mirror of
https://github.com/saymrwulf/verifying-crypto-with-lean.git
synced 2026-09-04 20:03:41 +00:00
mrwulf
63a809dd2c
New Chapter 13, 'The Second Summit: A Hash-Based Pyramid' — SLH-DSA
(FIPS 205) as the transfer experiment for the whole method:
- opens on leaf 18 as the anomaly; correctness-vs-security across the
quantum divide ('a correct implementation of a broken lock is still a
broken lock')
- Lamport -> Winternitz chains with the checksum see-saw run twice on
real w=16 numbers, including a concrete failed forgery (480 -> 479,
digit 14 -> 13)
- FORS worked at napkin scale (k=2, a=2, one reuse = one forgery) and
real scale (28 of 57,344, exponent 14)
- the virtual hypertree: digest split 21/7/2 to the bit, the 54-bit
meter peeled 9 bits per layer, verification priced exactly (254 fixed
oracle calls; the see-saw itself caps a layer at 510, so worst case
3,824 — the naive 525*35 bound is unreachable, and the chapter says
why); ~2^72 to build vs ~2^12 to check
- the eleven certificates, the loop-to-fold bridges, the honest
'visible, not correct' boundary (no second semantics — and why the
natural move fails), the cone-growth table, the t_l/t_len naming
inversion told as the war story it was, the apex as an audit
invitation with the verbatim theorem named
- 'The leaf, live': leaf-vs-head precision ('plausible, and wrong
twice'), the three-clause self-reference ledger (attested machinery /
attested scheme / honest gap), one-command tryit
- six exercises with pathway'd solutions; checkpoint hands the
who-checks-them question to the finale
Structural: attestation renamed ch14 and now carries the book's single
ending (where-to-go, further reading, final reframe, prospective
checkpoint — moved from ch12); its two interior checkpoints demoted to
bigidea/tryit so the terminal checkpoint stands alone; opening now
receives ch13's baton. ch12 ends as a chapter. Front matter: three-summit
arc, fourteen-week plan, honest discussion-exercise count; ch01 promise
ladder extended to Chapters 13/14; glossary +5 entries (and the
pre-existing Hasse-bound misordering fixed); README fourteen chapters +
build.sh recipe.
Every constant verified against fips205-slhdsa-verified and
lean-transparency-log by four adversarial checkers; arithmetic
independently recomputed; didactic panel scored the chapter 9/8 —
the book's high-water mark. Build: 128 pages, zero unresolved refs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
188 lines
8.6 KiB
TeX
188 lines
8.6 KiB
TeX
\chapter*{Glossary}
|
|
\markboth{Glossary}{}
|
|
\addcontentsline{toc}{chapter}{Glossary}
|
|
|
|
\newcommand{\gloss}[1]{\par\smallskip\noindent{\bfseries #1.}\ }
|
|
|
|
\gloss{Axiom-clean} Of a theorem: \lean{\#print axioms} reports exactly
|
|
Lean's standard trio \lean{[propext, Classical.choice, Quot.sound]} and
|
|
nothing else. The gold standard for shipped certificates
|
|
(Chapter~\ref{ch:honesty}).
|
|
|
|
\gloss{Bounds invariant} A predicate limiting how large limbs may grow
|
|
(e.g.\ every limb $< 2^{54}$), maintained across operations so that
|
|
machine arithmetic never overflows. One of the two clauses of every
|
|
operation spec (Chapters~\ref{ch:rust}--\ref{ch:denotation}).
|
|
|
|
\gloss{Carry} Value moved from one limb position to the next when a
|
|
limb exceeds its radix. Delayed (``lazy'') carries are the central
|
|
performance trick of fast field arithmetic and the habitat of its
|
|
characteristic bugs (Chapter~\ref{ch:why}; Interlude).
|
|
|
|
\gloss{Certificate} Data that makes a fact cheap to \emph{check}
|
|
regardless of how expensive it was to \emph{find}: a Pratt witness
|
|
tree for primality, a proof object for a theorem
|
|
(Chapter~\ref{ch:prime}).
|
|
|
|
\gloss{Charon / Aeneas} The two-stage extraction pipeline: Charon
|
|
compiles Rust to the LLBC intermediate representation; Aeneas
|
|
translates LLBC into pure Lean definitions
|
|
(Chapter~\ref{ch:rust}).
|
|
|
|
\gloss{Cofactor} The factor $8$ in the Ed25519 group order $8\ell$;
|
|
multiplying by it annihilates the small-torsion component of any point,
|
|
which is why \emph{cofactored} verifiers (the ZIP-215 lineage) check
|
|
$8sB = 8R + 8kA$. The verified dalek-lineage path checks the stricter
|
|
\emph{canonical} uncofactored equation byte-exactly
|
|
(Chapter~\ref{ch:pyramid}).
|
|
|
|
\gloss{Commuting square} The diagram --- machine operation along the
|
|
top, ideal operation along the bottom, denotation down the sides ---
|
|
whose closure \emph{is} implementation correctness
|
|
(Chapter~\ref{ch:denotation}).
|
|
|
|
\gloss{Complete (addition law)} An addition formula with no exceptional
|
|
cases: valid for every pair of points, including doubling and identity.
|
|
Ed25519's Edwards law is complete because $d$ is a non-square
|
|
(Chapter~\ref{ch:pyramid}).
|
|
|
|
\gloss{Decision procedure} An algorithm that settles \emph{every}
|
|
statement in a defined logical fragment --- \lean{omega} for linear
|
|
arithmetic, \lean{decide} for finite computations, \lean{ring} for
|
|
ring identities. Failure on an in-fragment goal means the goal is
|
|
false (Chapter~\ref{ch:automation}).
|
|
|
|
\gloss{Definitional equality} Two terms being identical after the
|
|
kernel computes (unfolds definitions, reduces recursion). What
|
|
\lean{rfl} checks; blocked by opaque variables in recursion position
|
|
(Chapter~\ref{ch:pat}).
|
|
|
|
\gloss{Denotation} The function $\denote{\cdot}$ mapping a machine
|
|
representation (limb array) to the mathematical value it \emph{means}
|
|
(an element of $\Fp$). The bridge on which all correctness statements
|
|
stand (Chapter~\ref{ch:denotation}).
|
|
|
|
\gloss{Euler's criterion} $a^{(p-1)/2} \equiv \pm 1 \pmod p$ decides
|
|
whether $a$ is a square modulo the odd prime $p$ ($+1$: square; $-1$:
|
|
non-square). Settles both completeness facts of
|
|
Chapter~\ref{ch:pyramid} (toolkit Card~7).
|
|
|
|
\gloss{Extraction} Mechanical translation of source code (Rust) into a
|
|
proof assistant's language via Charon/Aeneas, producing the \emph{model}
|
|
--- the artifact actually verified, never hand-edited
|
|
(Chapter~\ref{ch:rust}).
|
|
|
|
\gloss{Fermat's little theorem} $a^{p-1} \equiv 1 \pmod p$ for prime
|
|
$p$ and $a \not\equiv 0$; hence $a^{p-2} = a^{-1}$, the identity behind
|
|
the verified inversion chain (Chapters~\ref{ch:modular},
|
|
\ref{ch:field}).
|
|
|
|
\gloss{Find/check asymmetry} The gap between the cost of discovering a
|
|
fact and the cost of verifying a certificate for it --- the engine of
|
|
Pratt certificates, proof kernels, and (in disguise) the P-vs-NP
|
|
question (Chapter~\ref{ch:prime}).
|
|
|
|
\gloss{Fold} Reducing an overflow of the representation (weight
|
|
$2^{255}$ and above) back into range using the modulus identity
|
|
$2^{255} \equiv 19$; costs exactly one multiple of $p$ per unit folded
|
|
(Chapter~\ref{ch:denotation}; Interlude).
|
|
|
|
\gloss{FORS} Forest Of Random Subsets: SLH-DSA's few-time signature ---
|
|
$k$ small Merkle trees, one secret revealed per tree, all recomputed
|
|
roots compressed and certified by the hypertree; reuse degrades
|
|
gracefully instead of breaking, which is what buys statelessness
|
|
(Chapter~\ref{ch:secondsummit}).
|
|
|
|
\gloss{Goal state} The proof assistant's board: hypotheses above the
|
|
turnstile $\vdash$, obligation below. Reading it is the core tactic
|
|
skill (Chapter~\ref{ch:tactics}).
|
|
|
|
\gloss{Hash oracle} A hash function entering a proof as an \emph{axiom}
|
|
with assumed functional behavior and no proven properties; the five
|
|
SLH-DSA verify-path oracles are the standing example, and the audit's
|
|
cone table shows exactly which certificate leans on which
|
|
(Chapter~\ref{ch:secondsummit}).
|
|
|
|
\gloss{Hasse bound} An elliptic curve over $\Fp$ has $p + 1 - t$ points
|
|
with $|t| \le 2\sqrt{p}$; the thirty-second sanity check for any
|
|
claimed group order (Chapter~\ref{ch:pyramid}).
|
|
|
|
\gloss{Headroom} Bits of slack between a limb's payload (e.g.\ 51 bits)
|
|
and its machine word (64 bits); the budget lazy carries spend
|
|
(Chapter~\ref{ch:why}).
|
|
|
|
\gloss{Hypertree} SLH-DSA's tower of $d$ Merkle-tree layers, each tree's
|
|
root signed by a one-time key of the layer above --- a virtual structure
|
|
of $2^h$ keys that is never materialized: any path can be recomputed
|
|
from a seed, and one root pins it all (Chapter~\ref{ch:secondsummit}).
|
|
|
|
\gloss{Inductive type} A type defined by listing its constructors
|
|
exhaustively (\lean{Nat}: \lean{zero} and \lean{succ}). Grants both
|
|
pattern matching and the induction principle (Chapters~\ref{ch:lean},
|
|
\ref{ch:tactics}).
|
|
|
|
\gloss{Kernel} The small, paranoid core of a proof assistant that
|
|
re-checks every proof object against a fixed rule set; the only
|
|
component whose correctness soundness depends on
|
|
(Chapter~\ref{ch:why}).
|
|
|
|
\gloss{Limb} One machine word of a multi-word big-number
|
|
representation; Ed25519 field elements use five 51-bit limbs in 64-bit
|
|
words (Chapters~\ref{ch:why}, \ref{ch:denotation}).
|
|
|
|
\gloss{Model} The extracted Lean rendition of the source code, living
|
|
in \code{gen/}; the object theorems quantify over
|
|
(Chapter~\ref{ch:rust}).
|
|
|
|
\gloss{Montgomery form} Representing $x$ as $x \cdot R \bmod p$
|
|
(typically $R = 2^{256}$) to make post-multiplication reduction cheap;
|
|
absorbed by adjusting the denotation (Chapter~\ref{ch:denotation}).
|
|
|
|
\gloss{Pratt witness} An element $w$ with $w^{p-1} \equiv 1$ and
|
|
$w^{(p-1)/q} \not\equiv 1$ for every prime $q \mid p-1$; its existence
|
|
certifies $p$ prime, given certificates for the $q$'s
|
|
(Chapter~\ref{ch:prime}).
|
|
|
|
\gloss{Radix} The base of a limb representation ($2^{51}$ for the
|
|
dalek field, $4$ for this book's toy system).
|
|
|
|
\gloss{SLH-DSA} The stateless hash-based digital signature algorithm of
|
|
FIPS~205 (descended from SPHINCS\textsuperscript{+}): FORS under a
|
|
hypertree of Winternitz chains, built from hash functions and nothing
|
|
else --- no structure for Shor's algorithm to attack
|
|
(Chapter~\ref{ch:secondsummit}).
|
|
|
|
\gloss{Specification (spec)} The precise statement a program is proven
|
|
to satisfy. The two-clause shape for arithmetic: bounds propagation
|
|
plus value equation. A proof is only as good as its spec
|
|
(Chapters~\ref{ch:denotation}, \ref{ch:honesty}).
|
|
|
|
\gloss{Substitution test} Auditing a spec by substituting an
|
|
adversarial implementation and checking whether the statement notices;
|
|
detects trivial specs no tool can flag (Chapter~\ref{ch:honesty}).
|
|
|
|
\gloss{Tactic} A command in Lean's interactive proof mode that
|
|
transforms the goal state (\lean{intro}, \lean{rw}, \lean{induction},
|
|
\lean{omega}, \dots), assembling a proof object behind the scenes
|
|
(Chapter~\ref{ch:tactics}).
|
|
|
|
\gloss{Torsion} The small-order component of a curve point (order
|
|
dividing the cofactor); killed by multiplying by $8$, hence invisible
|
|
to cofactored verification (Chapter~\ref{ch:pyramid}).
|
|
|
|
\gloss{Trusted base} Everything a verification result assumes rather
|
|
than proves: the kernel, the extraction tool, declared axioms
|
|
(SHA-512, untranslatable backends). Honest projects keep it small,
|
|
documented, and machine-visible (Chapters~\ref{ch:rust},
|
|
\ref{ch:honesty}).
|
|
|
|
\gloss{Two-clause spec} This book's name for the standard operation
|
|
theorem: \emph{(1)} the operation succeeds and its output satisfies the
|
|
(possibly widened) bounds invariant; \emph{(2)} the output's denotation
|
|
equals the ideal result (Chapter~\ref{ch:denotation}; Interlude).
|
|
|
|
\gloss{Winternitz chain (WOTS\textsuperscript{+})} A hash chain
|
|
$c_0, F(c_0), F(F(c_0)), \dots$ signing one digit by revealing the
|
|
chain value at the digit's position; the verifier walks the remaining
|
|
steps to the published end. A checksum makes forward-walking forgeries
|
|
self-defeating (Chapter~\ref{ch:secondsummit}).
|