mirror of
https://github.com/saymrwulf/verifying-crypto-with-lean.git
synced 2026-09-03 19:53:45 +00:00
mrwulf
1f11b8aa4d
The operator caught what no check had ever tested: nobody had LOOKED at
the rendered pages. A ten-inspector visual audit of all 129 pages (every
page opened as an image) found 40 defects, including didactic
correctness bugs invisible to the text layer:
BAD, fixed:
- ch03 printed WRONG Lean operators: \lean{P /\ Q} lost its backslash
('P / Q') and \lean{P \/ Q} lost the operator entirely ('P Q') —
TeX ate them inside the non-verbatim macro. Now the unicode ∧/∨ the
book uses everywhere else.
- ch12: the doubling display overflowed its box border, slicing the
math; stacked on two lines.
- toolkit Card 6: the headroom-audit display was clipped by the page
edge; now an align* stack.
UGLY, fixed:
- title page: the 'pyramid motif' at 5% white opacity on near-black
rendered as smudge artifacts, plus a clipped ∀ glyph in the corner
— redrawn with solid mixed colors (no transparency), glyph removed;
the footer's mid-word paragraph gap was a \vspace landing inside
horizontal mode; fixed with \par
- ch06: both clock diagrams' wrap-around arrows ran counterclockwise,
retracing over earlier arcs — target position expressed as 12 (one
revolution) so the arc continues clockwise, landing on 0 (mod 12)
and 1 (mod 11) correctly
- ch04: two_mul'' printed as two_mul" (quote ligature)
- one-line orphaned box fragments and stranded solution headings
throughout: bigidea/tryit/pitfall/aha/checkpoint are now unbreakable
(none exceeds half a page), worked boxes announce '(continued)' after
a break, \solhead keeps four lines with \Needspace
- --all/--receipt flags printed as one merged dash: \ddash macro
- inline code no longer hyphen-breaks at underscores (codeguards)
- ch09's 2^{...} smudge, glossary margin overflow, ch08 orphaned
listing line, ch13 command-line layout, three >10pt overfulls
THE STRUCTURAL LESSON, encoded: the two worst clipping bugs had been
announced as 80pt/73pt overfull warnings in every build log and ignored.
check-book.sh now FAILS on any overfull box past 10pt — the machine was
telling us; now it is allowed to stop us.
132 pages; publication-history and README counts synced; every fixed
page re-rendered and verified by eye. Button: ALL GREEN (96 checks).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
188 lines
8.6 KiB
TeX
188 lines
8.6 KiB
TeX
\chapter*{Glossary}
|
|
\markboth{Glossary}{}
|
|
\addcontentsline{toc}{chapter}{Glossary}
|
|
|
|
\newcommand{\gloss}[1]{\par\smallskip\noindent{\bfseries #1.}\ }
|
|
|
|
\gloss{Axiom-clean} Of a theorem: \lean{\#print axioms} reports exactly
|
|
Lean's standard trio --- \lean{propext}, \lean{Classical.choice},
|
|
\lean{Quot.sound} --- and nothing else. The gold standard for shipped certificates
|
|
(Chapter~\ref{ch:honesty}).
|
|
|
|
\gloss{Bounds invariant} A predicate limiting how large limbs may grow
|
|
(e.g.\ every limb $< 2^{54}$), maintained across operations so that
|
|
machine arithmetic never overflows. One of the two clauses of every
|
|
operation spec (Chapters~\ref{ch:rust}--\ref{ch:denotation}).
|
|
|
|
\gloss{Carry} Value moved from one limb position to the next when a
|
|
limb exceeds its radix. Delayed (``lazy'') carries are the central
|
|
performance trick of fast field arithmetic and the habitat of its
|
|
characteristic bugs (Chapter~\ref{ch:why}; Interlude).
|
|
|
|
\gloss{Certificate} Data that makes a fact cheap to \emph{check}
|
|
regardless of how expensive it was to \emph{find}: a Pratt witness
|
|
tree for primality, a proof object for a theorem
|
|
(Chapter~\ref{ch:prime}).
|
|
|
|
\gloss{Charon / Aeneas} The two-stage extraction pipeline: Charon
|
|
compiles Rust to the LLBC intermediate representation; Aeneas
|
|
translates LLBC into pure Lean definitions
|
|
(Chapter~\ref{ch:rust}).
|
|
|
|
\gloss{Cofactor} The factor $8$ in the Ed25519 group order $8\ell$;
|
|
multiplying by it annihilates the small-torsion component of any point,
|
|
which is why \emph{cofactored} verifiers (the ZIP-215 lineage) check
|
|
$8sB = 8R + 8kA$. The verified dalek-lineage path checks the stricter
|
|
\emph{canonical} uncofactored equation byte-exactly
|
|
(Chapter~\ref{ch:pyramid}).
|
|
|
|
\gloss{Commuting square} The diagram --- machine operation along the
|
|
top, ideal operation along the bottom, denotation down the sides ---
|
|
whose closure \emph{is} implementation correctness
|
|
(Chapter~\ref{ch:denotation}).
|
|
|
|
\gloss{Complete (addition law)} An addition formula with no exceptional
|
|
cases: valid for every pair of points, including doubling and identity.
|
|
Ed25519's Edwards law is complete because $d$ is a non-square
|
|
(Chapter~\ref{ch:pyramid}).
|
|
|
|
\gloss{Decision procedure} An algorithm that settles \emph{every}
|
|
statement in a defined logical fragment --- \lean{omega} for linear
|
|
arithmetic, \lean{decide} for finite computations, \lean{ring} for
|
|
ring identities. Failure on an in-fragment goal means the goal is
|
|
false (Chapter~\ref{ch:automation}).
|
|
|
|
\gloss{Definitional equality} Two terms being identical after the
|
|
kernel computes (unfolds definitions, reduces recursion). What
|
|
\lean{rfl} checks; blocked by opaque variables in recursion position
|
|
(Chapter~\ref{ch:pat}).
|
|
|
|
\gloss{Denotation} The function $\denote{\cdot}$ mapping a machine
|
|
representation (limb array) to the mathematical value it \emph{means}
|
|
(an element of $\Fp$). The bridge on which all correctness statements
|
|
stand (Chapter~\ref{ch:denotation}).
|
|
|
|
\gloss{Euler's criterion} $a^{(p-1)/2} \equiv \pm 1 \pmod p$ decides
|
|
whether $a$ is a square modulo the odd prime $p$ ($+1$: square; $-1$:
|
|
non-square). Settles both completeness facts of
|
|
Chapter~\ref{ch:pyramid} (toolkit Card~7).
|
|
|
|
\gloss{Extraction} Mechanical translation of source code (Rust) into a
|
|
proof assistant's language via Charon/Aeneas, producing the \emph{model}
|
|
--- the artifact actually verified, never hand-edited
|
|
(Chapter~\ref{ch:rust}).
|
|
|
|
\gloss{Fermat's little theorem} $a^{p-1} \equiv 1 \pmod p$ for prime
|
|
$p$ and $a \not\equiv 0$; hence $a^{p-2} = a^{-1}$, the identity behind
|
|
the verified inversion chain (Chapters~\ref{ch:modular},
|
|
\ref{ch:field}).
|
|
|
|
\gloss{Find/check asymmetry} The gap between the cost of discovering a
|
|
fact and the cost of verifying a certificate for it --- the engine of
|
|
Pratt certificates, proof kernels, and (in disguise) the P-vs-NP
|
|
question (Chapter~\ref{ch:prime}).
|
|
|
|
\gloss{Fold} Reducing an overflow of the representation (weight
|
|
$2^{255}$ and above) back into range using the modulus identity
|
|
$2^{255} \equiv 19$; costs exactly one multiple of $p$ per unit folded
|
|
(Chapter~\ref{ch:denotation}; Interlude).
|
|
|
|
\gloss{FORS} Forest Of Random Subsets: SLH-DSA's few-time signature ---
|
|
$k$ small Merkle trees, one secret revealed per tree, all recomputed
|
|
roots compressed and certified by the hypertree; reuse degrades
|
|
gracefully instead of breaking, which is what buys statelessness
|
|
(Chapter~\ref{ch:secondsummit}).
|
|
|
|
\gloss{Goal state} The proof assistant's board: hypotheses above the
|
|
turnstile $\vdash$, obligation below. Reading it is the core tactic
|
|
skill (Chapter~\ref{ch:tactics}).
|
|
|
|
\gloss{Hash oracle} A hash function entering a proof as an \emph{axiom}
|
|
with assumed functional behavior and no proven properties; the five
|
|
SLH-DSA verify-path oracles are the standing example, and the audit's
|
|
cone table shows exactly which certificate leans on which
|
|
(Chapter~\ref{ch:secondsummit}).
|
|
|
|
\gloss{Hasse bound} An elliptic curve over $\Fp$ has $p + 1 - t$ points
|
|
with $|t| \le 2\sqrt{p}$; the thirty-second sanity check for any
|
|
claimed group order (Chapter~\ref{ch:pyramid}).
|
|
|
|
\gloss{Headroom} Bits of slack between a limb's payload (e.g.\ 51 bits)
|
|
and its machine word (64 bits); the budget lazy carries spend
|
|
(Chapter~\ref{ch:why}).
|
|
|
|
\gloss{Hypertree} SLH-DSA's tower of $d$ Merkle-tree layers, each tree's
|
|
root signed by a one-time key of the layer above --- a virtual structure
|
|
of $2^h$ keys that is never materialized: any path can be recomputed
|
|
from a seed, and one root pins it all (Chapter~\ref{ch:secondsummit}).
|
|
|
|
\gloss{Inductive type} A type defined by listing its constructors
|
|
exhaustively (\lean{Nat}: \lean{zero} and \lean{succ}). Grants both
|
|
pattern matching and the induction principle (Chapters~\ref{ch:lean},
|
|
\ref{ch:tactics}).
|
|
|
|
\gloss{Kernel} The small, paranoid core of a proof assistant that
|
|
re-checks every proof object against a fixed rule set; the only
|
|
component whose correctness soundness depends on
|
|
(Chapter~\ref{ch:why}).
|
|
|
|
\gloss{Limb} One machine word of a multi-word big-number
|
|
representation; Ed25519 field elements use five 51-bit limbs in 64-bit
|
|
words (Chapters~\ref{ch:why}, \ref{ch:denotation}).
|
|
|
|
\gloss{Model} The extracted Lean rendition of the source code, living
|
|
in \code{gen/}; the object theorems quantify over
|
|
(Chapter~\ref{ch:rust}).
|
|
|
|
\gloss{Montgomery form} Representing $x$ as $x \cdot R \bmod p$
|
|
(typically $R = 2^{256}$) to make post-multiplication reduction cheap;
|
|
absorbed by adjusting the denotation (Chapter~\ref{ch:denotation}).
|
|
|
|
\gloss{Pratt witness} An element $w$ with $w^{p-1} \equiv 1$ and
|
|
$w^{(p-1)/q} \not\equiv 1$ for every prime $q \mid p-1$; its existence
|
|
certifies $p$ prime, given certificates for the $q$'s
|
|
(Chapter~\ref{ch:prime}).
|
|
|
|
\gloss{Radix} The base of a limb representation ($2^{51}$ for the
|
|
dalek field, $4$ for this book's toy system).
|
|
|
|
\gloss{SLH-DSA} The stateless hash-based digital signature algorithm of
|
|
FIPS~205 (descended from SPHINCS\textsuperscript{+}): FORS under a
|
|
hypertree of Winternitz chains, built from hash functions and nothing
|
|
else --- no structure for Shor's algorithm to attack
|
|
(Chapter~\ref{ch:secondsummit}).
|
|
|
|
\gloss{Specification (spec)} The precise statement a program is proven
|
|
to satisfy. The two-clause shape for arithmetic: bounds propagation
|
|
plus value equation. A proof is only as good as its spec
|
|
(Chapters~\ref{ch:denotation}, \ref{ch:honesty}).
|
|
|
|
\gloss{Substitution test} Auditing a spec by substituting an
|
|
adversarial implementation and checking whether the statement notices;
|
|
detects trivial specs no tool can flag (Chapter~\ref{ch:honesty}).
|
|
|
|
\gloss{Tactic} A command in Lean's interactive proof mode that
|
|
transforms the goal state (\lean{intro}, \lean{rw}, \lean{induction},
|
|
\lean{omega}, \dots), assembling a proof object behind the scenes
|
|
(Chapter~\ref{ch:tactics}).
|
|
|
|
\gloss{Torsion} The small-order component of a curve point (order
|
|
dividing the cofactor); killed by multiplying by $8$, hence invisible
|
|
to cofactored verification (Chapter~\ref{ch:pyramid}).
|
|
|
|
\gloss{Trusted base} Everything a verification result assumes rather
|
|
than proves: the kernel, the extraction tool, declared axioms
|
|
(SHA-512, untranslatable backends). Honest projects keep it small,
|
|
documented, and machine-visible (Chapters~\ref{ch:rust},
|
|
\ref{ch:honesty}).
|
|
|
|
\gloss{Two-clause spec} This book's name for the standard operation
|
|
theorem: \emph{(1)} the operation succeeds and its output satisfies the
|
|
(possibly widened) bounds invariant; \emph{(2)} the output's denotation
|
|
equals the ideal result (Chapter~\ref{ch:denotation}; Interlude).
|
|
|
|
\gloss{Winternitz chain (WOTS\textsuperscript{+})} A hash chain
|
|
$c_0, F(c_0), F(F(c_0)), \dots$ signing one digit by revealing the
|
|
chain value at the digit's position; the verifier walks the remaining
|
|
steps to the published end. A checksum makes forward-walking forgeries
|
|
self-defeating (Chapter~\ref{ch:secondsummit}).
|