def forgery

bend-collections-laws-crypto@1.0.0.0 · proofs/crypto/aes/aead.bend:456

import Base
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend as G
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/subtle.bend as Eq

456# Opening C || T with T other than the tag of C gives None.
457def forgery(+nk: Nat, +nr: Nat, +key: List<&2, U32>, +iv: List<&2, U32>, +aad: List<&2, U32>, +c: List<&2, U32>, +t0: U32, +t1: U32, +t2: U32, +t3: U32, +t4: U32, +t5: U32, +t6: U32, +t7: U32, +t8: U32, +t9: U32, +t10: U32, +t11: U32, +t12: U32, +t13: U32, +t14: U32, +t15: U32, ne: {[t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15] != G.tag(nk, nr, key, iv, aad, c) : List<&2, U32>}) -> {G.open(nk, nr, key, iv, aad, List.append(&2, U32, c, [t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15])) == None{} : Maybe<&2, List<&2, U32>>}:
458  %Equal.sym(Maybe<&2, List<&2, U32>>, G.open(nk, nr, key, iv, aad, List.append(&2, U32, c, [t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15])), G.open_checked(nk, nr, key, iv, aad, c, [t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15]), open_append(nk, nr, key, iv, aad, c, t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15)) : {_ == None{} : Maybe<&2, List<&2, U32>>}
459  %Equal.sym(Bool, Eq.equal([t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15], G.tag(nk, nr, key, iv, aad, c)), False{}, equal_false([t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15], G.tag(nk, nr, key, iv, aad, c), ne)) : {G.accept(_, G.gctr(nk, nr, key, c, G.inc32(G.j0(iv)))) == None{} : Maybe<&2, List<&2, U32>>}
460  {==}