proofs/crypto/secp256k1/laws_verify.bend

bend-collections-laws-crypto@1.0.0.0 · 36 lines · 2 definitions

1import Base
2import bend-collections-laws-crypto@1.0.0.0/src/crypto/secp256k1.bend as K
3import bend-collections-laws-crypto@1.0.0.0/spec/crypto/secp256k1/ecdsa.bend as ES
4import bend-collections-laws-crypto@1.0.0.0/spec/crypto/secp256k1/schnorr.bend as SS
5
6# The clauses of src/crypto/secp256k1.bend: every function is its
7# specification (spec/crypto/secp256k1/, over the natural numbers, from
8# SEC 1 v2, SEC 2, RFC 6979, BIP-340 and the Ethereum yellow paper) for
9# every input (any byte lists, any Bool). The specification takes `one`,
10# the number 1 kept symbolic (h1: one == 1), so that its 256-bit constants
11# p, n and G are never expanded by the checker; every clause holds for the
12# one `one` there is.
13#
14# The clauses are in five files, each proved by its own root (so that
15# each root checks alone): laws.bend (keys and addresses, proof.bend),
16# laws_sign.bend (proof_sign.bend), laws_verify.bend (proof_verify.bend),
17# laws_recover.bend (proof_recover.bend) and laws_schnorr.bend
18# (proof_schnorr.bend). This file: proof_verify.bend.
19
20# ECDSA verification (SEC 1 4.1.4), high s accepted
21law Verify.correct:
22  for +one: Nat
23  for +h1: {one == 1n : Nat}
24  for +pk: List<&2, U32>
25  for +h: List<&2, U32>
26  for +sig: List<&2, U32>
27  {K.verify(pk, h, sig) == ES.verify(one, pk, h, sig, False{}) : Bool}
28
29# the same with high s rejected
30law VerifyStrict.correct:
31  for +one: Nat
32  for +h1: {one == 1n : Nat}
33  for +pk: List<&2, U32>
34  for +h: List<&2, U32>
35  for +sig: List<&2, U32>
36  {K.verify_strict(pk, h, sig) == ES.verify(one, pk, h, sig, True{}) : Bool}