def roundtrip

bend-collections-laws-crypto@1.0.0.0 · proofs/crypto/aes/aead.bend:447

import Base
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend as G
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/subtle.bend as Eq

447# Opening what seal produced gives the plaintext back.
448def roundtrip(+nk: Nat, +nr: Nat, +key: List<&2, U32>, +iv: List<&2, U32>, +aad: List<&2, U32>, +pt: List<&2, U32>) -> {G.open(nk, nr, key, iv, aad, G.seal(nk, nr, key, iv, aad, pt)) == Some{pt} : Maybe<&2, List<&2, U32>>}:
449  %Equal.sym(List<&2, U32>, G.tag(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv)))), [tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)], tag16(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))))) : {G.open(nk, nr, key, iv, aad, List.append(&2, U32, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), _)) == Some{pt} : Maybe<&2, List<&2, U32>>}
450  %Equal.sym(Maybe<&2, List<&2, U32>>, G.open(nk, nr, key, iv, aad, List.append(&2, U32, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), [tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)])), G.open_checked(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), [tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)]), open_append(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n))) : {_ == Some{pt} : Maybe<&2, List<&2, U32>>}
451  %Equal.sym(List<&2, U32>, G.tag(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv)))), [tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)], tag16(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))))) : {G.accept(Eq.equal([tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)], _), G.gctr(nk, nr, key, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), G.inc32(G.j0(iv)))) == Some{pt} : Maybe<&2, List<&2, U32>>}
452  %Equal.sym(Bool, Eq.equal([tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)], [tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)]), True{}, equal_refl([tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 0n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 1n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 2n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 3n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 4n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 5n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 6n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 7n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 8n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 9n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 10n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 11n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 12n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 13n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 14n), tb(nk, nr, key, iv, aad, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), 15n)])) : {G.accept(_, G.gctr(nk, nr, key, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), G.inc32(G.j0(iv)))) == Some{pt} : Maybe<&2, List<&2, U32>>}
453  %gctr_inv(nk, nr, key, pt, G.inc32(G.j0(iv))) : {Some{G.gctr(nk, nr, key, G.gctr(nk, nr, key, pt, G.inc32(G.j0(iv))), G.inc32(G.j0(iv)))} == Some{_} : Maybe<&2, List<&2, U32>>}
454  {==}