|
|
82ee511277
|
Scalar layer complete: Montgomery reduction + full mul ported, scalarImplementation aggregate
Port of the dalek Montgomery stack against THIS fork's own extraction
(gen sections byte-identical, proofs recompiled from scratch here):
- Proofs/ScalarMulSpec.lean - mul_internal: 9 exact schoolbook columns
- Proofs/ScalarMontSpec.lean - part1/part2 exact-division rounds
(LFACTOR*L0 = -1 mod 2^52), head/tail telescopes, mont_bound, tail walk
- Proofs/ScalarReduceSpec.lean - montgomery_reduce main walk:
scDenote r * 2^260 = Z in ZMod ell + 52-bit output bounds
- Proofs/ScalarFullMulSpec.lean - mul = double Montgomery round through
RR = R^2 mod ell; R cancelled as a unit; post: [mul a b] = [a]*[b]
- Proofs/ScalarMain.lean - scalarImplementation aggregate (ScBnd
interfaces; canonical inputs discharge the Montgomery bound)
sub_val_spec/add_val_spec posts strengthened with result-limb bounds.
check-scalar.sh: 9 proof files, 10 kernel audits, all exactly
[propext, Classical.choice, Quot.sound]. Button pressed fresh: green.
|
2026-07-03 21:46:39 +02:00 |
|
