def ap.last_inv

bend-osdev-aes@0.1.0.0 · PROOF.bend:2126

import Base
import bend-osdev-aes@0.1.0.0/aes.bend as X
import bend-collections@1.0.0.0/src/crypto/aes/aes.bend as A
import bend-collections@1.0.0.0/src/crypto/aes/types.bend as TT

2126def ap.last_inv(+z: TT.State, +k: TT.State) -> {X.aes.inv_last(A.last_round(X.aes.mask(z), X.aes.mask(k)), X.aes.mask(k)) == X.aes.mask(z) : TT.State}:
2127  %Equal.sym(TT.State, A.add_round_key(A.add_round_key(A.shift_rows(A.sub_bytes(X.aes.mask(z))), X.aes.mask(k)), X.aes.mask(k)), A.shift_rows(A.sub_bytes(X.aes.mask(z))), ap.ark2(A.shift_rows(A.sub_bytes(X.aes.mask(z))), X.aes.mask(k))) : {X.aes.inv_sub(X.aes.inv_shift(_)) == X.aes.mask(z) : TT.State}
2128  %Equal.sym(TT.State, X.aes.inv_shift(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), A.sub_bytes(X.aes.mask(z)), ap.shift(A.sub_bytes(X.aes.mask(z)))) : {X.aes.inv_sub(_) == X.aes.mask(z) : TT.State}
2129  ap.subi(z)