law iforgery

bend-collections-laws-crypto@1.0.0.0 · proofs/crypto/aead/chacha20poly1305.bend:322

import Base
import bend-collections-laws-crypto@1.0.0.0/src/crypto/aead/chacha20poly1305.bend as I

322# The implementation's tag is the specification's, so a t other than the
323# implementation's tag is rejected by the implementation.
324law iforgery:
325  for +key: List<&2, U32>
326  for +nonce: List<&2, U32>
327  for +aad: List<&2, U32>
328  for +ct: List<&2, U32>
329  for +t: List<&2, U32>
330  for +ht: {List.length(&2, U32, t) == 16n : Nat}
331  for ne: {t != I.tag(key, nonce, aad, ct) : List<&2, U32>}
332  {I.open(key, nonce, aad, List.append(&2, U32, ct, t)) == None{} : Maybe<&2, List<&2, U32>>}