verifying-crypto-with-lean/chapters/glossary.tex

\chapter*{Glossary}
\markboth{Glossary}{}
\addcontentsline{toc}{chapter}{Glossary}

\newcommand{\gloss}[1]{\par\smallskip\noindent{\bfseries #1.}\ }

\gloss{Axiom-clean} Of a theorem: \lean{\#print axioms} reports exactly
Lean's standard trio --- \lean{propext}, \lean{Classical.choice},
\lean{Quot.sound} --- and nothing else. The gold standard for shipped certificates
(Chapter~\ref{ch:honesty}).

\gloss{Bounds invariant} A predicate limiting how large limbs may grow
(e.g.\ every limb $< 2^{54}$), maintained across operations so that
machine arithmetic never overflows. One of the two clauses of every
operation spec (Chapters~\ref{ch:rust}--\ref{ch:denotation}).

\gloss{Carry} Value moved from one limb position to the next when a
limb exceeds its radix. Delayed (``lazy'') carries are the central
performance trick of fast field arithmetic and the habitat of its
characteristic bugs (Chapter~\ref{ch:why}; Interlude).

\gloss{Certificate} Data that makes a fact cheap to \emph{check}
regardless of how expensive it was to \emph{find}: a Pratt witness
tree for primality, a proof object for a theorem
(Chapter~\ref{ch:prime}).

\gloss{Charon / Aeneas} The two-stage extraction pipeline: Charon
compiles Rust to the LLBC intermediate representation; Aeneas
translates LLBC into pure Lean definitions
(Chapter~\ref{ch:rust}).

\gloss{Cofactor} The factor $8$ in the Ed25519 group order $8\ell$;
multiplying by it annihilates the small-torsion component of any point,
which is why \emph{cofactored} verifiers (the ZIP-215 lineage) check
$8sB = 8R + 8kA$. The verified dalek-lineage path checks the stricter
\emph{canonical} uncofactored equation byte-exactly
(Chapter~\ref{ch:pyramid}).

\gloss{Commuting square} The diagram --- machine operation along the
top, ideal operation along the bottom, denotation down the sides ---
whose closure \emph{is} implementation correctness
(Chapter~\ref{ch:denotation}).

\gloss{Complete (addition law)} An addition formula with no exceptional
cases: valid for every pair of points, including doubling and identity.
Ed25519's Edwards law is complete because $d$ is a non-square
(Chapter~\ref{ch:pyramid}).

\gloss{Decision procedure} An algorithm that settles \emph{every}
statement in a defined logical fragment --- \lean{omega} for linear
arithmetic, \lean{decide} for finite computations, \lean{ring} for
ring identities. Failure on an in-fragment goal means the goal is
false (Chapter~\ref{ch:automation}).

\gloss{Definitional equality} Two terms being identical after the
kernel computes (unfolds definitions, reduces recursion). What
\lean{rfl} checks; blocked by opaque variables in recursion position
(Chapter~\ref{ch:pat}).

\gloss{Denotation} The function $\denote{\cdot}$ mapping a machine
representation (limb array) to the mathematical value it \emph{means}
(an element of $\Fp$). The bridge on which all correctness statements
stand (Chapter~\ref{ch:denotation}).

\gloss{Euler's criterion} $a^{(p-1)/2} \equiv \pm 1 \pmod p$ decides
whether $a$ is a square modulo the odd prime $p$ ($+1$: square; $-1$:
non-square). Settles both completeness facts of
Chapter~\ref{ch:pyramid} (toolkit Card~7).

\gloss{Extraction} Mechanical translation of source code (Rust) into a
proof assistant's language via Charon/Aeneas, producing the \emph{model}
--- the artifact actually verified, never hand-edited
(Chapter~\ref{ch:rust}).

\gloss{Fermat's little theorem} $a^{p-1} \equiv 1 \pmod p$ for prime
$p$ and $a \not\equiv 0$; hence $a^{p-2} = a^{-1}$, the identity behind
the verified inversion chain (Chapters~\ref{ch:modular},
\ref{ch:field}).

\gloss{Find/check asymmetry} The gap between the cost of discovering a
fact and the cost of verifying a certificate for it --- the engine of
Pratt certificates, proof kernels, and (in disguise) the P-vs-NP
question (Chapter~\ref{ch:prime}).

\gloss{Fold} Reducing an overflow of the representation (weight
$2^{255}$ and above) back into range using the modulus identity
$2^{255} \equiv 19$; costs exactly one multiple of $p$ per unit folded
(Chapter~\ref{ch:denotation}; Interlude).

\gloss{FORS} Forest Of Random Subsets: SLH-DSA's few-time signature ---
$k$ small Merkle trees, one secret revealed per tree, all recomputed
roots compressed and certified by the hypertree; reuse degrades
gracefully instead of breaking, which is what buys statelessness
(Chapter~\ref{ch:secondsummit}).

\gloss{Goal state} The proof assistant's board: hypotheses above the
turnstile $\vdash$, obligation below. Reading it is the core tactic
skill (Chapter~\ref{ch:tactics}).

\gloss{Hash oracle} A hash function entering a proof as an \emph{axiom}
with assumed functional behavior and no proven properties; the five
SLH-DSA verify-path oracles are the standing example, and the audit's
cone table shows exactly which certificate leans on which
(Chapter~\ref{ch:secondsummit}).

\gloss{Hasse bound} An elliptic curve over $\Fp$ has $p + 1 - t$ points
with $|t| \le 2\sqrt{p}$; the thirty-second sanity check for any
claimed group order (Chapter~\ref{ch:pyramid}).

\gloss{Headroom} Bits of slack between a limb's payload (e.g.\ 51 bits)
and its machine word (64 bits); the budget lazy carries spend
(Chapter~\ref{ch:why}).

\gloss{Hypertree} SLH-DSA's tower of $d$ Merkle-tree layers, each tree's
root signed by a one-time key of the layer above --- a virtual structure
of $2^h$ keys that is never materialized: any path can be recomputed
from a seed, and one root pins it all (Chapter~\ref{ch:secondsummit}).

\gloss{Inductive type} A type defined by listing its constructors
exhaustively (\lean{Nat}: \lean{zero} and \lean{succ}). Grants both
pattern matching and the induction principle (Chapters~\ref{ch:lean},
\ref{ch:tactics}).

\gloss{Kernel} The small, paranoid core of a proof assistant that
re-checks every proof object against a fixed rule set; the only
component whose correctness soundness depends on
(Chapter~\ref{ch:why}).

\gloss{Limb} One machine word of a multi-word big-number
representation; Ed25519 field elements use five 51-bit limbs in 64-bit
words (Chapters~\ref{ch:why}, \ref{ch:denotation}).

\gloss{Model} The extracted Lean rendition of the source code, living
in \code{gen/}; the object theorems quantify over
(Chapter~\ref{ch:rust}).

\gloss{Montgomery form} Representing $x$ as $x \cdot R \bmod p$
(typically $R = 2^{256}$) to make post-multiplication reduction cheap;
absorbed by adjusting the denotation (Chapter~\ref{ch:denotation}).

\gloss{Pratt witness} An element $w$ with $w^{p-1} \equiv 1$ and
$w^{(p-1)/q} \not\equiv 1$ for every prime $q \mid p-1$; its existence
certifies $p$ prime, given certificates for the $q$'s
(Chapter~\ref{ch:prime}).

\gloss{Radix} The base of a limb representation ($2^{51}$ for the
dalek field, $4$ for this book's toy system).

\gloss{SLH-DSA} The stateless hash-based digital signature algorithm of
FIPS~205 (descended from SPHINCS\textsuperscript{+}): FORS under a
hypertree of Winternitz chains, built from hash functions and nothing
else --- no structure for Shor's algorithm to attack
(Chapter~\ref{ch:secondsummit}).

\gloss{Specification (spec)} The precise statement a program is proven
to satisfy. The two-clause shape for arithmetic: bounds propagation
plus value equation. A proof is only as good as its spec
(Chapters~\ref{ch:denotation}, \ref{ch:honesty}).

\gloss{Substitution test} Auditing a spec by substituting an
adversarial implementation and checking whether the statement notices;
detects trivial specs no tool can flag (Chapter~\ref{ch:honesty}).

\gloss{Tactic} A command in Lean's interactive proof mode that
transforms the goal state (\lean{intro}, \lean{rw}, \lean{induction},
\lean{omega}, \dots), assembling a proof object behind the scenes
(Chapter~\ref{ch:tactics}).

\gloss{Torsion} The small-order component of a curve point (order
dividing the cofactor); killed by multiplying by $8$, hence invisible
to cofactored verification (Chapter~\ref{ch:pyramid}).

\gloss{Trusted base} Everything a verification result assumes rather
than proves: the kernel, the extraction tool, declared axioms
(SHA-512, untranslatable backends). Honest projects keep it small,
documented, and machine-visible (Chapters~\ref{ch:rust},
\ref{ch:honesty}).

\gloss{Two-clause spec} This book's name for the standard operation
theorem: \emph{(1)} the operation succeeds and its output satisfies the
(possibly widened) bounds invariant; \emph{(2)} the output's denotation
equals the ideal result (Chapter~\ref{ch:denotation}; Interlude).

\gloss{Winternitz chain (WOTS\textsuperscript{+})} A hash chain
$c_0, F(c_0), F(F(c_0)), \dots$ signing one digit by revealing the
chain value at the digit's position; the verifier walks the remaining
steps to the published end. A checksum makes forward-walking forgeries
self-defeating (Chapter~\ref{ch:secondsummit}).