, sum1, carry1))
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]: loop 0:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 169:8-172:9
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 192:8-195:9
Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.add_loop
@ -480,7 +629,7 @@ def backend.serial.u64.scalar.Scalar52.add_loop
(iter, sum, carry)
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 163:4-176:5
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 186:4-199:5
Visibility: public -/
def backend.serial.u64.scalar.Scalar52.add
(a : backend.serial.u64.scalar.Scalar52)
@ -495,183 +644,25 @@ def backend.serial.u64.scalar.Scalar52.add
backend.serial.u64.scalar.Scalar52.ZERO mask 0#u64
backend.serial.u64.scalar.Scalar52.sub sum backend.serial.u64.constants.L
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide]: loop body 1:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 91:12-93:13
Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body
(bytes : Array Std.U8 64#usize) (i : Std.Usize)
(iter : core.ops.range.Range Std.Usize) (words : Array Std.U64 8#usize) :
Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array Std.U64
8#usize)) (Array Std.U64 8#usize))
:= do
let (o, iter1) ←
core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
match o with
| none => ok (done words)
| some j =>
let i1 ← i * 8#usize
let i2 ← i1 + j
let i3 ← Array.index_usize bytes i2
let i4 ← lift (UScalar.cast .U64 i3)
let i5 ← j * 8#usize
let i6 ← i4 <<< i5
let i7 ← Array.index_usize words i
let i8 ← lift (i7 ||| i6)
let a ← Array.update words i i8
ok (cont (iter1, a))
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide]: loop 1:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 91:12-93:13
Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
(iter : core.ops.range.Range Std.Usize) (bytes : Array Std.U8 64#usize)
(words : Array Std.U64 8#usize) (i : Std.Usize) :
Result (Array Std.U64 8#usize)
:= do
loop
(fun (iter1, words1) =>
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body bytes
i iter1 words1)
(iter, words)
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide]: loop body 0:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 90:8-94:9
Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body
(bytes : Array Std.U8 64#usize) (iter : core.ops.range.Range Std.Usize)
(words : Array Std.U64 8#usize) :
Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array Std.U64
8#usize)) (Array Std.U64 8#usize))
:= do
let (o, iter1) ←
core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
match o with
| none => ok (done words)
| some i =>
let words1 ←
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
{ start := 0#usize, «end» := 8#usize } bytes words i
ok (cont (iter1, words1))
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide]: loop 0:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 90:8-94:9
Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0
(iter : core.ops.range.Range Std.Usize) (bytes : Array Std.U8 64#usize)
(words : Array Std.U64 8#usize) :
Result (Array Std.U64 8#usize)
:= do
loop
(fun (iter1, words1) =>
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body bytes iter1
words1)
(iter, words)
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 88:4-118:5
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 136:4-141:5
Visibility: public -/
def backend.serial.u64.scalar.Scalar52.from_bytes_wide
(bytes : Array Std.U8 64#usize) :
Result backend.serial.u64.scalar.Scalar52
:= do
let words := Array.repeat 8#usize 0#u64
let words1 ←
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0
{ start := 0#usize, «end» := 8#usize } bytes words
let i ← 1#u64 <<< 52#i32
let mask ← i - 1#u64
let i1 ← Array.index_usize words1 0#usize
let (_, index_mut_back) ←
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
backend.serial.u64.scalar.Scalar52.ZERO 0#usize
let i2 ← lift (i1 &&& mask)
let i3 ← i1 >>> 52#i32
let i4 ← Array.index_usize words1 1#usize
let i5 ← i4 <<< 12#i32
let i6 ← lift (i3 ||| i5)
let lo := index_mut_back i2
let (_, index_mut_back1) ←
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
lo 1#usize
let i7 ← lift (i6 &&& mask)
let i8 ← i4 >>> 40#i32
let i9 ← Array.index_usize words1 2#usize
let i10 ← i9 <<< 24#i32
let i11 ← lift (i8 ||| i10)
let lo1 := index_mut_back1 i7
let (_, index_mut_back2) ←
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
lo1 2#usize
let i12 ← lift (i11 &&& mask)
let i13 ← i9 >>> 28#i32
let i14 ← Array.index_usize words1 3#usize
let i15 ← i14 <<< 36#i32
let i16 ← lift (i13 ||| i15)
let lo2 := index_mut_back2 i12
let (_, index_mut_back3) ←
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
lo2 3#usize
let i17 ← lift (i16 &&& mask)
let i18 ← i14 >>> 16#i32
let i19 ← Array.index_usize words1 4#usize
let i20 ← i19 <<< 48#i32
let i21 ← lift (i18 ||| i20)
let lo3 := index_mut_back3 i17
let (_, index_mut_back4) ←
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
lo3 4#usize
let i22 ← lift (i21 &&& mask)
let i23 ← i19 >>> 4#i32
let i24 ← lift (i23 &&& mask)
let i25 ← i19 >>> 56#i32
let i26 ← Array.index_usize words1 5#usize
let i27 ← i26 <<< 8#i32
let i28 ← lift (i25 ||| i27)
let hi := index_mut_back i24
let (_, index_mut_back5) ←
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
hi 1#usize
let i29 ← lift (i28 &&& mask)
let i30 ← i26 >>> 44#i32
let i31 ← Array.index_usize words1 6#usize
let i32 ← i31 <<< 20#i32
let i33 ← lift (i30 ||| i32)
let hi1 := index_mut_back5 i29
let (_, index_mut_back6) ←
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
hi1 2#usize
let i34 ← lift (i33 &&& mask)
let i35 ← i31 >>> 32#i32
let i36 ← Array.index_usize words1 7#usize
let i37 ← i36 <<< 32#i32
let i38 ← lift (i35 ||| i37)
let hi2 := index_mut_back6 i34
let (_, index_mut_back7) ←
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
hi2 3#usize
let i39 ← lift (i38 &&& mask)
let i40 ← i36 >>> 20#i32
let hi3 := index_mut_back7 i39
let (_, index_mut_back8) ←
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
hi3 4#usize
let i41 ← lift (i40 &&& mask)
let lo4 := index_mut_back4 i22
let lo5 ←
backend.serial.u64.scalar.Scalar52.montgomery_mul lo4
let (lo, hi) ←
backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts bytes
let lo1 ←
backend.serial.u64.scalar.Scalar52.montgomery_mul lo
backend.serial.u64.constants.R
let hi4 := index_mut_back8 i41
let hi5 ←
backend.serial.u64.scalar.Scalar52.montgomery_mul hi4
let hi1 ←
backend.serial.u64.scalar.Scalar52.montgomery_mul hi
backend.serial.u64.constants.RR
backend.serial.u64.scalar.Scalar52.add hi5 lo5
backend.serial.u64.scalar.Scalar52.add hi1 lo1
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::square_internal]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 233:4-252:5 -/
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 256:4-275:5 -/
def backend.serial.u64.scalar.Scalar52.square_internal
(a : backend.serial.u64.scalar.Scalar52) :
Result (Array Std.U128 9#usize)
@ -723,7 +714,7 @@ def backend.serial.u64.scalar.Scalar52.square_internal
ok (Array.make 9#usize [ i8, i10, i13, i17, i23, i27, i30, i32, i33 ])
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::mul]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 294:4-297:5
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 317:4-320:5
Visibility: public -/
def backend.serial.u64.scalar.Scalar52.mul
(a : backend.serial.u64.scalar.Scalar52)
@ -738,7 +729,7 @@ def backend.serial.u64.scalar.Scalar52.mul
backend.serial.u64.scalar.Scalar52.montgomery_reduce a2
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::square]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 302:4-305:5
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 325:4-328:5
Visibility: public -/
def backend.serial.u64.scalar.Scalar52.square
(self : backend.serial.u64.scalar.Scalar52) :
@ -752,7 +743,7 @@ def backend.serial.u64.scalar.Scalar52.square
backend.serial.u64.scalar.Scalar52.montgomery_reduce a1
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_square]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 315:4-317:5
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 338:4-340:5
Visibility: public -/
def backend.serial.u64.scalar.Scalar52.montgomery_square
(self : backend.serial.u64.scalar.Scalar52) :
@ -762,7 +753,7 @@ def backend.serial.u64.scalar.Scalar52.montgomery_square
backend.serial.u64.scalar.Scalar52.montgomery_reduce a
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::as_montgomery]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 321:4-323:5
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 344:4-346:5
Visibility: public -/
def backend.serial.u64.scalar.Scalar52.as_montgomery
(self : backend.serial.u64.scalar.Scalar52) :
@ -772,7 +763,7 @@ def backend.serial.u64.scalar.Scalar52.as_montgomery
backend.serial.u64.constants.RR
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_montgomery]: loop body 0:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 330:8-332:9
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 353:8-355:9
Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.from_montgomery_loop.body
@ -794,7 +785,7 @@ def backend.serial.u64.scalar.Scalar52.from_montgomery_loop.body
ok (cont (iter1, a))
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_montgomery]: loop 0:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 330:8-332:9
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 353:8-355:9
Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.from_montgomery_loop
@ -810,7 +801,7 @@ def backend.serial.u64.scalar.Scalar52.from_montgomery_loop
(iter, limbs)
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_montgomery]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 328:4-334:5
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 351:4-357:5
Visibility: public -/
def backend.serial.u64.scalar.Scalar52.from_montgomery
(self : backend.serial.u64.scalar.Scalar52) :

2
verification/gen/CurveScalar/FunsExternal_Template.lean
View file

@ -16,7 +16,7 @@ set_option maxRecDepth 2048
open curve25519_dalek
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub::black_box]:
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 182:8-186:9 -/
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 205:8-209:9 -/
axiom backend.serial.u64.scalar.Scalar52.sub.black_box
: Std.U64 → Result Std.U64