def m128_lo

bend-collections-laws-crypto@1.0.0.0 · proofs/math/random/uint64n.bend:116

import Base
import bend-collections-laws-crypto@1.0.0.0/spec/lib/common.bend as C
import bend-collections-laws-crypto@1.0.0.0/spec/math/w64.bend as SW
import bend-collections-laws-crypto@1.0.0.0/src/math/u64.bend as WU
import bend-collections-laws-crypto@1.0.0.0/src/math/w64.bend as X
import bend-collections-laws-crypto@1.0.0.0/proofs/math/typed/width.bend as WI
import bend-collections-laws-crypto@1.0.0.0/proofs/math/typed/w64m128.bend as M128

116# the halves of the 128-bit product
117def m128_lo(+x: WU.U64, +n: WU.U64) -> {SW.value(X.pfst(X.mul128(x, n))) == C.low(64n, Nat.mul(SW.value(x), SW.value(n))) : Nat}:
118  match x n:
119    case WU.U64{+al, +ah} WU.U64{+bl, +bh}:
120      +r = SW.value(X.pfst(X.mul128(WU.U64{al, ah}, WU.U64{bl, bh})))
121      +q = SW.value(X.psnd(X.mul128(WU.U64{al, ah}, WU.U64{bl, bh})))
122      %M128.m128_value(al, ah, bl, bh) : {r == C.low(64n, _) : Nat}
123      Equal.sym(Nat, C.low(64n, Nat.add(r, C.shift(64n, q))), r, WI.low_u(64n, r, q, M128.fit64(X.pfst(X.mul128(WU.U64{al, ah}, WU.U64{bl, bh})))))