law forgery

bend-collections-laws-crypto@1.0.0.0 · proofs/crypto/aead/laws.bend:175

import Base
import bend-collections-laws-crypto@1.0.0.0/src/crypto/aead.bend as A

175# ciphertext || t is rejected for every 16-byte t other than the tag of the
176# ciphertext under this key, nonce and aad.
177law forgery:
178  for +alg: A.Alg
179  for +key: List<&2, U32>
180  for +nonce: List<&2, U32>
181  for +aad: List<&2, U32>
182  for +ct: List<&2, U32>
183  for +t: List<&2, U32>
184  for +hk: {List.length(&2, U32, key) == A.key_size(alg) : Nat}
185  for +hn: {List.length(&2, U32, nonce) == A.nonce_size(alg) : Nat}
186  for +ht: {List.length(&2, U32, t) == 16n : Nat}
187  for ne: {t != expected_tag(alg, key, nonce, aad, ct) : List<&2, U32>}
188  {A.decrypt(alg, key, nonce, aad, List.append(&2, U32, ct, t)) == None{} : Maybe<&2, List<&2, U32>>}