proofs/crypto/blake/blake2b/laws.bend

bend-collections-laws-crypto@1.0.0.0 · 104 lines · 5 definitions

1import Base
2import bend-collections-laws-crypto@1.0.0.0/src/crypto/blake/blake2b/types.bend as T
3import bend-collections-laws-crypto@1.0.0.0/src/crypto/blake/blake2b/compress.bend as F
4import bend-collections-laws-crypto@1.0.0.0/src/crypto/blake/blake2b/blake2b.bend as I
5import bend-collections-laws-crypto@1.0.0.0/spec/crypto/blake/blake2b.bend as S
6
7# The public BLAKE2b-512 API equals the RFC 7693 specification of spec/crypto/blake/blake2b.bend for
8# every packed input array and every byte length: the same digest, or None for
9# both when byte_length exceeds 4 * the array's capacity.
10law blake2b_correct:
11  for words: Array<U32>
12  for +byte_length: Nat
13  {I.blake2b(words,byte_length) == S.blake2b(words,byte_length) : Maybe<&1,Array<U32>>}
14
15# The compression function F on a block that is not the last, for every chaining value h,
16# counter t and message block.
17law compress_correct:
18  for +h: T.Chain
19  for +t: T.Counter
20  for +w0: U32
21  for +w1: U32
22  for +w2: U32
23  for +w3: U32
24  for +w4: U32
25  for +w5: U32
26  for +w6: U32
27  for +w7: U32
28  for +w8: U32
29  for +w9: U32
30  for +w10: U32
31  for +w11: U32
32  for +w12: U32
33  for +w13: U32
34  for +w14: U32
35  for +w15: U32
36  for +w16: U32
37  for +w17: U32
38  for +w18: U32
39  for +w19: U32
40  for +w20: U32
41  for +w21: U32
42  for +w22: U32
43  for +w23: U32
44  for +w24: U32
45  for +w25: U32
46  for +w26: U32
47  for +w27: U32
48  for +w28: U32
49  for +w29: U32
50  for +w30: U32
51  for +w31: U32
52  {F.compress(h,t,w0,w1,w2,w3,w4,w5,w6,w7,w8,w9,w10,w11,w12,w13,w14,w15,w16,w17,w18,w19,w20,w21,w22,w23,w24,w25,w26,w27,w28,w29,w30,w31) == S.compress(h,[T.W{w0,w1},T.W{w2,w3},T.W{w4,w5},T.W{w6,w7},T.W{w8,w9},T.W{w10,w11},T.W{w12,w13},T.W{w14,w15},T.W{w16,w17},T.W{w18,w19},T.W{w20,w21},T.W{w22,w23},T.W{w24,w25},T.W{w26,w27},T.W{w28,w29},T.W{w30,w31}],t,False{}) : T.Chain}
53
54# The compression function F on the last block, for every chaining value h,
55# counter t and message block.
56law compress_last_correct:
57  for +h: T.Chain
58  for +t: T.Counter
59  for +w0: U32
60  for +w1: U32
61  for +w2: U32
62  for +w3: U32
63  for +w4: U32
64  for +w5: U32
65  for +w6: U32
66  for +w7: U32
67  for +w8: U32
68  for +w9: U32
69  for +w10: U32
70  for +w11: U32
71  for +w12: U32
72  for +w13: U32
73  for +w14: U32
74  for +w15: U32
75  for +w16: U32
76  for +w17: U32
77  for +w18: U32
78  for +w19: U32
79  for +w20: U32
80  for +w21: U32
81  for +w22: U32
82  for +w23: U32
83  for +w24: U32
84  for +w25: U32
85  for +w26: U32
86  for +w27: U32
87  for +w28: U32
88  for +w29: U32
89  for +w30: U32
90  for +w31: U32
91  {F.compress_last(h,t,w0,w1,w2,w3,w4,w5,w6,w7,w8,w9,w10,w11,w12,w13,w14,w15,w16,w17,w18,w19,w20,w21,w22,w23,w24,w25,w26,w27,w28,w29,w30,w31) == S.compress(h,[T.W{w0,w1},T.W{w2,w3},T.W{w4,w5},T.W{w6,w7},T.W{w8,w9},T.W{w10,w11},T.W{w12,w13},T.W{w14,w15},T.W{w16,w17},T.W{w18,w19},T.W{w20,w21},T.W{w22,w23},T.W{w24,w25},T.W{w26,w27},T.W{w28,w29},T.W{w30,w31}],t,True{}) : T.Chain}
92
93# Every digest is sixteen words (64 bytes).
94law digest_size:
95  for h: T.Chain
96  {Pair.snd(Array<U32>,U32,Array.size(U32,I.digest(h))) == 16 : U32}
97
98# Lengths past the array's capacity are rejected.
99law capacity_rejection:
100  for a: Array<U32>
101  for +n: Nat
102  for +capacity: U32
103  for invalid: {Nat.is_le(n,Nat.mul(4n,U32.to_nat(capacity))) == False{} : Bool}
104  {I.sized(n,(a,capacity)) == None{} : Maybe<&1,Array<U32>>}