def red_r

bend-collections-laws-crypto@1.0.0.0 · proofs/crypto/secp256k1/scalarops.bend:61

import Base
import bend-collections-laws-crypto@1.0.0.0/spec/lib/common.bend as C
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/secp256k1/field.bend as FS
import bend-collections-laws-crypto@1.0.0.0/src/crypto/secp256k1/scalar.bend as S
import bend-collections-laws-crypto@1.0.0.0/proofs/lib/logic.bend as Lg
import bend-collections-laws-crypto@1.0.0.0/proofs/math/natural/arith.bend as NR
import bend-collections-laws-crypto@1.0.0.0/proofs/crypto/secp256k1/limbs.bend as LV
import bend-collections-laws-crypto@1.0.0.0/proofs/crypto/secp256k1/ineq.bend as I
import bend-collections-laws-crypto@1.0.0.0/proofs/crypto/secp256k1/consts.bend as K

61# the reduced value below p, in the specification's terms
62def red_r(+one: Nat, +h1: {one == 1n : Nat}, +xs: List<&2, Nat>, +hx: {Nat.is_lt(LV.ev(xs), Nat.mul(C.shift(256n, one), C.shift(256n, one))) == True{} : Bool}) -> {FS.reduced(one, FS.order(one), S.reduce_u(xs)) == True{} : Bool}:
63  +lt = I.lt_subst_l(Nat.mod(LV.ev(xs), 1n+K.np(one)), LV.ev(S.reduce_u(xs)), 1n+K.np(one), Equal.sym(Nat, LV.ev(S.reduce_u(xs)), Nat.mod(LV.ev(xs), 1n+K.np(one)), red_e(one, h1, xs, hx)), NR.dm_lt(K.np(one), LV.ev(xs)))
64  +lt2 = I.lt_subst_l(LV.ev(S.reduce_u(xs)), FS.value(one, S.reduce_u(xs)), 1n+K.np(one), Equal.sym(Nat, FS.value(one, S.reduce_u(xs)), LV.ev(S.reduce_u(xs)), LV.ev_value(one, h1, S.reduce_u(xs))), lt)
65  +lt3 = I.lt_subst_r(FS.value(one, S.reduce_u(xs)), 1n+K.np(one), FS.order(one), Equal.sym(Nat, FS.order(one), 1n+K.np(one), K.order_eq(one, h1)), lt2)
66  Lg.and_intro(FS.limbs16(one, 16n, S.reduce_u(xs)), Nat.is_lt(FS.value(one, S.reduce_u(xs)), FS.order(one)), red_l(one, h1, xs, hx), lt3)