mirror of
https://github.com/saymrwulf/risc0-ed25519-verified.git
synced 2026-09-05 20:10:36 +00:00
saymrwulf
49a68688c9
This v4.1.x fork implements Scalar52::sub with TWO loops (loop0 = borrow chain; loop1 adds L &&& underflow_mask — the arithmetic-mask constant-time conditional), a genuinely different code path from upstream v5's subtle-based conditional_add_l. Verified per R2 against this fork's own gen: - sub_loop_spec (= loop0): borrow chain, verbatim technique from dalek - sub_loop1_zero_spec / sub_loop1_one_spec: the masked-L add, both mask values (0 / 2^64-1), full carry chains - sub_val_spec: denote(sub a b) = denote a - denote b in ZMod l; the underflow mask um = ((borrow>>>63) XOR 1) - 1 resolved per case - add_loop_spec + add_val_spec: denote(add a b) = denote a + denote b (v4 add_loop extracts token-identical to v5; composition through this fork's own sub_val_spec) check-scalar.sh: full manifest, 5/5 kernel axiom audit [propext, Classical.choice, Quot.sound], green at 300-400s/4096MB. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| AddSpec.lean | ||
| ConstSpecs.lean | ||
| Denote.lean | ||
| EdAddAffNiels.lean | ||
| EdAddProjNiels.lean | ||
| EdConvert.lean | ||
| EdCurve.lean | ||
| EdDenote.lean | ||
| EdDouble.lean | ||
| EdMain.lean | ||
| FeQ.lean | ||
| Field.lean | ||
| FieldMain.lean | ||
| InvertSpec.lean | ||
| MulSpec.lean | ||
| P25519.lean | ||
| ReduceSpec.lean | ||
| ScalarAddSpec.lean | ||
| ScalarDenote.lean | ||
| ScalarLoop.lean | ||
| ScalarSubSpec.lean | ||
| Square2Spec.lean | ||
| SquareSpec.lean | ||
| SubNegSpec.lean | ||