mirror of
https://github.com/saymrwulf/risc0-ed25519-verified.git
synced 2026-09-03 19:53:45 +00:00
Signature layer, first bricks: canonicity closure + hash-to-scalar foundation
Canonicity pass (the layer is now closed under its own preconditions): - sub_val_spec post carries the exact value equation (exists beta <= 1, scVal r + scVal b = scVal a + ell*beta, with the underflow guard beta = 1 -> scVal a < scVal b) - add/montgomery_reduce/mul/aggregate posts all carry scVal r < ell: canonical inputs give canonical outputs everywhere. Needed because from_bytes_wide (hash-to-scalar) feeds Montgomery outputs into add. Hash-to-scalar foundation (toward Scalar::from_hash / EdDSA verify): - extraction scope + from_bytes_wide (brings constants::R); regenerated gen - source repos carry a documented Aeneas-compat patch: the bare `hi[4] = words[7] >> 20` extracts ill-typed at pin bf13c42e; masked (semantic no-op, words[7] >> 20 < 2^44) - Proofs/ScalarWideSpec.lean: R constant lemmas (R = 2^260 mod ell, witness 2^260 = R + 255*ell) and montgomery_mul_spec, the single Montgomery round: [r]*2^260 = [a]*[b], canonical bounded output check-scalar.sh: 10 proof files, 11 kernel audits, all exactly [propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
This commit is contained in:
parent
82ee511277
commit
84da3793db
12 changed files with 653 additions and 261 deletions
File diff suppressed because one or more lines are too long
|
|
@ -5,7 +5,7 @@
|
|||
The value spec for the transpiled `Scalar52::add`: for limb-bounded,
|
||||
canonical inputs (scVal < ℓ), `add a b` denotes ⟦a⟧ + ⟦b⟧ in ZMod ℓ.
|
||||
|
||||
RUST ANALOG (curve25519-dalek v4.1.x fork, scalar.rs:161-174)
|
||||
RUST ANALOG (curve25519-dalek v5, scalar.rs:161-174)
|
||||
let mut sum = Scalar52::ZERO; let mask = (1u64 << 52) - 1;
|
||||
let mut carry: u64 = 0;
|
||||
for i in 0..5 { carry = a[i] + b[i] + (carry >> 52); sum[i] = carry & mask; }
|
||||
|
|
@ -228,6 +228,7 @@ theorem add_val_spec (a b : Sc)
|
|||
backend.serial.u64.scalar.Scalar52.add a b
|
||||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧ s4.val < 2^52) ∧
|
||||
scVal r < Ell ∧
|
||||
scDenote r = scDenote a + scDenote b ⦄ := by
|
||||
obtain ⟨hA0, hA1, hA2, hA3, hA4⟩ := hab
|
||||
obtain ⟨hB0, hB1, hB2, hB3, hB4⟩ := hbb
|
||||
|
|
@ -245,6 +246,7 @@ theorem add_val_spec (a b : Sc)
|
|||
show backend.serial.u64.scalar.Scalar52.sub sum backend.serial.u64.constants.L
|
||||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧ s4.val < 2^52) ∧
|
||||
scVal r < Ell ∧
|
||||
scDenote r = scDenote a + scDenote b ⦄
|
||||
-- telescope: scLimbs sum + 2^260·γ5 = scVal a + scVal b; canonicity kills γ5
|
||||
have hsva : scVal a = scLimbs a0 a1 a2 a3 a4 := scVal_eq a a0 a1 a2 a3 a4 ha
|
||||
|
|
@ -273,12 +275,21 @@ theorem add_val_spec (a b : Sc)
|
|||
(by refine ⟨?_, ?_, ?_, ?_, ?_⟩ <;> norm_num)
|
||||
(by rw [L_val]))
|
||||
intro r hr
|
||||
refine ⟨hr.1, ?_⟩
|
||||
rw [hr.2]
|
||||
have hL0 : scDenote backend.serial.u64.constants.L = 0 := by
|
||||
simp only [scDenote, L_val]; exact ZMod.natCast_self Ell
|
||||
have hsd : scDenote sum = scDenote a + scDenote b := by
|
||||
simp only [scDenote, hsum]; push_cast; ring
|
||||
rw [hL0, hsd]; ring
|
||||
obtain ⟨hbnds, ⟨β, hβle, heq, hguard⟩, hden⟩ := hr
|
||||
rw [L_val] at heq
|
||||
refine ⟨hbnds, ?_, ?_⟩
|
||||
· -- canonicity: the trailing sub L leaves a value below ℓ
|
||||
rcases Nat.le_one_iff_eq_zero_or_eq_one.mp hβle with h0 | h1
|
||||
· subst h0; omega
|
||||
· subst h1
|
||||
have hlt := hguard rfl
|
||||
rw [L_val] at hlt
|
||||
omega
|
||||
· rw [hden]
|
||||
have hL0 : scDenote backend.serial.u64.constants.L = 0 := by
|
||||
simp only [scDenote, L_val]; exact ZMod.natCast_self Ell
|
||||
have hsd : scDenote sum = scDenote a + scDenote b := by
|
||||
simp only [scDenote, hsum]; push_cast; ring
|
||||
rw [hL0, hsd]; ring
|
||||
|
||||
end ScalarProofs
|
||||
|
|
|
|||
|
|
@ -100,6 +100,7 @@ theorem mul_spec (a b : Sc)
|
|||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧
|
||||
s4.val < 2^52) ∧
|
||||
scVal r < Ell ∧
|
||||
scDenote r = scDenote a * scDenote b ⦄ := by
|
||||
obtain ⟨hA0, hA1, hA2, hA3, hA4⟩ := hab
|
||||
obtain ⟨hB0, hB1, hB2, hB3, hB4⟩ := hbb
|
||||
|
|
@ -117,6 +118,7 @@ theorem mul_spec (a b : Sc)
|
|||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧
|
||||
s4.val < 2^52) ∧
|
||||
scVal r < Ell ∧
|
||||
scDenote r = scDenote a * scDenote b ⦄
|
||||
-- column bounds and the column value identity
|
||||
have hzb0 : z0.val < 2^107 := by
|
||||
|
|
@ -156,7 +158,7 @@ theorem mul_spec (a b : Sc)
|
|||
-- ── first reduction: ⟦ab'⟧·R = a·b ──
|
||||
apply spec_bind (montgomery_reduce_spec zz z0 z1 z2 z3 z4 z5 z6 z7 z8 hzl
|
||||
⟨hzb0, hzb1, hzb2, hzb3, hzb4, hzb5, hzb6, hzb7, hzb8⟩ hZlt)
|
||||
rintro ab ⟨⟨ab0, ab1, ab2, ab3, ab4, habl, hab0, hab1, hab2, hab3, hab4⟩, habd⟩
|
||||
rintro ab ⟨⟨ab0, ab1, ab2, ab3, ab4, habl, hab0, hab1, hab2, hab3, hab4⟩, habc, habd⟩
|
||||
show (do
|
||||
let a2 ← backend.serial.u64.scalar.Scalar52.mul_internal ab
|
||||
backend.serial.u64.constants.RR
|
||||
|
|
@ -164,6 +166,7 @@ theorem mul_spec (a b : Sc)
|
|||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧
|
||||
s4.val < 2^52) ∧
|
||||
scVal r < Ell ∧
|
||||
scDenote r = scDenote a * scDenote b ⦄
|
||||
-- RR limb values
|
||||
have hR0 : (2764609938444603#u64).val = 2764609938444603 := by rfl
|
||||
|
|
@ -186,6 +189,7 @@ theorem mul_spec (a b : Sc)
|
|||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧
|
||||
s4.val < 2^52) ∧
|
||||
scVal r < Ell ∧
|
||||
scDenote r = scDenote a * scDenote b ⦄
|
||||
simp only [hR0, hR1, hR2, hR3, hR4] at hw0e hw1e hw2e hw3e hw4e hw5e hw6e hw7e hw8e
|
||||
-- column bounds (RR limbs are literals below 2^52: linear, omega-cheap)
|
||||
|
|
@ -222,12 +226,12 @@ theorem mul_spec (a b : Sc)
|
|||
apply spec_mono (montgomery_reduce_spec ww w0 w1 w2 w3 w4 w5 w6 w7 w8 hwl
|
||||
⟨hwb0, hwb1, hwb2, hwb3, hwb4, hwb5, hwb6, hwb7, hwb8⟩ hWlt)
|
||||
intro r hr
|
||||
refine ⟨hr.1, ?_⟩
|
||||
refine ⟨hr.1, hr.2.1, ?_⟩
|
||||
have hcW := congrArg (Nat.cast (R := ZMod Ell)) hWval
|
||||
push_cast at hcW
|
||||
have hcZ := congrArg (Nat.cast (R := ZMod Ell)) hZval
|
||||
push_cast at hcZ
|
||||
have hr2 := hr.2
|
||||
have hr2 := hr.2.2
|
||||
push_cast at hr2
|
||||
have habd2 := habd
|
||||
push_cast at habd2
|
||||
|
|
|
|||
|
|
@ -5,10 +5,12 @@
|
|||
`ScBnd` (52-bit limb representation) and `scDenote` (⟦·⟧ : Scalar52 →
|
||||
ZMod ℓ), plus the single bundled certificate `scalarImplementation`:
|
||||
|
||||
· add: canonical inputs → ⟦add a b⟧ = ⟦a⟧ + ⟦b⟧, ScBnd out
|
||||
· sub: canonical subtrahend → ⟦sub a b⟧ = ⟦a⟧ − ⟦b⟧, ScBnd out
|
||||
· mul: Montgomery input bound → ⟦mul a b⟧ = ⟦a⟧ · ⟦b⟧, ScBnd out
|
||||
· add: canonical inputs → ⟦add a b⟧ = ⟦a⟧ + ⟦b⟧
|
||||
· sub: canonical inputs → ⟦sub a b⟧ = ⟦a⟧ − ⟦b⟧
|
||||
· mul: Montgomery input bound → ⟦mul a b⟧ = ⟦a⟧ · ⟦b⟧
|
||||
(canonical inputs satisfy it: ℓ·ℓ < 2^260·ℓ)
|
||||
Every output is both ScBnd (52-bit limbs) and canonical (scVal < ℓ):
|
||||
the layer is closed under its own preconditions.
|
||||
|
||||
Audit: `#print axioms ScalarProofs.scalarImplementation` must report
|
||||
exactly [propext, Classical.choice, Quot.sound].
|
||||
|
|
@ -29,38 +31,43 @@ open Aeneas.Std.WP
|
|||
theorem scalar_add_correct (a b : Sc) (ha : ScBnd a) (hb : ScBnd b)
|
||||
(hca : scVal a < Ell) (hcb : scVal b < Ell) :
|
||||
backend.serial.u64.scalar.Scalar52.add a b
|
||||
⦃ r => ScBnd r ∧ scDenote r = scDenote a + scDenote b ⦄ := by
|
||||
⦃ r => ScBnd r ∧ scVal r < Ell ∧ scDenote r = scDenote a + scDenote b ⦄ := by
|
||||
obtain ⟨a0, a1, a2, a3, a4, hal, hA0, hA1, hA2, hA3, hA4⟩ := ha
|
||||
obtain ⟨b0, b1, b2, b3, b4, hbl, hB0, hB1, hB2, hB3, hB4⟩ := hb
|
||||
apply spec_mono (add_val_spec a b a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 hal hbl
|
||||
⟨hA0, hA1, hA2, hA3, hA4⟩ ⟨hB0, hB1, hB2, hB3, hB4⟩ hca hcb)
|
||||
intro r hr
|
||||
exact ⟨hr.1, hr.2⟩
|
||||
exact ⟨hr.1, hr.2.1, hr.2.2⟩
|
||||
|
||||
/-- Subtraction, clean interface. -/
|
||||
/-- Subtraction, clean interface: canonical inputs give a canonical output
|
||||
(β = 0: r = a − b < ℓ; β = 1: the guard says a < b, so r = a − b + ℓ < ℓ). -/
|
||||
theorem scalar_sub_correct (a b : Sc) (ha : ScBnd a) (hb : ScBnd b)
|
||||
(hcb : scVal b ≤ Ell) :
|
||||
(hca : scVal a < Ell) (hcb : scVal b ≤ Ell) :
|
||||
backend.serial.u64.scalar.Scalar52.sub a b
|
||||
⦃ r => ScBnd r ∧ scDenote r = scDenote a - scDenote b ⦄ := by
|
||||
⦃ r => ScBnd r ∧ scVal r < Ell ∧ scDenote r = scDenote a - scDenote b ⦄ := by
|
||||
obtain ⟨a0, a1, a2, a3, a4, hal, hA0, hA1, hA2, hA3, hA4⟩ := ha
|
||||
obtain ⟨b0, b1, b2, b3, b4, hbl, hB0, hB1, hB2, hB3, hB4⟩ := hb
|
||||
apply spec_mono (sub_val_spec a b a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 hal hbl
|
||||
⟨hA0, hA1, hA2, hA3, hA4⟩ ⟨hB0, hB1, hB2, hB3, hB4⟩ hcb)
|
||||
intro r hr
|
||||
exact ⟨hr.1, hr.2⟩
|
||||
obtain ⟨hbnds, ⟨β, hβle, heq, hguard⟩, hden⟩ := hr
|
||||
refine ⟨hbnds, ?_, hden⟩
|
||||
rcases Nat.le_one_iff_eq_zero_or_eq_one.mp hβle with h0 | h1
|
||||
· subst h0; omega
|
||||
· subst h1; have := hguard rfl; omega
|
||||
|
||||
/-- Multiplication, clean interface. The Montgomery hypothesis
|
||||
scVal a · scVal b < 2^260·ℓ holds in particular for canonical inputs. -/
|
||||
theorem scalar_mul_correct (a b : Sc) (ha : ScBnd a) (hb : ScBnd b)
|
||||
(hm : scVal a * scVal b < 2^260 * Ell) :
|
||||
backend.serial.u64.scalar.Scalar52.mul a b
|
||||
⦃ r => ScBnd r ∧ scDenote r = scDenote a * scDenote b ⦄ := by
|
||||
⦃ r => ScBnd r ∧ scVal r < Ell ∧ scDenote r = scDenote a * scDenote b ⦄ := by
|
||||
obtain ⟨a0, a1, a2, a3, a4, hal, hA0, hA1, hA2, hA3, hA4⟩ := ha
|
||||
obtain ⟨b0, b1, b2, b3, b4, hbl, hB0, hB1, hB2, hB3, hB4⟩ := hb
|
||||
apply spec_mono (mul_spec a b a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 hal hbl
|
||||
⟨hA0, hA1, hA2, hA3, hA4⟩ ⟨hB0, hB1, hB2, hB3, hB4⟩ hm)
|
||||
intro r hr
|
||||
exact ⟨hr.1, hr.2⟩
|
||||
exact ⟨hr.1, hr.2.1, hr.2.2⟩
|
||||
|
||||
/-- Canonical inputs always satisfy the Montgomery multiplication bound. -/
|
||||
theorem canonical_mul_bound {a b : Sc} (hca : scVal a < Ell) (hcb : scVal b < Ell) :
|
||||
|
|
@ -72,19 +79,20 @@ theorem canonical_mul_bound {a b : Sc} (hca : scVal a < Ell) (hcb : scVal b < El
|
|||
|
||||
/-- **The scalar-layer certificate**: the transpiled `Scalar52` add, sub
|
||||
and mul all denote the ring operations of ZMod ℓ on canonical inputs,
|
||||
with 52-bit-bounded limb output. One theorem, one axiom audit. -/
|
||||
and every output is again 52-bit-bounded AND canonical — the layer is
|
||||
closed under its own preconditions. One theorem, one axiom audit. -/
|
||||
theorem scalarImplementation :
|
||||
(∀ a b : Sc, ScBnd a → ScBnd b → scVal a < Ell → scVal b < Ell →
|
||||
backend.serial.u64.scalar.Scalar52.add a b
|
||||
⦃ r => ScBnd r ∧ scDenote r = scDenote a + scDenote b ⦄) ∧
|
||||
(∀ a b : Sc, ScBnd a → ScBnd b → scVal b ≤ Ell →
|
||||
⦃ r => ScBnd r ∧ scVal r < Ell ∧ scDenote r = scDenote a + scDenote b ⦄) ∧
|
||||
(∀ a b : Sc, ScBnd a → ScBnd b → scVal a < Ell → scVal b ≤ Ell →
|
||||
backend.serial.u64.scalar.Scalar52.sub a b
|
||||
⦃ r => ScBnd r ∧ scDenote r = scDenote a - scDenote b ⦄) ∧
|
||||
⦃ r => ScBnd r ∧ scVal r < Ell ∧ scDenote r = scDenote a - scDenote b ⦄) ∧
|
||||
(∀ a b : Sc, ScBnd a → ScBnd b → scVal a < Ell → scVal b < Ell →
|
||||
backend.serial.u64.scalar.Scalar52.mul a b
|
||||
⦃ r => ScBnd r ∧ scDenote r = scDenote a * scDenote b ⦄) :=
|
||||
⦃ r => ScBnd r ∧ scVal r < Ell ∧ scDenote r = scDenote a * scDenote b ⦄) :=
|
||||
⟨fun a b ha hb hca hcb => scalar_add_correct a b ha hb hca hcb,
|
||||
fun a b ha hb hcb => scalar_sub_correct a b ha hb hcb,
|
||||
fun a b ha hb hca hcb => scalar_sub_correct a b ha hb hca hcb,
|
||||
fun a b ha hb hca hcb =>
|
||||
scalar_mul_correct a b ha hb (canonical_mul_bound hca hcb)⟩
|
||||
|
||||
|
|
|
|||
|
|
@ -257,6 +257,7 @@ theorem mont_tail_spec (limbs : Std.Array Std.U128 9#usize)
|
|||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧
|
||||
s4.val < 2^52) ∧
|
||||
scVal r < Ell ∧
|
||||
scDenote r = (((carry4.val + z5.val + n1.val * 17592186044416 + n3.val * 1367801 + n4.val * 3916664325105025) + 2^52 * (z6.val + n2.val * 17592186044416 + n4.val * 1367801) + 2^104 * (z7.val + n3.val * 17592186044416) + 2^156 * (z8.val + n4.val * 17592186044416) : ℕ) : ZMod Ell) ⦄ := by
|
||||
obtain ⟨hn1b, hn2b, hn3b, hn4b⟩ := hnb
|
||||
obtain ⟨hz5, hz6, hz7, hz8⟩ := hzb
|
||||
|
|
@ -371,17 +372,28 @@ theorem mont_tail_spec (limbs : Std.Array Std.U128 9#usize)
|
|||
(by refine ⟨?_, ?_, ?_, ?_, ?_⟩ <;> norm_num)
|
||||
(by rw [L_val]))
|
||||
intro r hr
|
||||
refine ⟨hr.1, ?_⟩
|
||||
rw [hr.2]
|
||||
have hEz : (Ell : ZMod Ell) = 0 := ZMod.natCast_self Ell
|
||||
have hL0 : scDenote backend.serial.u64.constants.L = 0 := by
|
||||
simp only [scDenote, L_val]; exact hEz
|
||||
rw [hL0, sub_zero]
|
||||
obtain ⟨hbnds, ⟨β, hβle, heq, hguard⟩, hden⟩ := hr
|
||||
have hpre : scVal (Array.make 5#usize [r0, r1, r2, r3, r4])
|
||||
= scLimbs r0 r1 r2 r3 r4 := scVal_eq _ _ _ _ _ _ hmk
|
||||
simp only [scDenote, hpre]
|
||||
unfold scLimbs
|
||||
rw [hr4v]
|
||||
exact congrArg (Nat.cast (R := ZMod Ell)) hTt
|
||||
have hpreX : scVal (Array.make 5#usize [r0, r1, r2, r3, r4])
|
||||
= (carry4.val + z5.val + n1.val * 17592186044416 + n3.val * 1367801
|
||||
+ n4.val * 3916664325105025)
|
||||
+ 2^52 * (z6.val + n2.val * 17592186044416 + n4.val * 1367801)
|
||||
+ 2^104 * (z7.val + n3.val * 17592186044416)
|
||||
+ 2^156 * (z8.val + n4.val * 17592186044416) := by
|
||||
rw [hpre]; unfold scLimbs; rw [hr4v]; exact hTt
|
||||
rw [L_val, hpreX] at heq
|
||||
rw [L_val, hpreX] at hguard
|
||||
refine ⟨hbnds, ?_, ?_⟩
|
||||
· -- canonicity: the sub-L canonicalization of a value below 2ℓ lands below ℓ
|
||||
rcases Nat.le_one_iff_eq_zero_or_eq_one.mp hβle with h0 | h1
|
||||
· subst h0; omega
|
||||
· subst h1; have := hguard rfl; omega
|
||||
· rw [hden]
|
||||
have hEz : (Ell : ZMod Ell) = 0 := ZMod.natCast_self Ell
|
||||
have hL0 : scDenote backend.serial.u64.constants.L = 0 := by
|
||||
simp only [scDenote, L_val]; exact hEz
|
||||
rw [hL0, sub_zero]
|
||||
simp only [scDenote, hpreX]
|
||||
|
||||
end ScalarProofs
|
||||
|
|
|
|||
|
|
@ -48,6 +48,7 @@ theorem montgomery_reduce_spec (limbs : Std.Array Std.U128 9#usize)
|
|||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧
|
||||
s4.val < 2^52) ∧
|
||||
scVal r < Ell ∧
|
||||
scDenote r * 2^260 = ((z0.val + 2^52 * z1.val + 2^104 * z2.val + 2^156 * z3.val + 2^208 * z4.val + 2^260 * z5.val + 2^312 * z6.val + 2^364 * z7.val + 2^416 * z8.val : ℕ) : ZMod Ell) ⦄ := by
|
||||
obtain ⟨hz0, hz1, hz2, hz3, hz4, hz5, hz6, hz7, hz8⟩ := hzb
|
||||
-- Hide the Montgomery bound behind an existential for the duration of
|
||||
|
|
@ -192,8 +193,8 @@ theorem montgomery_reduce_spec (limbs : Std.Array Std.U128 9#usize)
|
|||
n1 n2 n3 n4 i3 i8 i21 hl hvi3 hvi8 hvi21 hcb4
|
||||
⟨hn1b, hn2b, hn3b, hn4b⟩ ⟨hz5, hz6, hz7, hz8⟩ hXb)
|
||||
intro r hr
|
||||
refine ⟨hr.1, ?_⟩
|
||||
rw [hr.2]
|
||||
refine ⟨hr.1, hr.2.1, ?_⟩
|
||||
rw [hr.2.2]
|
||||
have hEz : (Ell : ZMod Ell) = 0 := ZMod.natCast_self Ell
|
||||
have hc := congrArg (Nat.cast (R := ZMod Ell)) hHT
|
||||
push_cast at hc
|
||||
|
|
|
|||
|
|
@ -744,6 +744,8 @@ theorem sub_val_spec (a b : Sc)
|
|||
backend.serial.u64.scalar.Scalar52.sub a b
|
||||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧ s4.val < 2^52) ∧
|
||||
(∃ β : ℕ, β ≤ 1 ∧ scVal r + scVal b = scVal a + Ell * β ∧
|
||||
(β = 1 → scVal a < scVal b)) ∧
|
||||
scDenote r = scDenote a - scDenote b ⦄ := by
|
||||
obtain ⟨hA0, hA1, hA2, hA3, hA4⟩ := hab
|
||||
obtain ⟨hB0, hB1, hB2, hB3, hB4⟩ := hbb
|
||||
|
|
@ -767,6 +769,8 @@ theorem sub_val_spec (a b : Sc)
|
|||
{ start := 0#usize, «end» := 5#usize } dw mask underflow_mask 0#u64)
|
||||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧ s4.val < 2^52) ∧
|
||||
(∃ β : ℕ, β ≤ 1 ∧ scVal r + scVal b = scVal a + Ell * β ∧
|
||||
(β = 1 → scVal a < scVal b)) ∧
|
||||
scDenote r = scDenote a - scDenote b ⦄
|
||||
-- underflow mask: um = ((borrow>>>63) ^^^ 1) − 1 (all-ones iff borrow)
|
||||
step as ⟨i1, hi1⟩
|
||||
|
|
@ -793,12 +797,13 @@ theorem sub_val_spec (a b : Sc)
|
|||
rw [humv, hi2v, hβz]; norm_num
|
||||
apply spec_mono (sub_loop1_zero_spec dw mask um d0 d1 d2 d3 d4 hdl hmaskv humz hdb)
|
||||
rintro d ⟨r0, r1, r2, r3, r4, hrl, hr0, hr1, hr2, hr3, hr4⟩
|
||||
refine ⟨⟨r0, r1, r2, r3, r4, hrl,
|
||||
by omega, by omega, by omega, by omega, by omega⟩, ?_⟩
|
||||
have hdval : scVal d = scLimbs d0 d1 d2 d3 d4 := by
|
||||
rw [scVal_eq d r0 r1 r2 r3 r4 hrl]; unfold scLimbs; rw [hr0, hr1, hr2, hr3, hr4]
|
||||
have key : scVal d + scVal b = scVal a := by
|
||||
rw [hdval, hsva, hsvb]; rw [hβz] at hTsub; simpa using hTsub
|
||||
refine ⟨⟨r0, r1, r2, r3, r4, hrl,
|
||||
by omega, by omega, by omega, by omega, by omega⟩,
|
||||
⟨0, by norm_num, by omega, by omega⟩, ?_⟩
|
||||
have hc := congrArg (Nat.cast (R := ZMod Ell)) key
|
||||
push_cast at hc
|
||||
simp only [scDenote]; rw [eq_sub_iff_add_eq]; exact hc
|
||||
|
|
@ -809,7 +814,6 @@ theorem sub_val_spec (a b : Sc)
|
|||
rintro d ⟨r0, r1, r2, r3, r4, γ1, γ2, γ3, γ4, γ5, hrl,
|
||||
hgb1, hgb2, hgb3, hgb4, hgb5, hrb0, hrb1, hrb2, hrb3, hrb4,
|
||||
hf0, hf1, hf2, hf3, hf4⟩
|
||||
refine ⟨⟨r0, r1, r2, r3, r4, hrl, hrb0, hrb1, hrb2, hrb3, hrb4⟩, ?_⟩
|
||||
have hLsum : (671914833335277 + 2^52*3916664325105025 + 2^104*1367801
|
||||
+ 2^156*0 + 2^208*17592186044416 : ℕ) = Ell := by unfold Ell; norm_num
|
||||
have hTadd : scLimbs r0 r1 r2 r3 r4 + 2^260 * γ5 = scLimbs d0 d1 d2 d3 d4 + Ell := by
|
||||
|
|
@ -825,14 +829,25 @@ theorem sub_val_spec (a b : Sc)
|
|||
have hγ5 : γ5 = 1 := by
|
||||
have hRnn : 0 ≤ scLimbs a0 a1 a2 a3 a4 := Nat.zero_le _
|
||||
omega
|
||||
have hc := congrArg (Nat.cast (R := ZMod Ell)) hTadd
|
||||
have hc2 := congrArg (Nat.cast (R := ZMod Ell)) hTsub
|
||||
have hEz : (Ell : ZMod Ell) = 0 := ZMod.natCast_self Ell
|
||||
rw [hγ5] at hc
|
||||
rw [hβo] at hc2
|
||||
simp only [scDenote, scVal_eq d r0 r1 r2 r3 r4 hrl, hsva, hsvb]
|
||||
push_cast at hc hc2 ⊢
|
||||
rw [hEz] at hc
|
||||
linear_combination hc + hc2
|
||||
have hdval : scVal d = scLimbs r0 r1 r2 r3 r4 :=
|
||||
scVal_eq d r0 r1 r2 r3 r4 hrl
|
||||
have hdlt : scLimbs d0 d1 d2 d3 d4 < 2^260 := by unfold scLimbs; omega
|
||||
refine ⟨⟨r0, r1, r2, r3, r4, hrl, hrb0, hrb1, hrb2, hrb3, hrb4⟩,
|
||||
⟨1, le_refl 1, ?_, ?_⟩, ?_⟩
|
||||
· rw [hdval, hsva, hsvb]
|
||||
rw [hγ5] at hTadd
|
||||
omega
|
||||
· intro _
|
||||
rw [hsva, hsvb]
|
||||
omega
|
||||
· have hc := congrArg (Nat.cast (R := ZMod Ell)) hTadd
|
||||
have hc2 := congrArg (Nat.cast (R := ZMod Ell)) hTsub
|
||||
have hEz : (Ell : ZMod Ell) = 0 := ZMod.natCast_self Ell
|
||||
rw [hγ5] at hc
|
||||
rw [hβo] at hc2
|
||||
simp only [scDenote, scVal_eq d r0 r1 r2 r3 r4 hrl, hsva, hsvb]
|
||||
push_cast at hc hc2 ⊢
|
||||
rw [hEz] at hc
|
||||
linear_combination hc + hc2
|
||||
|
||||
end ScalarProofs
|
||||
|
|
|
|||
156
verification/Proofs/ScalarWideSpec.lean
Normal file
156
verification/Proofs/ScalarWideSpec.lean
Normal file
|
|
@ -0,0 +1,156 @@
|
|||
/- ──────────────────────────────────────────────────────────────────────────────
|
||||
Proofs/ScalarWideSpec.lean — toward the signature layer: hash-to-scalar.
|
||||
|
||||
`Scalar::from_hash` reduces the 512-bit SHA-512 output to a scalar via
|
||||
`Scalar52::from_bytes_wide` (scalar.rs:89-116):
|
||||
words ← 64 bytes, little-endian, 8×u64
|
||||
lo, hi ← 5×52-bit limbs each (lo + 2^260·hi = the 512-bit value)
|
||||
lo' = montgomery_mul(lo, R) -- ⟦lo'⟧ = ⟦lo⟧ (·R·R⁻¹)
|
||||
hi' = montgomery_mul(hi, RR) -- ⟦hi'⟧ = ⟦hi⟧·2^260 (·R²·R⁻¹)
|
||||
add(hi', lo') -- ⟦result⟧ = the value mod ℓ
|
||||
|
||||
This file provides the R constant lemmas (R ≡ 2^260 (mod ℓ), witness
|
||||
2^260 = R + 255·ℓ) and `montgomery_mul_spec`, the single Montgomery
|
||||
round: ⟦montgomery_mul a b⟧·2^260 = ⟦a⟧·⟦b⟧ with canonical bounded
|
||||
output — the composition of the proven `mul_internal_spec` and
|
||||
`montgomery_reduce_spec`, exactly the first half of `mul_spec`.
|
||||
|
||||
The unpack walk (`from_bytes_wide` itself) builds on these next.
|
||||
────────────────────────────────────────────────────────────────────────────── -/
|
||||
import Proofs.ScalarFullMulSpec
|
||||
open Aeneas Aeneas.Std Result
|
||||
open curve25519_dalek
|
||||
|
||||
set_option maxHeartbeats 8000000
|
||||
set_option linter.unusedSimpArgs false
|
||||
set_option exponentiation.threshold 600
|
||||
|
||||
namespace ScalarProofs
|
||||
|
||||
open Aeneas.Std.WP
|
||||
|
||||
/-! ### The R constant: R ≡ 2^260 (mod ℓ) -/
|
||||
|
||||
/-- The transpiled `constants::R` as a limb list. -/
|
||||
theorem R_limbs :
|
||||
(↑backend.serial.u64.constants.R : List U64) =
|
||||
[4302102966953709#u64, 1049714374468698#u64, 4503599278581019#u64,
|
||||
4503599627370495#u64, 17592186044415#u64] := by
|
||||
unfold backend.serial.u64.constants.R
|
||||
rfl
|
||||
|
||||
/-- The value of the transpiled R constant. -/
|
||||
theorem R_scVal : scVal backend.serial.u64.constants.R
|
||||
= 7237005577332262213973186563042994233755083008372585100823854863819240236781 := by
|
||||
rw [scVal_eq _ _ _ _ _ _ R_limbs]
|
||||
unfold scLimbs
|
||||
norm_num
|
||||
|
||||
/-- R is canonical (below ℓ). -/
|
||||
theorem R_lt : scVal backend.serial.u64.constants.R < Ell := by
|
||||
rw [R_scVal]; unfold Ell; norm_num
|
||||
|
||||
/-- R's limbs are 52-bit bounded. -/
|
||||
theorem R_bnd : ScBnd backend.serial.u64.constants.R := by
|
||||
refine ⟨_, _, _, _, _, R_limbs, ?_, ?_, ?_, ?_, ?_⟩ <;> norm_num
|
||||
|
||||
/-- **R denotes 2^260 in ZMod ℓ** — witness 2^260 = R + 255·ℓ,
|
||||
kernel-checked literal arithmetic. -/
|
||||
theorem R_denote :
|
||||
((7237005577332262213973186563042994233755083008372585100823854863819240236781 : ℕ)
|
||||
: ZMod Ell) = 2^260 := by
|
||||
have h : (2:ℕ)^260
|
||||
= 7237005577332262213973186563042994233755083008372585100823854863819240236781
|
||||
+ 255 * Ell := by
|
||||
unfold Ell; norm_num
|
||||
have hc := congrArg (Nat.cast (R := ZMod Ell)) h
|
||||
push_cast at hc
|
||||
have h2 : ((2:ZMod Ell))^260
|
||||
= (1852673427797059126777135760139006525652319754650249024631321344126610074238976 : ZMod Ell) := by
|
||||
norm_num
|
||||
rw [h2]
|
||||
push_cast
|
||||
rw [hc, ZMod.natCast_self Ell]
|
||||
ring
|
||||
|
||||
/-! ### The single Montgomery round -/
|
||||
|
||||
/-- **One Montgomery multiplication round**: for limb-bounded inputs under
|
||||
the Montgomery bound, `montgomery_mul a b` returns a canonical,
|
||||
bounded r with ⟦r⟧·2^260 = ⟦a⟧·⟦b⟧ in ZMod ℓ. This is the first
|
||||
half of the proven `mul_spec`, exposed as its own certificate because
|
||||
`from_bytes_wide` uses single rounds against R and RR. -/
|
||||
theorem montgomery_mul_spec (a b : Sc)
|
||||
(a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 : U64)
|
||||
(ha : (↑a : List U64) = [a0, a1, a2, a3, a4])
|
||||
(hb : (↑b : List U64) = [b0, b1, b2, b3, b4])
|
||||
(hab : a0.val < 2^52 ∧ a1.val < 2^52 ∧ a2.val < 2^52 ∧ a3.val < 2^52 ∧ a4.val < 2^52)
|
||||
(hbb : b0.val < 2^52 ∧ b1.val < 2^52 ∧ b2.val < 2^52 ∧ b3.val < 2^52 ∧ b4.val < 2^52)
|
||||
(hcab : scVal a * scVal b < 2^260 * Ell) :
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_mul a b
|
||||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧
|
||||
s4.val < 2^52) ∧
|
||||
scVal r < Ell ∧
|
||||
scDenote r * 2^260 = scDenote a * scDenote b ⦄ := by
|
||||
obtain ⟨hA0, hA1, hA2, hA3, hA4⟩ := hab
|
||||
obtain ⟨hB0, hB1, hB2, hB3, hB4⟩ := hbb
|
||||
unfold backend.serial.u64.scalar.Scalar52.montgomery_mul
|
||||
apply spec_bind (mul_internal_spec a b a0 a1 a2 a3 a4 b0 b1 b2 b3 b4 ha hb
|
||||
⟨hA0, hA1, hA2, hA3, hA4, hB0, hB1, hB2, hB3, hB4⟩)
|
||||
rintro zz ⟨z0, z1, z2, z3, z4, z5, z6, z7, z8, hzl,
|
||||
hz0e, hz1e, hz2e, hz3e, hz4e, hz5e, hz6e, hz7e, hz8e⟩
|
||||
show backend.serial.u64.scalar.Scalar52.montgomery_reduce zz
|
||||
⦃ r => (∃ s0 s1 s2 s3 s4 : U64, (↑r : List U64) = [s0, s1, s2, s3, s4] ∧
|
||||
s0.val < 2^52 ∧ s1.val < 2^52 ∧ s2.val < 2^52 ∧ s3.val < 2^52 ∧
|
||||
s4.val < 2^52) ∧
|
||||
scVal r < Ell ∧
|
||||
scDenote r * 2^260 = scDenote a * scDenote b ⦄
|
||||
have hzb0 : z0.val < 2^107 := by
|
||||
have := col_bound hA0 hB0; omega
|
||||
have hzb1 : z1.val < 2^107 := by
|
||||
have := col_bound hA0 hB1; have := col_bound hA1 hB0; omega
|
||||
have hzb2 : z2.val < 2^107 := by
|
||||
have := col_bound hA0 hB2; have := col_bound hA1 hB1
|
||||
have := col_bound hA2 hB0; omega
|
||||
have hzb3 : z3.val < 2^107 := by
|
||||
have := col_bound hA0 hB3; have := col_bound hA1 hB2
|
||||
have := col_bound hA2 hB1; have := col_bound hA3 hB0; omega
|
||||
have hzb4 : z4.val < 2^107 := by
|
||||
have := col_bound hA0 hB4; have := col_bound hA1 hB3
|
||||
have := col_bound hA2 hB2; have := col_bound hA3 hB1
|
||||
have := col_bound hA4 hB0; omega
|
||||
have hzb5 : z5.val < 2^107 := by
|
||||
have := col_bound hA1 hB4; have := col_bound hA2 hB3
|
||||
have := col_bound hA3 hB2; have := col_bound hA4 hB1; omega
|
||||
have hzb6 : z6.val < 2^107 := by
|
||||
have := col_bound hA2 hB4; have := col_bound hA3 hB3
|
||||
have := col_bound hA4 hB2; omega
|
||||
have hzb7 : z7.val < 2^107 := by
|
||||
have := col_bound hA3 hB4; have := col_bound hA4 hB3; omega
|
||||
have hzb8 : z8.val < 2^107 := by
|
||||
have := col_bound hA4 hB4; omega
|
||||
have hZval : z0.val + 2^52 * z1.val + 2^104 * z2.val + 2^156 * z3.val
|
||||
+ 2^208 * z4.val + 2^260 * z5.val + 2^312 * z6.val + 2^364 * z7.val
|
||||
+ 2^416 * z8.val = scVal a * scVal b := by
|
||||
rw [hz0e, hz1e, hz2e, hz3e, hz4e, hz5e, hz6e, hz7e, hz8e,
|
||||
scVal_eq a a0 a1 a2 a3 a4 ha, scVal_eq b b0 b1 b2 b3 b4 hb]
|
||||
unfold scLimbs
|
||||
ring
|
||||
have hZlt : z0.val + 2^52 * z1.val + 2^104 * z2.val + 2^156 * z3.val
|
||||
+ 2^208 * z4.val + 2^260 * z5.val + 2^312 * z6.val + 2^364 * z7.val
|
||||
+ 2^416 * z8.val < 2^260 * Ell := by rw [hZval]; exact hcab
|
||||
apply spec_mono (montgomery_reduce_spec zz z0 z1 z2 z3 z4 z5 z6 z7 z8 hzl
|
||||
⟨hzb0, hzb1, hzb2, hzb3, hzb4, hzb5, hzb6, hzb7, hzb8⟩ hZlt)
|
||||
intro r hr
|
||||
refine ⟨hr.1, hr.2.1, ?_⟩
|
||||
have hc := congrArg (Nat.cast (R := ZMod Ell)) hZval
|
||||
push_cast at hc
|
||||
have hr2 := hr.2.2
|
||||
push_cast at hr2
|
||||
rw [hr2]
|
||||
simp only [scDenote]
|
||||
push_cast
|
||||
linear_combination hc
|
||||
|
||||
end ScalarProofs
|
||||
|
|
@ -7,7 +7,7 @@ source ~/aeneas-toolchain/env.sh
|
|||
HERE="$(cd "$(dirname "$0")" && pwd)"
|
||||
AENEAS_LEAN="$AENEAS_HOME/backends/lean"
|
||||
GEN=(CurveScalar/TypesExternal CurveScalar/Types CurveScalar/FunsExternal CurveScalar/Funs)
|
||||
PROOFS=(ScalarDenote ScalarLoop ScalarSubSpec ScalarAddSpec ScalarMulSpec ScalarMontSpec ScalarReduceSpec ScalarFullMulSpec ScalarMain)
|
||||
PROOFS=(ScalarDenote ScalarLoop ScalarSubSpec ScalarAddSpec ScalarMulSpec ScalarMontSpec ScalarReduceSpec ScalarFullMulSpec ScalarMain ScalarWideSpec)
|
||||
|
||||
echo "=== stub/axiom audit ==="
|
||||
grep -rnE '^(private |protected |noncomputable )*axiom ' "$HERE"/Proofs/Scalar*.lean 2>/dev/null && { echo "axiom under Proofs/"; exit 1; }
|
||||
|
|
@ -28,15 +28,15 @@ lake env bash -c "
|
|||
export LEAN_PATH=\"\$LEAN_PATH:$HERE/gen:$HERE\"
|
||||
cd '$HERE'
|
||||
AUD=\$(mktemp '$HERE/.audit-scalar-XXXX.lean')
|
||||
{ echo 'import Proofs.ScalarMain'; echo '#print axioms ScalarProofs.L_val'
|
||||
{ echo 'import Proofs.ScalarMain'; echo 'import Proofs.ScalarWideSpec'; echo '#print axioms ScalarProofs.L_val'
|
||||
echo '#print axioms ScalarProofs.sub_loop_spec'
|
||||
echo '#print axioms ScalarProofs.sub_loop1_one_spec'; echo '#print axioms ScalarProofs.sub_val_spec'; echo '#print axioms ScalarProofs.add_val_spec'; echo '#print axioms ScalarProofs.mul_internal_spec'
|
||||
echo '#print axioms ScalarProofs.part1_spec'; echo '#print axioms ScalarProofs.montgomery_reduce_spec'; echo '#print axioms ScalarProofs.mul_spec'; echo '#print axioms ScalarProofs.scalarImplementation'; } > \"\$AUD\"
|
||||
echo '#print axioms ScalarProofs.part1_spec'; echo '#print axioms ScalarProofs.montgomery_reduce_spec'; echo '#print axioms ScalarProofs.mul_spec'; echo '#print axioms ScalarProofs.scalarImplementation'; echo '#print axioms ScalarProofs.montgomery_mul_spec'; } > \"\$AUD\"
|
||||
OUT=\$(LEAN_TIMEOUT=120 LEAN_MEM_MB=4096 '$HERE/lean-guard' \"\$AUD\" 2>&1)
|
||||
echo \"\$OUT\"
|
||||
rm -f \"\$AUD\" \"\${AUD%.lean}.olean\"
|
||||
N=\$(echo \"\$OUT\" | grep -cF \"depends on axioms: [propext, Classical.choice, Quot.sound]\" || true)
|
||||
[ \"\$N\" -eq 10 ] || { echo \"AXIOM AUDIT FAILED: \$N/10 clean\"; exit 1; }
|
||||
[ \"\$N\" -eq 11 ] || { echo \"AXIOM AUDIT FAILED: \$N/11 clean\"; exit 1; }
|
||||
" || { echo FAIL; exit 1; }
|
||||
echo " L_val axiom-clean"
|
||||
|
||||
|
|
|
|||
|
|
@ -24,6 +24,7 @@ charon cargo --preset=aeneas \
|
|||
--start-from 'crate::backend::serial::u64::scalar::_::montgomery_invert' \
|
||||
--start-from 'crate::backend::serial::u64::scalar::_::as_montgomery' \
|
||||
--start-from 'crate::backend::serial::u64::scalar::_::from_montgomery' \
|
||||
--start-from 'crate::backend::serial::u64::scalar::_::from_bytes_wide' \
|
||||
--opaque 'crate::backend::serial::u64::scalar::_::sub::black_box' \
|
||||
--dest-file "$HERE/CurveScalar.llbc" \
|
||||
-- --no-default-features
|
||||
|
|
|
|||
|
|
@ -33,6 +33,15 @@ def backend.serial.u64.constants.L : backend.serial.u64.scalar.Scalar52 :=
|
|||
@[global_simps, irreducible]
|
||||
def backend.serial.u64.constants.LFACTOR : Std.U64 := 1439961107955227#u64
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::constants::R]
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/constants.rs', lines 129:0-135:3 -/
|
||||
@[global_simps, irreducible]
|
||||
def backend.serial.u64.constants.R : backend.serial.u64.scalar.Scalar52 :=
|
||||
Array.make 5#usize [
|
||||
4302102966953709#u64, 1049714374468698#u64, 4503599278581019#u64,
|
||||
4503599627370495#u64, 17592186044415#u64
|
||||
]
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::constants::RR]
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/constants.rs', lines 138:0-144:3 -/
|
||||
@[global_simps, irreducible]
|
||||
|
|
@ -81,8 +90,37 @@ def backend.serial.u64.scalar.Scalar52.ZERO
|
|||
let a := Array.repeat 5#usize 0#u64
|
||||
a
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce::part2]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 266:8-269:9 -/
|
||||
def backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2
|
||||
(sum : Std.U128) : Result (Std.U128 × Std.U64) := do
|
||||
let i ← lift (UScalar.cast .U64 sum)
|
||||
let i1 ← 1#u64 <<< 52#i32
|
||||
let i2 ← i1 - 1#u64
|
||||
let w ← lift (i &&& i2)
|
||||
let i3 ← sum >>> 52#i32
|
||||
ok (i3, w)
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce::part1]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 260:8-263:9 -/
|
||||
def backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1
|
||||
(sum : Std.U128) : Result (Std.U128 × Std.U64) := do
|
||||
let i ← lift (UScalar.cast .U64 sum)
|
||||
let i1 ←
|
||||
lift (core.num.U64.wrapping_mul i backend.serial.u64.constants.LFACTOR)
|
||||
let i2 ← 1#u64 <<< 52#i32
|
||||
let i3 ← i2 - 1#u64
|
||||
let p ← lift (i1 &&& i3)
|
||||
let i4 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
backend.serial.u64.constants.L 0#usize
|
||||
let i5 ← backend.serial.u64.scalar.m p i4
|
||||
let i6 ← sum + i5
|
||||
let i7 ← i6 >>> 52#i32
|
||||
ok (i7, p)
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop body 0:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 190:8-193:9
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 193:8-196:9
|
||||
Visibility: public -/
|
||||
@[rust_loop_body]
|
||||
def backend.serial.u64.scalar.Scalar52.sub_loop0.body
|
||||
|
|
@ -116,7 +154,7 @@ def backend.serial.u64.scalar.Scalar52.sub_loop0.body
|
|||
ok (cont (iter1, difference1, borrow1))
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop 0:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 190:8-193:9
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 193:8-196:9
|
||||
Visibility: public -/
|
||||
@[rust_loop]
|
||||
def backend.serial.u64.scalar.Scalar52.sub_loop0
|
||||
|
|
@ -134,7 +172,7 @@ def backend.serial.u64.scalar.Scalar52.sub_loop0
|
|||
(iter, difference, borrow)
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop body 1:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 0:0-203:9
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 0:0-206:9
|
||||
Visibility: public -/
|
||||
@[rust_loop_body]
|
||||
def backend.serial.u64.scalar.Scalar52.sub_loop1.body
|
||||
|
|
@ -169,7 +207,7 @@ def backend.serial.u64.scalar.Scalar52.sub_loop1.body
|
|||
ok (cont (iter1, difference1, carry1))
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop 1:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 0:0-203:9
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 0:0-206:9
|
||||
Visibility: public -/
|
||||
@[rust_loop]
|
||||
def backend.serial.u64.scalar.Scalar52.sub_loop1
|
||||
|
|
@ -185,7 +223,7 @@ def backend.serial.u64.scalar.Scalar52.sub_loop1
|
|||
(iter, difference, carry)
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 176:4-206:5
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 179:4-209:5
|
||||
Visibility: public -/
|
||||
def backend.serial.u64.scalar.Scalar52.sub
|
||||
(a : backend.serial.u64.scalar.Scalar52)
|
||||
|
|
@ -205,76 +243,92 @@ def backend.serial.u64.scalar.Scalar52.sub
|
|||
{ start := 0#usize, «end» := 5#usize } difference mask underflow_mask
|
||||
0#u64
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]: loop body 0:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 166:8-169:9
|
||||
Visibility: public -/
|
||||
@[rust_loop_body]
|
||||
def backend.serial.u64.scalar.Scalar52.add_loop.body
|
||||
(a : backend.serial.u64.scalar.Scalar52)
|
||||
(b : backend.serial.u64.scalar.Scalar52) (mask : Std.U64)
|
||||
(iter : core.ops.range.Range Std.Usize)
|
||||
(sum : backend.serial.u64.scalar.Scalar52) (carry : Std.U64) :
|
||||
Result (ControlFlow ((core.ops.range.Range Std.Usize) ×
|
||||
backend.serial.u64.scalar.Scalar52 × Std.U64)
|
||||
backend.serial.u64.scalar.Scalar52)
|
||||
:= do
|
||||
let (o, iter1) ←
|
||||
core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
|
||||
match o with
|
||||
| none => ok (done sum)
|
||||
| some i =>
|
||||
let i1 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
a i
|
||||
let i2 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
b i
|
||||
let i3 ← i1 + i2
|
||||
let i4 ← carry >>> 52#i32
|
||||
let carry1 ← i3 + i4
|
||||
let (_, index_mut_back) ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
|
||||
sum i
|
||||
let i5 ← lift (carry1 &&& mask)
|
||||
let sum1 := index_mut_back i5
|
||||
ok (cont (iter1, sum1, carry1))
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]: loop 0:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 166:8-169:9
|
||||
Visibility: public -/
|
||||
@[rust_loop]
|
||||
def backend.serial.u64.scalar.Scalar52.add_loop
|
||||
(iter : core.ops.range.Range Std.Usize)
|
||||
(a : backend.serial.u64.scalar.Scalar52)
|
||||
(b : backend.serial.u64.scalar.Scalar52)
|
||||
(sum : backend.serial.u64.scalar.Scalar52) (mask : Std.U64) (carry : Std.U64)
|
||||
:
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 257:4-290:5 -/
|
||||
def backend.serial.u64.scalar.Scalar52.montgomery_reduce
|
||||
(limbs : Array Std.U128 9#usize) :
|
||||
Result backend.serial.u64.scalar.Scalar52
|
||||
:= do
|
||||
loop
|
||||
(fun (iter1, sum1, carry1) =>
|
||||
backend.serial.u64.scalar.Scalar52.add_loop.body a b mask iter1 sum1
|
||||
carry1)
|
||||
(iter, sum, carry)
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 160:4-173:5
|
||||
Visibility: public -/
|
||||
def backend.serial.u64.scalar.Scalar52.add
|
||||
(a : backend.serial.u64.scalar.Scalar52)
|
||||
(b : backend.serial.u64.scalar.Scalar52) :
|
||||
Result backend.serial.u64.scalar.Scalar52
|
||||
:= do
|
||||
let i ← 1#u64 <<< 52#i32
|
||||
let mask ← i - 1#u64
|
||||
let sum ←
|
||||
backend.serial.u64.scalar.Scalar52.add_loop
|
||||
{ start := 0#usize, «end» := 5#usize } a b
|
||||
backend.serial.u64.scalar.Scalar52.ZERO mask 0#u64
|
||||
backend.serial.u64.scalar.Scalar52.sub sum backend.serial.u64.constants.L
|
||||
let i ← Array.index_usize limbs 0#usize
|
||||
let (carry, n0) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i
|
||||
let i1 ← Array.index_usize limbs 1#usize
|
||||
let i2 ← carry + i1
|
||||
let i3 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
backend.serial.u64.constants.L 1#usize
|
||||
let i4 ← backend.serial.u64.scalar.m n0 i3
|
||||
let i5 ← i2 + i4
|
||||
let (carry1, n1) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i5
|
||||
let i6 ← Array.index_usize limbs 2#usize
|
||||
let i7 ← carry1 + i6
|
||||
let i8 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
backend.serial.u64.constants.L 2#usize
|
||||
let i9 ← backend.serial.u64.scalar.m n0 i8
|
||||
let i10 ← i7 + i9
|
||||
let i11 ← backend.serial.u64.scalar.m n1 i3
|
||||
let i12 ← i10 + i11
|
||||
let (carry2, n2) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i12
|
||||
let i13 ← Array.index_usize limbs 3#usize
|
||||
let i14 ← carry2 + i13
|
||||
let i15 ← backend.serial.u64.scalar.m n1 i8
|
||||
let i16 ← i14 + i15
|
||||
let i17 ← backend.serial.u64.scalar.m n2 i3
|
||||
let i18 ← i16 + i17
|
||||
let (carry3, n3) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i18
|
||||
let i19 ← Array.index_usize limbs 4#usize
|
||||
let i20 ← carry3 + i19
|
||||
let i21 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
backend.serial.u64.constants.L 4#usize
|
||||
let i22 ← backend.serial.u64.scalar.m n0 i21
|
||||
let i23 ← i20 + i22
|
||||
let i24 ← backend.serial.u64.scalar.m n2 i8
|
||||
let i25 ← i23 + i24
|
||||
let i26 ← backend.serial.u64.scalar.m n3 i3
|
||||
let i27 ← i25 + i26
|
||||
let (carry4, n4) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i27
|
||||
let i28 ← Array.index_usize limbs 5#usize
|
||||
let i29 ← carry4 + i28
|
||||
let i30 ← backend.serial.u64.scalar.m n1 i21
|
||||
let i31 ← i29 + i30
|
||||
let i32 ← backend.serial.u64.scalar.m n3 i8
|
||||
let i33 ← i31 + i32
|
||||
let i34 ← backend.serial.u64.scalar.m n4 i3
|
||||
let i35 ← i33 + i34
|
||||
let (carry5, r0) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i35
|
||||
let i36 ← Array.index_usize limbs 6#usize
|
||||
let i37 ← carry5 + i36
|
||||
let i38 ← backend.serial.u64.scalar.m n2 i21
|
||||
let i39 ← i37 + i38
|
||||
let i40 ← backend.serial.u64.scalar.m n4 i8
|
||||
let i41 ← i39 + i40
|
||||
let (carry6, r1) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i41
|
||||
let i42 ← Array.index_usize limbs 7#usize
|
||||
let i43 ← carry6 + i42
|
||||
let i44 ← backend.serial.u64.scalar.m n3 i21
|
||||
let i45 ← i43 + i44
|
||||
let (carry7, r2) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i45
|
||||
let i46 ← Array.index_usize limbs 8#usize
|
||||
let i47 ← carry7 + i46
|
||||
let i48 ← backend.serial.u64.scalar.m n4 i21
|
||||
let i49 ← i47 + i48
|
||||
let (carry8, r3) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i49
|
||||
let r4 ← lift (UScalar.cast .U64 carry8)
|
||||
backend.serial.u64.scalar.Scalar52.sub
|
||||
(Array.make 5#usize [ r0, r1, r2, r3, r4 ]) backend.serial.u64.constants.L
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::mul_internal]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 211:4-225:5 -/
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 214:4-228:5 -/
|
||||
def backend.serial.u64.scalar.Scalar52.mul_internal
|
||||
(a : backend.serial.u64.scalar.Scalar52)
|
||||
(b : backend.serial.u64.scalar.Scalar52) :
|
||||
|
|
@ -362,8 +416,262 @@ def backend.serial.u64.scalar.Scalar52.mul_internal
|
|||
let i50 ← backend.serial.u64.scalar.m i32 i24
|
||||
Array.update z8 8#usize i50
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_mul]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 309:4-311:5
|
||||
Visibility: public -/
|
||||
def backend.serial.u64.scalar.Scalar52.montgomery_mul
|
||||
(a : backend.serial.u64.scalar.Scalar52)
|
||||
(b : backend.serial.u64.scalar.Scalar52) :
|
||||
Result backend.serial.u64.scalar.Scalar52
|
||||
:= do
|
||||
let a1 ← backend.serial.u64.scalar.Scalar52.mul_internal a b
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce a1
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]: loop body 0:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 169:8-172:9
|
||||
Visibility: public -/
|
||||
@[rust_loop_body]
|
||||
def backend.serial.u64.scalar.Scalar52.add_loop.body
|
||||
(a : backend.serial.u64.scalar.Scalar52)
|
||||
(b : backend.serial.u64.scalar.Scalar52) (mask : Std.U64)
|
||||
(iter : core.ops.range.Range Std.Usize)
|
||||
(sum : backend.serial.u64.scalar.Scalar52) (carry : Std.U64) :
|
||||
Result (ControlFlow ((core.ops.range.Range Std.Usize) ×
|
||||
backend.serial.u64.scalar.Scalar52 × Std.U64)
|
||||
backend.serial.u64.scalar.Scalar52)
|
||||
:= do
|
||||
let (o, iter1) ←
|
||||
core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
|
||||
match o with
|
||||
| none => ok (done sum)
|
||||
| some i =>
|
||||
let i1 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
a i
|
||||
let i2 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
b i
|
||||
let i3 ← i1 + i2
|
||||
let i4 ← carry >>> 52#i32
|
||||
let carry1 ← i3 + i4
|
||||
let (_, index_mut_back) ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
|
||||
sum i
|
||||
let i5 ← lift (carry1 &&& mask)
|
||||
let sum1 := index_mut_back i5
|
||||
ok (cont (iter1, sum1, carry1))
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]: loop 0:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 169:8-172:9
|
||||
Visibility: public -/
|
||||
@[rust_loop]
|
||||
def backend.serial.u64.scalar.Scalar52.add_loop
|
||||
(iter : core.ops.range.Range Std.Usize)
|
||||
(a : backend.serial.u64.scalar.Scalar52)
|
||||
(b : backend.serial.u64.scalar.Scalar52)
|
||||
(sum : backend.serial.u64.scalar.Scalar52) (mask : Std.U64) (carry : Std.U64)
|
||||
:
|
||||
Result backend.serial.u64.scalar.Scalar52
|
||||
:= do
|
||||
loop
|
||||
(fun (iter1, sum1, carry1) =>
|
||||
backend.serial.u64.scalar.Scalar52.add_loop.body a b mask iter1 sum1
|
||||
carry1)
|
||||
(iter, sum, carry)
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 163:4-176:5
|
||||
Visibility: public -/
|
||||
def backend.serial.u64.scalar.Scalar52.add
|
||||
(a : backend.serial.u64.scalar.Scalar52)
|
||||
(b : backend.serial.u64.scalar.Scalar52) :
|
||||
Result backend.serial.u64.scalar.Scalar52
|
||||
:= do
|
||||
let i ← 1#u64 <<< 52#i32
|
||||
let mask ← i - 1#u64
|
||||
let sum ←
|
||||
backend.serial.u64.scalar.Scalar52.add_loop
|
||||
{ start := 0#usize, «end» := 5#usize } a b
|
||||
backend.serial.u64.scalar.Scalar52.ZERO mask 0#u64
|
||||
backend.serial.u64.scalar.Scalar52.sub sum backend.serial.u64.constants.L
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide]: loop body 1:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 91:12-93:13
|
||||
Visibility: public -/
|
||||
@[rust_loop_body]
|
||||
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body
|
||||
(bytes : Array Std.U8 64#usize) (i : Std.Usize)
|
||||
(iter : core.ops.range.Range Std.Usize) (words : Array Std.U64 8#usize) :
|
||||
Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array Std.U64
|
||||
8#usize)) (Array Std.U64 8#usize))
|
||||
:= do
|
||||
let (o, iter1) ←
|
||||
core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
|
||||
match o with
|
||||
| none => ok (done words)
|
||||
| some j =>
|
||||
let i1 ← i * 8#usize
|
||||
let i2 ← i1 + j
|
||||
let i3 ← Array.index_usize bytes i2
|
||||
let i4 ← lift (UScalar.cast .U64 i3)
|
||||
let i5 ← j * 8#usize
|
||||
let i6 ← i4 <<< i5
|
||||
let i7 ← Array.index_usize words i
|
||||
let i8 ← lift (i7 ||| i6)
|
||||
let a ← Array.update words i i8
|
||||
ok (cont (iter1, a))
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide]: loop 1:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 91:12-93:13
|
||||
Visibility: public -/
|
||||
@[rust_loop]
|
||||
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
|
||||
(iter : core.ops.range.Range Std.Usize) (bytes : Array Std.U8 64#usize)
|
||||
(words : Array Std.U64 8#usize) (i : Std.Usize) :
|
||||
Result (Array Std.U64 8#usize)
|
||||
:= do
|
||||
loop
|
||||
(fun (iter1, words1) =>
|
||||
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0.body bytes
|
||||
i iter1 words1)
|
||||
(iter, words)
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide]: loop body 0:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 90:8-94:9
|
||||
Visibility: public -/
|
||||
@[rust_loop_body]
|
||||
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body
|
||||
(bytes : Array Std.U8 64#usize) (iter : core.ops.range.Range Std.Usize)
|
||||
(words : Array Std.U64 8#usize) :
|
||||
Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array Std.U64
|
||||
8#usize)) (Array Std.U64 8#usize))
|
||||
:= do
|
||||
let (o, iter1) ←
|
||||
core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
|
||||
match o with
|
||||
| none => ok (done words)
|
||||
| some i =>
|
||||
let words1 ←
|
||||
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0_loop0
|
||||
{ start := 0#usize, «end» := 8#usize } bytes words i
|
||||
ok (cont (iter1, words1))
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide]: loop 0:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 90:8-94:9
|
||||
Visibility: public -/
|
||||
@[rust_loop]
|
||||
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0
|
||||
(iter : core.ops.range.Range Std.Usize) (bytes : Array Std.U8 64#usize)
|
||||
(words : Array Std.U64 8#usize) :
|
||||
Result (Array Std.U64 8#usize)
|
||||
:= do
|
||||
loop
|
||||
(fun (iter1, words1) =>
|
||||
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0.body bytes iter1
|
||||
words1)
|
||||
(iter, words)
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 88:4-118:5
|
||||
Visibility: public -/
|
||||
def backend.serial.u64.scalar.Scalar52.from_bytes_wide
|
||||
(bytes : Array Std.U8 64#usize) :
|
||||
Result backend.serial.u64.scalar.Scalar52
|
||||
:= do
|
||||
let words := Array.repeat 8#usize 0#u64
|
||||
let words1 ←
|
||||
backend.serial.u64.scalar.Scalar52.from_bytes_wide_loop0
|
||||
{ start := 0#usize, «end» := 8#usize } bytes words
|
||||
let i ← 1#u64 <<< 52#i32
|
||||
let mask ← i - 1#u64
|
||||
let i1 ← Array.index_usize words1 0#usize
|
||||
let (_, index_mut_back) ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
|
||||
backend.serial.u64.scalar.Scalar52.ZERO 0#usize
|
||||
let i2 ← lift (i1 &&& mask)
|
||||
let i3 ← i1 >>> 52#i32
|
||||
let i4 ← Array.index_usize words1 1#usize
|
||||
let i5 ← i4 <<< 12#i32
|
||||
let i6 ← lift (i3 ||| i5)
|
||||
let lo := index_mut_back i2
|
||||
let (_, index_mut_back1) ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
|
||||
lo 1#usize
|
||||
let i7 ← lift (i6 &&& mask)
|
||||
let i8 ← i4 >>> 40#i32
|
||||
let i9 ← Array.index_usize words1 2#usize
|
||||
let i10 ← i9 <<< 24#i32
|
||||
let i11 ← lift (i8 ||| i10)
|
||||
let lo1 := index_mut_back1 i7
|
||||
let (_, index_mut_back2) ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
|
||||
lo1 2#usize
|
||||
let i12 ← lift (i11 &&& mask)
|
||||
let i13 ← i9 >>> 28#i32
|
||||
let i14 ← Array.index_usize words1 3#usize
|
||||
let i15 ← i14 <<< 36#i32
|
||||
let i16 ← lift (i13 ||| i15)
|
||||
let lo2 := index_mut_back2 i12
|
||||
let (_, index_mut_back3) ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
|
||||
lo2 3#usize
|
||||
let i17 ← lift (i16 &&& mask)
|
||||
let i18 ← i14 >>> 16#i32
|
||||
let i19 ← Array.index_usize words1 4#usize
|
||||
let i20 ← i19 <<< 48#i32
|
||||
let i21 ← lift (i18 ||| i20)
|
||||
let lo3 := index_mut_back3 i17
|
||||
let (_, index_mut_back4) ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
|
||||
lo3 4#usize
|
||||
let i22 ← lift (i21 &&& mask)
|
||||
let i23 ← i19 >>> 4#i32
|
||||
let i24 ← lift (i23 &&& mask)
|
||||
let i25 ← i19 >>> 56#i32
|
||||
let i26 ← Array.index_usize words1 5#usize
|
||||
let i27 ← i26 <<< 8#i32
|
||||
let i28 ← lift (i25 ||| i27)
|
||||
let hi := index_mut_back i24
|
||||
let (_, index_mut_back5) ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
|
||||
hi 1#usize
|
||||
let i29 ← lift (i28 &&& mask)
|
||||
let i30 ← i26 >>> 44#i32
|
||||
let i31 ← Array.index_usize words1 6#usize
|
||||
let i32 ← i31 <<< 20#i32
|
||||
let i33 ← lift (i30 ||| i32)
|
||||
let hi1 := index_mut_back5 i29
|
||||
let (_, index_mut_back6) ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
|
||||
hi1 2#usize
|
||||
let i34 ← lift (i33 &&& mask)
|
||||
let i35 ← i31 >>> 32#i32
|
||||
let i36 ← Array.index_usize words1 7#usize
|
||||
let i37 ← i36 <<< 32#i32
|
||||
let i38 ← lift (i35 ||| i37)
|
||||
let hi2 := index_mut_back6 i34
|
||||
let (_, index_mut_back7) ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
|
||||
hi2 3#usize
|
||||
let i39 ← lift (i38 &&& mask)
|
||||
let i40 ← i36 >>> 20#i32
|
||||
let hi3 := index_mut_back7 i39
|
||||
let (_, index_mut_back8) ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
|
||||
hi3 4#usize
|
||||
let i41 ← lift (i40 &&& mask)
|
||||
let lo4 := index_mut_back4 i22
|
||||
let lo5 ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_mul lo4
|
||||
backend.serial.u64.constants.R
|
||||
let hi4 := index_mut_back8 i41
|
||||
let hi5 ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_mul hi4
|
||||
backend.serial.u64.constants.RR
|
||||
backend.serial.u64.scalar.Scalar52.add hi5 lo5
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::square_internal]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 230:4-249:5 -/
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 233:4-252:5 -/
|
||||
def backend.serial.u64.scalar.Scalar52.square_internal
|
||||
(a : backend.serial.u64.scalar.Scalar52) :
|
||||
Result (Array Std.U128 9#usize)
|
||||
|
|
@ -414,121 +722,8 @@ def backend.serial.u64.scalar.Scalar52.square_internal
|
|||
let i33 ← backend.serial.u64.scalar.m i18 i18
|
||||
ok (Array.make 9#usize [ i8, i10, i13, i17, i23, i27, i30, i32, i33 ])
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce::part2]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 263:8-266:9 -/
|
||||
def backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2
|
||||
(sum : Std.U128) : Result (Std.U128 × Std.U64) := do
|
||||
let i ← lift (UScalar.cast .U64 sum)
|
||||
let i1 ← 1#u64 <<< 52#i32
|
||||
let i2 ← i1 - 1#u64
|
||||
let w ← lift (i &&& i2)
|
||||
let i3 ← sum >>> 52#i32
|
||||
ok (i3, w)
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce::part1]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 257:8-260:9 -/
|
||||
def backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1
|
||||
(sum : Std.U128) : Result (Std.U128 × Std.U64) := do
|
||||
let i ← lift (UScalar.cast .U64 sum)
|
||||
let i1 ←
|
||||
lift (core.num.U64.wrapping_mul i backend.serial.u64.constants.LFACTOR)
|
||||
let i2 ← 1#u64 <<< 52#i32
|
||||
let i3 ← i2 - 1#u64
|
||||
let p ← lift (i1 &&& i3)
|
||||
let i4 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
backend.serial.u64.constants.L 0#usize
|
||||
let i5 ← backend.serial.u64.scalar.m p i4
|
||||
let i6 ← sum + i5
|
||||
let i7 ← i6 >>> 52#i32
|
||||
ok (i7, p)
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 254:4-287:5 -/
|
||||
def backend.serial.u64.scalar.Scalar52.montgomery_reduce
|
||||
(limbs : Array Std.U128 9#usize) :
|
||||
Result backend.serial.u64.scalar.Scalar52
|
||||
:= do
|
||||
let i ← Array.index_usize limbs 0#usize
|
||||
let (carry, n0) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i
|
||||
let i1 ← Array.index_usize limbs 1#usize
|
||||
let i2 ← carry + i1
|
||||
let i3 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
backend.serial.u64.constants.L 1#usize
|
||||
let i4 ← backend.serial.u64.scalar.m n0 i3
|
||||
let i5 ← i2 + i4
|
||||
let (carry1, n1) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i5
|
||||
let i6 ← Array.index_usize limbs 2#usize
|
||||
let i7 ← carry1 + i6
|
||||
let i8 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
backend.serial.u64.constants.L 2#usize
|
||||
let i9 ← backend.serial.u64.scalar.m n0 i8
|
||||
let i10 ← i7 + i9
|
||||
let i11 ← backend.serial.u64.scalar.m n1 i3
|
||||
let i12 ← i10 + i11
|
||||
let (carry2, n2) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i12
|
||||
let i13 ← Array.index_usize limbs 3#usize
|
||||
let i14 ← carry2 + i13
|
||||
let i15 ← backend.serial.u64.scalar.m n1 i8
|
||||
let i16 ← i14 + i15
|
||||
let i17 ← backend.serial.u64.scalar.m n2 i3
|
||||
let i18 ← i16 + i17
|
||||
let (carry3, n3) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i18
|
||||
let i19 ← Array.index_usize limbs 4#usize
|
||||
let i20 ← carry3 + i19
|
||||
let i21 ←
|
||||
backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
|
||||
backend.serial.u64.constants.L 4#usize
|
||||
let i22 ← backend.serial.u64.scalar.m n0 i21
|
||||
let i23 ← i20 + i22
|
||||
let i24 ← backend.serial.u64.scalar.m n2 i8
|
||||
let i25 ← i23 + i24
|
||||
let i26 ← backend.serial.u64.scalar.m n3 i3
|
||||
let i27 ← i25 + i26
|
||||
let (carry4, n4) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i27
|
||||
let i28 ← Array.index_usize limbs 5#usize
|
||||
let i29 ← carry4 + i28
|
||||
let i30 ← backend.serial.u64.scalar.m n1 i21
|
||||
let i31 ← i29 + i30
|
||||
let i32 ← backend.serial.u64.scalar.m n3 i8
|
||||
let i33 ← i31 + i32
|
||||
let i34 ← backend.serial.u64.scalar.m n4 i3
|
||||
let i35 ← i33 + i34
|
||||
let (carry5, r0) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i35
|
||||
let i36 ← Array.index_usize limbs 6#usize
|
||||
let i37 ← carry5 + i36
|
||||
let i38 ← backend.serial.u64.scalar.m n2 i21
|
||||
let i39 ← i37 + i38
|
||||
let i40 ← backend.serial.u64.scalar.m n4 i8
|
||||
let i41 ← i39 + i40
|
||||
let (carry6, r1) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i41
|
||||
let i42 ← Array.index_usize limbs 7#usize
|
||||
let i43 ← carry6 + i42
|
||||
let i44 ← backend.serial.u64.scalar.m n3 i21
|
||||
let i45 ← i43 + i44
|
||||
let (carry7, r2) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i45
|
||||
let i46 ← Array.index_usize limbs 8#usize
|
||||
let i47 ← carry7 + i46
|
||||
let i48 ← backend.serial.u64.scalar.m n4 i21
|
||||
let i49 ← i47 + i48
|
||||
let (carry8, r3) ←
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i49
|
||||
let r4 ← lift (UScalar.cast .U64 carry8)
|
||||
backend.serial.u64.scalar.Scalar52.sub
|
||||
(Array.make 5#usize [ r0, r1, r2, r3, r4 ]) backend.serial.u64.constants.L
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::mul]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 291:4-294:5
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 294:4-297:5
|
||||
Visibility: public -/
|
||||
def backend.serial.u64.scalar.Scalar52.mul
|
||||
(a : backend.serial.u64.scalar.Scalar52)
|
||||
|
|
@ -543,7 +738,7 @@ def backend.serial.u64.scalar.Scalar52.mul
|
|||
backend.serial.u64.scalar.Scalar52.montgomery_reduce a2
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::square]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 299:4-302:5
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 302:4-305:5
|
||||
Visibility: public -/
|
||||
def backend.serial.u64.scalar.Scalar52.square
|
||||
(self : backend.serial.u64.scalar.Scalar52) :
|
||||
|
|
@ -556,19 +751,8 @@ def backend.serial.u64.scalar.Scalar52.square
|
|||
backend.serial.u64.constants.RR
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce a1
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_mul]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 306:4-308:5
|
||||
Visibility: public -/
|
||||
def backend.serial.u64.scalar.Scalar52.montgomery_mul
|
||||
(a : backend.serial.u64.scalar.Scalar52)
|
||||
(b : backend.serial.u64.scalar.Scalar52) :
|
||||
Result backend.serial.u64.scalar.Scalar52
|
||||
:= do
|
||||
let a1 ← backend.serial.u64.scalar.Scalar52.mul_internal a b
|
||||
backend.serial.u64.scalar.Scalar52.montgomery_reduce a1
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_square]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 312:4-314:5
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 315:4-317:5
|
||||
Visibility: public -/
|
||||
def backend.serial.u64.scalar.Scalar52.montgomery_square
|
||||
(self : backend.serial.u64.scalar.Scalar52) :
|
||||
|
|
@ -578,7 +762,7 @@ def backend.serial.u64.scalar.Scalar52.montgomery_square
|
|||
backend.serial.u64.scalar.Scalar52.montgomery_reduce a
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::as_montgomery]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 318:4-320:5
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 321:4-323:5
|
||||
Visibility: public -/
|
||||
def backend.serial.u64.scalar.Scalar52.as_montgomery
|
||||
(self : backend.serial.u64.scalar.Scalar52) :
|
||||
|
|
@ -588,7 +772,7 @@ def backend.serial.u64.scalar.Scalar52.as_montgomery
|
|||
backend.serial.u64.constants.RR
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_montgomery]: loop body 0:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 327:8-329:9
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 330:8-332:9
|
||||
Visibility: public -/
|
||||
@[rust_loop_body]
|
||||
def backend.serial.u64.scalar.Scalar52.from_montgomery_loop.body
|
||||
|
|
@ -610,7 +794,7 @@ def backend.serial.u64.scalar.Scalar52.from_montgomery_loop.body
|
|||
ok (cont (iter1, a))
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_montgomery]: loop 0:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 327:8-329:9
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 330:8-332:9
|
||||
Visibility: public -/
|
||||
@[rust_loop]
|
||||
def backend.serial.u64.scalar.Scalar52.from_montgomery_loop
|
||||
|
|
@ -626,7 +810,7 @@ def backend.serial.u64.scalar.Scalar52.from_montgomery_loop
|
|||
(iter, limbs)
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_montgomery]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 325:4-331:5
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 328:4-334:5
|
||||
Visibility: public -/
|
||||
def backend.serial.u64.scalar.Scalar52.from_montgomery
|
||||
(self : backend.serial.u64.scalar.Scalar52) :
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ set_option maxRecDepth 2048
|
|||
open curve25519_dalek
|
||||
|
||||
/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub::black_box]:
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 179:8-183:9 -/
|
||||
Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 182:8-186:9 -/
|
||||
axiom backend.serial.u64.scalar.Scalar52.sub.black_box
|
||||
: Std.U64 → Result Std.U64
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue