def ap.last_eq

bend-osdev-aes@0.1.0.0 · PROOF.bend:2131

import Base
import bend-osdev-aes@0.1.0.0/aes.bend as X
import bend-collections@1.0.0.0/src/crypto/aes/aes.bend as A
import bend-collections@1.0.0.0/src/crypto/aes/types.bend as TT

2131def ap.last_eq(+z: TT.State, +k: TT.State) -> {A.last_round(X.aes.mask(z), X.aes.mask(k)) == X.aes.mask(A.add_round_key(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(k))) : TT.State}:
2132  %Equal.sym(TT.State, A.sub_bytes(X.aes.mask(z)), X.aes.mask(A.sub_bytes(X.aes.mask(z))), ap.subl(z)) : {A.add_round_key(A.shift_rows(_), X.aes.mask(k)) == X.aes.mask(A.add_round_key(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(k))) : TT.State}
2133  %Equal.sym(TT.State, A.shift_rows(X.aes.mask(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), ap.shm(A.sub_bytes(X.aes.mask(z)))) : {A.add_round_key(_, X.aes.mask(k)) == X.aes.mask(A.add_round_key(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(k))) : TT.State}
2134  ap.arkl(A.shift_rows(A.sub_bytes(X.aes.mask(z))), k)