Aead.roundtrip: def of bend-collections-laws-crypto@1.0.0.0
Import: import bend-collections-laws-crypto@1.0.0.0/proofs/crypto/aes/aead.bend as Aead
Lines 447-454 of bend-collections-laws-crypto@1.0.0.0/proofs/crypto/aes/aead.bend: https://jend.leeeet.dev/read.txt?path=bend-collections-laws-crypto@1.0.0.0/proofs/crypto/aes/aead.bend&start_line=447&end_line=454

import Base
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend as G
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/subtle.bend as Eq

# Opening what seal produced gives the plaintext back.
def roundtrip(+nk: Nat, +nr: Nat, +key: List<&2, U32>, +iv: List<&2, U32>, +aad: List<&2, U32>, +pt: List<&2, U32>) -> {G.open(nk, nr, key, iv, aad, G.seal(nk, nr, key, iv, aad, pt)) == Some{pt} : Maybe<&2, List<&2, U32>>}:
  %Equal.sym(List<&2, U32>, G.tag(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv)))), [tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)], tag16(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))))) : {G.open(nk, nr, key, iv, aad, List.append(&2, U32, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), _)) == Some{pt} : Maybe<&2, List<&2, U32>>}
  %Equal.sym(Maybe<&2, List<&2, U32>>, G.open(nk, nr, key, iv, aad, List.append(&2, U32, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), [tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)])), G.open_checked(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), [tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)]), open_append(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n))) : {_ == Some{pt} : Maybe<&2, List<&2, U32>>}
  %Equal.sym(List<&2, U32>, G.tag(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv)))), [tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)], tag16(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))))) : {G.accept(Eq.equal([tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)], _), G.gctr(nk, nr, key, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), G.inc32(G.j0(iv)))) == Some{pt} : Maybe<&2, List<&2, U32>>}
  %Equal.sym(Bool, Eq.equal([tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)], [tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)]), True{}, equal_refl([tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)])) : {G.accept(_, G.gctr(nk, nr, key, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), G.inc32(G.j0(iv)))) == Some{pt} : Maybe<&2, List<&2, U32>>}
  %gctr_inv(nk, nr, key, pt, G.inc32(G.j0(iv))) : {Some{G.gctr(nk, nr, key, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), G.inc32(G.j0(iv)))} == Some{_} : Maybe<&2, List<&2, U32>>}
  {==}

Uses (21):
  https://jend.leeeet.dev/definition.txt?path=Base/base.bend&name=Bool
  https://jend.leeeet.dev/definition.txt?path=Base/base.bend&name=Equal.sym
  https://jend.leeeet.dev/definition.txt?path=Base/base.bend&name=List
  https://jend.leeeet.dev/definition.txt?path=Base/base.bend&name=List.append
  https://jend.leeeet.dev/definition.txt?path=Base/base.bend&name=Maybe
  https://jend.leeeet.dev/definition.txt?path=Base/base.bend&name=Nat
  https://jend.leeeet.dev/definition.txt?path=Base/base.bend&name=U32
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/proofs/crypto/aes/aead.bend&name=equal_refl
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/proofs/crypto/aes/aead.bend&name=gctr_inv
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/proofs/crypto/aes/aead.bend&name=open_append
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/proofs/crypto/aes/aead.bend&name=tag16
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/proofs/crypto/aes/aead.bend&name=tb
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend&name=accept
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend&name=gctr
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend&name=inc32
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend&name=j0
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend&name=open
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend&name=open_checked
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend&name=seal
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend&name=tag
  https://jend.leeeet.dev/definition.txt?path=bend-collections-laws-crypto@1.0.0.0/spec/crypto/subtle.bend&name=equal