law Api128.forgery

bend-collections-laws-crypto@1.0.0.0 · proofs/crypto/aes/laws.bend:248

import Base
import bend-collections-laws-crypto@1.0.0.0/src/crypto/aesgcm.bend as GCM
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/aes/gcm.bend as G

248# A wrong tag gives None.
249law Api128.forgery:
250  for +key: List<&2, U32>
251  for +h: {List.length(&2, U32, key) == 16n : Nat}
252  for +n0: U32
253  for +n1: U32
254  for +n2: U32
255  for +n3: U32
256  for +n4: U32
257  for +n5: U32
258  for +n6: U32
259  for +n7: U32
260  for +n8: U32
261  for +n9: U32
262  for +n10: U32
263  for +n11: U32
264  for +aad: List<&2, U32>
265  for +c: List<&2, U32>
266  for +t0: U32
267  for +t1: U32
268  for +t2: U32
269  for +t3: U32
270  for +t4: U32
271  for +t5: U32
272  for +t6: U32
273  for +t7: U32
274  for +t8: U32
275  for +t9: U32
276  for +t10: U32
277  for +t11: U32
278  for +t12: U32
279  for +t13: U32
280  for +t14: U32
281  for +t15: U32
282  for ne: {[t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15] != G.aes_tag(key, [n0, n1, n2, n3, n4, n5, n6, n7, n8, n9, n10, n11], aad, c) : List<&2, U32>}
283  {GCM.aes128_gcm_decrypt(key, [n0, n1, n2, n3, n4, n5, n6, n7, n8, n9, n10, n11], aad, List.append(&2, U32, c, [t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15])) == None{} : Maybe<&2, List<&2, U32>>}