From 9e9eaf87d047d265449a5271e52cc1ceddc21278 Mon Sep 17 00:00:00 2001 From: Lucas Franceschino Date: Mon, 19 Feb 2024 12:48:43 +0100 Subject: [PATCH 1/7] feat(kyber/F*): serialize: introduce `BitVecEq` --- proofs/fstar/extraction-edited/BitVecEq.fst | 12 + proofs/fstar/extraction-edited/BitVecEq.fsti | 294 ++++++++++++++++++ .../Libcrux.Kem.Kyber.Serialize.fst | 11 +- .../Libcrux.Kem.Kyber.Serialize.fsti | 38 +-- 4 files changed, 331 insertions(+), 24 deletions(-) create mode 100644 proofs/fstar/extraction-edited/BitVecEq.fst create mode 100644 proofs/fstar/extraction-edited/BitVecEq.fsti diff --git a/proofs/fstar/extraction-edited/BitVecEq.fst b/proofs/fstar/extraction-edited/BitVecEq.fst new file mode 100644 index 00000000..c89f2fe3 --- /dev/null +++ b/proofs/fstar/extraction-edited/BitVecEq.fst @@ -0,0 +1,12 @@ +module BitVecEq + +open Core +open FStar.Mul +open FStar.FunctionalExtensionality + +let bit_vec_equal #n bv1 bv2 = forall i. bv1 i == bv2 i + +let bit_vec_equal_intro bv1 bv2 = () +let bit_vec_equal_elim bv1 bv2 = assert (feq bv1 bv2) + + diff --git a/proofs/fstar/extraction-edited/BitVecEq.fsti b/proofs/fstar/extraction-edited/BitVecEq.fsti new file mode 100644 index 00000000..13c9a227 --- /dev/null +++ b/proofs/fstar/extraction-edited/BitVecEq.fsti @@ -0,0 +1,294 @@ +module BitVecEq +#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" +open Core +open FStar.Mul +open MkSeq +open FStar.FunctionalExtensionality + +val bit_vec_equal (#n: nat) (bv1 bv2: bit_vec n): Type0 +val bit_vec_equal_intro (#n: nat) (bv1 bv2: bit_vec n) + : Lemma (requires forall i. bv1 i == bv2 i) + (ensures bit_vec_equal bv1 bv2) +val bit_vec_equal_elim (#n: nat) (bv1 bv2: bit_vec n) + : Lemma (requires bit_vec_equal #n bv1 bv2) + (ensures bv1 == bv2) + [SMTPat (bit_vec_equal #n bv1 bv2)] + +let bit_vec_equal_intro_principle () + : Lemma (forall n (bv1 bv2: bit_vec n). (forall i. bv1 i == bv2 i) ==> bit_vec_equal #n bv1 bv2) + = introduce forall n (bv1 bv2: bit_vec n). _ + with introduce (forall i. bv1 i == bv2 i) ==> bit_vec_equal #n bv1 bv2 + with _. bit_vec_equal_intro #n bv1 bv2 + +let bit_vec_equal_elim_principle () + : Lemma (forall n (bv1 bv2: bit_vec n). bit_vec_equal #n bv1 bv2 ==> (forall i. bv1 i == bv2 i)) + = introduce forall n (bv1 bv2: bit_vec n). _ + with introduce bit_vec_equal #n bv1 bv2 ==> (forall i. bv1 i == bv2 i) + with _. bit_vec_equal_elim #n bv1 bv2 + +let bit_vec_equal_trivial (bv1 bv2: bit_vec 0): Lemma (bv1 == bv2) + [SMTPat (eq2 #(bit_vec 0) bv1 bv2)] + = bit_vec_equal_intro bv1 bv2 + +let bit_vec_sub #n (bv: bit_vec n) (start: nat) (len: nat {start + len <= n}) + : bit_vec len + = on (i: nat {i < len}) + (fun i -> bv (start + i)) + +let bit_vec_equal_trivial_sub_smtpat (bv1: bit_vec 'n) + : Lemma (forall (bv2: bit_vec 0). bit_vec_sub bv1 0 0 == bv2) + [SMTPat (bit_vec_sub bv1 0 0)] + = introduce forall (bv2: bit_vec 0). bit_vec_sub bv1 0 0 == bv2 + with bit_vec_equal_trivial (bit_vec_sub bv1 0 0) bv2 + +unfold let retype #a #b (#_:unit{a == b}) + (x: a): b + = x + +let bit_vec_sub_all_lemma #n (bv: bit_vec n) + : Lemma (bit_vec_sub bv 0 n == bv) + [SMTPat (bit_vec_sub bv 0 n)] + = bit_vec_equal_intro (bit_vec_sub bv 0 n) bv + +let int_t_array_bitwise_eq' + #t1 #t2 #n1 #n2 + (arr1: t_Array (int_t t1) n1) (d1: num_bits t1) + (arr2: t_Array (int_t t2) n2) (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) + = bit_vec_equal (bit_vec_of_int_t_array arr1 d1) + (retype (bit_vec_of_int_t_array arr2 d2)) + +let int_t_array_bitwise_eq + #t1 #t2 #n1 #n2 + (arr1: t_Array (int_t t1) n1) (d1: num_bits t1) + (arr2: t_Array (int_t t2) n2) (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) + = bit_vec_of_int_t_array arr1 d1 + == bit_vec_of_int_t_array arr2 d2 + +// let get_bit_intro () +// : Lemma (forall (#n: inttype) (x: int_t n) (nth: usize {v nth < bits n}). +// get_bit #n x nth == ( if v x >= 0 then get_bit_nat (v x) (v nth) +// else get_bit_nat (pow2 (bits n) + v x) (v nth))) +// = introduce forall (n: inttype) (x: int_t n) (nth: usize {v nth < bits n}). +// get_bit #n x nth == ( if v x >= 0 then get_bit_nat (v x) (v nth) +// else get_bit_nat (pow2 (bits n) + v x) (v nth)) +// with get_bit_intro #n x nth + +#push-options "--fuel 0 --ifuel 0 --z3rlimit 80" +/// Rewrite a `bit_vec_of_int_t_array (Seq.slice arr ...)` into a `bit_vec_sub ...` +let int_t_seq_slice_to_bv_sub_lemma #t #n + (arr: t_Array (int_t t) n) + (start: nat) (len: usize {start + v len <= v n}) + (d: num_bits t) + : Lemma ( bit_vec_of_int_t_array (Seq.slice arr start (start + v len) <: t_Array _ len) d + `bit_vec_equal` bit_vec_sub (bit_vec_of_int_t_array arr d) (start * d) (v len * d)) + [SMTPat (bit_vec_sub (bit_vec_of_int_t_array arr d) (start * d) (v len * d))] + = let bv1 = bit_vec_of_int_t_array #_ #len (Seq.slice arr start (start + v len)) d in + let bv2 = bit_vec_sub (bit_vec_of_int_t_array arr d) (start * d) (v len * d) in + introduce forall i. bv1 i == bv2 i + with ( Seq.lemma_index_slice arr start (start + v len) (i / d); + Math.Lemmas.lemma_div_plus i start d; + Math.Lemmas.lemma_mod_plus i start d); + bit_vec_equal_intro bv1 bv2 + +#push-options "--split_queries always" +let int_t_eq_seq_slice_bv_sub_lemma #t #n1 #n2 + (arr1: t_Array (int_t t) n1) (arr2: t_Array (int_t t) n2) (d: num_bits t) + (start1 start2: nat) (len: nat {start1 + len <= v n1 /\ start2 + len <= v n2}) + : Lemma (requires Seq.slice arr1 start1 (start1 + len) == Seq.slice arr2 start2 (start2 + len)) + (ensures bit_vec_equal + (bit_vec_sub (bit_vec_of_int_t_array arr1 d) (start1 * d) (len * d)) + (bit_vec_sub (bit_vec_of_int_t_array arr2 d) (start2 * d) (len * d))) + [SMTPat ((bit_vec_sub (bit_vec_of_int_t_array arr1 d) (start1 * d) (len * d)) == + (bit_vec_sub (bit_vec_of_int_t_array arr2 d) (start2 * d) (len * d)))] + = let len = sz len in + int_t_seq_slice_to_bv_sub_lemma arr1 start1 len d; + int_t_seq_slice_to_bv_sub_lemma arr2 start2 len d; + // bit_vec_equal_elim_principle (); + bit_vec_equal_intro_principle () +#pop-options + +let bit_vec_equal_extend #n1 #n2 + (bv1: bit_vec n1) (bv2: bit_vec n2) (start1 start2: nat) + (len1: nat) + (len2: nat { start1 + len1 + len2 <= n1 /\ start2 + len1 + len2 <= n2}) + : Lemma + (requires + bit_vec_sub bv1 start1 len1 == bit_vec_sub bv2 start2 len1 + /\ bit_vec_sub bv1 (start1 + len1) len2 == bit_vec_sub bv2 (start2 + len1) len2) + (ensures bit_vec_sub bv1 start1 (len1+len2) == bit_vec_sub bv2 start2 (len1+len2)) + // [SMTPat (bit_vec_sub bv1 start1 len1 == bit_vec_sub bv2 start2 len1); + // SMTPat () + // ] + // SMTPat (bit_vec_sub bv1 (start1 + len1) len2 == bit_vec_sub bv2 (start2 + len1) len2)] + = let left1 = bit_vec_sub bv1 start1 len1 in + let left2 = bit_vec_sub bv2 start2 len1 in + let right1 = bit_vec_sub bv1 (start1 + len1) len2 in + let right2 = bit_vec_sub bv2 (start2 + len1) len2 in + // () + // bit_vec_equal_elim left1 left2 ; + // bit_vec_equal_elim right1 right2; + let entire1 = bit_vec_sub bv1 start1 (len1 + len2) in + let entire2 = bit_vec_sub bv2 start2 (len1 + len2) in + assert (forall (i:nat). i < len1 ==> left1 i == left2 i); + assert (forall (i:nat). i < len2 ==> right1 i == right2 i); + introduce forall (i:nat). i < len1 + len2 ==> entire1 i == entire2 i + with introduce i < len1 + len2 ==> entire1 i == entire2 i + with _. if i < len1 then assert (left1 i == left2 i) + else assert (entire1 i == right1 (i - len1)); + bit_vec_equal_intro entire1 entire2 +#pop-options + +// let bit_vec_equal_trans (#n: nat) (bv1 bv2 bv3: bit_vec n) +// : Lemma (requires bv1 `bit_vec_equal` bv2 /\ bv2 `bit_vec_equal` bv3) +// (ensures bv1 `bit_vec_equal` bv3) +// = bit_vec_equal_elim_principle (); +// bit_vec_equal_intro_principle () + +(* +let int_arr_bitwise_eq_range + #t1 #t2 #n1 #n2 + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) + (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) + (d1: num_bits t1) + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t2 -> Type0) + (arr2: t_Array (x: int_t t2 {refinement2 x}) n2) + (d2: num_bits t2) + (offset1 offset2: nat) + (bits: nat { + offset1 + bits <= v n1 * d1 + /\ offset2 + bits <= v n2 * d2 + }) + = bit_vec_equal #bits (fun i -> bit_vec_of_int_t_array arr1 d1 (i + offset1)) + = forall (k: nat). k < bits ==> + bit_vec_of_int_t_array arr1 d1 (offset1 + k) + == bit_vec_of_int_t_array arr2 d2 (offset2 + k) + +let int_arr_bitwise_eq_range_comm + #t1 #t2 #n1 #n2 + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) + (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) + (d1: num_bits t1) + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t2 -> Type0) + (arr2: t_Array (x: int_t t2 {refinement2 x}) n2) + (d2: num_bits t2) + (offset1 offset2: nat) + (bits: nat { + offset1 + bits <= v n1 * d1 + /\ offset2 + bits <= v n2 * d2 + }) + : Lemma (requires int_arr_bitwise_eq_range arr1 d1 arr2 d2 offset1 offset2 bits) + (ensures int_arr_bitwise_eq_range arr2 d2 arr1 d1 offset2 offset1 bits) + = () + +// kill that function in favor of range +let int_arr_bitwise_eq_up_to + #t1 #t2 #n1 #n2 + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) + (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) + (d1: num_bits t1) + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) + (arr2: t_Array (x: int_t t2 {refinement x}) n2) + (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) + (max: nat {max <= v n1 * d1}) + + = forall i. i < max + ==> bit_vec_of_int_t_array arr1 d1 i == bit_vec_of_int_t_array arr2 d2 i + +let int_arr_bitwise_eq_ + #t1 #t2 #n1 #n2 + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) + (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) + (d1: num_bits t1) + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) + (arr2: t_Array (x: int_t t2 {refinement x}) n2) + (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) + = int_arr_bitwise_eq_up_to arr1 d1 arr2 d2 (v n1 * d1) + +// move to fsti +let bit_vec_equal #n (bv1 bv2: bit_vec n) + = forall i. i < n ==> bv1 i == bv2 i + +let int_arr_bitwise_eq + #t1 #t2 #n1 #n2 + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) + (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) + (d1: num_bits t1) + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) + (arr2: t_Array (x: int_t t2 {refinement x}) n2) + (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) + = forall i. i < v n1 * d1 + ==> bit_vec_of_int_t_array arr1 d1 i == bit_vec_of_int_t_array arr2 d2 i + +let int_arr_bitwise_eq_range_transitivity + #t1 #t2 #t3 #n1 #n2 #n3 + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) + (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) + (d1: num_bits t1) + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t2 -> Type0) + (arr2: t_Array (x: int_t t2 {refinement2 x}) n2) + (d2: num_bits t2) + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement3: int_t t3 -> Type0) + (arr3: t_Array (x: int_t t3 {refinement3 x}) n3) + (d3: num_bits t3) + (offset1 offset2 offset3: nat) + (bits: nat { + offset1 + bits <= v n1 * d1 + /\ offset2 + bits <= v n2 * d2 + /\ offset3 + bits <= v n3 * d3 + }) + : Lemma + (requires int_arr_bitwise_eq_range #t1 #t2 #n1 #n2 arr1 d1 arr2 d2 offset1 offset2 bits + /\ int_arr_bitwise_eq_range #t2 #t3 #n2 #n3 arr2 d2 arr3 d3 offset2 offset3 bits) + (ensures int_arr_bitwise_eq_range #t1 #t3 #n1 #n3 arr1 d1 arr3 d3 offset1 offset3 bits) + = () + + +let int_arr_bitwise_eq_range_intro + #t1 #t2 #n1 #n2 + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) + (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) + (d1: num_bits t1) + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) + (arr2: t_Array (x: int_t t2 {refinement x}) n2) + (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) + : Lemma + (requires int_arr_bitwise_eq arr1 d1 arr2 d2) + (ensures int_arr_bitwise_eq_range arr1 d1 arr2 d2 0 0 (v n1 * d1)) + = admit () + +let int_arr_bitwise_eq_range_intro_eq_slice + #t #n1 #n2 + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t -> Type0) + (arr1: t_Array (x: int_t t {refinement x}) n1) + (arr2: t_Array (x: int_t t {refinement x}) n2) + (d: num_bits t) + (offset1 offset2: nat) + (n: nat {offset1 + n < v n1 /\ offset2 + n < v n2}) + (bits: nat { + offset1 + bits <= v n1 * d + /\ offset2 + bits <= v n2 * d + /\ bits <= n * d + }) + : Lemma (requires Seq.slice arr1 offset1 (offset1 + n) == Seq.slice arr2 offset2 (offset2 + n)) + (ensures int_arr_bitwise_eq_range arr1 d arr2 d offset1 offset2 bits) + = admit () + +let int_arr_bitwise_eq_range_intro_eq + #t #n1 #n2 + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t -> Type0) + (arr1: t_Array (x: int_t t {refinement1 x}) n1) + (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t -> Type0) + (arr2: t_Array (x: int_t t {refinement2 x}) n2) + (d: num_bits t) + (n_offset1 n_offset2: nat) + (n: nat {n_offset1 + n <= v n1 /\ n_offset2 + n <= v n2}) + // (offset1 offset2: nat) + (bits: nat { + n_offset1 * d + bits <= v n1 * d + /\ n_offset2 * d + bits <= v n2 * d + /\ bits <= n * d + }) + : Lemma (requires forall (i: nat). i < n ==> Seq.index arr1 (i + n_offset1) == Seq.index arr2 (i + n_offset2)) + (ensures int_arr_bitwise_eq_range arr1 d arr2 d (n_offset1 * d) (n_offset2 * d) bits) + = admit () +*) diff --git a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst index dc7a4fa7..11c3a8e4 100644 --- a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst +++ b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst @@ -6,8 +6,9 @@ open FStar.Mul open Libcrux.Kem.Kyber.Arithmetic open MkSeq +open BitVecEq -#push-options "--z3rlimit 80" +#push-options "--z3rlimit 180" [@@"opaque_to_smt"] let compress_coefficients_10_ (coefficient1 coefficient2 coefficient3 coefficient4: i32) = let coef1:u8 = cast (coefficient1 &. 255l <: i32) <: u8 in @@ -24,6 +25,7 @@ let compress_coefficients_10_ (coefficient1 coefficient2 coefficient3 coefficien (cast ((coefficient3 >>! 4l <: i32) &. 63l <: i32) <: u8) in let coef5:u8 = cast ((coefficient4 >>! 2l <: i32) &. 255l <: i32) <: u8 in + bit_vec_equal_intro_principle (); coef1, coef2, coef3, coef4, coef5 <: (u8 & u8 & u8 & u8 & u8) #pop-options @@ -63,6 +65,7 @@ let compress_coefficients_11_ (cast (coefficient7 >>! 6l <: i32) <: u8) in let coef11:u8 = cast (coefficient8 >>! 3l <: i32) <: u8 in + bit_vec_equal_intro_principle (); coef1, coef2, coef3, coef4, coef5, coef6, coef7, coef8, coef9, coef10, coef11 <: (u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8) @@ -79,6 +82,7 @@ let compress_coefficients_3_ coefficient1 coefficient2 = u8 in let coef3:u8 = cast ((coefficient2 >>! 4l <: u16) &. 255us <: u16) <: u8 in + bit_vec_equal_intro_principle (); coef1, coef2, coef3 <: (u8 & u8 & u8) #pop-options @@ -98,6 +102,7 @@ let compress_coefficients_5_ (coefficient5 >>! 4l <: u8) in let coef5:u8 = (coefficient8 <>! 2l <: u8) in + bit_vec_equal_intro_principle (); coef1, coef2, coef3, coef4, coef5 <: (u8 & u8 & u8 & u8 & u8) #pop-options @@ -112,6 +117,7 @@ let decompress_coefficients_10_ byte2 byte1 byte3 byte4 byte5 = lemma_get_bit_bounded' coefficient2 10; lemma_get_bit_bounded' coefficient3 10; lemma_get_bit_bounded' coefficient4 10; + bit_vec_equal_intro_principle (); coefficient1, coefficient2, coefficient3, coefficient4 #pop-options @@ -131,6 +137,7 @@ let decompress_coefficients_11_ in let coefficient7:i32 = ((byte10 &. 31l <: i32) <>! 2l <: i32) in let coefficient8:i32 = (byte11 <>! 5l <: i32) in + bit_vec_equal_intro_principle (); lemma_get_bit_bounded' coefficient1 11; lemma_get_bit_bounded' coefficient2 11; lemma_get_bit_bounded' coefficient3 11; @@ -156,6 +163,7 @@ let decompress_coefficients_4_ byte = let coefficient2:i32 = cast ((byte >>! 4l <: u8) &. 15uy <: u8) <: i32 in lemma_get_bit_bounded' coefficient1 4; lemma_get_bit_bounded' coefficient2 4; + bit_vec_equal_intro_principle (); coefficient1, coefficient2 #pop-options @@ -170,6 +178,7 @@ let decompress_coefficients_5_ byte1 byte2 byte3 byte4 byte5 = let coefficient6:i32 = (byte4 >>! 1l <: i32) &. 31l in let coefficient7:i32 = ((byte5 &. 7l <: i32) <>! 6l <: i32) in let coefficient8:i32 = byte5 >>! 3l in + bit_vec_equal_intro_principle (); lemma_get_bit_bounded' coefficient1 5; lemma_get_bit_bounded' coefficient2 5; lemma_get_bit_bounded' coefficient3 5; diff --git a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti index df3b6b7e..a65a336a 100644 --- a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti +++ b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti @@ -3,21 +3,13 @@ module Libcrux.Kem.Kyber.Serialize open Core open FStar.Mul open MkSeq - -let int_arr_bitwise_eq - #t1 #t2 #n1 #n2 - (arr1: t_Array (int_t t1) n1) - (d1: num_bits t1) - (arr2: t_Array (x: int_t t2) n2) - (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) - = forall i. i < v n1 * d1 - ==> bit_vec_of_int_t_array arr1 d1 i == bit_vec_of_int_t_array arr2 d2 i +open BitVecEq val compress_coefficients_10_ (coefficient1 coefficient2 coefficient3 coefficient4: i32) - : Prims.Pure (u8 & u8 & u8 & u8 & u8) + : Prims.Pure (u8 & u8 & u8 & u8 & u8) (requires True) (ensures fun tuple -> - int_arr_bitwise_eq + int_t_array_bitwise_eq' (create4 (coefficient1, coefficient2, coefficient3, coefficient4)) 10 (create5 tuple) 8 ) @@ -28,7 +20,7 @@ val compress_coefficients_11_ : Prims.Pure (u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8) (requires True) (ensures fun tuple -> - int_arr_bitwise_eq + int_t_array_bitwise_eq' (create8 (coefficient1, coefficient2, coefficient3, coefficient4, coefficient5, coefficient6, coefficient7, coefficient8)) 11 (create11 tuple) 8 ) @@ -37,7 +29,7 @@ val compress_coefficients_3_ (coefficient1 coefficient2: int_t_d u16_inttype 12) : Prims.Pure (u8 & u8 & u8) (requires True) (ensures fun tuple -> - int_arr_bitwise_eq + int_t_array_bitwise_eq' (create2 (coefficient1, coefficient2)) 12 (create3 tuple) 8 ) @@ -47,7 +39,7 @@ val compress_coefficients_5_ : Prims.Pure (u8 & u8 & u8 & u8 & u8) (requires True) (ensures fun tuple -> - int_arr_bitwise_eq + int_t_array_bitwise_eq' (create8 (coefficient1, coefficient2, coefficient3, coefficient4, coefficient5, coefficient6, coefficient7, coefficient8)) 5 (create5 tuple) 8 ) @@ -57,7 +49,7 @@ val decompress_coefficients_10_ (byte2 byte1 byte3 byte4 byte5: int_t_d i32_intt : Prims.Pure (i32_d 10 & i32_d 10 & i32_d 10 & i32_d 10) (requires True) (ensures fun (r1, r2, r3, r4) -> - int_arr_bitwise_eq + int_t_array_bitwise_eq' (create5 (byte1, byte2, byte3, byte4, byte5)) 8 (create4 #i32 (r1, r2, r3, r4)) 10 ) @@ -67,27 +59,27 @@ val decompress_coefficients_11_ : Prims.Pure (i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11) (requires True) (ensures fun (r1, r2, r3, r4, r5, r6, r7, r8) -> - int_arr_bitwise_eq - (create11 (byte1, byte2, byte3, byte4, byte5, byte6, byte7, byte8, byte9, byte10, byte11)) 8 - (create8 (r1, r2, r3, r4, r5, r6, r7, r8)) 11 + int_t_array_bitwise_eq' + (create11 #i32 (byte1, byte2, byte3, byte4, byte5, byte6, byte7, byte8, byte9, byte10, byte11)) 8 + (create8 #i32 (r1, r2, r3, r4, r5, r6, r7, r8)) 11 ) val decompress_coefficients_4_ (byte: u8) : Prims.Pure (i32_d 4 & i32_d 4) (requires True) (ensures fun (r1, r2) -> - int_arr_bitwise_eq + int_t_array_bitwise_eq' (create1 byte) 8 - (create2 (r1, r2)) 4 + (create2 #i32 (r1, r2)) 4 ) val decompress_coefficients_5_ (byte1 byte2 byte3 byte4 byte5: int_t_d i32_inttype 8) : Prims.Pure (i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5) (requires True) (ensures fun (r1, r2, r3, r4, r5, r6, r7, r8) -> - int_arr_bitwise_eq - (create5 (byte1, byte2, byte3, byte4, byte5)) 8 - (create8 (r1, r2, r3, r4, r5, r6, r7, r8)) 5 + int_t_array_bitwise_eq' + (create5 #i32 (byte1, byte2, byte3, byte4, byte5)) 8 + (create8 #i32 (r1, r2, r3, r4, r5, r6, r7, r8)) 5 ) val compress_then_serialize_10_ From d2779174c8d7c7e3799cedc2b4f5c5077b16c090 Mon Sep 17 00:00:00 2001 From: Lucas Franceschino Date: Mon, 19 Feb 2024 12:49:59 +0100 Subject: [PATCH 2/7] feat(kyber/F*): proof for `serialize_uncompress_ring_element` --- .../Libcrux.Kem.Kyber.Serialize.fst | 108 ++++++++++++------ .../Libcrux.Kem.Kyber.Serialize.fsti | 5 +- 2 files changed, 75 insertions(+), 38 deletions(-) diff --git a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst index 11c3a8e4..1ff10373 100644 --- a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst +++ b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst @@ -1345,45 +1345,79 @@ let deserialize_to_uncompressed_ring_element (serialized: t_Slice u8) = re #pop-options -#push-options "--z3rlimit 100" -let serialize_uncompressed_ring_element (re: Libcrux.Kem.Kyber.Arithmetic.wfPolynomialRingElement) = - let serialized:t_Array u8 (sz 384) = Rust_primitives.Hax.repeat 0uy (sz 384) in - let serialized:t_Array u8 (sz 384) = - Rust_primitives.Iterators.foldi_chunks_exact #_ #_ #(fun _ _ -> True) - (Rust_primitives.unsize re.Libcrux.Kem.Kyber.Arithmetic.f_coefficients) +module A = Libcrux.Kem.Kyber.Arithmetic + +[@@"opaque_to_smt"] +let update3 #n (s: t_Array 't n) (offset: usize {v offset + 3 <= v n}) (i0 i1 i2: 't) + : s': t_Array 't n { Seq.index s' (v offset + 0) == i0 + /\ Seq.index s' (v offset + 1) == i1 + /\ Seq.index s' (v offset + 2) == i2 + /\ (forall i. (i < v offset \/ i >= v offset + 3) ==> Seq.index s' i == Seq.index s i) } + = let open Rust_primitives.Hax.Monomorphized_update_at in + let s = update_at_usize s offset i0 in + let s = update_at_usize s (offset +! sz 1) i1 in + update_at_usize s (offset +! sz 2) i2 + +let slice_map_lemma #t #u #n (f: t -> u) (arr: t_Array t n) + (start: nat) (len: nat {start + len <= v n}) + : Lemma ( Seq.slice (Spec.Kyber.map' f arr) start (start + len) + == Spec.Kyber.map' f (Seq.slice arr start (start + len)) + ) + = let f_arr = Spec.Kyber.map' f arr in + let lhs = Seq.slice f_arr start (start + len) in + let rhs = Spec.Kyber.map' f (Seq.slice arr start (start + len)) in + introduce forall i. Seq.index lhs i == Seq.index rhs i + with ( + Seq.lemma_index_slice f_arr start (start + len) i; + Seq.lemma_index_slice arr start (start + len) i; + let sz_i_start, sz_i = sz (i + start), sz i in + assert (Seq.index f_arr (v sz_i_start) == f (Seq.index arr (v (sz_i_start)))); + assert (Seq.index rhs (v sz_i) == f (Seq.index (Seq.slice arr start (start + len)) (v sz_i))) + ); + assert (Seq.equal lhs rhs) + +#push-options "--z3rlimit 2800 --fuel 0 --ifuel 0 --retry 0 --split_queries no" +let serialize_uncompressed_ring_element re = + let serialized: t_Array u8 (sz 384) = Rust_primitives.Hax.repeat 0uy (sz 384) in + let max = v (sz 384) * 8 in + assert (max == 256 * 12 /\ max == 384 * 8 /\ 128 * 2 * 12 == max); + assert (128 == v (length re.f_coefficients /! (sz 2))); + let serialized = + Rust_primitives.Iterators.foldi_chunks_exact #_ #_ + #(fun serialized i -> + let i = v i in + i <= 128 /\ ( + let limit = i * 2 * 12 in + let coefficients: t_Array _ (sz 256) = Spec.Kyber.map' to_unsigned_representative re.f_coefficients in + bit_vec_sub (bit_vec_of_int_t_array serialized 8 ) 0 limit + == bit_vec_sub (bit_vec_of_int_t_array coefficients 12) 0 limit) + ) + (re.A.f_coefficients <: t_Array _ (sz 256)) (sz 2) serialized - (fun serialized temp_1_ -> - let serialized:t_Array u8 (sz 384) = serialized in - let i, coefficients:(usize & t_Array (Libcrux.Kem.Kyber.Arithmetic.i32_b (v Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS - 1)) (sz 2)) = temp_1_ in - assert (v i < 128); - let coefficient1:u16 = - Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 0 ] <: i32) - in - let coefficient2:u16 = - Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 1 ] <: i32) - in - let coef1, coef2, coef3:(u8 & u8 & u8) = - compress_coefficients_3_ coefficient1 coefficient2 - in - assert_spinoff (3 * v i + 3 <= 384); - assert_spinoff (range (v (sz 3) * v i) usize_inttype); - let serialized:t_Array u8 (sz 384) = - Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized - (sz 3 *! i <: usize) - coef1 - in - let serialized:t_Array u8 (sz 384) = - Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized - ((sz 3 *! i <: usize) +! sz 1 <: usize) - coef2 - in - let serialized:t_Array u8 (sz 384) = - Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized - ((sz 3 *! i <: usize) +! sz 2 <: usize) - coef3 - in - serialized) + (fun serialized it -> let i, coefficients = it in + + let coefficient1 = A.to_unsigned_representative (coefficients.[ sz 0 ] <: i32) in + let coefficient2 = A.to_unsigned_representative (coefficients.[ sz 1 ] <: i32) in + let (coef1, coef2, coef3) = compress_coefficients_3_ coefficient1 coefficient2 in + let j = sz 3 *! i in + let serialized' = update3 serialized j coef1 coef2 coef3 in + assert ( Seq.slice serialized' (v j) (v j + 3) + `Seq.equal` Seq.slice (create3 (coef1, coef2, coef3)) 0 3); + bit_vec_equal_intro + (let coefficients: t_Array _ (sz 2) = Spec.Kyber.map' to_unsigned_representative coefficients in + bit_vec_of_int_t_array coefficients 12) + (retype (bit_vec_sub (bit_vec_of_int_t_array serialized' 8) (3 * v i * 8) (3 * 8))); + let full_coefficients: t_Array u16 (sz 256) = Spec.Kyber.map' to_unsigned_representative re.f_coefficients in + slice_map_lemma #_ #u16 to_unsigned_representative re.f_coefficients (v i * 2) 2; + bit_vec_equal_intro + (bit_vec_sub (bit_vec_of_int_t_array serialized' 8) 0 (v i * 2 * 12)) + (bit_vec_sub (bit_vec_of_int_t_array serialized 8 ) 0 (v i * 2 * 12)); + bit_vec_equal_extend (bit_vec_of_int_t_array serialized' 8) + (bit_vec_of_int_t_array full_coefficients 12) + 0 0 (v i * 2 * 12) (3 * 8); + serialized' <: t_Array u8 (sz 384)) in serialized #pop-options + diff --git a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti index a65a336a..11e00399 100644 --- a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti +++ b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti @@ -183,4 +183,7 @@ val deserialize_to_uncompressed_ring_element (serialized: t_Slice u8) val serialize_uncompressed_ring_element (re: Libcrux.Kem.Kyber.Arithmetic.wfPolynomialRingElement) : Pure (t_Array u8 (sz 384)) (requires True) - (ensures (fun res -> True)) + (ensures (fun res -> + let coefficients: t_Array _ (sz 256) = Spec.Kyber.map' Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative re.f_coefficients in + int_t_array_bitwise_eq res 8 coefficients 12 + )) From f7ecf28a3d9b5506236edbf4aa388c79152ae946 Mon Sep 17 00:00:00 2001 From: Lucas Franceschino Date: Tue, 20 Feb 2024 07:30:12 +0100 Subject: [PATCH 3/7] fix(kyber/F*): spec, force subtype on bit vectors --- proofs/fstar/extraction-edited/Spec.Kyber.fst | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/proofs/fstar/extraction-edited/Spec.Kyber.fst b/proofs/fstar/extraction-edited/Spec.Kyber.fst index 39adaec8..ba35d385 100644 --- a/proofs/fstar/extraction-edited/Spec.Kyber.fst +++ b/proofs/fstar/extraction-edited/Spec.Kyber.fst @@ -176,12 +176,15 @@ let bytes_to_bits (#bytes: usize) (r: t_Array u8 bytes) (ensures fun f -> (forall i. bit_vec_of_int_t_array r 8 i == f i)) = bit_vec_of_int_t_array r 8 +unfold let retype_bit_vector #a #b (#_:unit{a == b}) (x: a): b = x + let byte_encode (d: dT) (coefficients: polynomial): t_Array u8 (sz (32 * d)) - = bits_to_bytes #(sz (32 * d)) (bit_vec_of_nat_array coefficients d) + = bits_to_bytes #(sz (32 * d)) + (retype_bit_vector (bit_vec_of_nat_array coefficients d)) let byte_decode (d: dT) (coefficients: t_Array u8 (sz (32 * d))): polynomial = let bv = bit_vec_of_int_t_array coefficients 8 in - let arr: t_Array nat (sz 256) = bit_vec_to_nat_array d bv in + let arr: t_Array nat (sz 256) = bit_vec_to_nat_array d (retype_bit_vector bv) in let p = map' (fun (x: nat) -> x % v v_FIELD_MODULUS <: nat) arr in introduce forall i. Seq.index p i < v v_FIELD_MODULUS with assert (Seq.index p i == Seq.index p (v (sz i))); From 9b6e1e54512651ef4cea679f1b42592ac18abbfc Mon Sep 17 00:00:00 2001 From: Lucas Franceschino Date: Tue, 20 Feb 2024 09:11:30 +0100 Subject: [PATCH 4/7] feat(kyber/F*): utilitary functions --- .../Libcrux.Kem.Kyber.Arithmetic.fsti | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti index 6cf0c1f1..8c68772f 100644 --- a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti +++ b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti @@ -57,6 +57,11 @@ let int_to_spec_fe (m:int) : Spec.Kyber.field_element = m_v + v Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS else m_v +let wf_fe_to_spec_fe (m: wfFieldElement): Spec.Kyber.field_element = + if v m < 0 + then v m + v Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS + else v m + let to_spec_fe (m:i32) : Spec.Kyber.field_element = int_to_spec_fe (v m) @@ -182,6 +187,12 @@ val down_cast_vector_b (#v_K:usize) (#b1:nat) (#b2:nat{b2 <= b1 /\ b1 < pow2_31} let op_String_Access #t #l (a:t_Array t l) (i:usize{v i < v l}) : t = a.[i] +let wf_poly_to_spec_poly (re: wfPolynomialRingElement): Spec.Kyber.polynomial = + let p = Spec.Kyber.map' (fun x -> wf_fe_to_spec_fe x <: nat) re.f_coefficients in + introduce forall i. Seq.index p i < v Spec.Kyber.v_FIELD_MODULUS + with assert (Seq.index p i == Seq.index p (v (sz i))); + p + let to_spec_poly (m:t_PolynomialRingElement) : (Spec.Kyber.polynomial) = let p = createi #nat (sz 256) (fun i -> to_spec_fe (m.f_coefficients.[i])) in assert (forall i. Seq.index p i = to_spec_fe (m.f_coefficients.[sz i])); From 056d0cb3d2efcca4b2cf173ad69c77d42e2d06bd Mon Sep 17 00:00:00 2001 From: Lucas Franceschino Date: Tue, 20 Feb 2024 10:46:39 +0100 Subject: [PATCH 5/7] fix(kyber/fstar): tweak some `Artihmetic.fst` proofs & rlimit --- .../Libcrux.Kem.Kyber.Arithmetic.fst | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst index 5139b2d7..2fd3d9ff 100644 --- a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst +++ b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst @@ -38,7 +38,7 @@ let sub_i32_b #b1 #b2 x y = let cast_i32_b #b1 #b2 x = x <: i32_b b2 -#push-options "--ifuel 0 --z3rlimit 150" +#push-options "--ifuel 0 --z3rlimit 250" let shr_i32_b #b #t x y = let r = (x <: i32) >>! y in assert (v r == v x / pow2 (v y)); @@ -78,8 +78,16 @@ let shr_i32_b #b #t x y = r <: i32_b (nat_div_ceil b (pow2 (v y)))) #pop-options -let v_BARRETT_R: i64 = 1L < Date: Tue, 20 Feb 2024 09:11:12 +0100 Subject: [PATCH 6/7] chore(kyber/F*): bump rlimits --- .../fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst index 1ff10373..0ffa9438 100644 --- a/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst +++ b/proofs/fstar/extraction-edited/Libcrux.Kem.Kyber.Serialize.fst @@ -8,7 +8,7 @@ open Libcrux.Kem.Kyber.Arithmetic open MkSeq open BitVecEq -#push-options "--z3rlimit 180" +#push-options "--z3rlimit 480 --split_queries always" [@@"opaque_to_smt"] let compress_coefficients_10_ (coefficient1 coefficient2 coefficient3 coefficient4: i32) = let coef1:u8 = cast (coefficient1 &. 255l <: i32) <: u8 in @@ -86,7 +86,7 @@ let compress_coefficients_3_ coefficient1 coefficient2 = coef1, coef2, coef3 <: (u8 & u8 & u8) #pop-options -#push-options "--z3rlimit 60 --split_queries always" +#push-options "--z3rlimit 160 --split_queries always" [@@"opaque_to_smt"] let compress_coefficients_5_ coefficient2 coefficient1 coefficient4 coefficient3 coefficient5 coefficient7 coefficient6 coefficient8 From d686389af5fa7931639273e374fc60965374b7b5 Mon Sep 17 00:00:00 2001 From: Lucas Franceschino Date: Mon, 19 Feb 2024 12:50:46 +0100 Subject: [PATCH 7/7] chore(kyber/F*): patches and hints --- proofs/fstar/extraction-edited.patch | 757 ++++-- .../.hints/BitVecEq.fsti.hints | 911 +++++++ .../.hints/Core.Array.fst.hints | 2 +- .../.hints/Core.Convert.fst.hints | 6 +- .../Core.Iter.Adapters.Enumerate.fst.hints | 2 +- .../Core.Iter.Adapters.Step_by.fst.hints | 2 +- .../.hints/Core.Iter.fsti.hints | 4 +- .../.hints/Core.Num.fsti.hints | 35 +- .../.hints/Core.Ops.Index.fst.hints | 2 +- .../.hints/Core.Ops.Range.fsti.hints | 30 +- .../.hints/Core.Ops.fst.hints | 2 +- .../.hints/Core.Option.fst.hints | 8 +- .../.hints/Core.Panicking.fst.hints | 4 +- .../.hints/Core.Result.fst.hints | 23 +- .../.hints/Core.Slice.fsti.hints | 6 +- .../.hints/Hax_lib.fst.hints | 4 +- .../.hints/Lib.IntTypes.fsti.hints | 139 +- .../.hints/Libcrux.Digest.fsti.hints | 6 +- .../Libcrux.Kem.Kyber.Arithmetic.fst.hints | 697 +++--- .../Libcrux.Kem.Kyber.Arithmetic.fsti.hints | 265 +- .../Libcrux.Kem.Kyber.Compress.fst.hints | 128 +- .../Libcrux.Kem.Kyber.Compress.fsti.hints | 4 +- ...crux.Kem.Kyber.Constant_time_ops.fst.hints | 41 +- ...rux.Kem.Kyber.Constant_time_ops.fsti.hints | 4 +- .../Libcrux.Kem.Kyber.Constants.fsti.hints | 16 +- ...Libcrux.Kem.Kyber.Hash_functions.fst.hints | 118 +- ...ibcrux.Kem.Kyber.Hash_functions.fsti.hints | 21 +- .../Libcrux.Kem.Kyber.Ind_cpa.fst.hints | 1146 ++++----- .../Libcrux.Kem.Kyber.Ind_cpa.fsti.hints | 107 +- .../Libcrux.Kem.Kyber.Kyber1024.fst.hints | 93 +- .../Libcrux.Kem.Kyber.Kyber1024.fsti.hints | 69 +- .../Libcrux.Kem.Kyber.Kyber512.fst.hints | 90 +- .../Libcrux.Kem.Kyber.Kyber512.fsti.hints | 81 +- .../Libcrux.Kem.Kyber.Kyber768.fst.hints | 103 +- .../Libcrux.Kem.Kyber.Kyber768.fsti.hints | 60 +- .../.hints/Libcrux.Kem.Kyber.Matrix.fst.hints | 129 +- .../Libcrux.Kem.Kyber.Matrix.fsti.hints | 10 +- .../.hints/Libcrux.Kem.Kyber.Ntt.fst.hints | 1124 ++------- .../.hints/Libcrux.Kem.Kyber.Ntt.fsti.hints | 12 +- .../Libcrux.Kem.Kyber.Sampling.fst.hints | 54 +- .../Libcrux.Kem.Kyber.Sampling.fsti.hints | 8 +- .../Libcrux.Kem.Kyber.Serialize.fst.hints | 2126 ++++++++++++----- .../Libcrux.Kem.Kyber.Serialize.fsti.hints | 100 +- .../.hints/Libcrux.Kem.Kyber.Types.fst.hints | 20 +- .../.hints/Libcrux.Kem.Kyber.fst.hints | 304 +-- .../.hints/Libcrux.Kem.Kyber.fsti.hints | 14 +- .../Libcrux_platform.Platform.fsti.hints | 1 + .../.hints/Libcrux_platform.fsti.hints | 1 - .../extraction-edited/.hints/MkSeq.fst.hints | 39 +- .../.hints/Rust_primitives.Arrays.fsti.hints | 162 +- .../Rust_primitives.BitVectors.fsti.hints | 131 +- ...ves.Hax.Monomorphized_update_at.fsti.hints | 10 +- .../.hints/Rust_primitives.Hax.fst.hints | 17 +- .../Rust_primitives.Integers.fsti.hints | 148 +- .../Rust_primitives.Iterators.fsti.hints | 60 +- .../.hints/Rust_primitives.fst.hints | 25 +- .../.hints/Spec.Kyber.fst.hints | 1727 +++++-------- .../fstar/extraction-secret-independent.patch | 769 ++++-- 58 files changed, 6548 insertions(+), 5429 deletions(-) create mode 100644 proofs/fstar/extraction-edited/.hints/BitVecEq.fsti.hints create mode 100644 proofs/fstar/extraction-edited/.hints/Libcrux_platform.Platform.fsti.hints delete mode 100644 proofs/fstar/extraction-edited/.hints/Libcrux_platform.fsti.hints diff --git a/proofs/fstar/extraction-edited.patch b/proofs/fstar/extraction-edited.patch index 5857621e..b828a0d7 100644 --- a/proofs/fstar/extraction-edited.patch +++ b/proofs/fstar/extraction-edited.patch @@ -1,5 +1,319 @@ +diff -ruN extraction/BitVecEq.fst extraction-edited/BitVecEq.fst +--- extraction/BitVecEq.fst 1970-01-01 01:00:00.000000000 +0100 ++++ extraction-edited/BitVecEq.fst 2024-02-20 10:46:13.853093120 +0100 +@@ -0,0 +1,12 @@ ++module BitVecEq ++ ++open Core ++open FStar.Mul ++open FStar.FunctionalExtensionality ++ ++let bit_vec_equal #n bv1 bv2 = forall i. bv1 i == bv2 i ++ ++let bit_vec_equal_intro bv1 bv2 = () ++let bit_vec_equal_elim bv1 bv2 = assert (feq bv1 bv2) ++ ++ +diff -ruN extraction/BitVecEq.fsti extraction-edited/BitVecEq.fsti +--- extraction/BitVecEq.fsti 1970-01-01 01:00:00.000000000 +0100 ++++ extraction-edited/BitVecEq.fsti 2024-02-20 10:46:13.894092295 +0100 +@@ -0,0 +1,294 @@ ++module BitVecEq ++#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" ++open Core ++open FStar.Mul ++open MkSeq ++open FStar.FunctionalExtensionality ++ ++val bit_vec_equal (#n: nat) (bv1 bv2: bit_vec n): Type0 ++val bit_vec_equal_intro (#n: nat) (bv1 bv2: bit_vec n) ++ : Lemma (requires forall i. bv1 i == bv2 i) ++ (ensures bit_vec_equal bv1 bv2) ++val bit_vec_equal_elim (#n: nat) (bv1 bv2: bit_vec n) ++ : Lemma (requires bit_vec_equal #n bv1 bv2) ++ (ensures bv1 == bv2) ++ [SMTPat (bit_vec_equal #n bv1 bv2)] ++ ++let bit_vec_equal_intro_principle () ++ : Lemma (forall n (bv1 bv2: bit_vec n). (forall i. bv1 i == bv2 i) ==> bit_vec_equal #n bv1 bv2) ++ = introduce forall n (bv1 bv2: bit_vec n). _ ++ with introduce (forall i. bv1 i == bv2 i) ==> bit_vec_equal #n bv1 bv2 ++ with _. bit_vec_equal_intro #n bv1 bv2 ++ ++let bit_vec_equal_elim_principle () ++ : Lemma (forall n (bv1 bv2: bit_vec n). bit_vec_equal #n bv1 bv2 ==> (forall i. bv1 i == bv2 i)) ++ = introduce forall n (bv1 bv2: bit_vec n). _ ++ with introduce bit_vec_equal #n bv1 bv2 ==> (forall i. bv1 i == bv2 i) ++ with _. bit_vec_equal_elim #n bv1 bv2 ++ ++let bit_vec_equal_trivial (bv1 bv2: bit_vec 0): Lemma (bv1 == bv2) ++ [SMTPat (eq2 #(bit_vec 0) bv1 bv2)] ++ = bit_vec_equal_intro bv1 bv2 ++ ++let bit_vec_sub #n (bv: bit_vec n) (start: nat) (len: nat {start + len <= n}) ++ : bit_vec len ++ = on (i: nat {i < len}) ++ (fun i -> bv (start + i)) ++ ++let bit_vec_equal_trivial_sub_smtpat (bv1: bit_vec 'n) ++ : Lemma (forall (bv2: bit_vec 0). bit_vec_sub bv1 0 0 == bv2) ++ [SMTPat (bit_vec_sub bv1 0 0)] ++ = introduce forall (bv2: bit_vec 0). bit_vec_sub bv1 0 0 == bv2 ++ with bit_vec_equal_trivial (bit_vec_sub bv1 0 0) bv2 ++ ++unfold let retype #a #b (#_:unit{a == b}) ++ (x: a): b ++ = x ++ ++let bit_vec_sub_all_lemma #n (bv: bit_vec n) ++ : Lemma (bit_vec_sub bv 0 n == bv) ++ [SMTPat (bit_vec_sub bv 0 n)] ++ = bit_vec_equal_intro (bit_vec_sub bv 0 n) bv ++ ++let int_t_array_bitwise_eq' ++ #t1 #t2 #n1 #n2 ++ (arr1: t_Array (int_t t1) n1) (d1: num_bits t1) ++ (arr2: t_Array (int_t t2) n2) (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) ++ = bit_vec_equal (bit_vec_of_int_t_array arr1 d1) ++ (retype (bit_vec_of_int_t_array arr2 d2)) ++ ++let int_t_array_bitwise_eq ++ #t1 #t2 #n1 #n2 ++ (arr1: t_Array (int_t t1) n1) (d1: num_bits t1) ++ (arr2: t_Array (int_t t2) n2) (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) ++ = bit_vec_of_int_t_array arr1 d1 ++ == bit_vec_of_int_t_array arr2 d2 ++ ++// let get_bit_intro () ++// : Lemma (forall (#n: inttype) (x: int_t n) (nth: usize {v nth < bits n}). ++// get_bit #n x nth == ( if v x >= 0 then get_bit_nat (v x) (v nth) ++// else get_bit_nat (pow2 (bits n) + v x) (v nth))) ++// = introduce forall (n: inttype) (x: int_t n) (nth: usize {v nth < bits n}). ++// get_bit #n x nth == ( if v x >= 0 then get_bit_nat (v x) (v nth) ++// else get_bit_nat (pow2 (bits n) + v x) (v nth)) ++// with get_bit_intro #n x nth ++ ++#push-options "--fuel 0 --ifuel 0 --z3rlimit 80" ++/// Rewrite a `bit_vec_of_int_t_array (Seq.slice arr ...)` into a `bit_vec_sub ...` ++let int_t_seq_slice_to_bv_sub_lemma #t #n ++ (arr: t_Array (int_t t) n) ++ (start: nat) (len: usize {start + v len <= v n}) ++ (d: num_bits t) ++ : Lemma ( bit_vec_of_int_t_array (Seq.slice arr start (start + v len) <: t_Array _ len) d ++ `bit_vec_equal` bit_vec_sub (bit_vec_of_int_t_array arr d) (start * d) (v len * d)) ++ [SMTPat (bit_vec_sub (bit_vec_of_int_t_array arr d) (start * d) (v len * d))] ++ = let bv1 = bit_vec_of_int_t_array #_ #len (Seq.slice arr start (start + v len)) d in ++ let bv2 = bit_vec_sub (bit_vec_of_int_t_array arr d) (start * d) (v len * d) in ++ introduce forall i. bv1 i == bv2 i ++ with ( Seq.lemma_index_slice arr start (start + v len) (i / d); ++ Math.Lemmas.lemma_div_plus i start d; ++ Math.Lemmas.lemma_mod_plus i start d); ++ bit_vec_equal_intro bv1 bv2 ++ ++#push-options "--split_queries always" ++let int_t_eq_seq_slice_bv_sub_lemma #t #n1 #n2 ++ (arr1: t_Array (int_t t) n1) (arr2: t_Array (int_t t) n2) (d: num_bits t) ++ (start1 start2: nat) (len: nat {start1 + len <= v n1 /\ start2 + len <= v n2}) ++ : Lemma (requires Seq.slice arr1 start1 (start1 + len) == Seq.slice arr2 start2 (start2 + len)) ++ (ensures bit_vec_equal ++ (bit_vec_sub (bit_vec_of_int_t_array arr1 d) (start1 * d) (len * d)) ++ (bit_vec_sub (bit_vec_of_int_t_array arr2 d) (start2 * d) (len * d))) ++ [SMTPat ((bit_vec_sub (bit_vec_of_int_t_array arr1 d) (start1 * d) (len * d)) == ++ (bit_vec_sub (bit_vec_of_int_t_array arr2 d) (start2 * d) (len * d)))] ++ = let len = sz len in ++ int_t_seq_slice_to_bv_sub_lemma arr1 start1 len d; ++ int_t_seq_slice_to_bv_sub_lemma arr2 start2 len d; ++ // bit_vec_equal_elim_principle (); ++ bit_vec_equal_intro_principle () ++#pop-options ++ ++let bit_vec_equal_extend #n1 #n2 ++ (bv1: bit_vec n1) (bv2: bit_vec n2) (start1 start2: nat) ++ (len1: nat) ++ (len2: nat { start1 + len1 + len2 <= n1 /\ start2 + len1 + len2 <= n2}) ++ : Lemma ++ (requires ++ bit_vec_sub bv1 start1 len1 == bit_vec_sub bv2 start2 len1 ++ /\ bit_vec_sub bv1 (start1 + len1) len2 == bit_vec_sub bv2 (start2 + len1) len2) ++ (ensures bit_vec_sub bv1 start1 (len1+len2) == bit_vec_sub bv2 start2 (len1+len2)) ++ // [SMTPat (bit_vec_sub bv1 start1 len1 == bit_vec_sub bv2 start2 len1); ++ // SMTPat () ++ // ] ++ // SMTPat (bit_vec_sub bv1 (start1 + len1) len2 == bit_vec_sub bv2 (start2 + len1) len2)] ++ = let left1 = bit_vec_sub bv1 start1 len1 in ++ let left2 = bit_vec_sub bv2 start2 len1 in ++ let right1 = bit_vec_sub bv1 (start1 + len1) len2 in ++ let right2 = bit_vec_sub bv2 (start2 + len1) len2 in ++ // () ++ // bit_vec_equal_elim left1 left2 ; ++ // bit_vec_equal_elim right1 right2; ++ let entire1 = bit_vec_sub bv1 start1 (len1 + len2) in ++ let entire2 = bit_vec_sub bv2 start2 (len1 + len2) in ++ assert (forall (i:nat). i < len1 ==> left1 i == left2 i); ++ assert (forall (i:nat). i < len2 ==> right1 i == right2 i); ++ introduce forall (i:nat). i < len1 + len2 ==> entire1 i == entire2 i ++ with introduce i < len1 + len2 ==> entire1 i == entire2 i ++ with _. if i < len1 then assert (left1 i == left2 i) ++ else assert (entire1 i == right1 (i - len1)); ++ bit_vec_equal_intro entire1 entire2 ++#pop-options ++ ++// let bit_vec_equal_trans (#n: nat) (bv1 bv2 bv3: bit_vec n) ++// : Lemma (requires bv1 `bit_vec_equal` bv2 /\ bv2 `bit_vec_equal` bv3) ++// (ensures bv1 `bit_vec_equal` bv3) ++// = bit_vec_equal_elim_principle (); ++// bit_vec_equal_intro_principle () ++ ++(* ++let int_arr_bitwise_eq_range ++ #t1 #t2 #n1 #n2 ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) ++ (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) ++ (d1: num_bits t1) ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t2 -> Type0) ++ (arr2: t_Array (x: int_t t2 {refinement2 x}) n2) ++ (d2: num_bits t2) ++ (offset1 offset2: nat) ++ (bits: nat { ++ offset1 + bits <= v n1 * d1 ++ /\ offset2 + bits <= v n2 * d2 ++ }) ++ = bit_vec_equal #bits (fun i -> bit_vec_of_int_t_array arr1 d1 (i + offset1)) ++ = forall (k: nat). k < bits ==> ++ bit_vec_of_int_t_array arr1 d1 (offset1 + k) ++ == bit_vec_of_int_t_array arr2 d2 (offset2 + k) ++ ++let int_arr_bitwise_eq_range_comm ++ #t1 #t2 #n1 #n2 ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) ++ (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) ++ (d1: num_bits t1) ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t2 -> Type0) ++ (arr2: t_Array (x: int_t t2 {refinement2 x}) n2) ++ (d2: num_bits t2) ++ (offset1 offset2: nat) ++ (bits: nat { ++ offset1 + bits <= v n1 * d1 ++ /\ offset2 + bits <= v n2 * d2 ++ }) ++ : Lemma (requires int_arr_bitwise_eq_range arr1 d1 arr2 d2 offset1 offset2 bits) ++ (ensures int_arr_bitwise_eq_range arr2 d2 arr1 d1 offset2 offset1 bits) ++ = () ++ ++// kill that function in favor of range ++let int_arr_bitwise_eq_up_to ++ #t1 #t2 #n1 #n2 ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) ++ (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) ++ (d1: num_bits t1) ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) ++ (arr2: t_Array (x: int_t t2 {refinement x}) n2) ++ (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) ++ (max: nat {max <= v n1 * d1}) ++ ++ = forall i. i < max ++ ==> bit_vec_of_int_t_array arr1 d1 i == bit_vec_of_int_t_array arr2 d2 i ++ ++let int_arr_bitwise_eq_ ++ #t1 #t2 #n1 #n2 ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) ++ (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) ++ (d1: num_bits t1) ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) ++ (arr2: t_Array (x: int_t t2 {refinement x}) n2) ++ (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) ++ = int_arr_bitwise_eq_up_to arr1 d1 arr2 d2 (v n1 * d1) ++ ++// move to fsti ++let bit_vec_equal #n (bv1 bv2: bit_vec n) ++ = forall i. i < n ==> bv1 i == bv2 i ++ ++let int_arr_bitwise_eq ++ #t1 #t2 #n1 #n2 ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) ++ (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) ++ (d1: num_bits t1) ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) ++ (arr2: t_Array (x: int_t t2 {refinement x}) n2) ++ (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) ++ = forall i. i < v n1 * d1 ++ ==> bit_vec_of_int_t_array arr1 d1 i == bit_vec_of_int_t_array arr2 d2 i ++ ++let int_arr_bitwise_eq_range_transitivity ++ #t1 #t2 #t3 #n1 #n2 #n3 ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) ++ (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) ++ (d1: num_bits t1) ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t2 -> Type0) ++ (arr2: t_Array (x: int_t t2 {refinement2 x}) n2) ++ (d2: num_bits t2) ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement3: int_t t3 -> Type0) ++ (arr3: t_Array (x: int_t t3 {refinement3 x}) n3) ++ (d3: num_bits t3) ++ (offset1 offset2 offset3: nat) ++ (bits: nat { ++ offset1 + bits <= v n1 * d1 ++ /\ offset2 + bits <= v n2 * d2 ++ /\ offset3 + bits <= v n3 * d3 ++ }) ++ : Lemma ++ (requires int_arr_bitwise_eq_range #t1 #t2 #n1 #n2 arr1 d1 arr2 d2 offset1 offset2 bits ++ /\ int_arr_bitwise_eq_range #t2 #t3 #n2 #n3 arr2 d2 arr3 d3 offset2 offset3 bits) ++ (ensures int_arr_bitwise_eq_range #t1 #t3 #n1 #n3 arr1 d1 arr3 d3 offset1 offset3 bits) ++ = () ++ ++ ++let int_arr_bitwise_eq_range_intro ++ #t1 #t2 #n1 #n2 ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) ++ (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) ++ (d1: num_bits t1) ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) ++ (arr2: t_Array (x: int_t t2 {refinement x}) n2) ++ (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) ++ : Lemma ++ (requires int_arr_bitwise_eq arr1 d1 arr2 d2) ++ (ensures int_arr_bitwise_eq_range arr1 d1 arr2 d2 0 0 (v n1 * d1)) ++ = admit () ++ ++let int_arr_bitwise_eq_range_intro_eq_slice ++ #t #n1 #n2 ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t -> Type0) ++ (arr1: t_Array (x: int_t t {refinement x}) n1) ++ (arr2: t_Array (x: int_t t {refinement x}) n2) ++ (d: num_bits t) ++ (offset1 offset2: nat) ++ (n: nat {offset1 + n < v n1 /\ offset2 + n < v n2}) ++ (bits: nat { ++ offset1 + bits <= v n1 * d ++ /\ offset2 + bits <= v n2 * d ++ /\ bits <= n * d ++ }) ++ : Lemma (requires Seq.slice arr1 offset1 (offset1 + n) == Seq.slice arr2 offset2 (offset2 + n)) ++ (ensures int_arr_bitwise_eq_range arr1 d arr2 d offset1 offset2 bits) ++ = admit () ++ ++let int_arr_bitwise_eq_range_intro_eq ++ #t #n1 #n2 ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t -> Type0) ++ (arr1: t_Array (x: int_t t {refinement1 x}) n1) ++ (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t -> Type0) ++ (arr2: t_Array (x: int_t t {refinement2 x}) n2) ++ (d: num_bits t) ++ (n_offset1 n_offset2: nat) ++ (n: nat {n_offset1 + n <= v n1 /\ n_offset2 + n <= v n2}) ++ // (offset1 offset2: nat) ++ (bits: nat { ++ n_offset1 * d + bits <= v n1 * d ++ /\ n_offset2 * d + bits <= v n2 * d ++ /\ bits <= n * d ++ }) ++ : Lemma (requires forall (i: nat). i < n ==> Seq.index arr1 (i + n_offset1) == Seq.index arr2 (i + n_offset2)) ++ (ensures int_arr_bitwise_eq_range arr1 d arr2 d (n_offset1 * d) (n_offset2 * d) bits) ++ = admit () ++*) diff -ruN extraction/Libcrux.Digest.fst extraction-edited/Libcrux.Digest.fst ---- extraction/Libcrux.Digest.fst 2024-02-06 13:56:02.927572316 +0100 +--- extraction/Libcrux.Digest.fst 2024-02-20 10:46:13.825093683 +0100 +++ extraction-edited/Libcrux.Digest.fst 1970-01-01 01:00:00.000000000 +0100 @@ -1,48 +0,0 @@ -module Libcrux.Digest @@ -51,8 +365,8 @@ diff -ruN extraction/Libcrux.Digest.fst extraction-edited/Libcrux.Digest.fst - then shake128x4_256_ v_LEN data0 data1 data2 data3 - else shake128x4_portable v_LEN data0 data1 data2 data3 diff -ruN extraction/Libcrux.Digest.fsti extraction-edited/Libcrux.Digest.fsti ---- extraction/Libcrux.Digest.fsti 2024-02-06 13:56:02.900572481 +0100 -+++ extraction-edited/Libcrux.Digest.fsti 2024-02-06 13:56:02.959572122 +0100 +--- extraction/Libcrux.Digest.fsti 2024-02-20 10:46:13.815093884 +0100 ++++ extraction-edited/Libcrux.Digest.fsti 2024-02-20 10:46:13.890092375 +0100 @@ -3,6 +3,11 @@ open Core open FStar.Mul @@ -79,7 +393,7 @@ diff -ruN extraction/Libcrux.Digest.fsti extraction-edited/Libcrux.Digest.fsti : Prims.Pure (t_Array u8 v_LEN & t_Array u8 v_LEN & t_Array u8 v_LEN & t_Array u8 v_LEN) diff -ruN extraction/Libcrux.Kem.fst extraction-edited/Libcrux.Kem.fst --- extraction/Libcrux.Kem.fst 1970-01-01 01:00:00.000000000 +0100 -+++ extraction-edited/Libcrux.Kem.fst 2024-02-06 13:56:02.975572024 +0100 ++++ extraction-edited/Libcrux.Kem.fst 2024-02-20 10:46:13.879092596 +0100 @@ -0,0 +1,6 @@ +module Libcrux.Kem +#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -88,9 +402,9 @@ diff -ruN extraction/Libcrux.Kem.fst extraction-edited/Libcrux.Kem.fst + + diff -ruN extraction/Libcrux.Kem.Kyber.Arithmetic.fst extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst ---- extraction/Libcrux.Kem.Kyber.Arithmetic.fst 2024-02-06 13:56:02.906572444 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst 2024-02-06 13:56:02.969572061 +0100 -@@ -1,81 +1,356 @@ +--- extraction/Libcrux.Kem.Kyber.Arithmetic.fst 2024-02-20 10:46:13.828093623 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst 2024-02-20 10:46:13.874092697 +0100 +@@ -1,81 +1,364 @@ module Libcrux.Kem.Kyber.Arithmetic -#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" +#set-options "--fuel 0 --ifuel 1 --z3rlimit 100" @@ -133,7 +447,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Arithmetic.fst extraction-edited/Libcrux. +let cast_i32_b #b1 #b2 x = + x <: i32_b b2 + -+#push-options "--ifuel 0 --z3rlimit 150" ++#push-options "--ifuel 0 --z3rlimit 250" +let shr_i32_b #b #t x y = + let r = (x <: i32) >>! y in + assert (v r == v x / pow2 (v y)); @@ -173,8 +487,16 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Arithmetic.fst extraction-edited/Libcrux. + r <: i32_b (nat_div_ceil b (pow2 (v y)))) +#pop-options + -+let v_BARRETT_R: i64 = 1L < derefine_vector_b #v_K #b x.[i]) in + r -+ + +-let add_to_ring_element (v_K: usize) (lhs rhs: t_PolynomialRingElement) = +let cast_poly_b #b1 #b2 x = + let r = createi (sz 256) (fun i -> (x.f_coefficients.[i] <: i32_b b2)) in + let res = {f_coefficients = r} in @@ -383,8 +706,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Arithmetic.fst extraction-edited/Libcrux. + eq_intro dx dr; + assert(Seq.equal dx dr); + res - --let add_to_ring_element (v_K: usize) (lhs rhs: t_PolynomialRingElement) = ++ +let cast_vector_b #v_K #b1 #b2 x = + let r = createi v_K (fun i -> cast_poly_b #b1 #b2 x.[i]) in + let dx = derefine_vector_b x in @@ -487,8 +809,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Arithmetic.fst extraction-edited/Libcrux. + + diff -ruN extraction/Libcrux.Kem.Kyber.Arithmetic.fsti extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti ---- extraction/Libcrux.Kem.Kyber.Arithmetic.fsti 2024-02-06 13:56:02.910572420 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti 2024-02-06 13:56:02.972572043 +0100 +--- extraction/Libcrux.Kem.Kyber.Arithmetic.fsti 2024-02-20 10:46:13.805094086 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti 2024-02-20 10:46:13.856093059 +0100 @@ -3,10 +3,32 @@ open Core open FStar.Mul @@ -522,7 +844,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Arithmetic.fsti extraction-edited/Libcrux let t_FieldElementTimesMontgomeryR = i32 unfold -@@ -16,119 +38,211 @@ +@@ -16,119 +38,222 @@ let v_BARRETT_SHIFT: i64 = 26L @@ -551,6 +873,11 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Arithmetic.fsti extraction-edited/Libcrux -val get_n_least_significant_bits (n: u8) (value: u32) - : Prims.Pure u32 - (requires n =. 4uy || n =. 5uy || n =. 10uy || n =. 11uy || n =. v_MONTGOMERY_SHIFT) ++let wf_fe_to_spec_fe (m: wfFieldElement): Spec.Kyber.field_element = ++ if v m < 0 ++ then v m + v Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS ++ else v m ++ +let to_spec_fe (m:i32) : Spec.Kyber.field_element = + int_to_spec_fe (v m) + @@ -715,6 +1042,12 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Arithmetic.fsti extraction-edited/Libcrux + +let op_String_Access #t #l (a:t_Array t l) (i:usize{v i < v l}) : t = a.[i] + ++let wf_poly_to_spec_poly (re: wfPolynomialRingElement): Spec.Kyber.polynomial = ++ let p = Spec.Kyber.map' (fun x -> wf_fe_to_spec_fe x <: nat) re.f_coefficients in ++ introduce forall i. Seq.index p i < v Spec.Kyber.v_FIELD_MODULUS ++ with assert (Seq.index p i == Seq.index p (v (sz i))); ++ p ++ +let to_spec_poly (m:t_PolynomialRingElement) : (Spec.Kyber.polynomial) = + let p = createi #nat (sz 256) (fun i -> to_spec_fe (m.f_coefficients.[i])) in + assert (forall i. Seq.index p i = to_spec_fe (m.f_coefficients.[sz i])); @@ -828,8 +1161,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Arithmetic.fsti extraction-edited/Libcrux - <: - bool)) diff -ruN extraction/Libcrux.Kem.Kyber.Compress.fst extraction-edited/Libcrux.Kem.Kyber.Compress.fst ---- extraction/Libcrux.Kem.Kyber.Compress.fst 2024-02-06 13:56:02.932572286 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Compress.fst 2024-02-06 13:56:02.960572116 +0100 +--- extraction/Libcrux.Kem.Kyber.Compress.fst 2024-02-20 10:46:13.810093985 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Compress.fst 2024-02-20 10:46:13.847093240 +0100 @@ -1,39 +1,79 @@ module Libcrux.Kem.Kyber.Compress -#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -933,8 +1266,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Compress.fst extraction-edited/Libcrux.Ke + res <: Libcrux.Kem.Kyber.Arithmetic.i32_b 3328 +#pop-options diff -ruN extraction/Libcrux.Kem.Kyber.Compress.fsti extraction-edited/Libcrux.Kem.Kyber.Compress.fsti ---- extraction/Libcrux.Kem.Kyber.Compress.fsti 2024-02-06 13:56:02.895572511 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Compress.fsti 2024-02-06 13:56:02.970572055 +0100 +--- extraction/Libcrux.Kem.Kyber.Compress.fsti 2024-02-20 10:46:13.794094307 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Compress.fsti 2024-02-20 10:46:13.886092456 +0100 @@ -3,8 +3,19 @@ open Core open FStar.Mul @@ -1000,8 +1333,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Compress.fsti extraction-edited/Libcrux.K + (requires fe =. 0l || fe =. 1l) + (fun result -> v result >= 0 /\ v result < 3329) diff -ruN extraction/Libcrux.Kem.Kyber.Constant_time_ops.fst extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fst ---- extraction/Libcrux.Kem.Kyber.Constant_time_ops.fst 2024-02-06 13:56:02.923572341 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fst 2024-02-06 13:56:02.956572140 +0100 +--- extraction/Libcrux.Kem.Kyber.Constant_time_ops.fst 2024-02-20 10:46:13.829093603 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fst 2024-02-20 10:46:13.860092979 +0100 @@ -4,56 +4,163 @@ open FStar.Mul @@ -1187,8 +1520,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Constant_time_ops.fst extraction-edited/L + ) +#pop-options diff -ruN extraction/Libcrux.Kem.Kyber.Constant_time_ops.fsti extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fsti ---- extraction/Libcrux.Kem.Kyber.Constant_time_ops.fsti 2024-02-06 13:56:02.903572462 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fsti 2024-02-06 13:56:02.955572146 +0100 +--- extraction/Libcrux.Kem.Kyber.Constant_time_ops.fsti 2024-02-20 10:46:13.827093643 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fsti 2024-02-20 10:46:13.876092657 +0100 @@ -20,7 +20,8 @@ val compare_ciphertexts_in_constant_time (v_CIPHERTEXT_SIZE: usize) (lhs rhs: t_Slice u8) @@ -1220,8 +1553,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Constant_time_ops.fsti extraction-edited/ + Hax_lib.implies (selector =. 0uy <: bool) (fun _ -> result =. lhs <: bool) && + Hax_lib.implies (selector <>. 0uy <: bool) (fun _ -> result =. rhs <: bool)) diff -ruN extraction/Libcrux.Kem.Kyber.fst extraction-edited/Libcrux.Kem.Kyber.fst ---- extraction/Libcrux.Kem.Kyber.fst 2024-02-06 13:56:02.934572274 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.fst 2024-02-06 13:56:02.940572237 +0100 +--- extraction/Libcrux.Kem.Kyber.fst 2024-02-20 10:46:13.795094287 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.fst 2024-02-20 10:46:13.851093160 +0100 @@ -1,12 +1,29 @@ module Libcrux.Kem.Kyber -#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -1495,8 +1828,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.fst extraction-edited/Libcrux.Kem.Kyber.f (Core.Convert.f_into public_key <: Libcrux.Kem.Kyber.Types.t_MlKemPublicKey v_PUBLIC_KEY_SIZE) + diff -ruN extraction/Libcrux.Kem.Kyber.fsti extraction-edited/Libcrux.Kem.Kyber.fsti ---- extraction/Libcrux.Kem.Kyber.fsti 2024-02-06 13:56:02.902572469 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.fsti 2024-02-06 13:56:02.962572103 +0100 +--- extraction/Libcrux.Kem.Kyber.fsti 2024-02-20 10:46:13.819093804 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.fsti 2024-02-20 10:46:13.888092415 +0100 @@ -10,36 +10,84 @@ Libcrux.Kem.Kyber.Constants.v_CPA_PKE_KEY_GENERATION_SEED_SIZE +! Libcrux.Kem.Kyber.Constants.v_SHARED_SECRET_SIZE @@ -1597,8 +1930,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.fsti extraction-edited/Libcrux.Kem.Kyber. + (ensures (fun kp -> + (kp.f_sk.f_value,kp.f_pk.f_value) == Spec.Kyber.ind_cca_generate_keypair p randomness)) diff -ruN extraction/Libcrux.Kem.Kyber.Hash_functions.fst extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fst ---- extraction/Libcrux.Kem.Kyber.Hash_functions.fst 2024-02-06 13:56:02.931572292 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fst 2024-02-06 13:56:02.965572085 +0100 +--- extraction/Libcrux.Kem.Kyber.Hash_functions.fst 2024-02-20 10:46:13.831093562 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fst 2024-02-20 10:46:13.858093019 +0100 @@ -3,13 +3,23 @@ open Core open FStar.Mul @@ -1651,8 +1984,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Hash_functions.fst extraction-edited/Libc + admit(); // We assume that shake128x4 correctly implements XOFx4 + out diff -ruN extraction/Libcrux.Kem.Kyber.Hash_functions.fsti extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fsti ---- extraction/Libcrux.Kem.Kyber.Hash_functions.fsti 2024-02-06 13:56:02.891572535 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fsti 2024-02-06 13:56:02.966572079 +0100 +--- extraction/Libcrux.Kem.Kyber.Hash_functions.fsti 2024-02-20 10:46:13.791094367 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fsti 2024-02-20 10:46:13.893092315 +0100 @@ -3,12 +3,17 @@ open Core open FStar.Mul @@ -1678,8 +2011,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Hash_functions.fsti extraction-edited/Lib + (ensures (fun res -> + (forall i. i < v v_K ==> Seq.index res i == Spec.Kyber.v_XOF (sz 840) (Seq.index input i)))) diff -ruN extraction/Libcrux.Kem.Kyber.Ind_cpa.fst extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fst ---- extraction/Libcrux.Kem.Kyber.Ind_cpa.fst 2024-02-06 13:56:02.928572310 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fst 2024-02-06 13:56:02.944572213 +0100 +--- extraction/Libcrux.Kem.Kyber.Ind_cpa.fst 2024-02-20 10:46:13.797094247 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fst 2024-02-20 10:46:13.891092355 +0100 @@ -1,5 +1,5 @@ module Libcrux.Kem.Kyber.Ind_cpa -#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -2390,8 +2723,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Ind_cpa.fst extraction-edited/Libcrux.Kem + res + diff -ruN extraction/Libcrux.Kem.Kyber.Ind_cpa.fsti extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fsti ---- extraction/Libcrux.Kem.Kyber.Ind_cpa.fsti 2024-02-06 13:56:02.907572438 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fsti 2024-02-06 13:56:02.982571982 +0100 +--- extraction/Libcrux.Kem.Kyber.Ind_cpa.fsti 2024-02-20 10:46:13.834093502 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fsti 2024-02-20 10:46:13.881092556 +0100 @@ -1,80 +1,151 @@ module Libcrux.Kem.Kyber.Ind_cpa -#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -2593,8 +2926,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Ind_cpa.fsti extraction-edited/Libcrux.Ke + + diff -ruN extraction/Libcrux.Kem.Kyber.Kyber1024.fst extraction-edited/Libcrux.Kem.Kyber.Kyber1024.fst ---- extraction/Libcrux.Kem.Kyber.Kyber1024.fst 2024-02-06 13:56:02.921572353 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Kyber1024.fst 2024-02-06 13:56:02.942572225 +0100 +--- extraction/Libcrux.Kem.Kyber.Kyber1024.fst 2024-02-20 10:46:13.821093764 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Kyber1024.fst 2024-02-20 10:46:13.842093341 +0100 @@ -7,19 +7,19 @@ (secret_key: Libcrux.Kem.Kyber.Types.t_MlKemPrivateKey (sz 3168)) (ciphertext: Libcrux.Kem.Kyber.Types.t_MlKemCiphertext (sz 1568)) @@ -2628,8 +2961,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Kyber1024.fst extraction-edited/Libcrux.K (sz 3168) (sz 1568) diff -ruN extraction/Libcrux.Kem.Kyber.Kyber512.fst extraction-edited/Libcrux.Kem.Kyber.Kyber512.fst ---- extraction/Libcrux.Kem.Kyber.Kyber512.fst 2024-02-06 13:56:02.913572402 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Kyber512.fst 2024-02-06 13:56:02.948572189 +0100 +--- extraction/Libcrux.Kem.Kyber.Kyber512.fst 2024-02-20 10:46:13.789094408 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Kyber512.fst 2024-02-20 10:46:13.863092918 +0100 @@ -7,19 +7,19 @@ (secret_key: Libcrux.Kem.Kyber.Types.t_MlKemPrivateKey (sz 1632)) (ciphertext: Libcrux.Kem.Kyber.Types.t_MlKemCiphertext (sz 768)) @@ -2663,8 +2996,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Kyber512.fst extraction-edited/Libcrux.Ke (sz 1632) (sz 800) diff -ruN extraction/Libcrux.Kem.Kyber.Kyber768.fst extraction-edited/Libcrux.Kem.Kyber.Kyber768.fst ---- extraction/Libcrux.Kem.Kyber.Kyber768.fst 2024-02-06 13:56:02.917572377 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Kyber768.fst 2024-02-06 13:56:02.938572249 +0100 +--- extraction/Libcrux.Kem.Kyber.Kyber768.fst 2024-02-20 10:46:13.792094347 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Kyber768.fst 2024-02-20 10:46:13.861092959 +0100 @@ -7,19 +7,19 @@ (secret_key: Libcrux.Kem.Kyber.Types.t_MlKemPrivateKey (sz 2400)) (ciphertext: Libcrux.Kem.Kyber.Types.t_MlKemCiphertext (sz 1088)) @@ -2698,8 +3031,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Kyber768.fst extraction-edited/Libcrux.Ke (sz 2400) (sz 1184) diff -ruN extraction/Libcrux.Kem.Kyber.Kyber768.fsti extraction-edited/Libcrux.Kem.Kyber.Kyber768.fsti ---- extraction/Libcrux.Kem.Kyber.Kyber768.fsti 2024-02-06 13:56:02.912572408 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Kyber768.fsti 2024-02-06 13:56:02.953572158 +0100 +--- extraction/Libcrux.Kem.Kyber.Kyber768.fsti 2024-02-20 10:46:13.813093925 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Kyber768.fsti 2024-02-20 10:46:13.850093180 +0100 @@ -74,14 +74,15 @@ val decapsulate (secret_key: Libcrux.Kem.Kyber.Types.t_MlKemPrivateKey (sz 2400)) @@ -2725,8 +3058,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Kyber768.fsti extraction-edited/Libcrux.K - (fun _ -> Prims.l_True) + (ensures (fun kp -> (kp.f_sk.f_value,kp.f_pk.f_value) == Spec.Kyber.kyber768_generate_keypair randomness)) diff -ruN extraction/Libcrux.Kem.Kyber.Matrix.fst extraction-edited/Libcrux.Kem.Kyber.Matrix.fst ---- extraction/Libcrux.Kem.Kyber.Matrix.fst 2024-02-06 13:56:02.930572298 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Matrix.fst 2024-02-06 13:56:02.976572018 +0100 +--- extraction/Libcrux.Kem.Kyber.Matrix.fst 2024-02-20 10:46:13.800094186 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Matrix.fst 2024-02-20 10:46:13.897092234 +0100 @@ -3,192 +3,188 @@ open Core open FStar.Mul @@ -3517,8 +3850,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Matrix.fst extraction-edited/Libcrux.Kem. + admit(); //P-F v_A_transpose diff -ruN extraction/Libcrux.Kem.Kyber.Matrix.fsti extraction-edited/Libcrux.Kem.Kyber.Matrix.fsti ---- extraction/Libcrux.Kem.Kyber.Matrix.fsti 2024-02-06 13:56:02.920572359 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Matrix.fsti 2024-02-06 13:56:02.963572097 +0100 +--- extraction/Libcrux.Kem.Kyber.Matrix.fsti 2024-02-20 10:46:13.807094045 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Matrix.fsti 2024-02-20 10:46:13.880092576 +0100 @@ -3,39 +3,71 @@ open Core open FStar.Mul @@ -3621,8 +3954,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Matrix.fsti extraction-edited/Libcrux.Kem + if transpose then Libcrux.Kem.Kyber.Arithmetic.to_spec_matrix_b #p res == matrix_A + else Libcrux.Kem.Kyber.Arithmetic.to_spec_matrix_b #p res == Spec.Kyber.matrix_transpose matrix_A) diff -ruN extraction/Libcrux.Kem.Kyber.Ntt.fst extraction-edited/Libcrux.Kem.Kyber.Ntt.fst ---- extraction/Libcrux.Kem.Kyber.Ntt.fst 2024-02-06 13:56:02.925572328 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Ntt.fst 2024-02-06 13:56:02.941572231 +0100 +--- extraction/Libcrux.Kem.Kyber.Ntt.fst 2024-02-20 10:46:13.809094005 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Ntt.fst 2024-02-20 10:46:13.855093079 +0100 @@ -1,56 +1,130 @@ module Libcrux.Kem.Kyber.Ntt -#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -4553,8 +4886,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Ntt.fst extraction-edited/Libcrux.Kem.Kyb + down_cast_poly_b #(8*3328) #3328 re +#pop-options diff -ruN extraction/Libcrux.Kem.Kyber.Ntt.fsti extraction-edited/Libcrux.Kem.Kyber.Ntt.fsti ---- extraction/Libcrux.Kem.Kyber.Ntt.fsti 2024-02-06 13:56:02.899572487 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Ntt.fsti 2024-02-06 13:56:02.945572207 +0100 +--- extraction/Libcrux.Kem.Kyber.Ntt.fsti 2024-02-20 10:46:13.812093945 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Ntt.fsti 2024-02-20 10:46:13.838093421 +0100 @@ -2,223 +2,80 @@ #set-options "--fuel 0 --ifuel 1 --z3rlimit 15" open Core @@ -4847,8 +5180,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Ntt.fsti extraction-edited/Libcrux.Kem.Ky + (ensures fun _ -> True) + diff -ruN extraction/Libcrux.Kem.Kyber.Sampling.fst extraction-edited/Libcrux.Kem.Kyber.Sampling.fst ---- extraction/Libcrux.Kem.Kyber.Sampling.fst 2024-02-06 13:56:02.909572426 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Sampling.fst 2024-02-06 13:56:02.980571994 +0100 +--- extraction/Libcrux.Kem.Kyber.Sampling.fst 2024-02-20 10:46:13.832093542 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Sampling.fst 2024-02-20 10:46:13.887092436 +0100 @@ -3,27 +3,34 @@ open Core open FStar.Mul @@ -5261,8 +5594,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Sampling.fst extraction-edited/Libcrux.Ke + out +#pop-options diff -ruN extraction/Libcrux.Kem.Kyber.Sampling.fsti extraction-edited/Libcrux.Kem.Kyber.Sampling.fsti ---- extraction/Libcrux.Kem.Kyber.Sampling.fsti 2024-02-06 13:56:02.905572450 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Sampling.fsti 2024-02-06 13:56:02.983571976 +0100 +--- extraction/Libcrux.Kem.Kyber.Sampling.fsti 2024-02-20 10:46:13.803094126 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Sampling.fsti 2024-02-20 10:46:13.895092274 +0100 @@ -3,77 +3,37 @@ open Core open FStar.Mul @@ -5363,9 +5696,9 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Sampling.fsti extraction-edited/Libcrux.K +// (ensures fun result -> (forall i. v (result.f_coefficients.[i]) >= 0)) + diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.Kem.Kyber.Serialize.fst ---- extraction/Libcrux.Kem.Kyber.Serialize.fst 2024-02-06 13:56:02.914572395 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Serialize.fst 2024-02-06 13:56:02.952572164 +0100 -@@ -1,8 +1,14 @@ +--- extraction/Libcrux.Kem.Kyber.Serialize.fst 2024-02-20 10:46:13.818093824 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Serialize.fst 2024-02-20 10:46:13.845093281 +0100 +@@ -1,8 +1,15 @@ module Libcrux.Kem.Kyber.Serialize -#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" +#set-options "--fuel 0 --ifuel 0 --z3rlimit 50 --retry 3" @@ -5375,15 +5708,18 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K +open Libcrux.Kem.Kyber.Arithmetic + +open MkSeq ++open BitVecEq + -+#push-options "--z3rlimit 80" ++#push-options "--z3rlimit 480 --split_queries always" +[@@"opaque_to_smt"] let compress_coefficients_10_ (coefficient1 coefficient2 coefficient3 coefficient4: i32) = let coef1:u8 = cast (coefficient1 &. 255l <: i32) <: u8 in let coef2:u8 = -@@ -19,11 +25,12 @@ +@@ -18,12 +25,14 @@ + (cast ((coefficient3 >>! 4l <: i32) &. 63l <: i32) <: u8) in let coef5:u8 = cast ((coefficient4 >>! 2l <: i32) &. 255l <: i32) <: u8 in ++ bit_vec_equal_intro_principle (); coef1, coef2, coef3, coef4, coef5 <: (u8 & u8 & u8 & u8 & u8) +#pop-options @@ -5397,7 +5733,11 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let coef1:u8 = cast (coefficient1 <: i32) <: u8 in let coef2:u8 = ((cast (coefficient2 &. 31l <: i32) <: u8) <>! 6l <: i32) <: u8) + in + let coef11:u8 = cast (coefficient8 >>! 3l <: i32) <: u8 in ++ bit_vec_equal_intro_principle (); coef1, coef2, coef3, coef4, coef5, coef6, coef7, coef8, coef9, coef10, coef11 <: (u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8) @@ -5416,10 +5756,11 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K in let coef3:u8 = cast ((coefficient2 >>! 4l <: u16) &. 255us <: u16) <: u8 in - coef1, coef2, coef3 <: (u8 & u8 & u8) ++ bit_vec_equal_intro_principle (); + coef1, coef2, coef3 <: (u8 & u8 & u8) +#pop-options -+#push-options "--z3rlimit 60 --split_queries always" ++#push-options "--z3rlimit 160 --split_queries always" +[@@"opaque_to_smt"] let compress_coefficients_5_ - (coefficient2 coefficient1 coefficient4 coefficient3 coefficient5 coefficient7 coefficient6 coefficient8: @@ -5430,9 +5771,11 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let coef1:u8 = ((coefficient2 &. 7uy <: u8) <>! 4l <: u8) in let coef5:u8 = (coefficient8 <>! 2l <: u8) in ++ bit_vec_equal_intro_principle (); coef1, coef2, coef3, coef4, coef5 <: (u8 & u8 & u8 & u8 & u8) +#pop-options @@ -5449,6 +5792,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K + lemma_get_bit_bounded' coefficient2 10; + lemma_get_bit_bounded' coefficient3 10; + lemma_get_bit_bounded' coefficient4 10; ++ bit_vec_equal_intro_principle (); + coefficient1, coefficient2, coefficient3, coefficient4 +#pop-options @@ -5461,10 +5805,11 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let coefficient1:i32 = ((byte2 &. 7l <: i32) <>! 3l <: i32) in let coefficient3:i32 = -@@ -109,6 +131,14 @@ +@@ -109,6 +137,15 @@ in let coefficient7:i32 = ((byte10 &. 31l <: i32) <>! 2l <: i32) in let coefficient8:i32 = (byte11 <>! 5l <: i32) in ++ bit_vec_equal_intro_principle (); + lemma_get_bit_bounded' coefficient1 11; + lemma_get_bit_bounded' coefficient2 11; + lemma_get_bit_bounded' coefficient3 11; @@ -5476,7 +5821,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K coefficient1, coefficient2, coefficient3, -@@ -117,15 +147,21 @@ +@@ -117,15 +154,22 @@ coefficient6, coefficient7, coefficient8 @@ -5495,6 +5840,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K -let decompress_coefficients_5_ (byte1 byte2 byte3 byte4 byte5: i32) = + lemma_get_bit_bounded' coefficient1 4; + lemma_get_bit_bounded' coefficient2 4; ++ bit_vec_equal_intro_principle (); + coefficient1, coefficient2 +#pop-options + @@ -5504,10 +5850,11 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let coefficient1:i32 = byte1 &. 31l in let coefficient2:i32 = ((byte2 &. 3l <: i32) <>! 5l <: i32) in let coefficient3:i32 = (byte2 >>! 2l <: i32) &. 31l in -@@ -134,6 +170,14 @@ +@@ -134,6 +178,15 @@ let coefficient6:i32 = (byte4 >>! 1l <: i32) &. 31l in let coefficient7:i32 = ((byte5 &. 7l <: i32) <>! 6l <: i32) in let coefficient8:i32 = byte5 >>! 3l in ++ bit_vec_equal_intro_principle (); + lemma_get_bit_bounded' coefficient1 5; + lemma_get_bit_bounded' coefficient2 5; + lemma_get_bit_bounded' coefficient3 5; @@ -5519,14 +5866,14 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K coefficient1, coefficient2, coefficient3, -@@ -142,31 +186,54 @@ +@@ -142,31 +195,54 @@ coefficient6, coefficient7, coefficient8 - <: - (i32 & i32 & i32 & i32 & i32 & i32 & i32 & i32) +#pop-options -+ + +let cast_bound_lemma + #t #u + (n: int_t t) @@ -5551,7 +5898,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K + = Math.Lemmas.pow2_plus 8 8; + Math.Lemmas.pow2_le_compat 32 16 +#pop-options - ++ +#restart-solver + +#push-options "--fuel 0 --ifuel 1 --query_stats --z3rlimit 100" @@ -5593,7 +5940,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let coefficient1:i32 = Libcrux.Kem.Kyber.Compress.compress_ciphertext_coefficient 10uy (Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 0 ] <: i32 -@@ -226,79 +293,96 @@ +@@ -226,79 +302,96 @@ serialized) in serialized @@ -5714,7 +6061,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K Libcrux.Kem.Kyber.Compress.compress_ciphertext_coefficient 11uy (Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 7 ] <: i32 ) -@@ -324,6 +408,8 @@ +@@ -324,6 +417,8 @@ coefficient7 coefficient8 in @@ -5723,7 +6070,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let serialized:t_Array u8 v_OUT_LEN = Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized (sz 11 *! i <: usize) -@@ -382,29 +468,20 @@ +@@ -382,29 +477,20 @@ serialized) in serialized @@ -5761,7 +6108,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let coefficient1:u8 = cast (Libcrux.Kem.Kyber.Compress.compress_ciphertext_coefficient 4uy (Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 0 ] -@@ -439,27 +516,20 @@ +@@ -439,27 +525,20 @@ serialized let compress_then_serialize_5_ @@ -5798,7 +6145,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let coefficient1:u8 = cast (Libcrux.Kem.Kyber.Compress.compress_ciphertext_coefficient 5uy (Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 0 ] -@@ -544,6 +614,14 @@ +@@ -544,6 +623,14 @@ <: u8 in @@ -5813,7 +6160,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let coefficient8:u8 = cast (Libcrux.Kem.Kyber.Compress.compress_ciphertext_coefficient 5uy (Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 7 ] -@@ -566,6 +644,8 @@ +@@ -566,6 +653,8 @@ coefficient6 coefficient8 in @@ -5822,7 +6169,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let serialized:t_Array u8 v_OUT_LEN = Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized (sz 5 *! i <: usize) -@@ -595,35 +675,24 @@ +@@ -595,35 +684,24 @@ in serialized @@ -5868,7 +6215,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let coefficient:u16 = Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative coefficient in -@@ -636,27 +705,35 @@ +@@ -636,27 +714,35 @@ <: t_Array u8 (sz 32)) in @@ -5913,7 +6260,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K match cast (v_COMPRESSION_FACTOR <: usize) <: u32 with | 4ul -> compress_then_serialize_4_ v_OUT_LEN re | 5ul -> compress_then_serialize_5_ v_OUT_LEN re -@@ -665,32 +742,49 @@ +@@ -665,32 +751,49 @@ <: Rust_primitives.Hax.t_Never) @@ -5982,7 +6329,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -698,14 +792,12 @@ +@@ -698,14 +801,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients (sz 4 *! i <: usize) @@ -6000,7 +6347,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -713,14 +805,12 @@ +@@ -713,14 +814,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 4 *! i <: usize) +! sz 1 <: usize) @@ -6018,7 +6365,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -728,14 +818,12 @@ +@@ -728,14 +827,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 4 *! i <: usize) +! sz 2 <: usize) @@ -6036,7 +6383,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -743,44 +831,43 @@ +@@ -743,44 +840,43 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 4 *! i <: usize) +! sz 3 <: usize) @@ -6107,7 +6454,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let coefficient1, coefficient2, -@@ -789,11 +876,21 @@ +@@ -789,11 +885,21 @@ coefficient5, coefficient6, coefficient7, @@ -6131,7 +6478,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -801,14 +898,12 @@ +@@ -801,14 +907,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients (sz 8 *! i <: usize) @@ -6149,7 +6496,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -816,14 +911,12 @@ +@@ -816,14 +920,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 1 <: usize) @@ -6167,7 +6514,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -831,14 +924,12 @@ +@@ -831,14 +933,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 2 <: usize) @@ -6185,7 +6532,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -846,14 +937,12 @@ +@@ -846,14 +946,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 3 <: usize) @@ -6203,7 +6550,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -861,14 +950,12 @@ +@@ -861,14 +959,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 4 <: usize) @@ -6221,7 +6568,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -876,14 +963,12 @@ +@@ -876,14 +972,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 5 <: usize) @@ -6239,7 +6586,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -891,14 +976,12 @@ +@@ -891,14 +985,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 6 <: usize) @@ -6257,7 +6604,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -906,35 +989,33 @@ +@@ -906,35 +998,33 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 7 <: usize) @@ -6308,7 +6655,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -947,9 +1028,9 @@ +@@ -947,9 +1037,9 @@ i32) } <: @@ -6320,7 +6667,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -962,33 +1043,32 @@ +@@ -962,33 +1052,32 @@ i32) } <: @@ -6371,7 +6718,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let coefficient1, coefficient2, -@@ -997,10 +1077,25 @@ +@@ -997,10 +1086,25 @@ coefficient5, coefficient6, coefficient7, @@ -6399,7 +6746,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1008,14 +1103,12 @@ +@@ -1008,14 +1112,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients (sz 8 *! i <: usize) @@ -6417,7 +6764,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1023,14 +1116,12 @@ +@@ -1023,14 +1125,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 1 <: usize) @@ -6435,7 +6782,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1038,14 +1129,12 @@ +@@ -1038,14 +1138,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 2 <: usize) @@ -6453,7 +6800,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1053,14 +1142,12 @@ +@@ -1053,14 +1151,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 3 <: usize) @@ -6471,7 +6818,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1068,14 +1155,12 @@ +@@ -1068,14 +1164,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 4 <: usize) @@ -6489,7 +6836,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1083,14 +1168,12 @@ +@@ -1083,14 +1177,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 5 <: usize) @@ -6507,7 +6854,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1098,14 +1181,12 @@ +@@ -1098,14 +1190,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 6 <: usize) @@ -6525,7 +6872,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1113,33 +1194,27 @@ +@@ -1113,33 +1203,27 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 7 <: usize) @@ -6569,7 +6916,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K let i, byte:(usize & u8) = temp_1_ in Core.Iter.Traits.Iterator.f_fold (Core.Iter.Traits.Collect.f_into_iter ({ Core.Ops.Range.f_start = sz 0; -@@ -1151,10 +1226,11 @@ +@@ -1151,10 +1235,11 @@ Core.Ops.Range.t_Range usize) re (fun re j -> @@ -6583,7 +6930,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1168,19 +1244,20 @@ +@@ -1168,19 +1253,20 @@ i32) } <: @@ -6610,7 +6957,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K match cast (v_COMPRESSION_FACTOR <: usize) <: u32 with | 10ul -> deserialize_then_decompress_10_ serialized | 11ul -> deserialize_then_decompress_11_ serialized -@@ -1190,11 +1267,11 @@ +@@ -1190,11 +1276,11 @@ <: Rust_primitives.Hax.t_Never) @@ -6626,7 +6973,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K match cast (v_COMPRESSION_FACTOR <: usize) <: u32 with | 4ul -> deserialize_then_decompress_4_ serialized | 5ul -> deserialize_then_decompress_5_ serialized -@@ -1203,27 +1280,32 @@ +@@ -1203,27 +1289,32 @@ <: Rust_primitives.Hax.t_Never) @@ -6675,7 +7022,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1231,12 +1313,12 @@ +@@ -1231,12 +1322,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients (sz 2 *! i <: usize) @@ -6691,7 +7038,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1244,34 +1326,28 @@ +@@ -1244,58 +1335,89 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 2 *! i <: usize) +! sz 1 <: usize) @@ -6708,10 +7055,8 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K +#pop-options -let serialize_uncompressed_ring_element (re: Libcrux.Kem.Kyber.Arithmetic.t_PolynomialRingElement) = -+#push-options "--z3rlimit 100" -+let serialize_uncompressed_ring_element (re: Libcrux.Kem.Kyber.Arithmetic.wfPolynomialRingElement) = - let serialized:t_Array u8 (sz 384) = Rust_primitives.Hax.repeat 0uy (sz 384) in - let serialized:t_Array u8 (sz 384) = +- let serialized:t_Array u8 (sz 384) = Rust_primitives.Hax.repeat 0uy (sz 384) in +- let serialized:t_Array u8 (sz 384) = - Core.Iter.Traits.Iterator.f_fold (Core.Iter.Traits.Collect.f_into_iter (Core.Iter.Traits.Iterator.f_enumerate - (Core.Slice.impl__chunks_exact (Rust_primitives.unsize re - .Libcrux.Kem.Kyber.Arithmetic.f_coefficients @@ -6724,56 +7069,126 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fst extraction-edited/Libcrux.K - Core.Iter.Adapters.Enumerate.t_Enumerate (Core.Slice.Iter.t_ChunksExact i32)) - <: - Core.Iter.Adapters.Enumerate.t_Enumerate (Core.Slice.Iter.t_ChunksExact i32)) -+ Rust_primitives.Iterators.foldi_chunks_exact #_ #_ #(fun _ _ -> True) -+ (Rust_primitives.unsize re.Libcrux.Kem.Kyber.Arithmetic.f_coefficients) ++module A = Libcrux.Kem.Kyber.Arithmetic ++ ++[@@"opaque_to_smt"] ++let update3 #n (s: t_Array 't n) (offset: usize {v offset + 3 <= v n}) (i0 i1 i2: 't) ++ : s': t_Array 't n { Seq.index s' (v offset + 0) == i0 ++ /\ Seq.index s' (v offset + 1) == i1 ++ /\ Seq.index s' (v offset + 2) == i2 ++ /\ (forall i. (i < v offset \/ i >= v offset + 3) ==> Seq.index s' i == Seq.index s i) } ++ = let open Rust_primitives.Hax.Monomorphized_update_at in ++ let s = update_at_usize s offset i0 in ++ let s = update_at_usize s (offset +! sz 1) i1 in ++ update_at_usize s (offset +! sz 2) i2 ++ ++let slice_map_lemma #t #u #n (f: t -> u) (arr: t_Array t n) ++ (start: nat) (len: nat {start + len <= v n}) ++ : Lemma ( Seq.slice (Spec.Kyber.map' f arr) start (start + len) ++ == Spec.Kyber.map' f (Seq.slice arr start (start + len)) ++ ) ++ = let f_arr = Spec.Kyber.map' f arr in ++ let lhs = Seq.slice f_arr start (start + len) in ++ let rhs = Spec.Kyber.map' f (Seq.slice arr start (start + len)) in ++ introduce forall i. Seq.index lhs i == Seq.index rhs i ++ with ( ++ Seq.lemma_index_slice f_arr start (start + len) i; ++ Seq.lemma_index_slice arr start (start + len) i; ++ let sz_i_start, sz_i = sz (i + start), sz i in ++ assert (Seq.index f_arr (v sz_i_start) == f (Seq.index arr (v (sz_i_start)))); ++ assert (Seq.index rhs (v sz_i) == f (Seq.index (Seq.slice arr start (start + len)) (v sz_i))) ++ ); ++ assert (Seq.equal lhs rhs) ++ ++#push-options "--z3rlimit 2800 --fuel 0 --ifuel 0 --retry 0 --split_queries no" ++let serialize_uncompressed_ring_element re = ++ let serialized: t_Array u8 (sz 384) = Rust_primitives.Hax.repeat 0uy (sz 384) in ++ let max = v (sz 384) * 8 in ++ assert (max == 256 * 12 /\ max == 384 * 8 /\ 128 * 2 * 12 == max); ++ assert (128 == v (length re.f_coefficients /! (sz 2))); ++ let serialized = ++ Rust_primitives.Iterators.foldi_chunks_exact #_ #_ ++ #(fun serialized i -> ++ let i = v i in ++ i <= 128 /\ ( ++ let limit = i * 2 * 12 in ++ let coefficients: t_Array _ (sz 256) = Spec.Kyber.map' to_unsigned_representative re.f_coefficients in ++ bit_vec_sub (bit_vec_of_int_t_array serialized 8 ) 0 limit ++ == bit_vec_sub (bit_vec_of_int_t_array coefficients 12) 0 limit) ++ ) ++ (re.A.f_coefficients <: t_Array _ (sz 256)) + (sz 2) serialized - (fun serialized temp_1_ -> - let serialized:t_Array u8 (sz 384) = serialized in +- (fun serialized temp_1_ -> +- let serialized:t_Array u8 (sz 384) = serialized in - let i, coefficients:(usize & t_Slice i32) = temp_1_ in -+ let i, coefficients:(usize & t_Array (Libcrux.Kem.Kyber.Arithmetic.i32_b (v Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS - 1)) (sz 2)) = temp_1_ in -+ assert (v i < 128); - let coefficient1:u16 = - Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 0 ] <: i32) - in -@@ -1281,6 +1357,8 @@ - let coef1, coef2, coef3:(u8 & u8 & u8) = - compress_coefficients_3_ coefficient1 coefficient2 - in -+ assert_spinoff (3 * v i + 3 <= 384); -+ assert_spinoff (range (v (sz 3) * v i) usize_inttype); - let serialized:t_Array u8 (sz 384) = - Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized - (sz 3 *! i <: usize) -@@ -1299,3 +1377,4 @@ - serialized) +- let coefficient1:u16 = +- Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 0 ] <: i32) +- in +- let coefficient2:u16 = +- Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 1 ] <: i32) +- in +- let coef1, coef2, coef3:(u8 & u8 & u8) = +- compress_coefficients_3_ coefficient1 coefficient2 +- in +- let serialized:t_Array u8 (sz 384) = +- Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized +- (sz 3 *! i <: usize) +- coef1 +- in +- let serialized:t_Array u8 (sz 384) = +- Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized +- ((sz 3 *! i <: usize) +! sz 1 <: usize) +- coef2 +- in +- let serialized:t_Array u8 (sz 384) = +- Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized +- ((sz 3 *! i <: usize) +! sz 2 <: usize) +- coef3 +- in +- serialized) ++ (fun serialized it -> let i, coefficients = it in ++ ++ let coefficient1 = A.to_unsigned_representative (coefficients.[ sz 0 ] <: i32) in ++ let coefficient2 = A.to_unsigned_representative (coefficients.[ sz 1 ] <: i32) in ++ let (coef1, coef2, coef3) = compress_coefficients_3_ coefficient1 coefficient2 in ++ let j = sz 3 *! i in ++ let serialized' = update3 serialized j coef1 coef2 coef3 in ++ assert ( Seq.slice serialized' (v j) (v j + 3) ++ `Seq.equal` Seq.slice (create3 (coef1, coef2, coef3)) 0 3); ++ bit_vec_equal_intro ++ (let coefficients: t_Array _ (sz 2) = Spec.Kyber.map' to_unsigned_representative coefficients in ++ bit_vec_of_int_t_array coefficients 12) ++ (retype (bit_vec_sub (bit_vec_of_int_t_array serialized' 8) (3 * v i * 8) (3 * 8))); ++ let full_coefficients: t_Array u16 (sz 256) = Spec.Kyber.map' to_unsigned_representative re.f_coefficients in ++ slice_map_lemma #_ #u16 to_unsigned_representative re.f_coefficients (v i * 2) 2; ++ bit_vec_equal_intro ++ (bit_vec_sub (bit_vec_of_int_t_array serialized' 8) 0 (v i * 2 * 12)) ++ (bit_vec_sub (bit_vec_of_int_t_array serialized 8 ) 0 (v i * 2 * 12)); ++ bit_vec_equal_extend (bit_vec_of_int_t_array serialized' 8) ++ (bit_vec_of_int_t_array full_coefficients 12) ++ 0 0 (v i * 2 * 12) (3 * 8); ++ serialized' <: t_Array u8 (sz 384)) in serialized +#pop-options ++ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fsti extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti ---- extraction/Libcrux.Kem.Kyber.Serialize.fsti 2024-02-06 13:56:02.916572383 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti 2024-02-06 13:56:02.958572128 +0100 -@@ -2,118 +2,193 @@ +--- extraction/Libcrux.Kem.Kyber.Serialize.fsti 2024-02-20 10:46:13.798094227 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti 2024-02-20 10:46:13.883092516 +0100 +@@ -2,118 +2,188 @@ #set-options "--fuel 0 --ifuel 1 --z3rlimit 15" open Core open FStar.Mul +open MkSeq -+ -+let int_arr_bitwise_eq -+ #t1 #t2 #n1 #n2 -+ (arr1: t_Array (int_t t1) n1) -+ (d1: num_bits t1) -+ (arr2: t_Array (x: int_t t2) n2) -+ (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) -+ = forall i. i < v n1 * d1 -+ ==> bit_vec_of_int_t_array arr1 d1 i == bit_vec_of_int_t_array arr2 d2 i ++open BitVecEq val compress_coefficients_10_ (coefficient1 coefficient2 coefficient3 coefficient4: i32) - : Prims.Pure (u8 & u8 & u8 & u8 & u8) Prims.l_True (fun _ -> Prims.l_True) -+ : Prims.Pure (u8 & u8 & u8 & u8 & u8) ++ : Prims.Pure (u8 & u8 & u8 & u8 & u8) + (requires True) + (ensures fun tuple -> -+ int_arr_bitwise_eq ++ int_t_array_bitwise_eq' + (create4 (coefficient1, coefficient2, coefficient3, coefficient4)) 10 + (create5 tuple) 8 + ) @@ -6790,7 +7205,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fsti extraction-edited/Libcrux. - : Prims.Pure (u8 & u8 & u8) Prims.l_True (fun _ -> Prims.l_True) + (requires True) + (ensures fun tuple -> -+ int_arr_bitwise_eq ++ int_t_array_bitwise_eq' + (create8 (coefficient1, coefficient2, coefficient3, coefficient4, coefficient5, coefficient6, coefficient7, coefficient8)) 11 + (create11 tuple) 8 + ) @@ -6799,7 +7214,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fsti extraction-edited/Libcrux. + : Prims.Pure (u8 & u8 & u8) + (requires True) + (ensures fun tuple -> -+ int_arr_bitwise_eq ++ int_t_array_bitwise_eq' + (create2 (coefficient1, coefficient2)) 12 + (create3 tuple) 8 + ) @@ -6815,7 +7230,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fsti extraction-edited/Libcrux. + : Prims.Pure (u8 & u8 & u8 & u8 & u8) + (requires True) + (ensures fun tuple -> -+ int_arr_bitwise_eq ++ int_t_array_bitwise_eq' + (create8 (coefficient1, coefficient2, coefficient3, coefficient4, coefficient5, coefficient6, coefficient7, coefficient8)) 5 + (create5 tuple) 8 + ) @@ -6825,7 +7240,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fsti extraction-edited/Libcrux. + : Prims.Pure (i32_d 10 & i32_d 10 & i32_d 10 & i32_d 10) + (requires True) + (ensures fun (r1, r2, r3, r4) -> -+ int_arr_bitwise_eq ++ int_t_array_bitwise_eq' + (create5 (byte1, byte2, byte3, byte4, byte5)) 8 + (create4 #i32 (r1, r2, r3, r4)) 10 + ) @@ -6839,9 +7254,9 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fsti extraction-edited/Libcrux. + : Prims.Pure (i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11) + (requires True) + (ensures fun (r1, r2, r3, r4, r5, r6, r7, r8) -> -+ int_arr_bitwise_eq -+ (create11 (byte1, byte2, byte3, byte4, byte5, byte6, byte7, byte8, byte9, byte10, byte11)) 8 -+ (create8 (r1, r2, r3, r4, r5, r6, r7, r8)) 11 ++ int_t_array_bitwise_eq' ++ (create11 #i32 (byte1, byte2, byte3, byte4, byte5, byte6, byte7, byte8, byte9, byte10, byte11)) 8 ++ (create8 #i32 (r1, r2, r3, r4, r5, r6, r7, r8)) 11 + ) val decompress_coefficients_4_ (byte: u8) @@ -6854,18 +7269,18 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fsti extraction-edited/Libcrux. + : Prims.Pure (i32_d 4 & i32_d 4) + (requires True) + (ensures fun (r1, r2) -> -+ int_arr_bitwise_eq ++ int_t_array_bitwise_eq' + (create1 byte) 8 -+ (create2 (r1, r2)) 4 ++ (create2 #i32 (r1, r2)) 4 + ) + +val decompress_coefficients_5_ (byte1 byte2 byte3 byte4 byte5: int_t_d i32_inttype 8) + : Prims.Pure (i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5) + (requires True) + (ensures fun (r1, r2, r3, r4, r5, r6, r7, r8) -> -+ int_arr_bitwise_eq -+ (create5 (byte1, byte2, byte3, byte4, byte5)) 8 -+ (create8 (r1, r2, r3, r4, r5, r6, r7, r8)) 5 ++ int_t_array_bitwise_eq' ++ (create5 #i32 (byte1, byte2, byte3, byte4, byte5)) 8 ++ (create8 #i32 (r1, r2, r3, r4, r5, r6, r7, r8)) 5 + ) val compress_then_serialize_10_ @@ -7013,10 +7428,13 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Serialize.fsti extraction-edited/Libcrux. +val serialize_uncompressed_ring_element (re: Libcrux.Kem.Kyber.Arithmetic.wfPolynomialRingElement) + : Pure (t_Array u8 (sz 384)) + (requires True) -+ (ensures (fun res -> True)) ++ (ensures (fun res -> ++ let coefficients: t_Array _ (sz 256) = Spec.Kyber.map' Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative re.f_coefficients in ++ int_t_array_bitwise_eq res 8 coefficients 12 ++ )) diff -ruN extraction/Libcrux.Kem.Kyber.Types.fst extraction-edited/Libcrux.Kem.Kyber.Types.fst ---- extraction/Libcrux.Kem.Kyber.Types.fst 2024-02-06 13:56:02.924572335 +0100 -+++ extraction-edited/Libcrux.Kem.Kyber.Types.fst 2024-02-06 13:56:02.951572170 +0100 +--- extraction/Libcrux.Kem.Kyber.Types.fst 2024-02-20 10:46:13.801094166 +0100 ++++ extraction-edited/Libcrux.Kem.Kyber.Types.fst 2024-02-20 10:46:13.877092637 +0100 @@ -50,7 +50,9 @@ let impl_6__len (v_SIZE: usize) (self: t_MlKemCiphertext v_SIZE) : usize = v_SIZE @@ -7052,7 +7470,7 @@ diff -ruN extraction/Libcrux.Kem.Kyber.Types.fst extraction-edited/Libcrux.Kem.K type t_MlKemKeyPair (v_PRIVATE_KEY_SIZE: usize) (v_PUBLIC_KEY_SIZE: usize) = { diff -ruN extraction/Libcrux_platform.Platform.fsti extraction-edited/Libcrux_platform.Platform.fsti --- extraction/Libcrux_platform.Platform.fsti 1970-01-01 01:00:00.000000000 +0100 -+++ extraction-edited/Libcrux_platform.Platform.fsti 2024-02-06 13:56:02.949572182 +0100 ++++ extraction-edited/Libcrux_platform.Platform.fsti 2024-02-20 10:46:13.873092717 +0100 @@ -0,0 +1,20 @@ +module Libcrux_platform.Platform +#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -7076,7 +7494,7 @@ diff -ruN extraction/Libcrux_platform.Platform.fsti extraction-edited/Libcrux_pl +val simd128_support: Prims.unit -> Prims.Pure bool Prims.l_True (fun _ -> Prims.l_True) diff -ruN extraction/MkSeq.fst extraction-edited/MkSeq.fst --- extraction/MkSeq.fst 1970-01-01 01:00:00.000000000 +0100 -+++ extraction-edited/MkSeq.fst 2024-02-06 13:56:02.973572036 +0100 ++++ extraction-edited/MkSeq.fst 2024-02-20 10:46:13.841093361 +0100 @@ -0,0 +1,91 @@ +module MkSeq +open Core @@ -7171,8 +7589,8 @@ diff -ruN extraction/MkSeq.fst extraction-edited/MkSeq.fst +%splice[] (init 13 (fun i -> create_gen_tac (i + 1))) diff -ruN extraction/Spec.Kyber.fst extraction-edited/Spec.Kyber.fst --- extraction/Spec.Kyber.fst 1970-01-01 01:00:00.000000000 +0100 -+++ extraction-edited/Spec.Kyber.fst 2024-02-06 13:56:02.967572073 +0100 -@@ -0,0 +1,430 @@ ++++ extraction-edited/Spec.Kyber.fst 2024-02-20 10:46:13.884092496 +0100 +@@ -0,0 +1,433 @@ +module Spec.Kyber +#set-options "--fuel 0 --ifuel 1 --z3rlimit 100" +open Core @@ -7351,12 +7769,15 @@ diff -ruN extraction/Spec.Kyber.fst extraction-edited/Spec.Kyber.fst + (ensures fun f -> (forall i. bit_vec_of_int_t_array r 8 i == f i)) + = bit_vec_of_int_t_array r 8 + ++unfold let retype_bit_vector #a #b (#_:unit{a == b}) (x: a): b = x ++ +let byte_encode (d: dT) (coefficients: polynomial): t_Array u8 (sz (32 * d)) -+ = bits_to_bytes #(sz (32 * d)) (bit_vec_of_nat_array coefficients d) ++ = bits_to_bytes #(sz (32 * d)) ++ (retype_bit_vector (bit_vec_of_nat_array coefficients d)) + +let byte_decode (d: dT) (coefficients: t_Array u8 (sz (32 * d))): polynomial + = let bv = bit_vec_of_int_t_array coefficients 8 in -+ let arr: t_Array nat (sz 256) = bit_vec_to_nat_array d bv in ++ let arr: t_Array nat (sz 256) = bit_vec_to_nat_array d (retype_bit_vector bv) in + let p = map' (fun (x: nat) -> x % v v_FIELD_MODULUS <: nat) arr in + introduce forall i. Seq.index p i < v v_FIELD_MODULUS + with assert (Seq.index p i == Seq.index p (v (sz i))); diff --git a/proofs/fstar/extraction-edited/.hints/BitVecEq.fsti.hints b/proofs/fstar/extraction-edited/.hints/BitVecEq.fsti.hints new file mode 100644 index 00000000..8cf143c6 --- /dev/null +++ b/proofs/fstar/extraction-edited/.hints/BitVecEq.fsti.hints @@ -0,0 +1,911 @@ +[ + "{ٝ,z", + [ + [ + "BitVecEq.bit_vec_equal_intro", + 1, + 0, + 1, + [ "@query" ], + 0, + "59286762d349f5b9996787df0af368ff" + ], + [ + "BitVecEq.bit_vec_equal_intro_principle", + 1, + 0, + 1, + [ + "@MaxIFuel_assumption", "@query", + "refinement_interpretation_Tm_refine_4930c2a3b9ed81b19c4163bc5d944ade", + "refinement_interpretation_Tm_refine_5ea27f29671734c284c74b54ac71be4c" + ], + 0, + "3d0c51c3f21387d10ee3aa036bd8db3f" + ], + [ + "BitVecEq.bit_vec_equal_elim_principle", + 1, + 0, + 1, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.squash", + "lemma_BitVecEq.bit_vec_equal_elim", + "refinement_interpretation_Tm_refine_2de20c066034c13bf76e9c0b94f4806c", + "refinement_interpretation_Tm_refine_f7508cd976fab894dc1e01a7483287a6" + ], + 0, + "fb4df4d22434569a63b52b3218e8f855" + ], + [ + "BitVecEq.bit_vec_equal_trivial", + 1, + 0, + 1, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", "int_typing", + "lemma_BitVecEq.bit_vec_equal_elim", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_c9b1a93dc7180dbdeb887c6ba6a0bb06" + ], + 0, + "a5dee7de8b06e3799cab7df1effbcf3b" + ], + [ + "BitVecEq.bit_vec_sub", + 1, + 0, + 1, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "int_inversion", "primitive_Prims.op_Addition", + "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_6f684e27d6af9965634108bcfe981953", + "refinement_interpretation_Tm_refine_c1424615841f28cac7fc34e92b7ff33c" + ], + 0, + "71775bf4907d2e9a78fd031450e8c8b8" + ], + [ + "BitVecEq.bit_vec_equal_trivial_sub_smtpat", + 1, + 0, + 1, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_c5efe95b1f250c44fbd9d953d94aff03" + ], + 0, + "05922fc60aa639c5fdae7ff386e6afb1" + ], + [ + "BitVecEq.retype", + 1, + 0, + 1, + [ + "@MaxIFuel_assumption", "@query", + "refinement_interpretation_Tm_refine_0dee8cb03258a67c2f7ec66427696212" + ], + 0, + "16f3278bdf9a68771f24f37804da3c34" + ], + [ + "BitVecEq.bit_vec_sub_all_lemma", + 1, + 0, + 1, + [ + "@MaxIFuel_assumption", "@query", + "BitVecEq_interpretation_Tm_arrow_b4ead33e06e21b401ac39ed9ccd66716", + "FStar.FunctionalExtensionality_interpretation_Tm_arrow_a7d5cc170be69663c495e8582d2bc62a", + "Prims_interpretation_Tm_arrow_2eaa01e78f73e9bab5d0955fc1a662da", + "Rust_primitives.BitVectors_interpretation_Tm_arrow_bc2eac05cff1f96671b35103fe52da33", + "equation_BitVecEq.bit_vec_sub", + "equation_FStar.FunctionalExtensionality.feq", "equation_Prims.nat", + "function_token_typing_BitVecEq.bit_vec_sub", "int_inversion", + "interpretation_Tm_abs_eb4b4f6028ac67b168b96720ea22e2fc", + "interpretation_Tm_abs_eb643fbfbab7ef908ba32052bb948a4f", + "lemma_BitVecEq.bit_vec_equal_elim", + "lemma_FStar.FunctionalExtensionality.feq_on_domain", + "primitive_Prims.op_Addition", "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_15f0687264c581284bdf37108526e858", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_c1424615841f28cac7fc34e92b7ff33c", + "refinement_kinding_Tm_refine_c1424615841f28cac7fc34e92b7ff33c", + "typing_Tm_abs_eb4b4f6028ac67b168b96720ea22e2fc", + "typing_Tm_abs_eb643fbfbab7ef908ba32052bb948a4f" + ], + 0, + "5e840c192bca659cc1bf0712abcb1518" + ], + [ + "BitVecEq.int_t_array_bitwise_eq'", + 1, + 0, + 1, + [ + "@MaxIFuel_assumption", "@query", "bool_inversion", + "equality_tok_Lib.IntTypes.PUB@tok", "equation_Lib.IntTypes.int_t", + "equation_Prims.nat", "equation_Rust_primitives.Arrays.t_Array", + "equation_Rust_primitives.BitVectors.num_bits", + "equation_Rust_primitives.Integers.int_t", + "equation_Rust_primitives.Integers.inttype", + "equation_Rust_primitives.Integers.minint", + "equation_Rust_primitives.Integers.range", + "equation_Rust_primitives.Integers.range_t", + "equation_Rust_primitives.Integers.unsigned", + "equation_Rust_primitives.Integers.usize", + "equation_Rust_primitives.Integers.v", "primitive_Prims.op_AmpAmp", + "primitive_Prims.op_LessThanOrEqual", "primitive_Prims.op_Multiply", + "projection_inverse_BoxBool_proj_0", + "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_2b93cc0d2fb3530ccc9d725f3cc7d456", + "refinement_interpretation_Tm_refine_4e3dded9bf4fcf599168cbb137ff3724", + "refinement_interpretation_Tm_refine_53d7089a905511e9e713c7dbc2f68178", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_a6d4eccfb2603ce5e66d6162c32df2b0", + "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", + "typing_FStar.Seq.Base.length", + "typing_Rust_primitives.Integers.int_t", + "typing_Rust_primitives.Integers.unsigned", + "typing_Rust_primitives.Integers.usize_inttype", + "typing_Rust_primitives.Integers.v" + ], + 0, + "0ba66af0f657c91b2cc8a74a30e60f05" + ], + [ + "BitVecEq.int_t_array_bitwise_eq", + 1, + 0, + 1, + [ + "@MaxIFuel_assumption", "@query", + "refinement_interpretation_Tm_refine_4e3dded9bf4fcf599168cbb137ff3724" + ], + 0, + "85a311e3e1961e4f078860f8115a4e4e" + ], + [ + "BitVecEq.int_t_seq_slice_to_bv_sub_lemma", + 1, + 0, + 0, + [ + "@MaxFuel_assumption", "@MaxIFuel_assumption", + "@fuel_correspondence_Prims.pow2.fuel_instrumented", "@query", + "BitVecEq_interpretation_Tm_arrow_b4ead33e06e21b401ac39ed9ccd66716", + "FStar.FunctionalExtensionality_interpretation_Tm_arrow_a7d5cc170be69663c495e8582d2bc62a", + "Prims_interpretation_Tm_arrow_2eaa01e78f73e9bab5d0955fc1a662da", + "Rust_primitives.BitVectors_interpretation_Tm_arrow_a1bbe86a3e470c2690a3539565e2b2c3", + "Rust_primitives.BitVectors_interpretation_Tm_arrow_bc2eac05cff1f96671b35103fe52da33", + "Rust_primitives.BitVectors_interpretation_Tm_arrow_bee60607ac45923beb97c3e371c44d68", + "bool_inversion", "constructor_distinct_Lib.IntTypes.S16", + "constructor_distinct_Lib.IntTypes.S32", + "constructor_distinct_Lib.IntTypes.S8", + "constructor_distinct_Lib.IntTypes.U1", + "constructor_distinct_Lib.IntTypes.U16", + "constructor_distinct_Lib.IntTypes.U32", + "constructor_distinct_Lib.IntTypes.U64", + "constructor_distinct_Lib.IntTypes.U8", + "constructor_distinct_Tm_unit", "equality_tok_Lib.IntTypes.PUB@tok", + "equality_tok_Lib.IntTypes.U32@tok", + "equality_tok_Lib.IntTypes.U64@tok", "equation_BitVecEq.bit_vec_sub", + "equation_FStar.FunctionalExtensionality.feq", + "equation_FStar.UInt.max_int", "equation_FStar.UInt.min_int", + "equation_Lib.IntTypes.bits", "equation_Lib.IntTypes.int_t", + "equation_Lib.IntTypes.maxint", "equation_Lib.IntTypes.minint", + "equation_Lib.IntTypes.unsigned", "equation_Lib.IntTypes.v", + "equation_Prims.nat", "equation_Rust_primitives.Arrays.t_Array", + "equation_Rust_primitives.BitVectors.bit_vec_of_int_t_array", + "equation_Rust_primitives.BitVectors.num_bits", + "equation_Rust_primitives.Integers.bits", + "equation_Rust_primitives.Integers.int_t", + "equation_Rust_primitives.Integers.inttype", + "equation_Rust_primitives.Integers.maxint", + "equation_Rust_primitives.Integers.minint", + "equation_Rust_primitives.Integers.range", + "equation_Rust_primitives.Integers.range_t", + "equation_Rust_primitives.Integers.unsigned", + "equation_Rust_primitives.Integers.usize", + "equation_Rust_primitives.Integers.v", + "function_token_typing_BitVecEq.bit_vec_sub", + "function_token_typing_Rust_primitives.BitVectors.bit_vec_of_int_t_array", + "int_inversion", "int_typing", + "interpretation_Tm_abs_0ce045133c37014f50d62d7dc349251d", + "interpretation_Tm_abs_352966ba8c3fcfe6f9dc92662e02fbff", + "interpretation_Tm_abs_eb4b4f6028ac67b168b96720ea22e2fc", + "interpretation_Tm_abs_eb643fbfbab7ef908ba32052bb948a4f", + "lemma_FStar.FunctionalExtensionality.feq_on_domain", + "lemma_FStar.Seq.Base.lemma_len_slice", + "lemma_Rust_primitives.Integers.pow2_values", + "primitive_Prims.op_Addition", "primitive_Prims.op_AmpAmp", + "primitive_Prims.op_Division", "primitive_Prims.op_LessThanOrEqual", + "primitive_Prims.op_Multiply", "primitive_Prims.op_Subtraction", + "projection_inverse_BoxBool_proj_0", + "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_24f4f435390b85ef53b462142b1f7860", + "refinement_interpretation_Tm_refine_2b93cc0d2fb3530ccc9d725f3cc7d456", + "refinement_interpretation_Tm_refine_411ffd57ad68e57f0f549a869f83f1d6", + "refinement_interpretation_Tm_refine_53d7089a905511e9e713c7dbc2f68178", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_81407705a0828c2c1b1976675443f647", + "refinement_interpretation_Tm_refine_83845a86f2550cdf941eeb1d9b59602b", + "refinement_interpretation_Tm_refine_92d34a673e14e6ea367dc49dbb252256", + "refinement_interpretation_Tm_refine_a20118601b41317c98322924cd2f10c3", + "refinement_interpretation_Tm_refine_a6d4eccfb2603ce5e66d6162c32df2b0", + "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", + "refinement_interpretation_Tm_refine_c1424615841f28cac7fc34e92b7ff33c", + "refinement_interpretation_Tm_refine_f745638d27656256eab52e67ec987e5a", + "refinement_kinding_Tm_refine_c1424615841f28cac7fc34e92b7ff33c", + "refinement_kinding_Tm_refine_f745638d27656256eab52e67ec987e5a", + "typing_FStar.Seq.Base.length", "typing_Lib.IntTypes.v", + "typing_Rust_primitives.Integers.bits", + "typing_Rust_primitives.Integers.int_t", + "typing_Rust_primitives.Integers.unsigned", + "typing_Rust_primitives.Integers.usize_inttype", + "typing_Rust_primitives.Integers.v", + "typing_Tm_abs_0ce045133c37014f50d62d7dc349251d", + "typing_Tm_abs_352966ba8c3fcfe6f9dc92662e02fbff", + "typing_Tm_abs_eb4b4f6028ac67b168b96720ea22e2fc", + "typing_Tm_abs_eb643fbfbab7ef908ba32052bb948a4f", + "typing_tok_Lib.IntTypes.PUB@tok" + ], + 0, + "ef738c7466342befcd8b3034bfffae5c" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 1, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "primitive_Prims.op_Addition", "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2" + ], + 0, + "30858238a464e5c4ad0717a6f6c18cc8" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 2, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "primitive_Prims.op_Addition", "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2" + ], + 0, + "ae4a6a72282782af80c5cdf5eba27264" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 3, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", + "equation_Rust_primitives.Arrays.t_Array", + "equation_Rust_primitives.Integers.int_t", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_53d7089a905511e9e713c7dbc2f68178" + ], + 0, + "47b98f832e2fbb8e465077c8e85f8d45" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 4, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "primitive_Prims.op_Addition", "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2" + ], + 0, + "7f1a73a0b63defe94e6fd819bb8a9322" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 5, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "primitive_Prims.op_Addition", "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2" + ], + 0, + "5906e3ef95f02a54636fa0b5ad4ebe2c" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 6, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", + "equation_Rust_primitives.Arrays.t_Array", + "equation_Rust_primitives.Integers.int_t", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_53d7089a905511e9e713c7dbc2f68178" + ], + 0, + "6420ceb33586fff6632de715ba4c8a62" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 7, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "primitive_Prims.op_Addition", + "refinement_interpretation_Tm_refine_24f4f435390b85ef53b462142b1f7860", + "refinement_interpretation_Tm_refine_53c655668b35152fbbd9a7948c262451", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2" + ], + 0, + "15bc552eec8074539add83fd6fd6860d" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 8, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "primitive_Prims.op_Addition", "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2" + ], + 0, + "eabfb42b4b25d271ac9e25fc5087db07" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 9, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", + "equation_Rust_primitives.Arrays.t_Array", + "equation_Rust_primitives.Integers.int_t", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_53d7089a905511e9e713c7dbc2f68178" + ], + 0, + "a3594ab47cfb3172b83525084cd15aa0" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 10, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "primitive_Prims.op_Addition", + "refinement_interpretation_Tm_refine_24f4f435390b85ef53b462142b1f7860", + "refinement_interpretation_Tm_refine_53c655668b35152fbbd9a7948c262451", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2" + ], + 0, + "3e4a3b84589bbad98942a5ff49b35d85" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 11, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "primitive_Prims.op_Addition", "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2" + ], + 0, + "45cf555c20c371deb335e95c4fa385e4" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 12, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", + "equation_Rust_primitives.Arrays.t_Array", + "equation_Rust_primitives.Integers.int_t", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_53d7089a905511e9e713c7dbc2f68178" + ], + 0, + "a62605948d6dc81aacd2f3b35e8a8086" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 13, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "equation_Rust_primitives.BitVectors.num_bits", + "primitive_Prims.op_Multiply", "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_2b93cc0d2fb3530ccc9d725f3cc7d456", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2" + ], + 0, + "cb51082c08944ddb750bf5986bee2436" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 14, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "bool_inversion", + "equality_tok_Lib.IntTypes.PUB@tok", "equation_Lib.IntTypes.v", + "equation_Prims.nat", "equation_Rust_primitives.BitVectors.num_bits", + "equation_Rust_primitives.Integers.inttype", + "equation_Rust_primitives.Integers.minint", + "equation_Rust_primitives.Integers.range", + "equation_Rust_primitives.Integers.range_t", + "equation_Rust_primitives.Integers.unsigned", + "equation_Rust_primitives.Integers.usize", + "equation_Rust_primitives.Integers.v", "primitive_Prims.op_AmpAmp", + "primitive_Prims.op_LessThanOrEqual", "primitive_Prims.op_Multiply", + "projection_inverse_BoxBool_proj_0", + "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_24f4f435390b85ef53b462142b1f7860", + "refinement_interpretation_Tm_refine_2b93cc0d2fb3530ccc9d725f3cc7d456", + "refinement_interpretation_Tm_refine_53c655668b35152fbbd9a7948c262451", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_a6d4eccfb2603ce5e66d6162c32df2b0", + "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", + "typing_Rust_primitives.Integers.unsigned", + "typing_Rust_primitives.Integers.usize_inttype", + "typing_Rust_primitives.Integers.v" + ], + 0, + "ef0d0901ecceaebdfd9c2dc671838624" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 15, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "equation_Rust_primitives.BitVectors.num_bits", + "primitive_Prims.op_Multiply", "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_2b93cc0d2fb3530ccc9d725f3cc7d456", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2" + ], + 0, + "5dc44008c007807c1865c9864404c3b2" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 16, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_90b5d2df39645a4835173a203da069e4" + ], + 0, + "11484adb2bfd480f49799a588c6c2089" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 17, + 0, + 0, + [ + "@MaxFuel_assumption", "@MaxIFuel_assumption", + "@fuel_correspondence_Prims.pow2.fuel_instrumented", "@query", + "bool_inversion", "constructor_distinct_Lib.IntTypes.S16", + "constructor_distinct_Lib.IntTypes.S32", + "constructor_distinct_Lib.IntTypes.S8", + "constructor_distinct_Lib.IntTypes.U1", + "constructor_distinct_Lib.IntTypes.U16", + "constructor_distinct_Lib.IntTypes.U32", + "constructor_distinct_Lib.IntTypes.U64", + "constructor_distinct_Lib.IntTypes.U8", + "constructor_distinct_Tm_unit", "equality_tok_Lib.IntTypes.PUB@tok", + "equality_tok_Lib.IntTypes.U32@tok", + "equality_tok_Lib.IntTypes.U64@tok", "equation_FStar.UInt.max_int", + "equation_FStar.UInt.min_int", "equation_Lib.IntTypes.bits", + "equation_Lib.IntTypes.maxint", "equation_Lib.IntTypes.minint", + "equation_Lib.IntTypes.unsigned", "equation_Lib.IntTypes.v", + "equation_Prims.nat", "equation_Rust_primitives.BitVectors.num_bits", + "equation_Rust_primitives.Integers.bits", + "equation_Rust_primitives.Integers.inttype", + "equation_Rust_primitives.Integers.maxint", + "equation_Rust_primitives.Integers.minint", + "equation_Rust_primitives.Integers.unsigned", + "equation_Rust_primitives.Integers.v", "int_inversion", + "lemma_Rust_primitives.Integers.pow2_values", + "primitive_Prims.op_Addition", "primitive_Prims.op_Multiply", + "primitive_Prims.op_Subtraction", "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_2b93cc0d2fb3530ccc9d725f3cc7d456", + "refinement_interpretation_Tm_refine_31a363db8a0a0025827fe2225dc592af", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_90b5d2df39645a4835173a203da069e4", + "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", + "typing_Rust_primitives.Integers.bits", + "typing_Rust_primitives.Integers.unsigned", + "typing_Rust_primitives.Integers.usize_inttype" + ], + 0, + "3c9bcb87d09adc01578b5c138f6953f4" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 18, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "bool_inversion", + "equality_tok_Lib.IntTypes.PUB@tok", "equation_Lib.IntTypes.v", + "equation_Prims.nat", "equation_Rust_primitives.BitVectors.num_bits", + "equation_Rust_primitives.Integers.inttype", + "equation_Rust_primitives.Integers.minint", + "equation_Rust_primitives.Integers.range", + "equation_Rust_primitives.Integers.range_t", + "equation_Rust_primitives.Integers.unsigned", + "equation_Rust_primitives.Integers.usize", + "equation_Rust_primitives.Integers.v", "primitive_Prims.op_Addition", + "primitive_Prims.op_AmpAmp", "primitive_Prims.op_LessThanOrEqual", + "primitive_Prims.op_Multiply", "projection_inverse_BoxBool_proj_0", + "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_2b93cc0d2fb3530ccc9d725f3cc7d456", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_90b5d2df39645a4835173a203da069e4", + "refinement_interpretation_Tm_refine_a6d4eccfb2603ce5e66d6162c32df2b0", + "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", + "typing_Rust_primitives.Integers.unsigned", + "typing_Rust_primitives.Integers.usize_inttype", + "typing_Rust_primitives.Integers.v" + ], + 0, + "43e11403c8477940124f71b6c9bd6eac" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 19, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "equation_Rust_primitives.BitVectors.num_bits", + "primitive_Prims.op_Multiply", "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_2b93cc0d2fb3530ccc9d725f3cc7d456", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2" + ], + 0, + "d8dd5ea9e5ad6ee14ab9df1fbff54b2f" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 20, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "equation_Prims.nat", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_90b5d2df39645a4835173a203da069e4" + ], + 0, + "f81fd4ebba605222fa35e0f95ad9968f" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 21, + 0, + 0, + [ + "@MaxFuel_assumption", "@MaxIFuel_assumption", + "@fuel_correspondence_Prims.pow2.fuel_instrumented", "@query", + "bool_inversion", "constructor_distinct_Lib.IntTypes.S16", + "constructor_distinct_Lib.IntTypes.S32", + "constructor_distinct_Lib.IntTypes.S8", + "constructor_distinct_Lib.IntTypes.U1", + "constructor_distinct_Lib.IntTypes.U16", + "constructor_distinct_Lib.IntTypes.U32", + "constructor_distinct_Lib.IntTypes.U64", + "constructor_distinct_Lib.IntTypes.U8", + "equality_tok_Lib.IntTypes.PUB@tok", + "equality_tok_Lib.IntTypes.U32@tok", + "equality_tok_Lib.IntTypes.U64@tok", "equation_FStar.UInt.max_int", + "equation_Lib.IntTypes.bits", "equation_Lib.IntTypes.maxint", + "equation_Lib.IntTypes.minint", "equation_Lib.IntTypes.unsigned", + "equation_Lib.IntTypes.v", "equation_Prims.nat", + "equation_Rust_primitives.Arrays.t_Array", + "equation_Rust_primitives.BitVectors.num_bits", + "equation_Rust_primitives.Integers.bits", + "equation_Rust_primitives.Integers.int_t", + "equation_Rust_primitives.Integers.inttype", + "equation_Rust_primitives.Integers.maxint", + "equation_Rust_primitives.Integers.minint", + "equation_Rust_primitives.Integers.unsigned", + "equation_Rust_primitives.Integers.v", + "lemma_Rust_primitives.Integers.pow2_values", + "primitive_Prims.op_Addition", "primitive_Prims.op_LessThanOrEqual", + "primitive_Prims.op_Multiply", "primitive_Prims.op_Subtraction", + "projection_inverse_BoxBool_proj_0", + "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_0e343cf55140f06ee7dbebe608047cd8", + "refinement_interpretation_Tm_refine_24f4f435390b85ef53b462142b1f7860", + "refinement_interpretation_Tm_refine_2b93cc0d2fb3530ccc9d725f3cc7d456", + "refinement_interpretation_Tm_refine_31a363db8a0a0025827fe2225dc592af", + "refinement_interpretation_Tm_refine_53c655668b35152fbbd9a7948c262451", + "refinement_interpretation_Tm_refine_53d7089a905511e9e713c7dbc2f68178", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_90b5d2df39645a4835173a203da069e4", + "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", + "typing_Rust_primitives.Integers.bits", + "typing_Rust_primitives.Integers.unsigned", + "typing_Rust_primitives.Integers.usize_inttype" + ], + 0, + "7889c89b1c0a2b405d736c0ef8eac088" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 22, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "bool_inversion", + "equation_Prims.nat", "equation_Rust_primitives.Integers.inttype", + "equation_Rust_primitives.Integers.maxint", + "equation_Rust_primitives.Integers.minint", + "equation_Rust_primitives.Integers.range", + "equation_Rust_primitives.Integers.range_t", + "equation_Rust_primitives.Integers.unsigned", + "equation_Rust_primitives.Integers.usize", + "equation_Rust_primitives.Integers.v", "primitive_Prims.op_Addition", + "primitive_Prims.op_AmpAmp", "primitive_Prims.op_LessThanOrEqual", + "projection_inverse_BoxBool_proj_0", + "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_953cac121c861a9a313e2dea9b773cf6", + "refinement_interpretation_Tm_refine_a6d4eccfb2603ce5e66d6162c32df2b0", + "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", + "typing_Rust_primitives.Integers.unsigned", + "typing_Rust_primitives.Integers.usize_inttype", + "typing_Rust_primitives.Integers.v" + ], + 0, + "d43c1e98741782237557ac46f9ee39a6" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 23, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "bool_inversion", "bool_typing", + "equality_tok_Lib.IntTypes.PUB@tok", + "equality_tok_Lib.IntTypes.S32@tok", "equation_Lib.IntTypes.maxint", + "equation_Lib.IntTypes.range", "equation_Lib.IntTypes.unsigned", + "equation_Lib.IntTypes.v", + "equation_Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS", + "equation_Prims.nat", "equation_Rust_primitives.Integers.bits", + "equation_Rust_primitives.Integers.i32", + "equation_Rust_primitives.Integers.int_t", + "equation_Rust_primitives.Integers.inttype", + "equation_Rust_primitives.Integers.maxint", + "equation_Rust_primitives.Integers.minint", + "equation_Rust_primitives.Integers.range", + "equation_Rust_primitives.Integers.range_t", + "equation_Rust_primitives.Integers.sz", + "equation_Rust_primitives.Integers.unsigned", + "equation_Rust_primitives.Integers.usize", + "equation_Rust_primitives.Integers.v", + "lemma_Rust_primitives.Integers.v_mk_int_lemma", + "primitive_Prims.op_Addition", "primitive_Prims.op_AmpAmp", + "primitive_Prims.op_LessThanOrEqual", + "projection_inverse_BoxBool_proj_0", + "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_0dee8cb03258a67c2f7ec66427696212", + "refinement_interpretation_Tm_refine_5280d0c4b9b990118f9152d1c5b93f3b", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_83845a86f2550cdf941eeb1d9b59602b", + "refinement_interpretation_Tm_refine_a6d4eccfb2603ce5e66d6162c32df2b0", + "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", + "typing_Lib.IntTypes.v", + "typing_Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS", + "typing_Rust_primitives.Integers.range", + "typing_Rust_primitives.Integers.unsigned", + "typing_Rust_primitives.Integers.usize_inttype", + "typing_Rust_primitives.Integers.v", + "typing_tok_Lib.IntTypes.PUB@tok", "typing_tok_Lib.IntTypes.S32@tok" + ], + 0, + "45d878fc2a402454f4ce4a8270753833" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 24, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", "bool_inversion", "bool_typing", + "equality_tok_Lib.IntTypes.PUB@tok", + "equality_tok_Lib.IntTypes.S32@tok", "equation_Lib.IntTypes.maxint", + "equation_Lib.IntTypes.range", "equation_Lib.IntTypes.unsigned", + "equation_Lib.IntTypes.v", + "equation_Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS", + "equation_Prims.nat", "equation_Rust_primitives.Integers.bits", + "equation_Rust_primitives.Integers.i32", + "equation_Rust_primitives.Integers.int_t", + "equation_Rust_primitives.Integers.inttype", + "equation_Rust_primitives.Integers.maxint", + "equation_Rust_primitives.Integers.minint", + "equation_Rust_primitives.Integers.range", + "equation_Rust_primitives.Integers.range_t", + "equation_Rust_primitives.Integers.sz", + "equation_Rust_primitives.Integers.unsigned", + "equation_Rust_primitives.Integers.usize", + "equation_Rust_primitives.Integers.v", + "lemma_Rust_primitives.Integers.v_mk_int_lemma", + "primitive_Prims.op_Addition", "primitive_Prims.op_AmpAmp", + "primitive_Prims.op_LessThanOrEqual", + "projection_inverse_BoxBool_proj_0", + "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_0dee8cb03258a67c2f7ec66427696212", + "refinement_interpretation_Tm_refine_5280d0c4b9b990118f9152d1c5b93f3b", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_83845a86f2550cdf941eeb1d9b59602b", + "refinement_interpretation_Tm_refine_a6d4eccfb2603ce5e66d6162c32df2b0", + "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", + "typing_Lib.IntTypes.v", + "typing_Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS", + "typing_Rust_primitives.Integers.range", + "typing_Rust_primitives.Integers.unsigned", + "typing_Rust_primitives.Integers.usize_inttype", + "typing_Rust_primitives.Integers.v", + "typing_tok_Lib.IntTypes.PUB@tok", "typing_tok_Lib.IntTypes.S32@tok" + ], + 0, + "d80a0f4aeab61c20bef4845a3dca55cd" + ], + [ + "BitVecEq.int_t_eq_seq_slice_bv_sub_lemma", + 25, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", + "BitVecEq_interpretation_Tm_arrow_b4ead33e06e21b401ac39ed9ccd66716", + "FStar.FunctionalExtensionality_interpretation_Tm_arrow_a7d5cc170be69663c495e8582d2bc62a", + "Prims_interpretation_Tm_arrow_2eaa01e78f73e9bab5d0955fc1a662da", + "Rust_primitives.BitVectors_interpretation_Tm_arrow_bc2eac05cff1f96671b35103fe52da33", + "bool_inversion", "bool_typing", "equality_tok_Lib.IntTypes.PUB@tok", + "equality_tok_Lib.IntTypes.S32@tok", "equation_BitVecEq.bit_vec_sub", + "equation_FStar.FunctionalExtensionality.is_restricted", + "equation_FStar.FunctionalExtensionality.restricted_t", + "equation_Lib.IntTypes.int_t", "equation_Lib.IntTypes.v", + "equation_Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS", + "equation_Prims.nat", "equation_Rust_primitives.Arrays.t_Array", + "equation_Rust_primitives.BitVectors.bit_vec", + "equation_Rust_primitives.BitVectors.bit_vec_of_int_t_array", + "equation_Rust_primitives.BitVectors.num_bits", + "equation_Rust_primitives.Integers.i32", + "equation_Rust_primitives.Integers.int_t", + "equation_Rust_primitives.Integers.inttype", + "equation_Rust_primitives.Integers.maxint", + "equation_Rust_primitives.Integers.minint", + "equation_Rust_primitives.Integers.range", + "equation_Rust_primitives.Integers.range_t", + "equation_Rust_primitives.Integers.sz", + "equation_Rust_primitives.Integers.unsigned", + "equation_Rust_primitives.Integers.usize", + "equation_Rust_primitives.Integers.v", "int_inversion", "int_typing", + "interpretation_Tm_abs_eb4b4f6028ac67b168b96720ea22e2fc", + "lemma_BitVecEq.bit_vec_equal_elim", + "lemma_BitVecEq.int_t_seq_slice_to_bv_sub_lemma", + "lemma_FStar.FunctionalExtensionality.extensionality", + "lemma_FStar.FunctionalExtensionality.feq_on_domain", + "lemma_FStar.Seq.Base.lemma_len_slice", + "lemma_Rust_primitives.Integers.v_mk_int_lemma", + "primitive_Prims.op_Addition", "primitive_Prims.op_AmpAmp", + "primitive_Prims.op_LessThanOrEqual", "primitive_Prims.op_Multiply", + "primitive_Prims.op_Subtraction", + "projection_inverse_BoxBool_proj_0", + "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_00de8574249a7ce53dacab309b687d50", + "refinement_interpretation_Tm_refine_0dee8cb03258a67c2f7ec66427696212", + "refinement_interpretation_Tm_refine_2b93cc0d2fb3530ccc9d725f3cc7d456", + "refinement_interpretation_Tm_refine_5280d0c4b9b990118f9152d1c5b93f3b", + "refinement_interpretation_Tm_refine_53d7089a905511e9e713c7dbc2f68178", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_7e4a6c5999db731b5d17d0418dfeea3e", + "refinement_interpretation_Tm_refine_81407705a0828c2c1b1976675443f647", + "refinement_interpretation_Tm_refine_83845a86f2550cdf941eeb1d9b59602b", + "refinement_interpretation_Tm_refine_a20118601b41317c98322924cd2f10c3", + "refinement_interpretation_Tm_refine_a4ae132d343ce75906bf7050ccfe68b4", + "refinement_interpretation_Tm_refine_a6d4eccfb2603ce5e66d6162c32df2b0", + "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", + "refinement_kinding_Tm_refine_c1424615841f28cac7fc34e92b7ff33c", + "typing_FStar.FunctionalExtensionality.on_domain", + "typing_FStar.Seq.Base.length", "typing_FStar.Seq.Base.slice", + "typing_Lib.IntTypes.v", + "typing_Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS", + "typing_Rust_primitives.BitVectors.bit_vec_of_int_t_array", + "typing_Rust_primitives.Integers.int_t", + "typing_Rust_primitives.Integers.range", + "typing_Rust_primitives.Integers.unsigned", + "typing_Rust_primitives.Integers.usize_inttype", + "typing_Rust_primitives.Integers.v", + "typing_Tm_abs_eb4b4f6028ac67b168b96720ea22e2fc", + "typing_Tm_abs_eb643fbfbab7ef908ba32052bb948a4f", + "typing_tok_Lib.IntTypes.PUB@tok", "typing_tok_Lib.IntTypes.S32@tok", + "unit_inversion" + ], + 0, + "6213700a8a1c881dd848638983196926" + ], + [ + "BitVecEq.bit_vec_equal_extend", + 1, + 0, + 0, + [ + "@MaxIFuel_assumption", "@query", + "BitVecEq_interpretation_Tm_arrow_b4ead33e06e21b401ac39ed9ccd66716", + "FStar.FunctionalExtensionality_interpretation_Tm_arrow_a7d5cc170be69663c495e8582d2bc62a", + "Prims_interpretation_Tm_arrow_2eaa01e78f73e9bab5d0955fc1a662da", + "Rust_primitives.BitVectors_interpretation_Tm_arrow_bc2eac05cff1f96671b35103fe52da33", + "b2t_def", "bool_inversion", "equation_BitVecEq.bit_vec_sub", + "equation_FStar.FunctionalExtensionality.feq", "equation_Prims.nat", + "equation_Prims.squash", "equation_Rust_primitives.Integers.inttype", + "equation_Rust_primitives.Integers.unsigned", + "function_token_typing_BitVecEq.bit_vec_sub", "int_inversion", + "int_typing", + "interpretation_Tm_abs_eb4b4f6028ac67b168b96720ea22e2fc", + "interpretation_Tm_abs_eb643fbfbab7ef908ba32052bb948a4f", + "lemma_BitVecEq.bit_vec_equal_elim", + "lemma_FStar.FunctionalExtensionality.feq_on_domain", + "primitive_Prims.op_Addition", "primitive_Prims.op_LessThan", + "primitive_Prims.op_Subtraction", + "projection_inverse_BoxBool_proj_0", + "projection_inverse_BoxInt_proj_0", + "refinement_interpretation_Tm_refine_266ea895698ef1c2c11479e2e605454e", + "refinement_interpretation_Tm_refine_2de20c066034c13bf76e9c0b94f4806c", + "refinement_interpretation_Tm_refine_4a7c44b5dbcd095a37f95c3335e2f0ea", + "refinement_interpretation_Tm_refine_542f9d4f129664613f2483a6c88bc7c2", + "refinement_interpretation_Tm_refine_6f684e27d6af9965634108bcfe981953", + "refinement_interpretation_Tm_refine_b9fb9a93e440aa2badbbdac025f74343", + "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", + "refinement_interpretation_Tm_refine_c1424615841f28cac7fc34e92b7ff33c", + "refinement_kinding_Tm_refine_c1424615841f28cac7fc34e92b7ff33c", + "typing_Rust_primitives.Integers.unsigned", + "typing_Rust_primitives.Integers.usize_inttype", + "typing_Tm_abs_eb4b4f6028ac67b168b96720ea22e2fc", + "typing_Tm_abs_eb643fbfbab7ef908ba32052bb948a4f" + ], + 0, + "381db8a80993f6e8254bf0eee19b774c" + ] + ] +] \ No newline at end of file diff --git a/proofs/fstar/extraction-edited/.hints/Core.Array.fst.hints b/proofs/fstar/extraction-edited/.hints/Core.Array.fst.hints index e781a8d3..f585cd28 100644 --- a/proofs/fstar/extraction-edited/.hints/Core.Array.fst.hints +++ b/proofs/fstar/extraction-edited/.hints/Core.Array.fst.hints @@ -20,7 +20,7 @@ "typing_Rust_primitives.Integers.v" ], 0, - "61d19e21e5ba401ccd51fac8dd4dc1bb" + "c86718181e1e8d01f7209e7c2a75f48f" ] ] ] \ No newline at end of file diff --git a/proofs/fstar/extraction-edited/.hints/Core.Convert.fst.hints b/proofs/fstar/extraction-edited/.hints/Core.Convert.fst.hints index f684cf7a..83935c0f 100644 --- a/proofs/fstar/extraction-edited/.hints/Core.Convert.fst.hints +++ b/proofs/fstar/extraction-edited/.hints/Core.Convert.fst.hints @@ -40,7 +40,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "89069ae0acc72a78e2efa55464713004" + "d99065ab1cecc1f4e429ca3f1178b733" ], [ "Core.Convert.impl_6_refined", @@ -71,7 +71,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "2e69cb8f79fbe8510f2c581d195eb17e" + "820c7d9e75762bc2bddd4d373dcc524a" ], [ "Core.Convert.integer_into", @@ -93,7 +93,7 @@ "typing_Rust_primitives.Integers.v" ], 0, - "4a75fc2edb3ec33d8d7d9232b2b0a9c1" + "2042829462f72cebdcb44987cae88e04" ] ] ] \ No newline at end of file diff --git a/proofs/fstar/extraction-edited/.hints/Core.Iter.Adapters.Enumerate.fst.hints b/proofs/fstar/extraction-edited/.hints/Core.Iter.Adapters.Enumerate.fst.hints index a38e3a7e..44236fb4 100644 --- a/proofs/fstar/extraction-edited/.hints/Core.Iter.Adapters.Enumerate.fst.hints +++ b/proofs/fstar/extraction-edited/.hints/Core.Iter.Adapters.Enumerate.fst.hints @@ -23,7 +23,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "6385868cd0d0e2d5436d295085d9ece7" + "01184cffc5ee0606003bb72c54bfe157" ] ] ] \ No newline at end of file diff --git a/proofs/fstar/extraction-edited/.hints/Core.Iter.Adapters.Step_by.fst.hints b/proofs/fstar/extraction-edited/.hints/Core.Iter.Adapters.Step_by.fst.hints index 20508edf..367df809 100644 --- a/proofs/fstar/extraction-edited/.hints/Core.Iter.Adapters.Step_by.fst.hints +++ b/proofs/fstar/extraction-edited/.hints/Core.Iter.Adapters.Step_by.fst.hints @@ -23,7 +23,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "cd17466b7eba81a3ad18f29a54ecdcfa" + "706694a0e0e6c2c02dc3b1a4e942410e" ] ] ] \ No newline at end of file diff --git a/proofs/fstar/extraction-edited/.hints/Core.Iter.fsti.hints b/proofs/fstar/extraction-edited/.hints/Core.Iter.fsti.hints index f861fff9..c57c41a6 100644 --- a/proofs/fstar/extraction-edited/.hints/Core.Iter.fsti.hints +++ b/proofs/fstar/extraction-edited/.hints/Core.Iter.fsti.hints @@ -43,7 +43,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "5e67dd92d9e724f630d50532cb4f36b6" + "66a9932a69b20c4a8f98d17fd83e53d6" ], [ "Core.Iter.iterator_array_contains", @@ -64,7 +64,7 @@ "typing_Rust_primitives.Integers.v" ], 0, - "9b3a6eac4d2d790e261dc9a792d7115c" + "e4c9913d7800c1eaa00ba7c16917f402" ] ] ] \ No newline at end of file diff --git a/proofs/fstar/extraction-edited/.hints/Core.Num.fsti.hints b/proofs/fstar/extraction-edited/.hints/Core.Num.fsti.hints index a1f76878..fe4a4b87 100644 --- a/proofs/fstar/extraction-edited/.hints/Core.Num.fsti.hints +++ b/proofs/fstar/extraction-edited/.hints/Core.Num.fsti.hints @@ -8,7 +8,7 @@ 1, [ "@query", "equation_Rust_primitives.Integers.i32_inttype" ], 0, - "49c30328cc62eb103e966138f7d6bc4c" + "1a6141588a98f6a13327acb76aefcdf7" ], [ "Core.Num.impl__u32__from_le_bytes", @@ -47,7 +47,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "d81dfb79264e3e188fbd87697cc43338" + "b90a3012ce103b8f88b68a00a16caca3" ], [ "Core.Num.impl__u32__from_be_bytes", @@ -86,7 +86,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "aeb67c6090d6b471aa2b210a53a97b4d" + "55f8274f6b74b3aa0127595734423f8f" ], [ "Core.Num.impl__u32__to_le_bytes", @@ -125,7 +125,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "0ce9b8888a37d21a25e81a5a5c4bfe6e" + "5fe96e8ef6e2a1d99064e86fd374fdfe" ], [ "Core.Num.impl__u32__to_be_bytes", @@ -164,7 +164,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "7f04f9ea22cd0a14da00914f8d408fcf" + "259ad4b001842d020242998aaac5d6d7" ], [ "Core.Num.impl__u64__from_le_bytes", @@ -203,7 +203,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "c93947dab1fb3013cff8cad6b52b3c9c" + "e08e2ac36362ada4f519d369291b14c7" ], [ "Core.Num.impl__u64__from_be_bytes", @@ -242,7 +242,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "6a4e7bb9ec276bef8b1d210371d17790" + "182240cd37bb5ddba594ab5dcfe7f385" ], [ "Core.Num.impl__u64__to_le_bytes", @@ -281,7 +281,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "56167e58dc1efe630d223cd100c10899" + "f8492a1bfc04f6abac0940aab21fde92" ], [ "Core.Num.impl__u64__to_be_bytes", @@ -320,7 +320,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "903d9cc70ccbdfb98677bb2c9338bd37" + "88c2d9763fd89800abe716f80102f178" ], [ "Core.Num.impl__u128__from_le_bytes", @@ -359,7 +359,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "db8393219f7f9368ad04f51fda9d4439" + "887b154a5d2cae46f088e6a6d6b5eb42" ], [ "Core.Num.impl__u128__from_be_bytes", @@ -398,7 +398,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "e94c37e3e522f5b3f7d584eb358af67f" + "083e5e94e244f346dd1119176f10360f" ], [ "Core.Num.impl__u128__to_le_bytes", @@ -437,7 +437,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "15582e3fdf25975b9f64604ea6865777" + "0bd722eb7ee7a8f48106504fe46393ca" ], [ "Core.Num.impl__u128__to_be_bytes", @@ -476,7 +476,7 @@ "typing_Rust_primitives.Integers.usize_inttype" ], 0, - "948bf2141fe892e8e60b3930afd99afa" + "9ad536f1aa71edd5edf1fc9d4c865041" ], [ "Core.Num.impl__u16__pow", @@ -530,7 +530,7 @@ "typing_tok_Lib.IntTypes.U32@tok" ], 0, - "f81005b265bd0f2c8a69c3a58ef3957f" + "f0d9ee449fb2d70bd4c2ef2a69699e89" ], [ "Core.Num.impl__u32__pow", @@ -579,7 +579,7 @@ "typing_tok_Lib.IntTypes.PUB@tok", "typing_tok_Lib.IntTypes.U32@tok" ], 0, - "66242ac093c2f011ce65faa03ae6c3d1" + "188ce25bae866baa7924954c732c7e30" ], [ "Core.Num.impl__i32__pow", @@ -623,8 +623,7 @@ "refinement_interpretation_Tm_refine_a6d4eccfb2603ce5e66d6162c32df2b0", "refinement_interpretation_Tm_refine_bacb80e693f1faab8ffabcbb77914bec", "token_correspondence_Prims.pow2.fuel_instrumented", - "typing_Lib.IntTypes.bits", "typing_Lib.IntTypes.v", - "typing_Rust_primitives.Integers.range", + "typing_Lib.IntTypes.v", "typing_Rust_primitives.Integers.range", "typing_Rust_primitives.Integers.unsigned", "typing_Rust_primitives.Integers.usize_inttype", "typing_Rust_primitives.Integers.v", @@ -632,7 +631,7 @@ "typing_tok_Lib.IntTypes.U32@tok" ], 0, - "ee1449dfadf27251393f073b2b5a9b3b" + "f7921d8f289ecc4a100c8c4d629bc166" ] ] ] \ No newline at end of file diff --git a/proofs/fstar/extraction-edited/.hints/Core.Ops.Index.fst.hints b/proofs/fstar/extraction-edited/.hints/Core.Ops.Index.fst.hints index 325ce74c..0494e842 100644 --- a/proofs/fstar/extraction-edited/.hints/Core.Ops.Index.fst.hints +++ b/proofs/fstar/extraction-edited/.hints/Core.Ops.Index.fst.hints @@ -1 +1 @@ -[ "BQtquV\u0004", [] ] \ No newline at end of file +[ "IT\"֤S+I`", [] ] \ No newline at end of file diff --git a/proofs/fstar/extraction-edited/.hints/Core.Ops.Range.fsti.hints b/proofs/fstar/extraction-edited/.hints/Core.Ops.Range.fsti.hints index 90584d74..8ea71d53 100644 --- a/proofs/fstar/extraction-edited/.hints/Core.Ops.Range.fsti.hints +++ b/proofs/fstar/extraction-edited/.hints/Core.Ops.Range.fsti.hints @@ -8,7 +8,7 @@ 1, [ "@query" ], 0, - "2f1c4ebd64b4ef2de2bf8ead9ea5fbd5" + "44802066e80e4c98fe0a5522fa8d77fc" ], [ "Core.Ops.Range.t_RangeFrom", @@ -17,7 +17,7 @@ 1, [ "@query" ], 0, - "1c8410e9fff6969980b1c779dc7a0d0e" + "cbf8164fc30162c1d873ea3690811a50" ], [ "Core.Ops.Range.t_Range", @@ -26,7 +26,7 @@ 1, [ "@query" ], 0, - "97054f685c7336ede743fd1deab8e3b7" + "73f8d83e4d7ace78f9bb275b6ada4c6b" ], [ "Core.Ops.Range.fold_range'", @@ -113,7 +113,7 @@ "well-founded-ordering-on-nat" ], 0, - "004d04f9ceb5b61d57ad4936af6b6f8e" + "afbc273a622a53b6b9e90bab13313c65" ], [ "Core.Ops.Range.iterator_range", @@ -146,7 +146,7 @@ "typing_tok_Lib.IntTypes.PUB@tok" ], 0, - "6f470bc2d150339f7391d9c6ccee779c" + "59671aa05874272d4ee72812d3550023" ], [ "Core.Ops.Range.impl_index_range_slice", @@ -195,7 +195,7 @@ "typing_tok_Lib.IntTypes.PUB@tok" ], 0, - "922ce28a5109ef85001234f7492a0dd7" + "003fe8264515ab8b0ef4ba55335b87bd" ], [ "Core.Ops.Range.impl_index_range_to_slice", @@ -243,7 +243,7 @@ "typing_tok_Lib.IntTypes.PUB@tok" ], 0, - "7cb344bf8fc7ef9338622f5691294604" + "85f3152a14fd46cde8c2e6e48e6c0192" ], [ "Core.Ops.Range.impl_index_range_from_slice", @@ -285,7 +285,7 @@ "typing_Rust_primitives.Integers.v" ], 0, - "cadfa962a493ca1f875624c5bb8081e9" + "3e98e6c80e1781977669d9d104d3dfcc" ], [ "Core.Ops.Range.impl_range_index_array", @@ -306,7 +306,7 @@ "typing_Rust_primitives.Integers.v" ], 0, - "96d0f32e631ac69972d6d9ad7aefabcf" + "2f2f0c3904069e1dfada5bd6852fe37c" ], [ "Core.Ops.Range.impl_range_to_index_array", @@ -327,7 +327,7 @@ "typing_Rust_primitives.Integers.v" ], 0, - "f69ff4da52b25e1566b624876409c9c8" + "030a540e8763c6ff54660532fc151a01" ], [ "Core.Ops.Range.impl_range_from_index_array", @@ -348,7 +348,7 @@ "typing_Rust_primitives.Integers.v" ], 0, - "71c1bfa7f48d8b4b2d92bd3231c7f2bc" + "3c62c0577dff57fb3b9e6210bd5d4e1f" ], [ "Core.Ops.Range.impl_range_full_index_array", @@ -369,7 +369,7 @@ "typing_Rust_primitives.Integers.v" ], 0, - "d162d4e11cb4daead2ee7c3d5687931c" + "d9901e0ec1592849572a39f7583f5c56" ], [ "Core.Ops.Range.update_at_tc_array_range", @@ -386,7 +386,7 @@ "token_correspondence_Core.Ops.Index.in_range" ], 0, - "8b243bdeabb6cac5ba23598c9c69e978" + "91c133608a751b616967f9ef3254331b" ], [ "Core.Ops.Range.update_at_tc_array_range_to", @@ -403,7 +403,7 @@ "token_correspondence_Core.Ops.Index.in_range" ], 0, - "31da2a6b84cfee9dd11aac73eb824c46" + "8194aa85d51d0296cfa3c14059e8a592" ], [ "Core.Ops.Range.update_at_tc_array_range_from", @@ -420,7 +420,7 @@ "token_correspondence_Core.Ops.Index.in_range" ], 0, - "007bbd2a56f1b36601ce100c74d40e60" + "9b9bfff4e9780936c49455895a70726e" ] ] ] \ No newline at end of file diff --git a/proofs/fstar/extraction-edited/.hints/Core.Ops.fst.hints b/proofs/fstar/extraction-edited/.hints/Core.Ops.fst.hints index 279d79d0..2add45cc 100644 --- a/proofs/fstar/extraction-edited/.hints/Core.Ops.fst.hints +++ b/proofs/fstar/extraction-edited/.hints/Core.Ops.fst.hints @@ -15,7 +15,7 @@ "token_correspondence_Core.Ops.Index.in_range" ], 0, - "3cd847f4f421eb1541c8febade998a71" + "37bba1d678031983b3fa984afca61e02" ] ] ] \ No newline at end of file diff --git a/proofs/fstar/extraction-edited/.hints/Core.Option.fst.hints b/proofs/fstar/extraction-edited/.hints/Core.Option.fst.hints index 4259ee6c..a1fd717b 100644 --- a/proofs/fstar/extraction-edited/.hints/Core.Option.fst.hints +++ b/proofs/fstar/extraction-edited/.hints/Core.Option.fst.hints @@ -1,5 +1,5 @@ [ - "\u001d$\u00018\u001e\\", + "bW\\\u001b bit_vec_equal #n bv1 bv2) +- = introduce forall n (bv1 bv2: bit_vec n). _ +- with introduce (forall i. bv1 i == bv2 i) ==> bit_vec_equal #n bv1 bv2 +- with _. bit_vec_equal_intro #n bv1 bv2 +- +-let bit_vec_equal_elim_principle () +- : Lemma (forall n (bv1 bv2: bit_vec n). bit_vec_equal #n bv1 bv2 ==> (forall i. bv1 i == bv2 i)) +- = introduce forall n (bv1 bv2: bit_vec n). _ +- with introduce bit_vec_equal #n bv1 bv2 ==> (forall i. bv1 i == bv2 i) +- with _. bit_vec_equal_elim #n bv1 bv2 +- +-let bit_vec_equal_trivial (bv1 bv2: bit_vec 0): Lemma (bv1 == bv2) +- [SMTPat (eq2 #(bit_vec 0) bv1 bv2)] +- = bit_vec_equal_intro bv1 bv2 +- +-let bit_vec_sub #n (bv: bit_vec n) (start: nat) (len: nat {start + len <= n}) +- : bit_vec len +- = on (i: nat {i < len}) +- (fun i -> bv (start + i)) +- +-let bit_vec_equal_trivial_sub_smtpat (bv1: bit_vec 'n) +- : Lemma (forall (bv2: bit_vec 0). bit_vec_sub bv1 0 0 == bv2) +- [SMTPat (bit_vec_sub bv1 0 0)] +- = introduce forall (bv2: bit_vec 0). bit_vec_sub bv1 0 0 == bv2 +- with bit_vec_equal_trivial (bit_vec_sub bv1 0 0) bv2 +- +-unfold let retype #a #b (#_:unit{a == b}) +- (x: a): b +- = x +- +-let bit_vec_sub_all_lemma #n (bv: bit_vec n) +- : Lemma (bit_vec_sub bv 0 n == bv) +- [SMTPat (bit_vec_sub bv 0 n)] +- = bit_vec_equal_intro (bit_vec_sub bv 0 n) bv +- +-let int_t_array_bitwise_eq' +- #t1 #t2 #n1 #n2 +- (arr1: t_Array (int_t t1) n1) (d1: num_bits t1) +- (arr2: t_Array (int_t t2) n2) (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) +- = bit_vec_equal (bit_vec_of_int_t_array arr1 d1) +- (retype (bit_vec_of_int_t_array arr2 d2)) +- +-let int_t_array_bitwise_eq +- #t1 #t2 #n1 #n2 +- (arr1: t_Array (int_t t1) n1) (d1: num_bits t1) +- (arr2: t_Array (int_t t2) n2) (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) +- = bit_vec_of_int_t_array arr1 d1 +- == bit_vec_of_int_t_array arr2 d2 +- +-// let get_bit_intro () +-// : Lemma (forall (#n: inttype) (x: int_t n) (nth: usize {v nth < bits n}). +-// get_bit #n x nth == ( if v x >= 0 then get_bit_nat (v x) (v nth) +-// else get_bit_nat (pow2 (bits n) + v x) (v nth))) +-// = introduce forall (n: inttype) (x: int_t n) (nth: usize {v nth < bits n}). +-// get_bit #n x nth == ( if v x >= 0 then get_bit_nat (v x) (v nth) +-// else get_bit_nat (pow2 (bits n) + v x) (v nth)) +-// with get_bit_intro #n x nth +- +-#push-options "--fuel 0 --ifuel 0 --z3rlimit 80" +-/// Rewrite a `bit_vec_of_int_t_array (Seq.slice arr ...)` into a `bit_vec_sub ...` +-let int_t_seq_slice_to_bv_sub_lemma #t #n +- (arr: t_Array (int_t t) n) +- (start: nat) (len: usize {start + v len <= v n}) +- (d: num_bits t) +- : Lemma ( bit_vec_of_int_t_array (Seq.slice arr start (start + v len) <: t_Array _ len) d +- `bit_vec_equal` bit_vec_sub (bit_vec_of_int_t_array arr d) (start * d) (v len * d)) +- [SMTPat (bit_vec_sub (bit_vec_of_int_t_array arr d) (start * d) (v len * d))] +- = let bv1 = bit_vec_of_int_t_array #_ #len (Seq.slice arr start (start + v len)) d in +- let bv2 = bit_vec_sub (bit_vec_of_int_t_array arr d) (start * d) (v len * d) in +- introduce forall i. bv1 i == bv2 i +- with ( Seq.lemma_index_slice arr start (start + v len) (i / d); +- Math.Lemmas.lemma_div_plus i start d; +- Math.Lemmas.lemma_mod_plus i start d); +- bit_vec_equal_intro bv1 bv2 +- +-#push-options "--split_queries always" +-let int_t_eq_seq_slice_bv_sub_lemma #t #n1 #n2 +- (arr1: t_Array (int_t t) n1) (arr2: t_Array (int_t t) n2) (d: num_bits t) +- (start1 start2: nat) (len: nat {start1 + len <= v n1 /\ start2 + len <= v n2}) +- : Lemma (requires Seq.slice arr1 start1 (start1 + len) == Seq.slice arr2 start2 (start2 + len)) +- (ensures bit_vec_equal +- (bit_vec_sub (bit_vec_of_int_t_array arr1 d) (start1 * d) (len * d)) +- (bit_vec_sub (bit_vec_of_int_t_array arr2 d) (start2 * d) (len * d))) +- [SMTPat ((bit_vec_sub (bit_vec_of_int_t_array arr1 d) (start1 * d) (len * d)) == +- (bit_vec_sub (bit_vec_of_int_t_array arr2 d) (start2 * d) (len * d)))] +- = let len = sz len in +- int_t_seq_slice_to_bv_sub_lemma arr1 start1 len d; +- int_t_seq_slice_to_bv_sub_lemma arr2 start2 len d; +- // bit_vec_equal_elim_principle (); +- bit_vec_equal_intro_principle () +-#pop-options +- +-let bit_vec_equal_extend #n1 #n2 +- (bv1: bit_vec n1) (bv2: bit_vec n2) (start1 start2: nat) +- (len1: nat) +- (len2: nat { start1 + len1 + len2 <= n1 /\ start2 + len1 + len2 <= n2}) +- : Lemma +- (requires +- bit_vec_sub bv1 start1 len1 == bit_vec_sub bv2 start2 len1 +- /\ bit_vec_sub bv1 (start1 + len1) len2 == bit_vec_sub bv2 (start2 + len1) len2) +- (ensures bit_vec_sub bv1 start1 (len1+len2) == bit_vec_sub bv2 start2 (len1+len2)) +- // [SMTPat (bit_vec_sub bv1 start1 len1 == bit_vec_sub bv2 start2 len1); +- // SMTPat () +- // ] +- // SMTPat (bit_vec_sub bv1 (start1 + len1) len2 == bit_vec_sub bv2 (start2 + len1) len2)] +- = let left1 = bit_vec_sub bv1 start1 len1 in +- let left2 = bit_vec_sub bv2 start2 len1 in +- let right1 = bit_vec_sub bv1 (start1 + len1) len2 in +- let right2 = bit_vec_sub bv2 (start2 + len1) len2 in +- // () +- // bit_vec_equal_elim left1 left2 ; +- // bit_vec_equal_elim right1 right2; +- let entire1 = bit_vec_sub bv1 start1 (len1 + len2) in +- let entire2 = bit_vec_sub bv2 start2 (len1 + len2) in +- assert (forall (i:nat). i < len1 ==> left1 i == left2 i); +- assert (forall (i:nat). i < len2 ==> right1 i == right2 i); +- introduce forall (i:nat). i < len1 + len2 ==> entire1 i == entire2 i +- with introduce i < len1 + len2 ==> entire1 i == entire2 i +- with _. if i < len1 then assert (left1 i == left2 i) +- else assert (entire1 i == right1 (i - len1)); +- bit_vec_equal_intro entire1 entire2 +-#pop-options +- +-// let bit_vec_equal_trans (#n: nat) (bv1 bv2 bv3: bit_vec n) +-// : Lemma (requires bv1 `bit_vec_equal` bv2 /\ bv2 `bit_vec_equal` bv3) +-// (ensures bv1 `bit_vec_equal` bv3) +-// = bit_vec_equal_elim_principle (); +-// bit_vec_equal_intro_principle () +- +-(* +-let int_arr_bitwise_eq_range +- #t1 #t2 #n1 #n2 +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) +- (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) +- (d1: num_bits t1) +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t2 -> Type0) +- (arr2: t_Array (x: int_t t2 {refinement2 x}) n2) +- (d2: num_bits t2) +- (offset1 offset2: nat) +- (bits: nat { +- offset1 + bits <= v n1 * d1 +- /\ offset2 + bits <= v n2 * d2 +- }) +- = bit_vec_equal #bits (fun i -> bit_vec_of_int_t_array arr1 d1 (i + offset1)) +- = forall (k: nat). k < bits ==> +- bit_vec_of_int_t_array arr1 d1 (offset1 + k) +- == bit_vec_of_int_t_array arr2 d2 (offset2 + k) +- +-let int_arr_bitwise_eq_range_comm +- #t1 #t2 #n1 #n2 +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) +- (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) +- (d1: num_bits t1) +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t2 -> Type0) +- (arr2: t_Array (x: int_t t2 {refinement2 x}) n2) +- (d2: num_bits t2) +- (offset1 offset2: nat) +- (bits: nat { +- offset1 + bits <= v n1 * d1 +- /\ offset2 + bits <= v n2 * d2 +- }) +- : Lemma (requires int_arr_bitwise_eq_range arr1 d1 arr2 d2 offset1 offset2 bits) +- (ensures int_arr_bitwise_eq_range arr2 d2 arr1 d1 offset2 offset1 bits) +- = () +- +-// kill that function in favor of range +-let int_arr_bitwise_eq_up_to +- #t1 #t2 #n1 #n2 +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) +- (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) +- (d1: num_bits t1) +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) +- (arr2: t_Array (x: int_t t2 {refinement x}) n2) +- (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) +- (max: nat {max <= v n1 * d1}) +- +- = forall i. i < max +- ==> bit_vec_of_int_t_array arr1 d1 i == bit_vec_of_int_t_array arr2 d2 i +- +-let int_arr_bitwise_eq_ +- #t1 #t2 #n1 #n2 +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) +- (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) +- (d1: num_bits t1) +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) +- (arr2: t_Array (x: int_t t2 {refinement x}) n2) +- (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) +- = int_arr_bitwise_eq_up_to arr1 d1 arr2 d2 (v n1 * d1) +- +-// move to fsti +-let bit_vec_equal #n (bv1 bv2: bit_vec n) +- = forall i. i < n ==> bv1 i == bv2 i +- +-let int_arr_bitwise_eq +- #t1 #t2 #n1 #n2 +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) +- (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) +- (d1: num_bits t1) +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) +- (arr2: t_Array (x: int_t t2 {refinement x}) n2) +- (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) +- = forall i. i < v n1 * d1 +- ==> bit_vec_of_int_t_array arr1 d1 i == bit_vec_of_int_t_array arr2 d2 i +- +-let int_arr_bitwise_eq_range_transitivity +- #t1 #t2 #t3 #n1 #n2 #n3 +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) +- (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) +- (d1: num_bits t1) +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t2 -> Type0) +- (arr2: t_Array (x: int_t t2 {refinement2 x}) n2) +- (d2: num_bits t2) +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement3: int_t t3 -> Type0) +- (arr3: t_Array (x: int_t t3 {refinement3 x}) n3) +- (d3: num_bits t3) +- (offset1 offset2 offset3: nat) +- (bits: nat { +- offset1 + bits <= v n1 * d1 +- /\ offset2 + bits <= v n2 * d2 +- /\ offset3 + bits <= v n3 * d3 +- }) +- : Lemma +- (requires int_arr_bitwise_eq_range #t1 #t2 #n1 #n2 arr1 d1 arr2 d2 offset1 offset2 bits +- /\ int_arr_bitwise_eq_range #t2 #t3 #n2 #n3 arr2 d2 arr3 d3 offset2 offset3 bits) +- (ensures int_arr_bitwise_eq_range #t1 #t3 #n1 #n3 arr1 d1 arr3 d3 offset1 offset3 bits) +- = () +- +- +-let int_arr_bitwise_eq_range_intro +- #t1 #t2 #n1 #n2 +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t1 -> Type0) +- (arr1: t_Array (x: int_t t1 {refinement1 x}) n1) +- (d1: num_bits t1) +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t2 -> Type0) +- (arr2: t_Array (x: int_t t2 {refinement x}) n2) +- (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) +- : Lemma +- (requires int_arr_bitwise_eq arr1 d1 arr2 d2) +- (ensures int_arr_bitwise_eq_range arr1 d1 arr2 d2 0 0 (v n1 * d1)) +- = admit () +- +-let int_arr_bitwise_eq_range_intro_eq_slice +- #t #n1 #n2 +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement: int_t t -> Type0) +- (arr1: t_Array (x: int_t t {refinement x}) n1) +- (arr2: t_Array (x: int_t t {refinement x}) n2) +- (d: num_bits t) +- (offset1 offset2: nat) +- (n: nat {offset1 + n < v n1 /\ offset2 + n < v n2}) +- (bits: nat { +- offset1 + bits <= v n1 * d +- /\ offset2 + bits <= v n2 * d +- /\ bits <= n * d +- }) +- : Lemma (requires Seq.slice arr1 offset1 (offset1 + n) == Seq.slice arr2 offset2 (offset2 + n)) +- (ensures int_arr_bitwise_eq_range arr1 d arr2 d offset1 offset2 bits) +- = admit () +- +-let int_arr_bitwise_eq_range_intro_eq +- #t #n1 #n2 +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement1: int_t t -> Type0) +- (arr1: t_Array (x: int_t t {refinement1 x}) n1) +- (#[FStar.Tactics.exact (`(fun _ -> True))]refinement2: int_t t -> Type0) +- (arr2: t_Array (x: int_t t {refinement2 x}) n2) +- (d: num_bits t) +- (n_offset1 n_offset2: nat) +- (n: nat {n_offset1 + n <= v n1 /\ n_offset2 + n <= v n2}) +- // (offset1 offset2: nat) +- (bits: nat { +- n_offset1 * d + bits <= v n1 * d +- /\ n_offset2 * d + bits <= v n2 * d +- /\ bits <= n * d +- }) +- : Lemma (requires forall (i: nat). i < n ==> Seq.index arr1 (i + n_offset1) == Seq.index arr2 (i + n_offset2)) +- (ensures int_arr_bitwise_eq_range arr1 d arr2 d (n_offset1 * d) (n_offset2 * d) bits) +- = admit () +-*) diff -ruN extraction-edited/Libcrux.Digest.fsti extraction-secret-independent/Libcrux.Digest.fsti ---- extraction-edited/Libcrux.Digest.fsti 2024-02-06 13:56:02.959572122 +0100 -+++ extraction-secret-independent/Libcrux.Digest.fsti 2024-02-06 13:56:03.021571745 +0100 +--- extraction-edited/Libcrux.Digest.fsti 2024-02-20 10:46:13.890092375 +0100 ++++ extraction-secret-independent/Libcrux.Digest.fsti 2024-02-20 10:46:13.916091852 +0100 @@ -1,31 +1,41 @@ module Libcrux.Digest #set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -71,9 +385,9 @@ diff -ruN extraction-edited/Libcrux.Digest.fsti extraction-secret-independent/Li + +val shake256 (v_LEN: usize) (data: t_Slice u8) : t_Array u8 v_LEN diff -ruN extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst extraction-secret-independent/Libcrux.Kem.Kyber.Arithmetic.fst ---- extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst 2024-02-06 13:56:02.969572061 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Arithmetic.fst 2024-02-06 13:56:03.033571672 +0100 -@@ -1,356 +1,81 @@ +--- extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst 2024-02-20 10:46:13.874092697 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Arithmetic.fst 2024-02-20 10:46:13.944091288 +0100 +@@ -1,364 +1,81 @@ module Libcrux.Kem.Kyber.Arithmetic -#set-options "--fuel 0 --ifuel 1 --z3rlimit 100" +#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -115,7 +429,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst extraction-secret-i -let cast_i32_b #b1 #b2 x = - x <: i32_b b2 - --#push-options "--ifuel 0 --z3rlimit 150" +-#push-options "--ifuel 0 --z3rlimit 250" -let shr_i32_b #b #t x y = - let r = (x <: i32) >>! y in - assert (v r == v x / pow2 (v y)); @@ -155,8 +469,16 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst extraction-secret-i - r <: i32_b (nat_div_ceil b (pow2 (v y)))) -#pop-options - --let v_BARRETT_R: i64 = 1L < derefine_vector_b #v_K #b x.[i]) in - r -- ++ cast (fe +! (Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS &. (fe >>! 31l <: i32) <: i32) <: i32) ++ <: ++ u16 + -let cast_poly_b #b1 #b2 x = - let r = createi (sz 256) (fun i -> (x.f_coefficients.[i] <: i32_b b2)) in - let res = {f_coefficients = r} in @@ -362,10 +687,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst extraction-secret-i - eq_intro dx dr; - assert(Seq.equal dx dr); - res -+ cast (fe +! (Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS &. (fe >>! 31l <: i32) <: i32) <: i32) -+ <: -+ u16 - +- -let cast_vector_b #v_K #b1 #b2 x = - let r = createi v_K (fun i -> cast_poly_b #b1 #b2 x.[i]) in - let dx = derefine_vector_b x in @@ -469,8 +791,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fst extraction-secret-i - - diff -ruN extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Arithmetic.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti 2024-02-06 13:56:02.972572043 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Arithmetic.fsti 2024-02-06 13:56:03.024571727 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti 2024-02-20 10:46:13.856093059 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Arithmetic.fsti 2024-02-20 10:46:13.936091449 +0100 @@ -3,32 +3,10 @@ open Core open FStar.Mul @@ -504,7 +826,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti extraction-secret- let t_FieldElementTimesMontgomeryR = i32 unfold -@@ -36,213 +14,122 @@ +@@ -36,224 +14,122 @@ let v_BARRETT_MULTIPLIER: i64 = 20159L @@ -533,6 +855,11 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti extraction-secret- - m_v + v Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS - else m_v - +-let wf_fe_to_spec_fe (m: wfFieldElement): Spec.Kyber.field_element = +- if v m < 0 +- then v m + v Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS +- else v m +- -let to_spec_fe (m:i32) : Spec.Kyber.field_element = - int_to_spec_fe (v m) - @@ -699,6 +1026,12 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti extraction-secret- - -let op_String_Access #t #l (a:t_Array t l) (i:usize{v i < v l}) : t = a.[i] - +-let wf_poly_to_spec_poly (re: wfPolynomialRingElement): Spec.Kyber.polynomial = +- let p = Spec.Kyber.map' (fun x -> wf_fe_to_spec_fe x <: nat) re.f_coefficients in +- introduce forall i. Seq.index p i < v Spec.Kyber.v_FIELD_MODULUS +- with assert (Seq.index p i == Seq.index p (v (sz i))); +- p +- -let to_spec_poly (m:t_PolynomialRingElement) : (Spec.Kyber.polynomial) = - let p = createi #nat (sz 256) (fun i -> to_spec_fe (m.f_coefficients.[i])) in - assert (forall i. Seq.index p i = to_spec_fe (m.f_coefficients.[sz i])); @@ -816,8 +1149,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Arithmetic.fsti extraction-secret- + <: + bool)) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Compress.fst extraction-secret-independent/Libcrux.Kem.Kyber.Compress.fst ---- extraction-edited/Libcrux.Kem.Kyber.Compress.fst 2024-02-06 13:56:02.960572116 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Compress.fst 2024-02-06 13:56:02.989571939 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Compress.fst 2024-02-20 10:46:13.847093240 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Compress.fst 2024-02-20 10:46:13.925091671 +0100 @@ -1,79 +1,39 @@ module Libcrux.Kem.Kyber.Compress -#set-options "--fuel 0 --ifuel 0 --z3rlimit 200" @@ -922,8 +1255,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Compress.fst extraction-secret-ind + (Core.Ops.Arith.Neg.neg fe <: i32) &. + ((Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS +! 1l <: i32) /! 2l <: i32) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Compress.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Compress.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Compress.fsti 2024-02-06 13:56:02.970572055 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Compress.fsti 2024-02-06 13:56:02.994571909 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Compress.fsti 2024-02-20 10:46:13.886092456 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Compress.fsti 2024-02-20 10:46:13.946091248 +0100 @@ -3,42 +3,44 @@ open Core open FStar.Mul @@ -995,8 +1328,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Compress.fsti extraction-secret-in - (fun result -> v result >= 0 /\ v result < 3329) + : Prims.Pure i32 (requires fe =. 0l || fe =. 1l) (fun _ -> Prims.l_True) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fst extraction-secret-independent/Libcrux.Kem.Kyber.Constant_time_ops.fst ---- extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fst 2024-02-06 13:56:02.956572140 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Constant_time_ops.fst 2024-02-06 13:56:03.000571872 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fst 2024-02-20 10:46:13.860092979 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Constant_time_ops.fst 2024-02-20 10:46:13.908092013 +0100 @@ -4,163 +4,61 @@ open FStar.Mul @@ -1185,8 +1518,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fst extraction-s -#pop-options + out diff -ruN extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Constant_time_ops.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fsti 2024-02-06 13:56:02.955572146 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Constant_time_ops.fsti 2024-02-06 13:56:02.993571915 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fsti 2024-02-20 10:46:13.876092657 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Constant_time_ops.fsti 2024-02-20 10:46:13.939091389 +0100 @@ -20,26 +20,30 @@ val compare_ciphertexts_in_constant_time (v_CIPHERTEXT_SIZE: usize) (lhs rhs: t_Slice u8) @@ -1230,7 +1563,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Constant_time_ops.fsti extraction- + result = rhs <: bool)) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Conversions.fst extraction-secret-independent/Libcrux.Kem.Kyber.Conversions.fst --- extraction-edited/Libcrux.Kem.Kyber.Conversions.fst 1970-01-01 01:00:00.000000000 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Conversions.fst 2024-02-06 13:56:02.987571951 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Conversions.fst 2024-02-20 10:46:13.905092073 +0100 @@ -0,0 +1,87 @@ +module Libcrux.Kem.Kyber.Conversions +#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -1321,8 +1654,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Conversions.fst extraction-secret- + cast (fe +! ((fe >>! 15l <: i32) &. Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS <: i32)) <: u16 \ Pas de fin de ligne à la fin du fichier diff -ruN extraction-edited/Libcrux.Kem.Kyber.fst extraction-secret-independent/Libcrux.Kem.Kyber.fst ---- extraction-edited/Libcrux.Kem.Kyber.fst 2024-02-06 13:56:02.940572237 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.fst 2024-02-06 13:56:02.990571933 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.fst 2024-02-20 10:46:13.851093160 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.fst 2024-02-20 10:46:13.922091731 +0100 @@ -1,29 +1,12 @@ module Libcrux.Kem.Kyber -#set-options "--fuel 0 --ifuel 1 --z3rlimit 100" @@ -1601,8 +1934,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.fst extraction-secret-independent/ - + (Core.Convert.f_into public_key <: Libcrux.Kem.Kyber.Types.t_KyberPublicKey v_PUBLIC_KEY_SIZE) diff -ruN extraction-edited/Libcrux.Kem.Kyber.fsti extraction-secret-independent/Libcrux.Kem.Kyber.fsti ---- extraction-edited/Libcrux.Kem.Kyber.fsti 2024-02-06 13:56:02.962572103 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.fsti 2024-02-06 13:56:03.008571824 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.fsti 2024-02-20 10:46:13.888092415 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.fsti 2024-02-20 10:46:13.930091570 +0100 @@ -4,90 +4,37 @@ open FStar.Mul @@ -1711,8 +2044,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.fsti extraction-secret-independent + Prims.l_True + (fun _ -> Prims.l_True) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fst extraction-secret-independent/Libcrux.Kem.Kyber.Hash_functions.fst ---- extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fst 2024-02-06 13:56:02.965572085 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Hash_functions.fst 2024-02-06 13:56:03.005571842 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fst 2024-02-20 10:46:13.858093019 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Hash_functions.fst 2024-02-20 10:46:13.929091590 +0100 @@ -3,28 +3,18 @@ open Core open FStar.Mul @@ -1780,8 +2113,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fst extraction-secr - out + out diff -ruN extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Hash_functions.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fsti 2024-02-06 13:56:02.966572079 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Hash_functions.fsti 2024-02-06 13:56:02.997571890 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fsti 2024-02-20 10:46:13.893092315 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Hash_functions.fsti 2024-02-20 10:46:13.906092053 +0100 @@ -3,17 +3,12 @@ open Core open FStar.Mul @@ -1808,7 +2141,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Hash_functions.fsti extraction-sec + : Prims.Pure (t_Array (t_Array u8 (sz 840)) v_K) Prims.l_True (fun _ -> Prims.l_True) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Helper.fst extraction-secret-independent/Libcrux.Kem.Kyber.Helper.fst --- extraction-edited/Libcrux.Kem.Kyber.Helper.fst 1970-01-01 01:00:00.000000000 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Helper.fst 2024-02-06 13:56:03.030571690 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Helper.fst 2024-02-20 10:46:13.937091429 +0100 @@ -0,0 +1,6 @@ +module Libcrux.Kem.Kyber.Helper +#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -1817,8 +2150,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Helper.fst extraction-secret-indep + + diff -ruN extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fst extraction-secret-independent/Libcrux.Kem.Kyber.Ind_cpa.fst ---- extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fst 2024-02-06 13:56:02.944572213 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Ind_cpa.fst 2024-02-06 13:56:03.028571702 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fst 2024-02-20 10:46:13.891092355 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Ind_cpa.fst 2024-02-20 10:46:13.933091510 +0100 @@ -1,5 +1,5 @@ module Libcrux.Kem.Kyber.Ind_cpa -#set-options "--fuel 0 --ifuel 1 --z3rlimit 100" @@ -2533,8 +2866,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fst extraction-secret-inde - res - diff -ruN extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Ind_cpa.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fsti 2024-02-06 13:56:02.982571982 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Ind_cpa.fsti 2024-02-06 13:56:03.014571788 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fsti 2024-02-20 10:46:13.881092556 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Ind_cpa.fsti 2024-02-20 10:46:13.903092113 +0100 @@ -1,151 +1,80 @@ module Libcrux.Kem.Kyber.Ind_cpa -#set-options "--fuel 0 --ifuel 1 --z3rlimit 100" @@ -2736,8 +3069,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Ind_cpa.fsti extraction-secret-ind + Prims.l_True + (fun _ -> Prims.l_True) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber1024.fst extraction-secret-independent/Libcrux.Kem.Kyber.Kyber1024.fst ---- extraction-edited/Libcrux.Kem.Kyber.Kyber1024.fst 2024-02-06 13:56:02.942572225 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber1024.fst 2024-02-06 13:56:03.011571806 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Kyber1024.fst 2024-02-20 10:46:13.842093341 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber1024.fst 2024-02-20 10:46:13.914091892 +0100 @@ -3,37 +3,22 @@ open Core open FStar.Mul @@ -2786,8 +3119,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber1024.fst extraction-secret-in (sz 3168) (sz 1568) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber1024.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Kyber1024.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Kyber1024.fsti 2024-02-06 13:56:02.979572000 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber1024.fsti 2024-02-06 13:56:03.009571818 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Kyber1024.fsti 2024-02-20 10:46:13.844093301 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber1024.fsti 2024-02-20 10:46:13.926091651 +0100 @@ -63,32 +63,27 @@ Libcrux.Kem.Kyber.Constants.v_SHARED_SECRET_SIZE +! v_CPA_PKE_CIPHERTEXT_SIZE_1024_ @@ -2833,8 +3166,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber1024.fsti extraction-secret-i Prims.l_True (fun _ -> Prims.l_True) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber512.fst extraction-secret-independent/Libcrux.Kem.Kyber.Kyber512.fst ---- extraction-edited/Libcrux.Kem.Kyber.Kyber512.fst 2024-02-06 13:56:02.948572189 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber512.fst 2024-02-06 13:56:03.003571854 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Kyber512.fst 2024-02-20 10:46:13.863092918 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber512.fst 2024-02-20 10:46:13.949091188 +0100 @@ -3,37 +3,22 @@ open Core open FStar.Mul @@ -2883,8 +3216,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber512.fst extraction-secret-ind (sz 1632) (sz 800) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber512.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Kyber512.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Kyber512.fsti 2024-02-06 13:56:02.946572201 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber512.fsti 2024-02-06 13:56:03.012571799 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Kyber512.fsti 2024-02-20 10:46:13.839093401 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber512.fsti 2024-02-20 10:46:13.912091932 +0100 @@ -63,32 +63,27 @@ Libcrux.Kem.Kyber.Constants.v_SHARED_SECRET_SIZE +! v_CPA_PKE_CIPHERTEXT_SIZE_512_ @@ -2930,8 +3263,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber512.fsti extraction-secret-in Prims.l_True (fun _ -> Prims.l_True) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber768.fst extraction-secret-independent/Libcrux.Kem.Kyber.Kyber768.fst ---- extraction-edited/Libcrux.Kem.Kyber.Kyber768.fst 2024-02-06 13:56:02.938572249 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber768.fst 2024-02-06 13:56:03.001571866 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Kyber768.fst 2024-02-20 10:46:13.861092959 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber768.fst 2024-02-20 10:46:13.943091308 +0100 @@ -3,37 +3,22 @@ open Core open FStar.Mul @@ -2980,8 +3313,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber768.fst extraction-secret-ind (sz 2400) (sz 1184) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber768.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Kyber768.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Kyber768.fsti 2024-02-06 13:56:02.953572158 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber768.fsti 2024-02-06 13:56:03.017571769 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Kyber768.fsti 2024-02-20 10:46:13.850093180 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Kyber768.fsti 2024-02-20 10:46:13.918091812 +0100 @@ -63,33 +63,27 @@ Libcrux.Kem.Kyber.Constants.v_SHARED_SECRET_SIZE +! v_CPA_PKE_CIPHERTEXT_SIZE_768_ @@ -3030,8 +3363,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Kyber768.fsti extraction-secret-in - (ensures (fun kp -> (kp.f_sk.f_value,kp.f_pk.f_value) == Spec.Kyber.kyber768_generate_keypair randomness)) + (fun _ -> Prims.l_True) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Matrix.fst extraction-secret-independent/Libcrux.Kem.Kyber.Matrix.fst ---- extraction-edited/Libcrux.Kem.Kyber.Matrix.fst 2024-02-06 13:56:02.976572018 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Matrix.fst 2024-02-06 13:56:03.025571721 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Matrix.fst 2024-02-20 10:46:13.897092234 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Matrix.fst 2024-02-20 10:46:13.921091751 +0100 @@ -3,418 +3,432 @@ open Core open FStar.Mul @@ -3840,8 +4173,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Matrix.fst extraction-secret-indep - admit(); //P-F v_A_transpose diff -ruN extraction-edited/Libcrux.Kem.Kyber.Matrix.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Matrix.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Matrix.fsti 2024-02-06 13:56:02.963572097 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Matrix.fsti 2024-02-06 13:56:03.015571781 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Matrix.fsti 2024-02-20 10:46:13.880092576 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Matrix.fsti 2024-02-20 10:46:13.940091369 +0100 @@ -3,71 +3,39 @@ open Core open FStar.Mul @@ -3944,8 +4277,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Matrix.fsti extraction-secret-inde + Prims.l_True + (fun _ -> Prims.l_True) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Ntt.fst extraction-secret-independent/Libcrux.Kem.Kyber.Ntt.fst ---- extraction-edited/Libcrux.Kem.Kyber.Ntt.fst 2024-02-06 13:56:02.941572231 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Ntt.fst 2024-02-06 13:56:02.998571884 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Ntt.fst 2024-02-20 10:46:13.855093079 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Ntt.fst 2024-02-20 10:46:13.928091610 +0100 @@ -1,130 +1,56 @@ module Libcrux.Kem.Kyber.Ntt -#set-options "--fuel 0 --ifuel 1 --z3rlimit 100" @@ -4876,8 +5209,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Ntt.fst extraction-secret-independ -#pop-options + re diff -ruN extraction-edited/Libcrux.Kem.Kyber.Ntt.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Ntt.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Ntt.fsti 2024-02-06 13:56:02.945572207 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Ntt.fsti 2024-02-06 13:56:03.031571684 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Ntt.fsti 2024-02-20 10:46:13.838093421 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Ntt.fsti 2024-02-20 10:46:13.947091228 +0100 @@ -2,80 +2,224 @@ #set-options "--fuel 0 --ifuel 1 --z3rlimit 15" open Core @@ -5171,8 +5504,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Ntt.fsti extraction-secret-indepen + <: + bool)) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Sampling.fst extraction-secret-independent/Libcrux.Kem.Kyber.Sampling.fst ---- extraction-edited/Libcrux.Kem.Kyber.Sampling.fst 2024-02-06 13:56:02.980571994 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Sampling.fst 2024-02-06 13:56:03.020571751 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Sampling.fst 2024-02-20 10:46:13.887092436 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Sampling.fst 2024-02-20 10:46:13.902092134 +0100 @@ -3,34 +3,27 @@ open Core open FStar.Mul @@ -5609,8 +5942,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Sampling.fst extraction-secret-ind -#pop-options + out diff -ruN extraction-edited/Libcrux.Kem.Kyber.Sampling.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Sampling.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Sampling.fsti 2024-02-06 13:56:02.983571976 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Sampling.fsti 2024-02-06 13:56:03.007571830 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Sampling.fsti 2024-02-20 10:46:13.895092274 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Sampling.fsti 2024-02-20 10:46:13.935091469 +0100 @@ -3,37 +3,77 @@ open Core open FStar.Mul @@ -5711,9 +6044,9 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Sampling.fsti extraction-secret-in + Prims.l_True + (fun _ -> Prims.l_True) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-independent/Libcrux.Kem.Kyber.Serialize.fst ---- extraction-edited/Libcrux.Kem.Kyber.Serialize.fst 2024-02-06 13:56:02.952572164 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Serialize.fst 2024-02-06 13:56:03.023571733 +0100 -@@ -1,14 +1,8 @@ +--- extraction-edited/Libcrux.Kem.Kyber.Serialize.fst 2024-02-20 10:46:13.845093281 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Serialize.fst 2024-02-20 10:46:13.919091791 +0100 +@@ -1,15 +1,8 @@ module Libcrux.Kem.Kyber.Serialize -#set-options "--fuel 0 --ifuel 0 --z3rlimit 50 --retry 3" +#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" @@ -5723,15 +6056,18 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in -open Libcrux.Kem.Kyber.Arithmetic - -open MkSeq +-open BitVecEq - --#push-options "--z3rlimit 80" +-#push-options "--z3rlimit 480 --split_queries always" -[@@"opaque_to_smt"] let compress_coefficients_10_ (coefficient1 coefficient2 coefficient3 coefficient4: i32) = let coef1:u8 = cast (coefficient1 &. 255l <: i32) <: u8 in let coef2:u8 = -@@ -25,12 +19,11 @@ +@@ -25,14 +18,12 @@ + (cast ((coefficient3 >>! 4l <: i32) &. 63l <: i32) <: u8) in let coef5:u8 = cast ((coefficient4 >>! 2l <: i32) &. 255l <: i32) <: u8 in +- bit_vec_equal_intro_principle (); coef1, coef2, coef3, coef4, coef5 <: (u8 & u8 & u8 & u8 & u8) -#pop-options @@ -5745,7 +6081,11 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coef1:u8 = cast (coefficient1 <: i32) <: u8 in let coef2:u8 = ((cast (coefficient2 &. 31l <: i32) <: u8) <>! 6l <: i32) <: u8) + in + let coef11:u8 = cast (coefficient8 >>! 3l <: i32) <: u8 in +- bit_vec_equal_intro_principle (); coef1, coef2, coef3, coef4, coef5, coef6, coef7, coef8, coef9, coef10, coef11 <: (u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8) @@ -5763,11 +6103,12 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in u8 in let coef3:u8 = cast ((coefficient2 >>! 4l <: u16) &. 255us <: u16) <: u8 in +- bit_vec_equal_intro_principle (); - coef1, coef2, coef3 <: (u8 & u8 & u8) -#pop-options + coef1, coef2, coef3 <: (u8 & u8 & u8) --#push-options "--z3rlimit 60 --split_queries always" +-#push-options "--z3rlimit 160 --split_queries always" -[@@"opaque_to_smt"] let compress_coefficients_5_ - coefficient2 coefficient1 coefficient4 coefficient3 coefficient5 coefficient7 coefficient6 coefficient8 @@ -5778,9 +6119,11 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coef1:u8 = ((coefficient2 &. 7uy <: u8) <>! 4l <: u8) in let coef5:u8 = (coefficient8 <>! 2l <: u8) in +- bit_vec_equal_intro_principle (); coef1, coef2, coef3, coef4, coef5 <: (u8 & u8 & u8 & u8 & u8) -#pop-options @@ -5796,6 +6139,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in - lemma_get_bit_bounded' coefficient2 10; - lemma_get_bit_bounded' coefficient3 10; - lemma_get_bit_bounded' coefficient4 10; +- bit_vec_equal_intro_principle (); - coefficient1, coefficient2, coefficient3, coefficient4 -#pop-options + coefficient1, coefficient2, coefficient3, coefficient4 <: (i32 & i32 & i32 & i32) @@ -5809,10 +6153,11 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coefficient1:i32 = ((byte2 &. 7l <: i32) <>! 3l <: i32) in let coefficient3:i32 = -@@ -131,14 +109,6 @@ +@@ -137,15 +109,6 @@ in let coefficient7:i32 = ((byte10 &. 31l <: i32) <>! 2l <: i32) in let coefficient8:i32 = (byte11 <>! 5l <: i32) in +- bit_vec_equal_intro_principle (); - lemma_get_bit_bounded' coefficient1 11; - lemma_get_bit_bounded' coefficient2 11; - lemma_get_bit_bounded' coefficient3 11; @@ -5824,7 +6169,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in coefficient1, coefficient2, coefficient3, -@@ -147,21 +117,15 @@ +@@ -154,22 +117,15 @@ coefficient6, coefficient7, coefficient8 @@ -5840,6 +6185,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coefficient2:i32 = cast ((byte >>! 4l <: u8) &. 15uy <: u8) <: i32 in - lemma_get_bit_bounded' coefficient1 4; - lemma_get_bit_bounded' coefficient2 4; +- bit_vec_equal_intro_principle (); - coefficient1, coefficient2 -#pop-options - @@ -5852,10 +6198,11 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coefficient1:i32 = byte1 &. 31l in let coefficient2:i32 = ((byte2 &. 3l <: i32) <>! 5l <: i32) in let coefficient3:i32 = (byte2 >>! 2l <: i32) &. 31l in -@@ -170,14 +134,6 @@ +@@ -178,15 +134,6 @@ let coefficient6:i32 = (byte4 >>! 1l <: i32) &. 31l in let coefficient7:i32 = ((byte5 &. 7l <: i32) <>! 6l <: i32) in let coefficient8:i32 = byte5 >>! 3l in +- bit_vec_equal_intro_principle (); - lemma_get_bit_bounded' coefficient1 5; - lemma_get_bit_bounded' coefficient2 5; - lemma_get_bit_bounded' coefficient3 5; @@ -5867,7 +6214,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in coefficient1, coefficient2, coefficient3, -@@ -186,54 +142,31 @@ +@@ -195,54 +142,31 @@ coefficient6, coefficient7, coefficient8 @@ -5941,7 +6288,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coefficient1:i32 = Libcrux.Kem.Kyber.Compress.compress_ciphertext_coefficient 10uy (Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 0 ] <: i32 -@@ -293,96 +226,79 @@ +@@ -302,96 +226,79 @@ serialized) in serialized @@ -6062,7 +6409,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in Libcrux.Kem.Kyber.Compress.compress_ciphertext_coefficient 11uy (Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 7 ] <: i32 ) -@@ -408,8 +324,6 @@ +@@ -417,8 +324,6 @@ coefficient7 coefficient8 in @@ -6071,7 +6418,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let serialized:t_Array u8 v_OUT_LEN = Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized (sz 11 *! i <: usize) -@@ -468,20 +382,29 @@ +@@ -477,20 +382,29 @@ serialized) in serialized @@ -6109,7 +6456,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coefficient1:u8 = cast (Libcrux.Kem.Kyber.Compress.compress_ciphertext_coefficient 4uy (Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 0 ] -@@ -516,20 +439,27 @@ +@@ -525,20 +439,27 @@ serialized let compress_then_serialize_5_ @@ -6146,7 +6493,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coefficient1:u8 = cast (Libcrux.Kem.Kyber.Compress.compress_ciphertext_coefficient 5uy (Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 0 ] -@@ -614,14 +544,6 @@ +@@ -623,14 +544,6 @@ <: u8 in @@ -6161,7 +6508,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coefficient8:u8 = cast (Libcrux.Kem.Kyber.Compress.compress_ciphertext_coefficient 5uy (Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 7 ] -@@ -644,8 +566,6 @@ +@@ -653,8 +566,6 @@ coefficient6 coefficient8 in @@ -6170,7 +6517,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let serialized:t_Array u8 v_OUT_LEN = Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized (sz 5 *! i <: usize) -@@ -675,24 +595,35 @@ +@@ -684,24 +595,35 @@ in serialized @@ -6216,7 +6563,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coefficient:u16 = Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative coefficient in -@@ -705,36 +636,28 @@ +@@ -714,36 +636,28 @@ <: t_Array u8 (sz 32)) in @@ -6264,7 +6611,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in | 4ul -> compress_then_serialize_4_ v_OUT_LEN re | 5ul -> compress_then_serialize_5_ v_OUT_LEN re | _ -> -@@ -742,49 +665,32 @@ +@@ -751,49 +665,32 @@ <: Rust_primitives.Hax.t_Never) @@ -6333,7 +6680,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -792,12 +698,14 @@ +@@ -801,12 +698,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients (sz 4 *! i <: usize) @@ -6351,7 +6698,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -805,12 +713,14 @@ +@@ -814,12 +713,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 4 *! i <: usize) +! sz 1 <: usize) @@ -6369,7 +6716,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -818,12 +728,14 @@ +@@ -827,12 +728,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 4 *! i <: usize) +! sz 2 <: usize) @@ -6387,7 +6734,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -831,43 +743,44 @@ +@@ -840,43 +743,44 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 4 *! i <: usize) +! sz 3 <: usize) @@ -6458,7 +6805,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coefficient1, coefficient2, -@@ -876,21 +789,11 @@ +@@ -885,21 +789,11 @@ coefficient5, coefficient6, coefficient7, @@ -6482,7 +6829,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -898,12 +801,14 @@ +@@ -907,12 +801,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients (sz 8 *! i <: usize) @@ -6500,7 +6847,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -911,12 +816,14 @@ +@@ -920,12 +816,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 1 <: usize) @@ -6518,7 +6865,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -924,12 +831,14 @@ +@@ -933,12 +831,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 2 <: usize) @@ -6536,7 +6883,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -937,12 +846,14 @@ +@@ -946,12 +846,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 3 <: usize) @@ -6554,7 +6901,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -950,12 +861,14 @@ +@@ -959,12 +861,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 4 <: usize) @@ -6572,7 +6919,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -963,12 +876,14 @@ +@@ -972,12 +876,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 5 <: usize) @@ -6590,7 +6937,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -976,12 +891,14 @@ +@@ -985,12 +891,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 6 <: usize) @@ -6608,7 +6955,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -989,33 +906,35 @@ +@@ -998,33 +906,35 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 7 <: usize) @@ -6659,7 +7006,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1028,9 +947,9 @@ +@@ -1037,9 +947,9 @@ i32) } <: @@ -6671,7 +7018,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1043,32 +962,33 @@ +@@ -1052,32 +962,33 @@ i32) } <: @@ -6722,7 +7069,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let coefficient1, coefficient2, -@@ -1077,25 +997,10 @@ +@@ -1086,25 +997,10 @@ coefficient5, coefficient6, coefficient7, @@ -6750,7 +7097,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1103,12 +1008,14 @@ +@@ -1112,12 +1008,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients (sz 8 *! i <: usize) @@ -6768,7 +7115,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1116,12 +1023,14 @@ +@@ -1125,12 +1023,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 1 <: usize) @@ -6786,7 +7133,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1129,12 +1038,14 @@ +@@ -1138,12 +1038,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 2 <: usize) @@ -6804,7 +7151,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1142,12 +1053,14 @@ +@@ -1151,12 +1053,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 3 <: usize) @@ -6822,7 +7169,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1155,12 +1068,14 @@ +@@ -1164,12 +1068,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 4 <: usize) @@ -6840,7 +7187,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1168,12 +1083,14 @@ +@@ -1177,12 +1083,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 5 <: usize) @@ -6858,7 +7205,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1181,12 +1098,14 @@ +@@ -1190,12 +1098,14 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 6 <: usize) @@ -6876,7 +7223,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1194,27 +1113,33 @@ +@@ -1203,27 +1113,33 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 8 *! i <: usize) +! sz 7 <: usize) @@ -6920,7 +7267,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in let i, byte:(usize & u8) = temp_1_ in Core.Iter.Traits.Iterator.f_fold (Core.Iter.Traits.Collect.f_into_iter ({ Core.Ops.Range.f_start = sz 0; -@@ -1226,11 +1151,10 @@ +@@ -1235,11 +1151,10 @@ Core.Ops.Range.t_Range usize) re (fun re j -> @@ -6934,7 +7281,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1244,21 +1168,20 @@ +@@ -1253,21 +1168,20 @@ i32) } <: @@ -6963,7 +7310,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in | 10ul -> deserialize_then_decompress_10_ serialized | 11ul -> deserialize_then_decompress_11_ serialized | _ -> -@@ -1267,12 +1190,12 @@ +@@ -1276,12 +1190,12 @@ <: Rust_primitives.Hax.t_Never) @@ -6981,7 +7328,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in | 4ul -> deserialize_then_decompress_4_ serialized | 5ul -> deserialize_then_decompress_5_ serialized | _ -> -@@ -1280,32 +1203,27 @@ +@@ -1289,32 +1203,27 @@ <: Rust_primitives.Hax.t_Never) @@ -7030,7 +7377,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1313,12 +1231,12 @@ +@@ -1322,12 +1231,12 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients (sz 2 *! i <: usize) @@ -7046,7 +7393,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in { re with Libcrux.Kem.Kyber.Arithmetic.f_coefficients -@@ -1326,28 +1244,34 @@ +@@ -1335,89 +1244,58 @@ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize re .Libcrux.Kem.Kyber.Arithmetic.f_coefficients ((sz 2 *! i <: usize) +! sz 1 <: usize) @@ -7062,14 +7409,58 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in re -#pop-options --#push-options "--z3rlimit 100" --let serialize_uncompressed_ring_element (re: Libcrux.Kem.Kyber.Arithmetic.wfPolynomialRingElement) = -+let serialize_uncompressed_ring_element (re: Libcrux.Kem.Kyber.Arithmetic.t_PolynomialRingElement) = - let serialized:t_Array u8 (sz 384) = Rust_primitives.Hax.repeat 0uy (sz 384) in - let serialized:t_Array u8 (sz 384) = -- Rust_primitives.Iterators.foldi_chunks_exact #_ #_ #(fun _ _ -> True) -- (Rust_primitives.unsize re.Libcrux.Kem.Kyber.Arithmetic.f_coefficients) +-module A = Libcrux.Kem.Kyber.Arithmetic +- +-[@@"opaque_to_smt"] +-let update3 #n (s: t_Array 't n) (offset: usize {v offset + 3 <= v n}) (i0 i1 i2: 't) +- : s': t_Array 't n { Seq.index s' (v offset + 0) == i0 +- /\ Seq.index s' (v offset + 1) == i1 +- /\ Seq.index s' (v offset + 2) == i2 +- /\ (forall i. (i < v offset \/ i >= v offset + 3) ==> Seq.index s' i == Seq.index s i) } +- = let open Rust_primitives.Hax.Monomorphized_update_at in +- let s = update_at_usize s offset i0 in +- let s = update_at_usize s (offset +! sz 1) i1 in +- update_at_usize s (offset +! sz 2) i2 +- +-let slice_map_lemma #t #u #n (f: t -> u) (arr: t_Array t n) +- (start: nat) (len: nat {start + len <= v n}) +- : Lemma ( Seq.slice (Spec.Kyber.map' f arr) start (start + len) +- == Spec.Kyber.map' f (Seq.slice arr start (start + len)) +- ) +- = let f_arr = Spec.Kyber.map' f arr in +- let lhs = Seq.slice f_arr start (start + len) in +- let rhs = Spec.Kyber.map' f (Seq.slice arr start (start + len)) in +- introduce forall i. Seq.index lhs i == Seq.index rhs i +- with ( +- Seq.lemma_index_slice f_arr start (start + len) i; +- Seq.lemma_index_slice arr start (start + len) i; +- let sz_i_start, sz_i = sz (i + start), sz i in +- assert (Seq.index f_arr (v sz_i_start) == f (Seq.index arr (v (sz_i_start)))); +- assert (Seq.index rhs (v sz_i) == f (Seq.index (Seq.slice arr start (start + len)) (v sz_i))) +- ); +- assert (Seq.equal lhs rhs) +- +-#push-options "--z3rlimit 2800 --fuel 0 --ifuel 0 --retry 0 --split_queries no" +-let serialize_uncompressed_ring_element re = +- let serialized: t_Array u8 (sz 384) = Rust_primitives.Hax.repeat 0uy (sz 384) in +- let max = v (sz 384) * 8 in +- assert (max == 256 * 12 /\ max == 384 * 8 /\ 128 * 2 * 12 == max); +- assert (128 == v (length re.f_coefficients /! (sz 2))); +- let serialized = +- Rust_primitives.Iterators.foldi_chunks_exact #_ #_ +- #(fun serialized i -> +- let i = v i in +- i <= 128 /\ ( +- let limit = i * 2 * 12 in +- let coefficients: t_Array _ (sz 256) = Spec.Kyber.map' to_unsigned_representative re.f_coefficients in +- bit_vec_sub (bit_vec_of_int_t_array serialized 8 ) 0 limit +- == bit_vec_sub (bit_vec_of_int_t_array coefficients 12) 0 limit) +- ) +- (re.A.f_coefficients <: t_Array _ (sz 256)) - (sz 2) ++let serialize_uncompressed_ring_element (re: Libcrux.Kem.Kyber.Arithmetic.t_PolynomialRingElement) = ++ let serialized:t_Array u8 (sz 384) = Rust_primitives.Hax.repeat 0uy (sz 384) in ++ let serialized:t_Array u8 (sz 384) = + Core.Iter.Traits.Iterator.f_fold (Core.Iter.Traits.Collect.f_into_iter (Core.Iter.Traits.Iterator.f_enumerate + (Core.Slice.impl__chunks_exact (Rust_primitives.unsize re + .Libcrux.Kem.Kyber.Arithmetic.f_coefficients @@ -7083,51 +7474,75 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fst extraction-secret-in + <: + Core.Iter.Adapters.Enumerate.t_Enumerate (Core.Slice.Iter.t_ChunksExact i32)) serialized - (fun serialized temp_1_ -> - let serialized:t_Array u8 (sz 384) = serialized in -- let i, coefficients:(usize & t_Array (Libcrux.Kem.Kyber.Arithmetic.i32_b (v Libcrux.Kem.Kyber.Constants.v_FIELD_MODULUS - 1)) (sz 2)) = temp_1_ in -- assert (v i < 128); +- (fun serialized it -> let i, coefficients = it in +- +- let coefficient1 = A.to_unsigned_representative (coefficients.[ sz 0 ] <: i32) in +- let coefficient2 = A.to_unsigned_representative (coefficients.[ sz 1 ] <: i32) in +- let (coef1, coef2, coef3) = compress_coefficients_3_ coefficient1 coefficient2 in +- let j = sz 3 *! i in +- let serialized' = update3 serialized j coef1 coef2 coef3 in +- assert ( Seq.slice serialized' (v j) (v j + 3) +- `Seq.equal` Seq.slice (create3 (coef1, coef2, coef3)) 0 3); +- bit_vec_equal_intro +- (let coefficients: t_Array _ (sz 2) = Spec.Kyber.map' to_unsigned_representative coefficients in +- bit_vec_of_int_t_array coefficients 12) +- (retype (bit_vec_sub (bit_vec_of_int_t_array serialized' 8) (3 * v i * 8) (3 * 8))); +- let full_coefficients: t_Array u16 (sz 256) = Spec.Kyber.map' to_unsigned_representative re.f_coefficients in +- slice_map_lemma #_ #u16 to_unsigned_representative re.f_coefficients (v i * 2) 2; +- bit_vec_equal_intro +- (bit_vec_sub (bit_vec_of_int_t_array serialized' 8) 0 (v i * 2 * 12)) +- (bit_vec_sub (bit_vec_of_int_t_array serialized 8 ) 0 (v i * 2 * 12)); +- bit_vec_equal_extend (bit_vec_of_int_t_array serialized' 8) +- (bit_vec_of_int_t_array full_coefficients 12) +- 0 0 (v i * 2 * 12) (3 * 8); +- serialized' <: t_Array u8 (sz 384)) ++ (fun serialized temp_1_ -> ++ let serialized:t_Array u8 (sz 384) = serialized in + let i, coefficients:(usize & t_Slice i32) = temp_1_ in - let coefficient1:u16 = - Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 0 ] <: i32) - in -@@ -1357,8 +1281,6 @@ - let coef1, coef2, coef3:(u8 & u8 & u8) = - compress_coefficients_3_ coefficient1 coefficient2 - in -- assert_spinoff (3 * v i + 3 <= 384); -- assert_spinoff (range (v (sz 3) * v i) usize_inttype); - let serialized:t_Array u8 (sz 384) = - Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized - (sz 3 *! i <: usize) -@@ -1377,4 +1299,3 @@ - serialized) ++ let coefficient1:u16 = ++ Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 0 ] <: i32) ++ in ++ let coefficient2:u16 = ++ Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative (coefficients.[ sz 1 ] <: i32) ++ in ++ let coef1, coef2, coef3:(u8 & u8 & u8) = ++ compress_coefficients_3_ coefficient1 coefficient2 ++ in ++ let serialized:t_Array u8 (sz 384) = ++ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized ++ (sz 3 *! i <: usize) ++ coef1 ++ in ++ let serialized:t_Array u8 (sz 384) = ++ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized ++ ((sz 3 *! i <: usize) +! sz 1 <: usize) ++ coef2 ++ in ++ let serialized:t_Array u8 (sz 384) = ++ Rust_primitives.Hax.Monomorphized_update_at.update_at_usize serialized ++ ((sz 3 *! i <: usize) +! sz 2 <: usize) ++ coef3 ++ in ++ serialized) in serialized -#pop-options +- diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti extraction-secret-independent/Libcrux.Kem.Kyber.Serialize.fsti ---- extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti 2024-02-06 13:56:02.958572128 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Serialize.fsti 2024-02-06 13:56:02.996571897 +0100 -@@ -2,193 +2,118 @@ +--- extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti 2024-02-20 10:46:13.883092516 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Serialize.fsti 2024-02-20 10:46:13.910091973 +0100 +@@ -2,188 +2,118 @@ #set-options "--fuel 0 --ifuel 1 --z3rlimit 15" open Core open FStar.Mul -open MkSeq -- --let int_arr_bitwise_eq -- #t1 #t2 #n1 #n2 -- (arr1: t_Array (int_t t1) n1) -- (d1: num_bits t1) -- (arr2: t_Array (x: int_t t2) n2) -- (d2: num_bits t2 {v n1 * d1 == v n2 * d2}) -- = forall i. i < v n1 * d1 -- ==> bit_vec_of_int_t_array arr1 d1 i == bit_vec_of_int_t_array arr2 d2 i +-open BitVecEq val compress_coefficients_10_ (coefficient1 coefficient2 coefficient3 coefficient4: i32) -- : Prims.Pure (u8 & u8 & u8 & u8 & u8) +- : Prims.Pure (u8 & u8 & u8 & u8 & u8) - (requires True) - (ensures fun tuple -> -- int_arr_bitwise_eq +- int_t_array_bitwise_eq' - (create4 (coefficient1, coefficient2, coefficient3, coefficient4)) 10 - (create5 tuple) 8 - ) @@ -7140,7 +7555,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti extraction-secret-i : Prims.Pure (u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8 & u8) - (requires True) - (ensures fun tuple -> -- int_arr_bitwise_eq +- int_t_array_bitwise_eq' - (create8 (coefficient1, coefficient2, coefficient3, coefficient4, coefficient5, coefficient6, coefficient7, coefficient8)) 11 - (create11 tuple) 8 - ) @@ -7149,7 +7564,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti extraction-secret-i - : Prims.Pure (u8 & u8 & u8) - (requires True) - (ensures fun tuple -> -- int_arr_bitwise_eq +- int_t_array_bitwise_eq' - (create2 (coefficient1, coefficient2)) 12 - (create3 tuple) 8 - ) @@ -7164,7 +7579,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti extraction-secret-i - : Prims.Pure (u8 & u8 & u8 & u8 & u8) - (requires True) - (ensures fun tuple -> -- int_arr_bitwise_eq +- int_t_array_bitwise_eq' - (create8 (coefficient1, coefficient2, coefficient3, coefficient4, coefficient5, coefficient6, coefficient7, coefficient8)) 5 - (create5 tuple) 8 - ) @@ -7174,7 +7589,7 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti extraction-secret-i - : Prims.Pure (i32_d 10 & i32_d 10 & i32_d 10 & i32_d 10) - (requires True) - (ensures fun (r1, r2, r3, r4) -> -- int_arr_bitwise_eq +- int_t_array_bitwise_eq' - (create5 (byte1, byte2, byte3, byte4, byte5)) 8 - (create4 #i32 (r1, r2, r3, r4)) 10 - ) @@ -7190,9 +7605,9 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti extraction-secret-i - : Prims.Pure (i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11 & i32_d 11) - (requires True) - (ensures fun (r1, r2, r3, r4, r5, r6, r7, r8) -> -- int_arr_bitwise_eq -- (create11 (byte1, byte2, byte3, byte4, byte5, byte6, byte7, byte8, byte9, byte10, byte11)) 8 -- (create8 (r1, r2, r3, r4, r5, r6, r7, r8)) 11 +- int_t_array_bitwise_eq' +- (create11 #i32 (byte1, byte2, byte3, byte4, byte5, byte6, byte7, byte8, byte9, byte10, byte11)) 8 +- (create8 #i32 (r1, r2, r3, r4, r5, r6, r7, r8)) 11 - ) + (byte2 byte1 byte3 byte5 byte4 byte6 byte7 byte9 byte8 byte10 byte11: i32) + : Prims.Pure (i32 & i32 & i32 & i32 & i32 & i32 & i32 & i32) @@ -7203,18 +7618,18 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti extraction-secret-i - : Prims.Pure (i32_d 4 & i32_d 4) - (requires True) - (ensures fun (r1, r2) -> -- int_arr_bitwise_eq +- int_t_array_bitwise_eq' - (create1 byte) 8 -- (create2 (r1, r2)) 4 +- (create2 #i32 (r1, r2)) 4 - ) - -val decompress_coefficients_5_ (byte1 byte2 byte3 byte4 byte5: int_t_d i32_inttype 8) - : Prims.Pure (i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5 & i32_d 5) - (requires True) - (ensures fun (r1, r2, r3, r4, r5, r6, r7, r8) -> -- int_arr_bitwise_eq -- (create5 (byte1, byte2, byte3, byte4, byte5)) 8 -- (create8 (r1, r2, r3, r4, r5, r6, r7, r8)) 5 +- int_t_array_bitwise_eq' +- (create5 #i32 (byte1, byte2, byte3, byte4, byte5)) 8 +- (create8 #i32 (r1, r2, r3, r4, r5, r6, r7, r8)) 5 - ) + : Prims.Pure (i32 & i32) Prims.l_True (fun _ -> Prims.l_True) + @@ -7362,7 +7777,10 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti extraction-secret-i -val serialize_uncompressed_ring_element (re: Libcrux.Kem.Kyber.Arithmetic.wfPolynomialRingElement) - : Pure (t_Array u8 (sz 384)) - (requires True) -- (ensures (fun res -> True)) +- (ensures (fun res -> +- let coefficients: t_Array _ (sz 256) = Spec.Kyber.map' Libcrux.Kem.Kyber.Arithmetic.to_unsigned_representative re.f_coefficients in +- int_t_array_bitwise_eq res 8 coefficients 12 +- )) + : Prims.Pure Libcrux.Kem.Kyber.Arithmetic.t_PolynomialRingElement + Prims.l_True + (fun _ -> Prims.l_True) @@ -7370,8 +7788,8 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Serialize.fsti extraction-secret-i +val serialize_uncompressed_ring_element (re: Libcrux.Kem.Kyber.Arithmetic.t_PolynomialRingElement) + : Prims.Pure (t_Array u8 (sz 384)) Prims.l_True (fun _ -> Prims.l_True) diff -ruN extraction-edited/Libcrux.Kem.Kyber.Types.fst extraction-secret-independent/Libcrux.Kem.Kyber.Types.fst ---- extraction-edited/Libcrux.Kem.Kyber.Types.fst 2024-02-06 13:56:02.951572170 +0100 -+++ extraction-secret-independent/Libcrux.Kem.Kyber.Types.fst 2024-02-06 13:56:03.027571709 +0100 +--- extraction-edited/Libcrux.Kem.Kyber.Types.fst 2024-02-20 10:46:13.877092637 +0100 ++++ extraction-secret-independent/Libcrux.Kem.Kyber.Types.fst 2024-02-20 10:46:13.915091872 +0100 @@ -3,31 +3,31 @@ open Core open FStar.Mul @@ -7640,14 +8058,14 @@ diff -ruN extraction-edited/Libcrux.Kem.Kyber.Types.fst extraction-secret-indepe : t_Array u8 v_PRIVATE_KEY_SIZE = impl_12__as_slice v_PRIVATE_KEY_SIZE self.f_sk diff -ruN extraction-edited/Libcrux_platform.fsti extraction-secret-independent/Libcrux_platform.fsti --- extraction-edited/Libcrux_platform.fsti 1970-01-01 01:00:00.000000000 +0100 -+++ extraction-secret-independent/Libcrux_platform.fsti 2024-02-06 13:56:02.991571927 +0100 ++++ extraction-secret-independent/Libcrux_platform.fsti 2024-02-20 10:46:13.923091711 +0100 @@ -0,0 +1,4 @@ +module Libcrux_platform +#set-options "--fuel 0 --ifuel 1 --z3rlimit 15" + +val simd256_support : unit -> bool diff -ruN extraction-edited/Libcrux_platform.Platform.fsti extraction-secret-independent/Libcrux_platform.Platform.fsti ---- extraction-edited/Libcrux_platform.Platform.fsti 2024-02-06 13:56:02.949572182 +0100 +--- extraction-edited/Libcrux_platform.Platform.fsti 2024-02-20 10:46:13.873092717 +0100 +++ extraction-secret-independent/Libcrux_platform.Platform.fsti 1970-01-01 01:00:00.000000000 +0100 @@ -1,20 +0,0 @@ -module Libcrux_platform.Platform @@ -7671,7 +8089,7 @@ diff -ruN extraction-edited/Libcrux_platform.Platform.fsti extraction-secret-ind - -val simd128_support: Prims.unit -> Prims.Pure bool Prims.l_True (fun _ -> Prims.l_True) diff -ruN extraction-edited/MkSeq.fst extraction-secret-independent/MkSeq.fst ---- extraction-edited/MkSeq.fst 2024-02-06 13:56:02.973572036 +0100 +--- extraction-edited/MkSeq.fst 2024-02-20 10:46:13.841093361 +0100 +++ extraction-secret-independent/MkSeq.fst 1970-01-01 01:00:00.000000000 +0100 @@ -1,91 +0,0 @@ -module MkSeq @@ -7766,9 +8184,9 @@ diff -ruN extraction-edited/MkSeq.fst extraction-secret-independent/MkSeq.fst - -%splice[] (init 13 (fun i -> create_gen_tac (i + 1))) diff -ruN extraction-edited/Spec.Kyber.fst extraction-secret-independent/Spec.Kyber.fst ---- extraction-edited/Spec.Kyber.fst 2024-02-06 13:56:02.967572073 +0100 +--- extraction-edited/Spec.Kyber.fst 2024-02-20 10:46:13.884092496 +0100 +++ extraction-secret-independent/Spec.Kyber.fst 1970-01-01 01:00:00.000000000 +0100 -@@ -1,430 +0,0 @@ +@@ -1,433 +0,0 @@ -module Spec.Kyber -#set-options "--fuel 0 --ifuel 1 --z3rlimit 100" -open Core @@ -7947,12 +8365,15 @@ diff -ruN extraction-edited/Spec.Kyber.fst extraction-secret-independent/Spec.Ky - (ensures fun f -> (forall i. bit_vec_of_int_t_array r 8 i == f i)) - = bit_vec_of_int_t_array r 8 - +-unfold let retype_bit_vector #a #b (#_:unit{a == b}) (x: a): b = x +- -let byte_encode (d: dT) (coefficients: polynomial): t_Array u8 (sz (32 * d)) -- = bits_to_bytes #(sz (32 * d)) (bit_vec_of_nat_array coefficients d) +- = bits_to_bytes #(sz (32 * d)) +- (retype_bit_vector (bit_vec_of_nat_array coefficients d)) - -let byte_decode (d: dT) (coefficients: t_Array u8 (sz (32 * d))): polynomial - = let bv = bit_vec_of_int_t_array coefficients 8 in -- let arr: t_Array nat (sz 256) = bit_vec_to_nat_array d bv in +- let arr: t_Array nat (sz 256) = bit_vec_to_nat_array d (retype_bit_vector bv) in - let p = map' (fun (x: nat) -> x % v v_FIELD_MODULUS <: nat) arr in - introduce forall i. Seq.index p i < v v_FIELD_MODULUS - with assert (Seq.index p i == Seq.index p (v (sz i)));