verifying-crypto-with-lean/chapters/ch12-the-pyramid.tex

\chapter{The Pyramid: From Field to Signature, and Where You Come In}
\label{ch:pyramid}

\section{The view from the field layer}

Chapter~\ref{ch:field} left us holding a verified field. A signature scheme
is still three stories up. This chapter climbs them --- what each layer
\emph{states}, what makes each one \emph{hard}, and where the campaign
stands as this book goes to press --- then hands you the map and the keys.
The floors above the field enter this chapter as question marks; by the last
section you will know precisely which of them are theorems.

\begin{center}
\begin{tikzpicture}[
  lay/.style={draw=ink2,thick,rounded corners=2pt,align=center,minimum height=1.0cm},
  st/.style={font=\footnotesize\color{ink2},anchor=west,align=left}
]
  \node[lay,fill=accentsoft,minimum width=3.0cm]  (sig) at (0,3.75) {\textbf{Signature}};
  \node[lay,fill=warnsoft,minimum width=5.4cm]    (sca) at (0,2.5)  {\textbf{Scalars mod $\boldsymbol{\ell}$}};
  \node[lay,fill=provensoft,minimum width=7.8cm]  (grp) at (0,1.25) {\textbf{Group law}};
  \node[lay,fill=codebg,minimum width=10.2cm]     (fld) at (0,0)    {\textbf{Field $\Fp$}};
  \node[st] at (5.7,0)    {\textbf{done}: certificates in 4 repos, axiom-clean};
  \node[st] at (5.7,1.25) {\textbf{?} --- this chapter, second section};
  \node[st] at (5.7,2.5)  {\textbf{?} --- third section};
  \node[st] at (5.7,3.75) {\textbf{?} --- the apex section};
\end{tikzpicture}
\end{center}

\section{The group law: geometry becomes algebra}

An elliptic curve is a set of points $(x,y)$ satisfying an equation; for
Ed25519 it is the \emph{twisted Edwards} curve
$-x^2 + y^2 = 1 + d\,x^2 y^2$ over $\Fp$. The miracle: these points form a
\emph{group} under the addition law
\[
(x_1,y_1) + (x_2,y_2) \;=\;
\left(
\frac{x_1 y_2 + x_2 y_1}{1 + d\,x_1 x_2 y_1 y_2},\;
\frac{y_1 y_2 + x_1 x_2}{1 - d\,x_1 x_2 y_1 y_2}
\right).
\]
Two facts make this law a verifier's dream, and both carry Edwards-curve
signatures for exactly this reason. First, it is \textbf{complete}: for the
Ed25519 parameters those denominators are \emph{never zero} --- no special
cases for doubling, no branch for the identity, hence constant-time-friendly
code with no rarely-taken paths for bugs to hide in. (The proof, due to
Bernstein and Lange, is a jewel of quiet algebra: if a denominator vanished,
$d$ would have to be a square in $\Fp$ --- and it is not, which is a
\lean{decide}-scale fact away from primality.)

\begin{worked}{running the addition law by hand --- napkin curve, then the real one}
Two runs of the same formula: first on numbers that fit a napkin, then on
the real 77-digit constants with nothing hidden. \emph{The moves are
identical; only the digits get longer.}

\emph{Run 1 --- the napkin curve.} Work mod $13$ with $d = 2$ (a
non-square mod $13$: the squares are $\{1,3,4,9,10,12\}$ --- so this toy
inherits the real curve's completeness, as the worked example below
derives). The point $P = (2,4)$ is on the curve: $-4 + 16 = 12$ and
$1 + 2\cdot 4\cdot 16 = 129 \equiv 12$ \checkmark. Now double it. The
shared product first: $d\,x^2 y^2 = 2 \cdot 4 \cdot 16 = 128 \equiv 11$.
Then
\[
x_3 \;=\; \frac{2xy}{1 + 11} \;=\; \frac{16}{12} \;\equiv\; 3 \cdot 12^{-1}
\;=\; 3\cdot 12 \;=\; 36 \;\equiv\; 10,
\qquad
y_3 \;=\; \frac{y^2\!+\!x^2}{1 - 11} \;=\; \frac{20}{3} \;\equiv\; 7\cdot 3^{-1}
\;=\; 7 \cdot 9 \;=\; 63 \;\equiv\; 11
\]
(the inverses by scanning: $12\cdot 12 = 144 \equiv 1$, $3\cdot 9 = 27
\equiv 1$). So $2P = (10, 11)$ --- and recheck it is on the curve:
$-100+121 = 21 \equiv 8$; $1 + 2\cdot(100\cdot 121) \equiv 1 + 2\cdot(9
\cdot 4) = 73 \equiv 8$ \checkmark. Keep $(10,11)$; the apex section will
want it.

\emph{Run 2 --- the real base point, full digits.} The same doubling, on
Ed25519's base point $B = (x_1, y_1)$:
\par\noindent{\footnotesize $x_1 \;=$}\\[-2pt]
{\footnotesize\ttfamily\begin{tabular}{@{}l@{}}15\,11222\,13495\,35400\,77250\,11514\,09588\,53151\,14540\\
12693\,04185\,72060\,46113\,28394\,98477\,62202\end{tabular}}\par\smallskip
\par\noindent{\footnotesize $y_1 \;=$}\\[-2pt]
{\footnotesize\ttfamily\begin{tabular}{@{}l@{}}46\,31683\,56949\,26478\,16942\,83940\,03475\,16314\,13079\\
93866\,25622\,56157\,83033\,60316\,52518\,55960\end{tabular}}\par\smallskip
The machine's first step is the product $u = x_1 y_1 \bmod p$. Nobody
multiplies two 77-digit numbers by hand --- and nobody needs to, because
the machine can hand you its homework for auditing: the quotient $q$ and
remainder $u$ it claims, turning the step into one integer equation
\[
x_1 \cdot y_1 \;=\; q \cdot p + u ,
\]
\par\noindent{\footnotesize $q \;=$}\\[-2pt]
{\footnotesize\ttfamily\begin{tabular}{@{}l@{}}12\,08977\,70796\,28320\,61800\,09211\,27670\,82520\,91632\\
10154\,43348\,57648\,36890\,62715\,98782\,09761\end{tabular}}\par\smallskip
\par\noindent{\footnotesize $u \;=$}\\[-2pt]
{\footnotesize\ttfamily\begin{tabular}{@{}l@{}}46\,82740\,38508\,23179\,24507\,22166\,30277\,19756\,51442\\
05554\,12565\,49766\,74165\,82953\,38171\,01731\end{tabular}}\par\smallskip
which Chapter~\ref{ch:modular}'s shadow arithmetic audits on two
independent small clocks. Digit sums (clock $9$): $x_1 \to 3$,
$y_1 \to 1$, $q \to 0$, $p \to 7$, $u \to 3$; left side $3\cdot 1 = 3$,
right side $0 \cdot 7 + 3 = 3$ \checkmark. Alternating digit sums (clock
$11$, signs from the units digit up): $x_1 \to 5$, $y_1 \to 9$,
$q \to 10$, $p \to 2$, $u \to 3$; left $5 \cdot 9 = 45 \equiv 1$, right
$10 \cdot 2 + 3 = 23 \equiv 1$ \checkmark. Do the digit sums yourself ---
each is two careful minutes over the blocks printed above; that labor
\emph{is} the pen-and-paper content at this size. Five more certified
steps of exactly this shape (square, multiply by $d$, the two inversions
via Fermat chains) complete the doubling, landing on
\par\noindent{\footnotesize $x_{2B} =$}\\[-2pt]
{\footnotesize\ttfamily\begin{tabular}{@{}l@{}}24\,72741\,32351\,06541\,00255\,45745\,71675\,58883\,46227\\
68167\,39763\,84567\,26423\,68252\,12336\,08206\end{tabular}}\par\smallskip
\par\noindent{\footnotesize $y_{2B} =$}\\[-2pt]
{\footnotesize\ttfamily\begin{tabular}{@{}l@{}}15\,54967\,55802\,80190\,17635\,26687\,10449\,54225\,15495\\
72066\,44506\,05805\,07079\,59306\,26430\,49417\end{tabular}}\par\smallskip
--- the coordinates of $2B$ that every Ed25519 stack on earth agrees on.
Two honest footnotes. A passing two-clock audit is strong evidence, not
proof (a wrong digit survives both clocks once in $99$ tries); the kernel
checks the exact equation --- the audit is \emph{your} hand on the
ladder, the kernel is the ratchet. And what you just did --- verify a
giant computation through small residues plus a supplied witness --- is
precisely the certificate method of Chapter~\ref{ch:prime} and the
denotation method of Chapter~\ref{ch:denotation}, meeting at the summit.
\end{worked}

\begin{worked}{the completeness argument, derived to its hinge}
The Bernstein--Lange proof rewards a full pen-and-paper walk --- symbols,
not toy numbers, because the argument \emph{is} the real one at every
size. We run it on the Edwards curve $x^2 + y^2 = 1 + d x^2 y^2$ with
$d$ a non-square (Ed25519's twisted form adds decorations; the skeleton
is identical, and the exercises hand you the twist). Suppose, for
contradiction, points $(x_1,y_1)$, $(x_2,y_2)$ on the curve make a
denominator vanish: $\varepsilon := d\,x_1 x_2 y_1 y_2 \in \{\pm 1\}$.
A product equal to $\pm 1$ has no zero factor, so all four coordinates
are nonzero. Three moves, each checkable by expansion:

\emph{Move 1 --- square the assumption.} From $\varepsilon^2 = 1$:
$d^2 x_1^2 x_2^2 y_1^2 y_2^2 = 1$, which rearranges to
\[
1 \;=\; d x_1^2 y_1^2 \cdot d x_2^2 y_2^2 .
\]

\emph{Move 2 --- expand a well-chosen square.} Using
$x_1^2 + y_1^2 = 1 + d x_1^2 y_1^2$ (the curve, point 1) and
$\varepsilon x_1 y_1 = d x_1^2 y_1^2\, x_2 y_2$ (multiply the definition
of $\varepsilon$ by $x_1 y_1$):
\[
(x_1 + \varepsilon y_1)^2
= x_1^2 + y_1^2 + 2\varepsilon x_1 y_1
= 1 + d x_1^2 y_1^2 + 2\, d x_1^2 y_1^2\, x_2 y_2 .
\]

\emph{Move 3 --- substitute Move 1's $1$ and factor.} Replace the
leading $1$ by $d x_1^2 y_1^2 \cdot d x_2^2 y_2^2$ and pull out
$d x_1^2 y_1^2$:
\[
(x_1 + \varepsilon y_1)^2
= d x_1^2 y_1^2 \big( d x_2^2 y_2^2 + 1 + 2 x_2 y_2 \big)
= d x_1^2 y_1^2 \big( x_2^2 + y_2^2 + 2 x_2 y_2 \big)
= d\,\big(x_1 y_1 (x_2 + y_2)\big)^2 ,
\]
where the middle equality used the curve equation for point 2 backwards
($1 + d x_2^2 y_2^2 = x_2^2 + y_2^2$). Now the hinge: if
$x_2 + y_2 \neq 0$, divide ---
\[
d = \left( \frac{x_1 + \varepsilon y_1}{x_1 y_1 (x_2 + y_2)} \right)^{2},
\]
\textbf{$d$ is a square}. And if $x_2 + y_2 = 0$, rerun Moves 2--3 with
$(x_1 - \varepsilon y_1)^2$ to get $d \cdot (x_1 y_1 (x_2 - y_2))^2$
instead --- $x_2 - y_2$ cannot \emph{also} vanish (both would force
$x_2 = y_2 = 0$). Either way $d$ is a square in $\Fp$. But Ed25519's $d$
is \emph{not} --- one Legendre-symbol computation,
$d^{(p-1)/2} \equiv -1 \pmod p$, checkable by exactly the
square-and-multiply ladder of Chapter~\ref{ch:prime}, established once
as a constant fact in the verified development. Contradiction; no
denominator ever vanishes. Savor the architecture: one quadratic-residue
bit about one constant buys the \emph{total absence of special cases}
from every point addition ever executed --- and thereby the absence of
the rarely-taken branches where Chapter~\ref{ch:why}'s bugs live. That
is what ``a curve chosen for verifiability'' means in practice.
\end{worked} Second, the implementation
represents points \emph{projectively} (extended coordinates $(X:Y:Z:T)$,
avoiding division entirely) --- so the layer has its own denotation,
$(X:Y:Z:T) \mapsto (X/Z, Y/Z)$, and its own commuting squares built on the
field layer's specs. Same movie, one floor up: the verified group law in the
companion repos is precisely the statement that projective point addition
implements the rational formula above, all bounds included, for each fork's
own extraction. First question mark from the opening figure, resolved:
\textbf{group law --- done, complete addition, all four forks.}

\section{Scalars: a second field, and a frontier}

The group of curve points has order $8\ell$ with
$\ell = 2^{252} + 27742\ldots$ prime. Signature arithmetic happens in
exponents --- multiples of points --- so it is arithmetic mod $\ell$: a
\emph{second} finite field, with its own Rust implementation (radix-52
limbs, Montgomery multiplication) and its own denotation bridge. Nothing
conceptually new --- which is itself the lesson: the method \emph{scales
sideways} without new ideas.

First feel the cycle on the napkin curve: the multiples of $P = (2,4)$
from the group-law worked example repeat with period $16$ ($16P$ is the
identity $(0,1)$ --- patient readers can verify with fourteen more
doublings-and-additions of the kind already performed). So computing
$21 \cdot P$ never takes $21$ additions: $21 \equiv 5 \pmod{16}$, hence
$21P = 5P$. \emph{All exponent bookkeeping happens mod the cycle
length.} For the real base point $B$ the cycle length is the prime
$\ell$ below, and ``bookkeeping mod $\ell$'' is an entire second
arithmetic world in the code --- this floor.

\begin{worked}{sizing the group --- real constants, three-line audits}
The scalar layer's constants invite the same pen-and-paper audits as the
field's. The group order is $8\ell$ with
\[
\ell \;=\; 2^{252} + 27742317777372353535851937790883648493 ,
\]
that $38$-digit tail being an inseparable companion of anyone who works
on this layer. Three audits, each a few lines:

\emph{(1) Consistency with the curve.} A theorem of Hasse says an
elliptic curve over $\Fp$ has $p + 1 - t$ points with
$|t| \le 2\sqrt{p}$ --- so about $2^{255}$ points, within
$2^{128.5}$-ish. Check the claimed order:
$8\ell = 2^{3} \cdot 2^{252} + 8 \cdot (38\text{-digit}) =
2^{255} + (\text{a number} < 2^{129})$. Sits exactly in Hasse's window
around $p + 1 \approx 2^{255}$ ✓. The claimed structure is at least
arithmetically possible --- a thirty-second sanity check worth running on
\emph{any} curve parameter set someone hands you.

\emph{(2) The tail is not decoration.} Could a signature library
``round'' $\ell$ to $2^{252}$ --- who would notice? Anyone reducing a
$256$-bit hash output mod $\ell$: the reductions differ on roughly a
$2^{-124}$ slice of inputs (the interval lengths differ by the tail), and
the certified theorem \code{L\_val} in all four companion repos ---
\emph{the transpiled constant equals $\ell$, digit for digit} --- exists
precisely because ``a constant nobody can eyeball'' is where typos
retire. The proof is one \lean{decide}-scale comparison, and it has
teeth: change one digit of the Rust constant and \code{check-scalar.sh}
fails.

\emph{(3) Why the $8$s in the verification equation.} The full group has
order $8\ell = 2^3 \cdot \ell$, so (by the structure of finite abelian
groups) it decomposes as $\Z_8$-part $\times$ $\Z_\ell$-part: every point
splits as $X = T + Y$ with $T$ of order dividing $8$ (``torsion'') and
$Y$ of order dividing $\ell$. Multiply by $8$:
\[
8X \;=\; 8T + 8Y \;=\; \mathcal{O} + 8Y \;=\; 8Y
\]
--- the torsion component is annihilated, whoever chose it. An attacker
who tampers with a public key by adding a small-order point $T$ changes
$X$ but not $8X$; the cofactored equation $8sB = 8R + 8kA$ is therefore
immune to a whole class of malleability games that the uncofactored
$sB = R + kA$ is not. Three multiplications by $8$, bought by exactly the
three-line computation above.
\end{worked}

The engineering met a wall here, and you have earned the exact
coordinates. Picture the session: the Montgomery multiplication square is
stated, the strategy that conquered the field layer is deployed, and the
checker simply --- does not come back. Not an error message; a machine
grinding toward the memory ceiling of Chapter~\ref{ch:field}, because
scalar Montgomery multiplication mixes $2^{256}$-scale coefficients into
single certificate steps, and no amount of waiting fixes arithmetic that
does not fit. For a while this wall \emph{was} the campaign's working
edge --- the honest label on the map read ``frontier,'' and it stayed
there for weeks. It fell the way the method file predicts, not by a
bigger machine but by smaller lemmas: re-decompose until every heavy
identity is an isolated, context-free lemma the kernel checks alone ---
exact-division Montgomery rounds, a double round through
$RR \equiv R^2$ --- and the layer is now \emph{complete on all four
forks}: add, sub, and Montgomery multiplication certified (including the
pleasing theorem that the code's constant \code{L} \emph{is} $\ell$,
digit for digit). Second question mark, resolved: \textbf{scalars ---
done, add, sub, Montgomery mul certified, all four forks.} One floor to
go.

\section{The apex: what ``verified signature'' says}

EdDSA verification accepts $(R, s)$ on message $m$ under key $A$ when the
verification equation holds --- and RFC~8032 admits two readings. The
\emph{cofactored} form $8sB = 8R + 8kA$ (with $k = H(R,A,m)$; the $8$s
absorb the torsion, as the exercises below explore) is what ZIP-215-style
verifiers check. The dalek lineage this campaign verified checks the
\emph{stricter, canonical} form: recompute $[k](-A) + [s]B$, encode it,
and demand the signature's $R$ match \emph{byte for byte}. The apex
certificates state, in four button-enforced tiers that climb from bytes
to points, that the extracted verifier accepts exactly when:

\begin{itemize}[leftmargin=1.4em]
\item \textbf{byte apex}: $\code{compress}([s]B - [k]A) = R$ as bytes;
\item \textbf{half-lift}: $R$ \emph{is the canonical encoding} of
  $[k](-A) + [s]B$;
\item \textbf{point equation}: any valid curve point canonically encoded
  by $R$ \emph{equals} $[k](-A) + [s]B$ --- encodings are injective on
  the curve, courtesy of $d$'s non-squareness doing a second job;
\item \textbf{full lift}: $R$ \emph{decompresses} to a valid on-curve
  point equal to $[k](-A) + [s]B$ --- decompression itself proven, square
  root, sign bit, and all.
\end{itemize}

\begin{worked}{decompression, run twice --- napkin curve, then the real base point}
The four tiers stand on one mechanism: a point is stored as \emph{$y$
plus a single bit --- is $x$ odd or even?} Run it small, then real.

\emph{Run 1 --- the napkin curve} (mod $13$, $d = 2$, the curve of the
group-law worked example). Encode $2P = (10, 11)$: store $y = 11$ and the
bit ``$x$ even.'' Now decompress $(11, \text{even})$ from scratch. The
curve equation, solved for $x^2$:
\[
x^2 \;=\; \frac{y^2 - 1}{1 + d\,y^2}
\;=\; \frac{121 - 1}{1 + 2\cdot 121}
\;\equiv\; \frac{3}{9}
\;=\; 3 \cdot 9^{-1} \;=\; 3\cdot 3 \;=\; 9 \pmod{13}.
\]
The square roots of $9$ mod $13$: $3$ and $10$ --- \emph{one odd, one
even}, and that is no accident: the two roots are $x$ and $13 - x$, and
$13$ is odd, so their parities always differ (unless $x = 0$, where both
roots coincide). The stored bit says ``even'': take $x = 10$. Recovered:
$(10, 11)$, exactly the point we encoded --- and no \emph{other} curve
point could have produced $(11, \text{even})$, which is the entire
content of tier 3.

\emph{Run 2 --- the real thing.} The compressed base point of Ed25519 is
a 32-byte constant you can find in any implementation on earth (hex,
little-endian):
\begin{center}
\ttfamily 58 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66\\
66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66
\end{center}
\noindent (one \code{58}, then thirty-one \code{66}s --- all thirty-two
bytes, nothing elided).
Byte 31 is $\code{0x66} = 01100110_2$: its top bit is $0$, so the sign
bit says ``$x$ even.'' The remaining 255 bits, read little-endian, are
\par\noindent{\footnotesize $y_B \;=$}\\[-2pt]
{\footnotesize\ttfamily\begin{tabular}{@{}l@{}}46\,31683\,56949\,26478\,16942\,83940\,03475\,16314\,13079\\
93866\,25622\,56157\,83033\,60316\,52518\,55960\end{tabular}}\par\smallskip
The design claim behind this constant: $y_B = 4/5$ in $\Fp$, i.e.\
$5\,y_B \equiv 4 \pmod p$. At full size that is one integer equation,
\[
5 \cdot y_B - 4 \;=\; 4 \cdot p \quad\text{\emph{exactly}},
\]
and this one you can verify with \emph{no} shortcuts and \emph{no}
witnesses: multiply $y_B$ by $5$ yourself (one right-to-left carry pass),
multiply $p$ by $4$, subtract $4$, compare every digit:
\par\noindent{\footnotesize $5\,y_B - 4 \;=$}\\[-2pt]
{\footnotesize\ttfamily\begin{tabular}{@{}l@{}}231\,58417\,84746\,32390\,84714\,19700\,17375\,81570\,65399\\
69331\,28112\,80789\,15168\,01582\,62592\,79796\end{tabular}}\par\smallskip
\par\noindent{\footnotesize $4\,p \;=\;\;\;\;\;\;\;$}\\[-2pt]
{\footnotesize\ttfamily\begin{tabular}{@{}l@{}}231\,58417\,84746\,32390\,84714\,19700\,17375\,81570\,65399\\
69331\,28112\,80789\,15168\,01582\,62592\,79796\end{tabular}}\par\smallskip
An honest fifteen minutes, and you have hand-checked a constant that
every Ed25519 signature on the planet flows through. Then the sign bit
earns its keep exactly as on the napkin: the real
$x_B$ ends in $\ldots 202$ (even), and $p - x_B$ ends in $\ldots 747$
(odd --- check it from the last six digits alone: $819949 - 762202 =
57747$). One even root, one odd root; the bit picks $x_B$. The one thing
paper cannot do at this size is the square root itself: the machine
raises to the exponent $(p+3)/8$ --- about $252$ squarings of 77-digit
numbers --- and the certificate \code{sqrt\_ratio\_i\_sq\_spec} pins its
output with the same kind of witness-checked equation you audited in the
group-law example, the kernel playing the role of your two clocks.
\end{worked}

The trusted base is \emph{smaller} than the one you might have predicted.
SHA-512 enters as an opaque oracle with \textbf{no assumed properties at
all} --- not even ``behaves like an ideal hash''; the theorems hold for
whatever bytes it produces. The wire-format types stay opaque. And the
point-multiplication backends are \emph{not} in the trusted base:
extraction pins the serial path, which is real translated code, proven
like everything below it. Each repo's check script has a dedicated phase
that \lean{\#print axioms} all four tiers and fails the build if any
cone deviates from that documented boundary by a single axiom.

Read that again with Chapter~\ref{ch:honesty} eyes: it is a
\emph{smaller} claim than ``Ed25519 is verified!'' --- nothing about the
hash, nothing about signing, nothing about side channels --- and that is
exactly why you can believe it. And with that, the last question mark
falls: \textbf{apex --- done, accept $\Leftrightarrow$
decompress$(R) = [k](-A)+[s]B$, hash an opaque oracle by design.} The
opening figure is now all theorems, floor to peak, on all four forks.

\section{What you now know, and where to take it}

Take inventory. You can read a goal state and drive a proof; you know which
decision procedure owns which arithmetic fragment; you can build a
denotation bridge and state a two-clause spec; you can certify a prime with
a witness tree; you can audit anyone's certificate in one command and four
questions. That skill set is not Ed25519-specific --- it is the working
method of machine-checked mathematics applied to systems, and elliptic
curves were merely your first campaign.

Where to go from here, in increasing order of ambition:

\begin{itemize}[leftmargin=1.4em]
\item \textbf{Read a real proof end-to-end.} \code{FieldSpec.lean} in
  \code{dalek-ed25519-verified}, top to bottom, with this book as the
  decoder ring. Budget an afternoon; expect the odd hour of humility.
\item \textbf{Verify something of yours.} Pick a 200-line pure function you
  actually use --- a parser, a checksum, a data structure --- write its
  denotation (what does it \emph{mean}?), state the square, prove it.
  The first solo bridge is the moment this stops being a course.
\item \textbf{Go deeper into the theory.} \emph{Theorem Proving in Lean 4}
  (the official text), \emph{Mathematics in Lean} (Mathlib's course), and
  the Lean Zulip --- an unusually welcoming expert community --- are the
  standard next doors.
\end{itemize}

\subsection*{Where you come in}

The chapter title made a promise, and here it is, kept without
condescension: there is open, real work on this pyramid sized for the
person who finished this book. The ed25519 pyramids are capped, but the
Pasta curve layer (the Pallas group law and scalar multiplication) is
paused with its field foundations proven and the route mapped. The
terrain is known: the scalar layer's kernel-frontier crossing is the
template for the hard part, and the control repo's
\code{METHOD.md}/\code{TIERS.md} state exactly what a finished brick
looks like --- spec shape, axiom audit, check-script entry. Nobody is
saving this for an expert. Frontier work in machine-checked cryptography
is, right now, undergraduate-accessible, and every chapter before this
one was the access.

\subsection*{Further reading, annotated}

\begin{itemize}[leftmargin=1.4em]
\item \emph{Theorem Proving in Lean 4} (Avigad, de Moura, et al.; free
online) --- the official text. Read it \emph{after} this book's
Chapters 2--5 and it will feel like meeting the extended family of
ideas you already know; its dependent-type chapters go far beyond our
needs and are worth the trip.
\item \emph{Mathematics in Lean} (the Mathlib community course) ---
hands-on Mathlib fluency: naming conventions, search strategies, the
algebra hierarchy. The fastest cure for ``I know the fact exists but
not its name,'' which will be your main bottleneck after this book.
\item \emph{The Lean Zulip} (\code{leanprover.zulipchat.com}) --- where
the community lives. Unusually welcoming to beginners; search before
asking, then ask well: a minimal example plus the goal state gets
expert answers in hours.
\item Bernstein \& Lange, \emph{Faster addition and doubling on
elliptic curves} (2007) --- the completeness proof this chapter's
worked example walked; readable with this book's preparation, and a
model of what ``designed for implementers'' mathematics looks like.
\item The RFC for EdDSA (RFC 8032) --- the signature scheme as
deployed, cofactor-$8$s and encoding details included. Read the
verification equation section against this chapter and notice how much
sharper your questions have become.
\item Project Everest / HACL$^{*}$ and Fiat Crypto --- the two other
major verified-crypto lineages (F$^{*}$-based and Coq-based
respectively), both shipping in real TLS stacks and browsers. Reading
their claims with your Chapter~\ref{ch:honesty} toolkit is instructive
in both directions: the methods differ, the honest-boundary discipline
rhymes.
\end{itemize}

\begin{aha}
One last reframe, the one this book was secretly about. ``Formal
verification'' sounds like bureaucracy --- forms, stamps, compliance. What
you actually practiced is closer to \emph{engineering's version of the
scientific method}: make the claim precise enough to be falsifiable, then
let an incorruptible referee try to falsify it, then publish the referee's
report with the assumptions itemized. Cryptography needed that discipline
first because its failures are silent and adversarial. It will not need it
last.
\end{aha}

\begin{tryit}
The graduation exercise. In the mini-system from
\code{exercises/Ch09.lean}, the file \code{exercises/Ch12.lean} plants a
\emph{deliberate off-by-one carry bug} in a variant \lean{add'} --- of
exactly the species from Chapter~\ref{ch:why}: correct on all limb pairs
except a thin boundary slice. Your final tasks: (1) write the spec ---
watch it \emph{refuse to prove}; (2) extract the counterexample from the
stuck goal state; (3) confirm by \lean{\#eval}; (4) fix the code and finish
the proof. That arc --- spec, refusal, counterexample, fix, certificate ---
is the entire profession in miniature. Welcome to it.
\end{tryit}

\section*{Exercises}

\exercise{(Paper) Verify Move 2 and Move 3 of the completeness worked
example by full expansion --- every term written out, nothing skipped.
Then adapt the argument's \emph{first} move to the twisted curve
$-x^2 + y^2 = 1 + d x^2 y^2$: where does the $-1$ enter, and why does the
argument want $-1$ to be a \emph{square} mod $p$? (Hint: $p = 2^{255}-19
\equiv 1 \pmod 4$, and for such primes $-1$ is a quadratic residue ---
which is not an accident of the curve designers.)}

\exercise{(Paper) In the group decomposition $X = T + Y$ (torsion of
order dividing $8$ plus a $\Z_\ell$ component), verify: (a) $8X = 8Y$;
(b) $8Y \neq \mathcal{O}$ whenever $Y \neq \mathcal{O}$ --- why does this
need $\gcd(8, \ell) = 1$, and where does the argument use that $\ell$ is
prime and $> 8$? (c) Conclude what an attacker who adds a small-order
point to a public key changes, and what they provably cannot change.}

\exercise{(Audit drill) Write down, from memory, the complete list of
what the apex certificates \emph{assume} (their trusted base) and what
they \emph{establish}, then check yourself against this chapter's
apex section. Anything you forgot is the thing to reread before you
audit a real system.}

\exercise{(Paper) The point $3P = (6, 10)$ lives on the napkin curve
(mod $13$, $d = 2$). Encode it (which bit?), then decompress your own
encoding from scratch --- compute $x^2$ from $y$, find both square
roots by scanning, and let the bit choose. Confirm you recover $(6,10)$
and not the other root.}

\section*{Solutions and pathways}
\solutionsintro

\solhead{12.1}
\pathway For the expansion: Move 2 is the binomial square plus two
substitutions --- write $(x_1 + \varepsilon y_1)^2 = x_1^2 +
2\varepsilon x_1 y_1 + y_1^2$, then replace $x_1^2 + y_1^2$ via the curve
and $\varepsilon x_1 y_1$ via the definition. Move 3 is distributing
$d x_1^2 y_1^2$ and recognizing a perfect square. For the twist,
transport the curve equation and re-run Move 2.
\answer Move 2 fully expanded:
$(x_1+\varepsilon y_1)^2 = x_1^2 + 2\varepsilon x_1 y_1 + y_1^2$;
curve gives $x_1^2 + y_1^2 = 1 + dx_1^2y_1^2$; and
$\varepsilon x_1 y_1 = (d x_1 x_2 y_1 y_2)(x_1 y_1) = d x_1^2 y_1^2 x_2
y_2$ --- sum the three pieces to get the displayed line ✓. Move 3:
$d x_1^2 y_1^2 (d x_2^2 y_2^2 + 1 + 2 x_2 y_2)$; the curve for point 2
says $1 + d x_2^2 y_2^2 = x_2^2 + y_2^2$, so the bracket is
$x_2^2 + 2x_2y_2 + y_2^2 = (x_2+y_2)^2$, and
$d x_1^2 y_1^2 (x_2+y_2)^2 = d (x_1 y_1 (x_2+y_2))^2$ ✓. For the twisted
curve: $x_1^2 + y_1^2$ no longer appears --- the curve supplies
$y_1^2 - x_1^2$ --- so the well-chosen square must mix a factor
$\sqrt{-1}$ into the $x$'s (expand $(\sqrt{-1}\,x_1 + \varepsilon y_1)^2
= -x_1^2 + y_1^2 + 2\varepsilon\sqrt{-1}\,x_1 y_1$: the curve's
left-hand side appears exactly). That $\sqrt{-1}$ must \emph{exist} in
$\Fp$ for the argument to run --- hence the requirement that $-1$ be a
square, guaranteed by $p \equiv 1 \pmod 4$. The designers chose the
twist $a = -1$ \emph{because} it is a square mod this $p$: speed came
from the twist, completeness survived because of the residue class.
Parameters this well-matched are chosen, not lucky.

\solhead{12.2}
\pathway All three parts are order bookkeeping: $nZ = \mathcal{O}$
exactly when the order of $Z$ divides $n$.
\answer (a) $8X = 8T + 8Y$; the order of $T$ divides $8$, so
$8T = \mathcal{O}$, leaving $8Y$ ✓. (b) The order of $Y$ divides the
prime $\ell$, so it is $1$ or $\ell$. If $Y \neq \mathcal{O}$ the order
is $\ell$; then $8Y = \mathcal{O}$ would force $\ell \mid 8$ ---
impossible since $\ell > 8$ (it is $\approx 2^{252}$). This is where
both primality (order is $1$ or $\ell$, nothing between) and size come
in; $\gcd(8,\ell) = 1$ is the compact way to say ``multiplying by $8$ is
invertible on the $\Z_\ell$ part.'' (c) The attacker changes the point
$X$ (so: byte-level equality checks, hashes of the key, uniqueness
assumptions \emph{can} be affected --- real protocols have been bitten)
but provably cannot change $8X$, hence cannot affect the truth value of
any cofactored verification equation. Note carefully which verifiers
inherit this robustness: the \emph{cofactored} (ZIP-215) lineage. The
verified dalek-lineage verifier deliberately checks the stricter
canonical byte-equality criterion instead --- knowing \emph{which}
equation a library actually checks is this exercise's real teeth, and
the anza repo's ledger pins exactly that distinction for Solana's
verifier.

\solhead{12.3}
\pathway Close the book. Write two columns: \emph{assumes} /
\emph{establishes}. Then open the apex section and diff.
\answer The list your memory should reproduce --- \emph{assumes}:
(1) SHA-512 as an opaque oracle, with \emph{no} properties assumed ---
not even ideality; the theorems hold for whatever bytes it produces;
(2) the opaque wire-format types (the signature struct and error type,
per fork); (3) the three standard Lean axioms; (4) the extraction
pipeline preserves meaning (one tool, pinned versions). Notably ABSENT:
any backend assumption --- the serial path is pinned at extraction and
proven as real code. \emph{Establishes}, in four tiers each pinned to
exactly that boundary by the check script: the extracted verifier
returns true \emph{iff} the signature's $R$ decompresses to a valid
on-curve point equal to $[k](-A) + [s]B$ --- with field arithmetic,
group law, scalar arithmetic, encoding, and decompression each carried
by its own kernel-checked layer below. If your two columns match this,
you can audit a verification paper's abstract in ninety seconds ---
which was the promise on the book's cover, kept.

\solhead{12.4}
\pathway Mirror the worked example's run 1 with $y = 10$.
\answer Encode: $x = 6$ is even $\Rightarrow$ store $(10, \text{even})$.
Decompress: $y^2 = 100 \equiv 9$, so
$x^2 = (9-1)/(1 + 2\cdot 9) = 8/19 \equiv 8 \cdot 6^{-1}$; scanning gives
$6^{-1} = 11$ ($6 \cdot 11 = 66 \equiv 1$), so $x^2 = 88 \equiv 10$. The
roots of $10$: scan the squares --- $6^2 = 36 \equiv 10$ and
$7^2 = 49 \equiv 10$, so $\{6, 7\}$, one even, one odd (they sum to
$13$). The bit says even: $x = 6$ \checkmark. Choosing $7$ instead would
put you on the curve at the WRONG point $(7,10) = -3P$ --- the sign bit
is one bit of information doing real cryptographic work.

\begin{checkpoint}
The book's ending is a beginning, so the final checkpoint is prospective:
you should be able to (1) state what each pyramid layer claims and which
denotation it rides on; (2) explain to a security engineer why completeness
of the Edwards law matters to \emph{code}; (3) locate the current frontier
and say precisely why it is hard; and (4) name the next proof \emph{you}
intend to write. The authors of the companion repositories left the
scaffolding up on purpose.
\end{checkpoint}