def pd.dc0

bend-osdev-cbc@0.1.0.0 · PROOF_padded.bend:108

import Base
import bend-osdev-bytes@0.1.1.0/bytes.bend as B
import bend-osdev-bytes@0.1.1.0/LAWS.bend as BL
import bend-osdev-mode-core@0.1.0.0/mode_core.bend as M
import bend-osdev-pkcs7@0.1.0.0/pkcs7.bend as P
import bend-osdev-cbc@0.1.0.0/cbc.bend as C

108# an empty ciphertext cannot decrypt to M': its decryption is empty, and
109# unpadding the empty string is refused
110def pd.dc0(~K: Data, ~dec: K -> M.CmBlock -> M.CmBlock, +k: K, +iv: B.Octets, +mp: B.Octets, +m: B.Octets, e2: {P.Pkcs7.unpad(16n, mp) == Done{m} : Result<&2, &2, M.CmError, B.Octets>}, +c: B.Octets, eo: {Nat.is_lt(0n, B.Octets.len(c)) == False{} : Bool}, e1: {C.Cbc.decrypt(~K, ~dec, k, iv, c) == Done{mp} : Result<&2, &2, M.CmError, B.Octets>}) -> {C.Cbc.decrypt_padded(~K, ~dec, k, iv, c) == Done{m} : Result<&2, &2, M.CmError, B.Octets>}:
111  # c is empty
112  +z = pd.len0(B.Octets.len(c))(eo)
113  +nl = pd.nil(B.Octets.to_list(c))(Equal.trans(Nat, B.len(B.Octets.to_list(c)), B.Octets.len(c), 0n, Equal.sym(Nat, B.Octets.len(c), B.len(B.Octets.to_list(c)), BL.octets_len_list(c)), z))
114  # so M' is empty
115  +e3 = Equal.trans(Result<&2, &2, M.CmError, B.Octets>, C.cbc.d1.fast(~K, ~dec, k, C.cbc.iv(iv), Nil{}), C.Cbc.decrypt(~K, ~dec, k, iv, c), Done{mp}, Equal.cong(List<&2, U32>, Result<&2, &2, M.CmError, B.Octets>, l => C.cbc.d1.fast(~K, ~dec, k, C.cbc.iv(iv), l), Nil{}, B.Octets.to_list(c), Equal.sym(List<&2, U32>, B.Octets.to_list(c), Nil{}, nl)), e1)
116  +z2 = pd.e0(~K, ~dec, k, C.cbc.iv(iv), mp)(e3)
117  # and unpadding it is refused
118  +e4 = Equal.trans(Result<&2, &2, M.CmError, B.Octets>, Fail{M.CmTooShort{0n}}, P.Pkcs7.unpad(16n, mp), Done{m}, Equal.cong(Nat, Result<&2, &2, M.CmError, B.Octets>, n => pk.ug(16n, mp, n, Nat.mod(n, 16n)), 0n, B.Octets.len(mp), Equal.sym(Nat, B.Octets.len(mp), 0n, z2)), e2)
119  Empty.absurd({C.Cbc.decrypt_padded(~K, ~dec, k, iv, c) == Done{m} : Result<&2, &2, M.CmError, B.Octets>}, pd.fd(B.Octets, M.CmTooShort{0n}, m, e4))