verifying-crypto-with-lean/main.tex

\documentclass[11pt]{report}
\input{preamble}

\begin{document}

% ===================== TITLE PAGE =====================
\begin{titlepage}
\pagecolor{ink}\color{paper}
\begin{tikzpicture}[remember picture,overlay]
  % the proof pyramid the book climbs — drawn in solid mixed colors, never
  % transparency: low-opacity fills on a dark ground render as smudge and
  % vary by viewer. Crisp thin outlines make it read as intentional.
  \foreach \i/\w in {0/5.4, 1/4.2, 2/3.0, 3/1.8}{
    \draw[paper!30!ink, line width=0.5pt, fill=paper!8!ink]
      ($(current page.center)+(-\w/2,{-3.0+\i*0.95})$) rectangle ++(\w,0.8);
  }
\end{tikzpicture}
\vspace*{3.2cm}
{\fontsize{15}{18}\selectfont\scshape\color{accent} a hands-on course in\par}
\vspace{0.5cm}
{\fontsize{40}{44}\selectfont\bfseries Verifying Cryptography\\[2pt] with Lean 4\par}
\vspace{0.8cm}
{\fontsize{15}{20}\selectfont\color{paper}
From {\ttfamily 1+1=2} to a machine-checked proof that\\ real elliptic-curve code is correct.\par}
\vfill
{\large\color{paper} A curriculum for the curious undergraduate ---\\
no prior formal-verification or Lean experience assumed.\par}
\vspace{0.8cm}
{\color{paper!40!ink}\rule{\linewidth}{0.6pt}\par}
\vspace{0.15cm}
{\small\color{paper}\raggedright
Companion to a public transparency log of machine-checked proofs ---
\textbf{\code{ltl.zkdefi.org}}, 19 entries and counting, one of them
post-quantum. Open it on your phone now; by the last chapter you will be
able to verify every entry yourself.\par
\smallskip
Every code snippet in this book runs. Every claim it makes about a proof,
a proof assistant has checked.\par}
\end{titlepage}
\restoregeometry
\pagecolor{paper}\color{ink}

% BEGIN PUBHIST ==================== publication history =====================
% The current-edition line is machine-checked by check-book.sh: its chapter
% count and page count must match the built book, and the committed PDF must
% contain it. Historical lines are frozen and exempt from the claim checks.
\thispagestyle{empty}
\vspace*{2cm}
{\small
\noindent\textbf{Second edition} --- published August 8, 2026: fourteen
chapters, 132 pages.

\medskip
\noindent\emph{Publication history}
\begin{itemize}[leftmargin=1.4em]
\item \textbf{First edition}, July 3, 2026 --- twelve chapters and the
  Interlude; expanded the same day with the pen-and-paper program and
  in-book solution pathways (53 to 106 pages).
\item July 28, 2026 --- the Attestation Protocol added as a thirteenth
  chapter.
\item \textbf{Second edition}, August 8, 2026 --- full didactic overhaul
  (seven moves, from a seven-reader audit); new Chapter~13, \emph{The
  Second Summit} (SLH-DSA, post-quantum); the Attestation Protocol becomes
  the fourteen-chapter book's single finale; \code{check-book.sh} added ---
  the script that verifies every countable claim in this book, including
  the line at the top of this page, against measured reality.
\end{itemize}

\medskip
\noindent The complete revision record is the git history of
\code{github.com/saymrwulf/verifying-crypto-with-lean}.
}
\clearpage
% END PUBHIST ================================================================

% ===================== HOW TO READ =====================
\chapter*{How to read this book}
\markboth{How to read this book}{}
\addcontentsline{toc}{chapter}{How to read this book}

There is a public web page --- \code{ltl.zkdefi.org} --- that lists nineteen
pieces of software, each stamped with a machine-checked proof that it does what
it claims. One of those stamps was earned two days before the writer of that
proof could make anyone else believe it; another belongs to a signature scheme
built to survive a quantum computer. This book is the road from not
understanding a single word on that page to being able to verify every entry on
it yourself, and to add your own.

You are about to learn one of the most powerful ideas in computer science: how
to make a computer \emph{prove} that a program is correct --- not test it on a
few inputs and hope, but establish, with the certainty of mathematics, that it
does the right thing on \emph{every} input. We will aim that power at
cryptography, where a single overlooked carry bit can quietly compromise every
key a system ever generates.

This book assumes you can program a little and remember a little high-school
algebra. It assumes \textbf{nothing} about formal methods, proof assistants, or
Lean. We start from \code{1 + 1 = 2} and end three summits later: real,
published, machine-checked theorems about Ed25519 --- the signature scheme in
your SSH client, your phone, and half the internet --- then about a hash-based
scheme built for the quantum era, and finally about the public log that lets a
stranger check all of it without trusting anyone.

\begin{itemize}[leftmargin=1.4em]
  \item \textbf{Do the exercises.} Reading a proof is like watching someone
  swim. You learn by getting in the water. Solutions are in the \code{solutions/}
  folder, but consult them only after a real attempt.
  \item \textbf{Everything runs.} The \code{exercises/} folder has Lean files you
  can open and check. When the book says ``Lean accepts this,'' you can watch it
  happen.
\end{itemize}

\begin{aha}
The secret this book reveals: a proof is not a wall of Greek symbols meant to
intimidate. A proof is a \emph{program} --- and a proof assistant is a very
strict compiler for it. Once you see proofs as programs, the fear evaporates and
the fun begins.
\end{aha}

\noindent\emph{(That green box you just read is an ``aha'' --- an intuition
meant to click. You will also meet coral \emph{big idea} boxes for
load-bearing concepts, grey \emph{try it} boxes that ask you to run something,
amber \emph{pitfall} boxes marking traps, and a framed \emph{checkpoint} at
each chapter's end. That is the whole legend; you have now seen one in the
wild.)}

\subsection*{Working the pen-and-paper material}

The notebook-ruled \emph{Pen and paper} boxes are not optional
enrichment; they are half the course. Each one performs a computation
with the \emph{real} constants of the systems under study ---
$2^{255}-19$, radix $2^{51}$, the fold constant $19$, the actual
inversion chain --- because the numbers themselves carry the arguments:
a headroom margin of $17$ bits, a design constant that fails at $8$ and
works at $16$, a certificate that beats trial division by a factor of
$10^{34}$. Copy each one out by hand at least once --- transcription is
where the steps become yours. Every chapter's exercises are followed
immediately by \emph{Solutions and pathways}: the pathway (how a person
finds the answer) before the answer, because the pathway is the
transferable part. The honest protocol: attempt, struggle a little,
then read --- in that order.

\subsection*{For instructors}

The book is engineered for self-study, which makes it easy to teach
from: every exercise carries an immediate pathway-then-answer solution,
so contact hours can go to the parts that need a human --- discussing
the discussion exercises (Chapters 1, 7, 10, 11, and 13 carry one; they
are the seminar seeds), pair-debugging the Lean files, and auditing real repositories
together (Appendix~\ref{app:tour} is a ready-made lab session). Grading
suggestion: collect the pen-and-paper worked examples \emph{reproduced
from memory} rather than problem sets --- the book's bet is that a
student who can re-derive the $16p$ audit or the certificate cost
ledger unprompted has the durable skill, and that bet is testable. The
Lean solution files compile against the pinned toolchain in the repo;
\code{lake build Solutions} is your answer key's answer key. Prerequisites
in practice: one programming course (any language) and comfort with
high-school algebra; no number theory, no logic, no Rust. The
fourteen-week plan below has been paced so the two hard climbs ---
Chapter~9 and the Interlude --- each get a full week with nothing else
competing.

\subsection*{A fourteen-week plan}

For self-study or a seminar, the book paces naturally as a semester:

\begin{center}
\small
\begin{tabular}{@{}lll@{}}
\toprule
\textbf{Weeks} & \textbf{Material} & \textbf{Deliverable} \\
\midrule
1     & Ch.~1 + toolkit Cards 1--2       & the two Ch.~1 audits, by hand \\
2--3  & Ch.~2--3 + \code{Ch02/Ch03.lean} & term-mode proof portfolio \\
4     & Ch.~4 + \code{Ch04.lean}         & the \code{zero\_add} board trace, from memory \\
5     & Ch.~5 + \code{Ch05.lean}         & ten goals, right tool each \\
6     & Ch.~6 + \code{Ch06.lean}         & the Euclid inversion, reproduced \\
7     & Ch.~7 + \code{Ch07.lean}         & hand-checked certificate for 97 \\
8     & Ch.~8 + repo reading (App.~C)    & annotated extract of \code{gen/} \\
9     & Ch.~9 + \code{Ch09.lean}         & the miniature bridge, proved \\
10    & Interlude                        & the complete by-hand verification \\
11    & Ch.~10--11                       & audit drill on a stranger's repo \\
12    & Ch.~12 + \code{Ch12.lean}        & graduation: spec--refusal--fix--certificate \\
13    & Ch.~13                           & the checksum see-saw + the cone table, from memory \\
14    & Ch.~14 + project                 & a fifteen-minute independent log verification;\\
      &                                  & then one open lemma or one solo bridge \\
\bottomrule
\end{tabular}
\end{center}

\tableofcontents

% ===================== CHAPTERS =====================
\input{chapters/ch01-why-verify}
\input{chapters/ch02-meet-lean}
\input{chapters/ch03-propositions-as-types}
\input{chapters/ch04-tactics}
\input{chapters/ch05-numbers-and-automation}
\input{chapters/ch06-modular-arithmetic}
\input{chapters/ch07-primality-certificates}
\input{chapters/ch08-rust-to-lean}
\input{chapters/ch09-denotation-bridge}
\input{chapters/interlude-by-hand}
\input{chapters/ch10-verifying-a-field}
\input{chapters/ch11-honesty-and-axioms}
\input{chapters/ch12-the-pyramid}
\input{chapters/ch13-second-summit}
\input{chapters/ch14-attestation-protocol}

\appendix
\input{chapters/appendix-toolkit}
\input{chapters/appendix-walkthroughs}
\input{chapters/appendix-repo-tour}
\input{chapters/glossary}

\end{document}