PROOF.bend

bend-osdev-crypto@0.1.0.0 · 1,828 lines · 97 definitions

1import Base
2import bend-osdev-bytes@0.1.0.0/bytes.bend as B
3import bend-osdev-bytes@0.1.0.0/LAWS.bend as BL
4import bend-osdev-bytes@0.1.0.0/PROOF.bend as BP
5import bend-osdev-word64@0.1.0.0/word64.bend as W
6import bend-osdev-cipher-modes@0.1.0.0/cipher_modes.bend as M
7import bend-osdev-cipher-modes@0.1.0.0/aes.bend as X
8import bend-osdev-cipher-modes@0.1.0.0/ccm.bend as MC
9import bend-osdev-legacy-ciphers@0.1.0.0/legacy_ciphers.bend as L
10import bend-osdev-legacy-ciphers@0.1.0.0/des.bend as D
11import bend-osdev-legacy-ciphers@0.1.0.0/tdes.bend as T
12import bend-osdev-legacy-ciphers@0.1.0.0/sm4.bend as S
13import bend-osdev-legacy-ciphers@0.1.0.0/camellia.bend as Ca
14import bend-osdev-legacy-ciphers@0.1.0.0/serpent.bend as Sp
15import bend-osdev-legacy-ciphers@0.1.0.0/twofish.bend as Tf
16import bend-osdev-legacy-ciphers@0.1.0.0/rc4.bend as R
17import bend-osdev-legacy-ciphers@0.1.0.0/aria.bend as Ar
18import bend-osdev-legacy-ciphers@0.1.0.0/cast6.bend as C6
19import bend-osdev-legacy-ciphers@0.1.0.0/blowfish.bend as Bf
20import bend-osdev-legacy-ciphers@0.1.0.0/cast5.bend as C5
21import bend-osdev-legacy-ciphers@0.1.0.0/tea.bend as Te
22import bend-osdev-legacy-ciphers@0.1.0.0/xtea.bend as Xt
23import bend-osdev-legacy-ciphers@0.1.0.0/fcrypt.bend as Fc
24import bend-osdev-legacy-ciphers@0.1.0.0/LAWS.bend as LL
25import bend-osdev-legacy-ciphers@0.1.0.0/PROOF.bend as LP
26import bend-osdev-crc@0.1.0.0/crc.bend as C
27import bend-osdev-crc@0.1.0.0/LAWS.bend as CL
28import bend-osdev-crc@0.1.0.0/PROOF.bend as CP
29import bend-osdev-crypto@0.1.0.0/crypto.bend as Cr
30import bend-osdev-crypto@0.1.0.0/stream.bend as St
31import bend-osdev-crypto@0.1.0.0/block.bend as Bk
32import bend-osdev-crypto@0.1.0.0/modes.bend as Md
33import bend-osdev-crypto@0.1.0.0/pcbc.bend as Pc
34import bend-osdev-crypto@0.1.0.0/lrw.bend as Lw
35import bend-osdev-crypto@0.1.0.0/xcbc.bend as Xc
36import bend-osdev-crypto@0.1.0.0/vmac.bend as Vm
37import bend-osdev-crypto@0.1.0.0/cts.bend as Ct
38import bend-osdev-crypto@0.1.0.0/octets.bend as Oc
39import bend-osdev-gf@0.1.0.0/gf128.bend as G
40import bend-osdev-crypto@0.1.0.0/hash.bend as H
41import bend-osdev-crypto@0.1.0.0/mac.bend as Mc
42import bend-osdev-crypto@0.1.0.0/hmac.bend as Hm
43import bend-osdev-crypto@0.1.0.0/hkdf.bend as Hk
44import bend-osdev-crypto@0.1.0.0/sign.bend as Sg
45import bend-osdev-crypto@0.1.0.0/kex.bend as Kx
46import bend-osdev-crypto@0.1.0.0/inst_cm.bend as CM
47import bend-osdev-crypto@0.1.0.0/inst_lc.bend as LC
48import bend-osdev-crypto@0.1.0.0/inst_aes.bend as A
49import bend-osdev-crypto@0.1.0.0/inst_rc4.bend as RC
50import bend-osdev-crypto@0.1.0.0/inst_ccm.bend as CC
51import bend-osdev-crypto@0.1.0.0/inst_cmac.bend as CMI
52import bend-osdev-crypto@0.1.0.0/inst_crc.bend as CR
53import bend-osdev-crypto@0.1.0.0/inst_sha2.bend as SH
54import bend-osdev-crypto@0.1.0.0/inst_sha3.bend as S3
55import bend-osdev-hashes@0.1.0.0/hashes.bend as Hs
56import bend-osdev-hashes@0.1.0.0/md4.bend as HM4
57import bend-osdev-hashes@0.1.0.0/md5.bend as HM5
58import bend-osdev-hashes@0.1.0.0/sha1.bend as HS1
59import bend-osdev-hashes@0.1.0.0/ripemd160.bend as HRM
60import bend-osdev-hashes@0.1.0.0/sm3.bend as HSM
61import bend-osdev-hashes@0.1.0.0/streebog.bend as HST
62import bend-osdev-hashes@0.1.0.0/michael.bend as HMI
63import bend-osdev-crypto@0.1.0.0/inst_michael.bend as MIC
64import bend-osdev-crypto@0.1.0.0/pbkdf2.bend as Pb
65import bend-osdev-crypto@0.1.0.0/inst_pbkdf2.bend as PbI
66import bend-osdev-crypto@0.1.0.0/kbkdf.bend as Kb
67import bend-osdev-crypto@0.1.0.0/inst_kbkdf.bend as KbI
68import bend-osdev-hashes@0.1.0.0/LAWS.bend as HSL
69import bend-osdev-hashes@0.1.0.0/PROOF.bend as HSP
70import bend-collections-laws-crypto@1.0.0.0/spec/crypto/sha.bend as F256
71import bend-collections-laws-crypto@1.0.0.0/spec/crypto/sha512.bend as F512
72import bend-collections-laws-crypto@1.0.0.0/spec/crypto/sha3.bend as F202
73import bend-collections-laws-crypto@1.0.0.0/src/crypto/hash.bend as Hc
74import bend-collections-laws-crypto@1.0.0.0/proofs/crypto/hash/laws.bend as HL
75import bend-collections-laws-crypto@1.0.0.0/proofs/crypto/hash/proof.bend as HP
76import bend-osdev-crypto@0.1.0.0/LAWS.bend as Laws
77
78# BEGIN GENERATED by gen/proof.py: bits
79# the low byte of a XOR depends only on the low byte of its first operand
80def byte_xor_byte(z: U32, k: U32) -> {B.byte(U32.xor(z, k)) == B.byte(U32.xor(B.byte(z), k)) : U32}:
81  match z k:
82    case U32{WCon{a0, WCon{a1, WCon{a2, WCon{a3, WCon{a4, WCon{a5, WCon{a6, WCon{a7, WCon{a8, WCon{a9, WCon{a10, WCon{a11, WCon{a12, WCon{a13, WCon{a14, WCon{a15, WCon{a16, WCon{a17, WCon{a18, WCon{a19, WCon{a20, WCon{a21, WCon{a22, WCon{a23, WCon{a24, WCon{a25, WCon{a26, WCon{a27, WCon{a28, WCon{a29, WCon{a30, WCon{a31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}} U32{WCon{b0, WCon{b1, WCon{b2, WCon{b3, WCon{b4, WCon{b5, WCon{b6, WCon{b7, WCon{b8, WCon{b9, WCon{b10, WCon{b11, WCon{b12, WCon{b13, WCon{b14, WCon{b15, WCon{b16, WCon{b17, WCon{b18, WCon{b19, WCon{b20, WCon{b21, WCon{b22, WCon{b23, WCon{b24, WCon{b25, WCon{b26, WCon{b27, WCon{b28, WCon{b29, WCon{b30, WCon{b31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
83      {==}
84
85# a word's big-endian bytes are four
86def be32_len(v: U32) -> {B.Octets.len(B.Octets.be32(v)) == 4n : Nat}:
87  match v:
88    case U32{WCon{a0, WCon{a1, WCon{a2, WCon{a3, WCon{a4, WCon{a5, WCon{a6, WCon{a7, WCon{a8, WCon{a9, WCon{a10, WCon{a11, WCon{a12, WCon{a13, WCon{a14, WCon{a15, WCon{a16, WCon{a17, WCon{a18, WCon{a19, WCon{a20, WCon{a21, WCon{a22, WCon{a23, WCon{a24, WCon{a25, WCon{a26, WCon{a27, WCon{a28, WCon{a29, WCon{a30, WCon{a31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
89      {==}
90
91# a 128-bit block's 16 bytes, masked and read back
92def f128_bytes(b: M.CmBlock) -> {CM.cr.f128.block(B.mask(CM.cr.f128.bytes(b))) == Some{b} : Maybe<&2, M.CmBlock>}:
93  match b:
94    case M.CmBlock{U32{WCon{a0, WCon{a1, WCon{a2, WCon{a3, WCon{a4, WCon{a5, WCon{a6, WCon{a7, WCon{a8, WCon{a9, WCon{a10, WCon{a11, WCon{a12, WCon{a13, WCon{a14, WCon{a15, WCon{a16, WCon{a17, WCon{a18, WCon{a19, WCon{a20, WCon{a21, WCon{a22, WCon{a23, WCon{a24, WCon{a25, WCon{a26, WCon{a27, WCon{a28, WCon{a29, WCon{a30, WCon{a31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{d0, WCon{d1, WCon{d2, WCon{d3, WCon{d4, WCon{d5, WCon{d6, WCon{d7, WCon{d8, WCon{d9, WCon{d10, WCon{d11, WCon{d12, WCon{d13, WCon{d14, WCon{d15, WCon{d16, WCon{d17, WCon{d18, WCon{d19, WCon{d20, WCon{d21, WCon{d22, WCon{d23, WCon{d24, WCon{d25, WCon{d26, WCon{d27, WCon{d28, WCon{d29, WCon{d30, WCon{d31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{e0, WCon{e1, WCon{e2, WCon{e3, WCon{e4, WCon{e5, WCon{e6, WCon{e7, WCon{e8, WCon{e9, WCon{e10, WCon{e11, WCon{e12, WCon{e13, WCon{e14, WCon{e15, WCon{e16, WCon{e17, WCon{e18, WCon{e19, WCon{e20, WCon{e21, WCon{e22, WCon{e23, WCon{e24, WCon{e25, WCon{e26, WCon{e27, WCon{e28, WCon{e29, WCon{e30, WCon{e31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
95      {==}
96# END GENERATED: bits
97
98# XOR undone: a == (a xor b) xor b, for every bit, word and byte. Each lemma
99# is stated simple side first, the form a rewrite (%e : P) takes.
100
101def bool_xx(a: Bool, b: Bool) -> {a == Bool.xor(Bool.xor(a, b), b) : Bool}:
102  match a b:
103    case True{} True{}:
104      {==}
105    case True{} False{}:
106      {==}
107    case False{} True{}:
108      {==}
109    case False{} False{}:
110      {==}
111
112def word_xx(n: Nat, a: Word(n), b: Word(n)) -> {a == Word.xor(n, Word.xor(n, a, b), b) : Word(n)}:
113  match n:
114    case 0n:
115      match a b:
116        case WNil{} WNil{}:
117          {==}
118    case 1n+p:
119      match a b:
120        case WCon{ah, at} WCon{bh, bt}:
121          %bool_xx(ah, bh) : {WCon{ah, at} == WCon{_, Word.xor(p, Word.xor(p, at, bt), bt)} : Word(1n+p)}
122          %word_xx(p, at, bt) : {WCon{ah, at} == WCon{ah, _} : Word(1n+p)}
123          {==}
124
125def u32_xx(a: U32, b: U32) -> {a == U32.xor(U32.xor(a, b), b) : U32}:
126  match a b:
127    case U32{x} U32{y}:
128      %word_xx(32n, x, y) : {U32{x} == U32{_} : U32}
129      {==}
130
131def byte_xx(+h: U32, +k: U32) -> {B.byte(h) == B.byte(U32.xor(B.byte(U32.xor(h, k)), k)) : U32}:
132  %byte_xor_byte(U32.xor(h, k), k) : {B.byte(h) == _ : U32}
133  %u32_xx(h, k) : {B.byte(h) == B.byte(_) : U32}
134  {==}
135
136# Lists and Octets
137
138def rev2(l: List<&2, U32>, +a: List<&2, U32>) -> {St.cr.rev_onto(St.cr.rev_onto(l, a), Nil{}) == St.cr.rev_onto(a, l) : List<&2, U32>}:
139  match l:
140    case Nil{}:
141      {==}
142    case Con{h, t}:
143      rev2(t, Con{h, a})
144
145def mask_append(p: List<&2, U32>, +q: List<&2, U32>) -> {B.mask(B.append(p, q)) == B.append(B.mask(p), B.mask(q)) : List<&2, U32>}:
146  match p:
147    case Nil{}:
148      {==}
149    case Con{+h, +t}:
150      %mask_append(t, q) : {Con{B.byte(h), B.mask(B.append(t, q))} == Con{B.byte(h), _} : List<&2, U32>}
151      {==}
152
153# Octets.of_list of an append is the append of the Octets (from bytes' laws)
154def octets_of_append(+p: List<&2, U32>, +q: List<&2, U32>) -> {B.Octets.of_list(B.append(p, q)) == B.Octets.append(B.Octets.of_list(p), B.Octets.of_list(q)) : B.Octets}:
155  %BL.octets_of_to(B.Octets.append(B.Octets.of_list(p), B.Octets.of_list(q))) : {B.Octets.of_list(B.append(p, q)) == _ : B.Octets}
156  %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.append(B.Octets.of_list(p), B.Octets.of_list(q))), B.append(B.Octets.to_list(B.Octets.of_list(p)), B.Octets.to_list(B.Octets.of_list(q))), BL.octets_append_list(B.Octets.of_list(p), B.Octets.of_list(q))) : {B.Octets.of_list(B.append(p, q)) == B.Octets.of_list(_) : B.Octets}
157  %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.of_list(p)), B.mask(p), BL.octets_to_of(p)) : {B.Octets.of_list(B.append(p, q)) == B.Octets.of_list(B.append(_, B.Octets.to_list(B.Octets.of_list(q)))) : B.Octets}
158  %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.of_list(q)), B.mask(q), BL.octets_to_of(q)) : {B.Octets.of_list(B.append(p, q)) == B.Octets.of_list(B.append(B.mask(p), _)) : B.Octets}
159  %mask_append(p, q) : {B.Octets.of_list(B.append(p, q)) == B.Octets.of_list(_) : B.Octets}
160  %BL.octets_to_of(B.append(p, q)) : {B.Octets.of_list(B.append(p, q)) == B.Octets.of_list(_) : B.Octets}
161  %Equal.sym(B.Octets, B.Octets.of_list(B.Octets.to_list(B.Octets.of_list(B.append(p, q)))), B.Octets.of_list(B.append(p, q)), BL.octets_of_list_idempotent(B.append(p, q))) : {B.Octets.of_list(B.append(p, q)) == _ : B.Octets}
162  {==}
163
164# Stream ciphers from keystream generators (stream.bend)
165
166# the loop, for every list and state, is the structural output reversed onto
167# what it had
168def ks_go_ref(~S: Data, ~next: S -> St.CrKsStep<S>, ys: List<&2, U32>, +s: S, +acc: List<&2, U32>) -> {St.cr.ks.go(~S, ~next, ys, s, acc) == St.CrKsRun{St.cr.ks.after(~S, ~next, ys, s), St.cr.rev_onto(St.cr.ks.xs(~S, ~next, ys, s), acc)} : St.CrKsRun<S>}:
169  match ys:
170    case Nil{}:
171      {==}
172    case Con{x, t}:
173      ks_go_ref(~S, ~next, t, St.CrKsStep.st(~S, next(s)), Con{B.byte(U32.xor(x, St.CrKsStep.k(~S, next(s)))), acc})
174
175def xor_update_ref(~S: Data, ~next: S -> St.CrKsStep<S>, +s: S, +m: B.Octets) -> {St.CrXorOut{St.cr.ks.after(~S, ~next, B.Octets.to_list(m), s), B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s))} == St.CrXor.update(~S, ~next, s, m) : St.CrXorOut<S>}:
176  %Equal.sym(St.CrKsRun<S>, St.cr.ks.go(~S, ~next, B.Octets.to_list(m), s, Nil{}), St.CrKsRun{St.cr.ks.after(~S, ~next, B.Octets.to_list(m), s), St.cr.rev_onto(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s), Nil{})}, ks_go_ref(~S, ~next, B.Octets.to_list(m), s, Nil{})) : {St.CrXorOut{St.cr.ks.after(~S, ~next, B.Octets.to_list(m), s), B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s))} == St.cr.ks.out(~S, _) : St.CrXorOut<S>}
177  %rev2(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s), Nil{}) : {St.CrXorOut{St.cr.ks.after(~S, ~next, B.Octets.to_list(m), s), B.Octets.of_list(_)} == St.CrXorOut{St.cr.ks.after(~S, ~next, B.Octets.to_list(m), s), B.Octets.of_list(St.cr.rev_onto(St.cr.rev_onto(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s), Nil{}), Nil{}))} : St.CrXorOut<S>}
178  {==}
179
180def ks_mask_xs(~S: Data, ~next: S -> St.CrKsStep<S>, ys: List<&2, U32>, +s: S) -> {St.cr.ks.xs(~S, ~next, ys, s) == St.cr.ks.xs(~S, ~next, B.mask(ys), s) : List<&2, U32>}:
181  match ys:
182    case Nil{}:
183      {==}
184    case Con{+h, +t}:
185      %byte_xor_byte(h, St.CrKsStep.k(~S, next(s))) : {Con{B.byte(U32.xor(h, St.CrKsStep.k(~S, next(s)))), St.cr.ks.xs(~S, ~next, t, St.CrKsStep.st(~S, next(s)))} == Con{_, St.cr.ks.xs(~S, ~next, B.mask(t), St.CrKsStep.st(~S, next(s)))} : List<&2, U32>}
186      %ks_mask_xs(~S, ~next, t, St.CrKsStep.st(~S, next(s))) : {Con{B.byte(U32.xor(h, St.CrKsStep.k(~S, next(s)))), St.cr.ks.xs(~S, ~next, t, St.CrKsStep.st(~S, next(s)))} == Con{B.byte(U32.xor(h, St.CrKsStep.k(~S, next(s)))), _} : List<&2, U32>}
187      {==}
188
189def ks_xs_xs(~S: Data, ~next: S -> St.CrKsStep<S>, ys: List<&2, U32>, +s: S) -> {B.mask(ys) == St.cr.ks.xs(~S, ~next, St.cr.ks.xs(~S, ~next, ys, s), s) : List<&2, U32>}:
190  match ys:
191    case Nil{}:
192      {==}
193    case Con{+h, +t}:
194      %byte_xx(h, St.CrKsStep.k(~S, next(s))) : {Con{B.byte(h), B.mask(t)} == Con{_, St.cr.ks.xs(~S, ~next, St.cr.ks.xs(~S, ~next, t, St.CrKsStep.st(~S, next(s))), St.CrKsStep.st(~S, next(s)))} : List<&2, U32>}
195      %ks_xs_xs(~S, ~next, t, St.CrKsStep.st(~S, next(s))) : {Con{B.byte(h), B.mask(t)} == Con{B.byte(h), _} : List<&2, U32>}
196      {==}
197
198def Laws.xor_involution(S, next, s, m):
199  %xor_update_ref(~S, ~next, s, m) : {St.CrXor.out_data(~S, St.CrXor.update(~S, ~next, s, St.CrXor.out_data(~S, _))) == m : B.Octets}
200  %xor_update_ref(~S, ~next, s, B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s))) : {St.CrXor.out_data(~S, _) == m : B.Octets}
201  %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s))), B.mask(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s)), BL.octets_to_of(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s))) : {B.Octets.of_list(St.cr.ks.xs(~S, ~next, _, s)) == m : B.Octets}
202  %ks_mask_xs(~S, ~next, St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s), s) : {B.Octets.of_list(_) == m : B.Octets}
203  %ks_xs_xs(~S, ~next, B.Octets.to_list(m), s) : {B.Octets.of_list(_) == m : B.Octets}
204  %BL.octets_to_of(B.Octets.to_list(m)) : {B.Octets.of_list(_) == m : B.Octets}
205  %Equal.sym(B.Octets, B.Octets.of_list(B.Octets.to_list(B.Octets.of_list(B.Octets.to_list(m)))), B.Octets.of_list(B.Octets.to_list(m)), BL.octets_of_list_idempotent(B.Octets.to_list(m))) : {_ == m : B.Octets}
206  BL.octets_of_to(m)
207
208def ks_after_append(~S: Data, ~next: S -> St.CrKsStep<S>, xs: List<&2, U32>, +ys: List<&2, U32>, +s: S) -> {St.cr.ks.after(~S, ~next, B.append(xs, ys), s) == St.cr.ks.after(~S, ~next, ys, St.cr.ks.after(~S, ~next, xs, s)) : S}:
209  match xs:
210    case Nil{}:
211      {==}
212    case Con{x, t}:
213      ks_after_append(~S, ~next, t, ys, St.CrKsStep.st(~S, next(s)))
214
215def ks_xs_append(~S: Data, ~next: S -> St.CrKsStep<S>, xs: List<&2, U32>, +ys: List<&2, U32>, +s: S) -> {St.cr.ks.xs(~S, ~next, B.append(xs, ys), s) == B.append(St.cr.ks.xs(~S, ~next, xs, s), St.cr.ks.xs(~S, ~next, ys, St.cr.ks.after(~S, ~next, xs, s))) : List<&2, U32>}:
216  match xs:
217    case Nil{}:
218      {==}
219    case Con{+x, +t}:
220      %ks_xs_append(~S, ~next, t, ys, St.CrKsStep.st(~S, next(s))) : {Con{B.byte(U32.xor(x, St.CrKsStep.k(~S, next(s)))), St.cr.ks.xs(~S, ~next, B.append(t, ys), St.CrKsStep.st(~S, next(s)))} == Con{B.byte(U32.xor(x, St.CrKsStep.k(~S, next(s)))), _} : List<&2, U32>}
221      {==}
222
223def Laws.xor_streaming_state(S, next, s, a, b):
224  %xor_update_ref(~S, ~next, s, a) : {St.CrXor.out_state(~S, St.CrXor.update(~S, ~next, s, B.Octets.append(a, b))) == St.CrXor.out_state(~S, St.CrXor.update(~S, ~next, St.CrXor.out_state(~S, _), b)) : S}
225  %xor_update_ref(~S, ~next, St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s), b) : {St.CrXor.out_state(~S, St.CrXor.update(~S, ~next, s, B.Octets.append(a, b))) == St.CrXor.out_state(~S, _) : S}
226  %xor_update_ref(~S, ~next, s, B.Octets.append(a, b)) : {St.CrXor.out_state(~S, _) == St.cr.ks.after(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s)) : S}
227  %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.append(a, b)), B.append(B.Octets.to_list(a), B.Octets.to_list(b)), BL.octets_append_list(a, b)) : {St.cr.ks.after(~S, ~next, _, s) == St.cr.ks.after(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s)) : S}
228  ks_after_append(~S, ~next, B.Octets.to_list(a), B.Octets.to_list(b), s)
229
230def Laws.xor_streaming_data(S, next, s, a, b):
231  %xor_update_ref(~S, ~next, s, a) : {St.CrXor.out_data(~S, St.CrXor.update(~S, ~next, s, B.Octets.append(a, b))) == B.Octets.append(St.CrXor.out_data(~S, _), St.CrXor.out_data(~S, St.CrXor.update(~S, ~next, St.CrXor.out_state(~S, _), b))) : B.Octets}
232  %xor_update_ref(~S, ~next, St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s), b) : {St.CrXor.out_data(~S, St.CrXor.update(~S, ~next, s, B.Octets.append(a, b))) == B.Octets.append(B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s)), St.CrXor.out_data(~S, _)) : B.Octets}
233  %xor_update_ref(~S, ~next, s, B.Octets.append(a, b)) : {St.CrXor.out_data(~S, _) == B.Octets.append(B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s)), B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s)))) : B.Octets}
234  %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.append(a, b)), B.append(B.Octets.to_list(a), B.Octets.to_list(b)), BL.octets_append_list(a, b)) : {B.Octets.of_list(St.cr.ks.xs(~S, ~next, _, s)) == B.Octets.append(B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s)), B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s)))) : B.Octets}
235  %Equal.sym(List<&2, U32>, St.cr.ks.xs(~S, ~next, B.append(B.Octets.to_list(a), B.Octets.to_list(b)), s), B.append(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s), St.cr.ks.xs(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s))), ks_xs_append(~S, ~next, B.Octets.to_list(a), B.Octets.to_list(b), s)) : {B.Octets.of_list(_) == B.Octets.append(B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s)), B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s)))) : B.Octets}
236  octets_of_append(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s), St.cr.ks.xs(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s)))
237
238# CTR: CrXor over CTR's keystream generator
239
240def Laws.ctr_involution(K, Blk, enc, blk_of, blk_to, s, m):
241  Laws.xor_involution(~Md.CrCtrState<K>, ~Md.CrCtr.next(~K, ~Blk, ~enc, ~blk_of, ~blk_to), s, m)
242
243def Laws.ctr_streaming_data(K, Blk, enc, blk_of, blk_to, s, a, b):
244  Laws.xor_streaming_data(~Md.CrCtrState<K>, ~Md.CrCtr.next(~K, ~Blk, ~enc, ~blk_of, ~blk_to), s, a, b)
245
246def Laws.ctr_streaming_state(K, Blk, enc, blk_of, blk_to, s, a, b):
247  Laws.xor_streaming_state(~Md.CrCtrState<K>, ~Md.CrCtr.next(~K, ~Blk, ~enc, ~blk_of, ~blk_to), s, a, b)
248
249# The block formats
250
251def Laws.cmblock_format(b):
252  %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.of_list(CM.cr.f128.bytes(b))), B.mask(CM.cr.f128.bytes(b)), BL.octets_to_of(CM.cr.f128.bytes(b))) : {CM.cr.f128.block(_) == Some{b} : Maybe<&2, M.CmBlock>}
253  f128_bytes(b)
254
255def cmblock_xx(s: M.CmBlock, k: M.CmBlock) -> {s == CM.CrBlk128.xor(CM.CrBlk128.xor(s, k), k) : M.CmBlock}:
256  match s k:
257    case M.CmBlock{+a0, +a1, +a2, +a3} M.CmBlock{+b0, +b1, +b2, +b3}:
258      %u32_xx(a0, b0) : {M.CmBlock{a0, a1, a2, a3} == M.CmBlock{_, U32.xor(U32.xor(a1, b1), b1), U32.xor(U32.xor(a2, b2), b2), U32.xor(U32.xor(a3, b3), b3)} : M.CmBlock}
259      %u32_xx(a1, b1) : {M.CmBlock{a0, a1, a2, a3} == M.CmBlock{a0, _, U32.xor(U32.xor(a2, b2), b2), U32.xor(U32.xor(a3, b3), b3)} : M.CmBlock}
260      %u32_xx(a2, b2) : {M.CmBlock{a0, a1, a2, a3} == M.CmBlock{a0, a1, _, U32.xor(U32.xor(a3, b3), b3)} : M.CmBlock}
261      %u32_xx(a3, b3) : {M.CmBlock{a0, a1, a2, a3} == M.CmBlock{a0, a1, a2, _} : M.CmBlock}
262      {==}
263
264def Laws.cmblock_xor(a, b):
265  Equal.sym(M.CmBlock, a, CM.CrBlk128.xor(CM.CrBlk128.xor(a, b), b), cmblock_xx(a, b))
266
267def Laws.lcblock64_format(b):
268  LL.block64_octets_round_trip(b)
269
270def lcblock64_xx(s: L.LcBlock64, k: L.LcBlock64) -> {s == LC.CrBlk64.xor(LC.CrBlk64.xor(s, k), k) : L.LcBlock64}:
271  match s k:
272    case L.LcBlock64{+a0, +a1} L.LcBlock64{+b0, +b1}:
273      %u32_xx(a0, b0) : {L.LcBlock64{a0, a1} == L.LcBlock64{_, U32.xor(U32.xor(a1, b1), b1)} : L.LcBlock64}
274      %u32_xx(a1, b1) : {L.LcBlock64{a0, a1} == L.LcBlock64{a0, _} : L.LcBlock64}
275      {==}
276
277def Laws.lcblock64_xor(a, b):
278  Equal.sym(L.LcBlock64, a, LC.CrBlk64.xor(LC.CrBlk64.xor(a, b), b), lcblock64_xx(a, b))
279
280# ECB and CBC: the loops that run are the structural forms (for every block
281# cipher; the round trips, which need the cipher's own law, are per instance)
282
283def ecb_tr(~K: Data, ~Blk: Data, ~f: K -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +acc: List<&2, Blk>) -> {Md.cr.ecb.go(~K, ~Blk, ~f, k, bs, acc) == Md.cr.blks.rev_onto(~Blk, acc, Md.cr.ecb(~K, ~Blk, ~f, k, bs)) : List<&2, Blk>}:
284  match bs:
285    case Nil{}:
286      {==}
287    case Con{b, t}:
288      ecb_tr(~K, ~Blk, ~f, k, t, Con{f(k, b), acc})
289
290def ecb_pub(~K: Data, ~Blk: Data, ~f: K -> Blk -> Blk, +k: K, bs: List<&2, Blk>) -> {Md.cr.ecb.go(~K, ~Blk, ~f, k, bs, Nil{}) == Md.cr.ecb(~K, ~Blk, ~f, k, bs) : List<&2, Blk>}:
291  ecb_tr(~K, ~Blk, ~f, k, bs, Nil{})
292
293def cbc_enc_tr(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +iv: Blk, +acc: List<&2, Blk>) -> {Md.cr.cbc.enc.go(~K, ~Blk, ~enc, ~bxor, k, bs, iv, acc) == Md.cr.blks.rev_onto(~Blk, acc, Md.cr.cbc.enc(~K, ~Blk, ~enc, ~bxor, k, bs, iv)) : List<&2, Blk>}:
294  match bs:
295    case Nil{}:
296      {==}
297    case Con{+p, t}:
298      cbc_enc_tr(~K, ~Blk, ~enc, ~bxor, k, t, enc(k, bxor(p, iv)), Con{enc(k, bxor(p, iv)), acc})
299
300def cbc_dec_tr(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +iv: Blk, +acc: List<&2, Blk>) -> {Md.cr.cbc.dec.go(~K, ~Blk, ~dec, ~bxor, k, bs, iv, acc) == Md.cr.blks.rev_onto(~Blk, acc, Md.cr.cbc.dec(~K, ~Blk, ~dec, ~bxor, k, bs, iv)) : List<&2, Blk>}:
301  match bs:
302    case Nil{}:
303      {==}
304    case Con{+c, t}:
305      cbc_dec_tr(~K, ~Blk, ~dec, ~bxor, k, t, c, Con{bxor(dec(k, c), iv), acc})
306
307def cbc_enc_pub(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +iv: Blk) -> {Md.cr.cbc.enc.go(~K, ~Blk, ~enc, ~bxor, k, bs, iv, Nil{}) == Md.cr.cbc.enc(~K, ~Blk, ~enc, ~bxor, k, bs, iv) : List<&2, Blk>}:
308  cbc_enc_tr(~K, ~Blk, ~enc, ~bxor, k, bs, iv, Nil{})
309
310def cbc_dec_pub(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +iv: Blk) -> {Md.cr.cbc.dec.go(~K, ~Blk, ~dec, ~bxor, k, bs, iv, Nil{}) == Md.cr.cbc.dec(~K, ~Blk, ~dec, ~bxor, k, bs, iv) : List<&2, Blk>}:
311  cbc_dec_tr(~K, ~Blk, ~dec, ~bxor, k, bs, iv, Nil{})
312
313# PCBC (pcbc.bend): the loops that run are the structural forms
314
315def pcbc_enc_tr(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +v: Blk, +acc: List<&2, Blk>) -> {Pc.cr.pcbc.enc.go(~K, ~Blk, ~enc, ~bxor, k, bs, v, acc) == Md.cr.blks.rev_onto(~Blk, acc, Pc.cr.pcbc.enc(~K, ~Blk, ~enc, ~bxor, k, bs, v)) : List<&2, Blk>}:
316  match bs:
317    case Nil{}:
318      {==}
319    case Con{+p, t}:
320      pcbc_enc_tr(~K, ~Blk, ~enc, ~bxor, k, t, bxor(p, enc(k, bxor(p, v))), Con{enc(k, bxor(p, v)), acc})
321
322def pcbc_dec_tr(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +v: Blk, +acc: List<&2, Blk>) -> {Pc.cr.pcbc.dec.go(~K, ~Blk, ~dec, ~bxor, k, bs, v, acc) == Md.cr.blks.rev_onto(~Blk, acc, Pc.cr.pcbc.dec(~K, ~Blk, ~dec, ~bxor, k, bs, v)) : List<&2, Blk>}:
323  match bs:
324    case Nil{}:
325      {==}
326    case Con{+c, t}:
327      pcbc_dec_tr(~K, ~Blk, ~dec, ~bxor, k, t, bxor(bxor(dec(k, c), v), c), Con{bxor(dec(k, c), v), acc})
328
329def pcbc_enc_pub(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +v: Blk) -> {Pc.cr.pcbc.enc.go(~K, ~Blk, ~enc, ~bxor, k, bs, v, Nil{}) == Pc.cr.pcbc.enc(~K, ~Blk, ~enc, ~bxor, k, bs, v) : List<&2, Blk>}:
330  pcbc_enc_tr(~K, ~Blk, ~enc, ~bxor, k, bs, v, Nil{})
331
332def pcbc_dec_pub(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +v: Blk) -> {Pc.cr.pcbc.dec.go(~K, ~Blk, ~dec, ~bxor, k, bs, v, Nil{}) == Pc.cr.pcbc.dec(~K, ~Blk, ~dec, ~bxor, k, bs, v) : List<&2, Blk>}:
333  pcbc_dec_tr(~K, ~Blk, ~dec, ~bxor, k, bs, v, Nil{})
334
335# LRW (lrw.bend): the loops that run are the structural forms
336
337def lrw_enc_tr(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, ~blk_of: B.Octets -> Maybe<&2, Blk>, +k: K, +k2: G.Gf128, bs: List<&2, Blk>, +i: G.Gf128, +acc: List<&2, Blk>) -> {Lw.cr.lrw.enc.go(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, bs, i, acc) == Md.cr.blks.rev_onto(~Blk, acc, Lw.cr.lrw.enc(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, bs, i)) : List<&2, Blk>}:
338  match bs:
339    case Nil{}:
340      {==}
341    case Con{p, t}:
342      lrw_enc_tr(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, t, Lw.cr.lrw.inc(i), Con{Lw.cr.lrw.benc(~K, ~Blk, ~enc, ~bxor, k, Lw.cr.lrw.tweak(~Blk, ~blk_of, k2, i), p), acc})
343
344def lrw_dec_tr(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, ~blk_of: B.Octets -> Maybe<&2, Blk>, +k: K, +k2: G.Gf128, bs: List<&2, Blk>, +i: G.Gf128, +acc: List<&2, Blk>) -> {Lw.cr.lrw.dec.go(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, bs, i, acc) == Md.cr.blks.rev_onto(~Blk, acc, Lw.cr.lrw.dec(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, bs, i)) : List<&2, Blk>}:
345  match bs:
346    case Nil{}:
347      {==}
348    case Con{c, t}:
349      lrw_dec_tr(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, t, Lw.cr.lrw.inc(i), Con{Lw.cr.lrw.bdec(~K, ~Blk, ~dec, ~bxor, k, Lw.cr.lrw.tweak(~Blk, ~blk_of, k2, i), c), acc})
350
351def lrw_enc_pub(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, ~blk_of: B.Octets -> Maybe<&2, Blk>, +k: K, +k2: G.Gf128, bs: List<&2, Blk>, +i: G.Gf128) -> {Lw.cr.lrw.enc.go(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, bs, i, Nil{}) == Lw.cr.lrw.enc(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, bs, i) : List<&2, Blk>}:
352  lrw_enc_tr(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, bs, i, Nil{})
353
354def lrw_dec_pub(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, ~blk_of: B.Octets -> Maybe<&2, Blk>, +k: K, +k2: G.Gf128, bs: List<&2, Blk>, +i: G.Gf128) -> {Lw.cr.lrw.dec.go(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, bs, i, Nil{}) == Lw.cr.lrw.dec(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, bs, i) : List<&2, Blk>}:
355  lrw_dec_tr(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, bs, i, Nil{})
356
357# MACs
358
359def Laws.mac_verify_tag_accepts(K, compute, k, m):
360  BL.octets_is_eq_refl(compute(k, m))
361
362def Laws.mac_verify_tag_agrees(K, compute, k, m, t):
363  {==}
364
365def Laws.hmac_accepts(digest, kk, m):
366  Laws.mac_verify_tag_accepts(~Hm.CrHmacKey, ~Hm.CrHmac.mac(~digest), kk, m)
367
368def Laws.cmac_accepts(K, enc, k, m):
369  Laws.mac_verify_tag_accepts(~K, ~CMI.CrCmac.mac(~K, ~enc), k, m)
370
371def Laws.xcbc_accepts(K, Blk, bsize, enc, blk_of, blk_to, kk, m):
372  Laws.mac_verify_tag_accepts(~Xc.CrXcbcKey<K>, ~Xc.CrXcbc.mac(~K, ~Blk, ~bsize, ~enc, ~blk_of, ~blk_to), kk, m)
373
374def Laws.vmac_accepts(K, Blk, bsize, enc, blk_of, blk_to, nlen, kk, m):
375  Laws.mac_verify_tag_accepts(~Vm.CrVmacKey<K>, ~Vm.CrVmac.mac(~K, ~Blk, ~bsize, ~enc, ~blk_of, ~blk_to, ~nlen), kk, m)
376
377# CRCs as hashes: from crc's streaming laws
378
379def Laws.crc32_hash_streaming(spec, c, a, b):
380  CL.streaming32(spec, c, a, b)
381
382def Laws.crc32_hash_split(spec, a, b):
383  %CL.streaming32(spec, C.Crc32Spec.start(spec), a, b) : {CR.CrCrc32.final(~spec, _) == CR.CrCrc32.digest(~spec, B.Octets.append(a, b)) : B.Octets}
384  {==}
385
386def Laws.crc64_hash_streaming(spec, c, a, b):
387  CL.streaming64(spec, c, a, b)
388
389def Laws.crc64_hash_split(spec, a, b):
390  %CL.streaming64(spec, C.Crc64Spec.start(spec), a, b) : {CR.CrCrc64.final(~spec, _) == CR.CrCrc64.digest(~spec, B.Octets.append(a, b)) : B.Octets}
391  {==}
392
393# AEADs
394
395def Laws.lift_round_trip(E, f, d, r, p, h):
396  match r:
397    case Fail{e}:
398      {==}
399    case Done{c}:
400      %Equal.sym(Result<&2, &2, E, B.Octets>, d(c), Done{p}, h) : {Cr.CrError.lift(~E, ~B.Octets, ~f, _) == Done{p} : Result<&2, &2, Cr.CrError, B.Octets>}
401      {==}
402
403def Laws.ccm_round_trip_if(K, enc, tlen, k, nonce, aad, p, h):
404  Laws.lift_round_trip(~M.CmError, ~CM.CrCm.err, c => MC.Ccm.decrypt(~K, ~enc, k, tlen, nonce, aad, c), MC.Ccm.encrypt(~K, ~enc, k, tlen, nonce, aad, p), p, h)
405
406# Signatures and key agreement
407
408def Laws.sign_verify_bytes_if(SK, PK, public, pk_of, pk_to, sign, verify, sk, m, hf, ha):
409  %Equal.sym(Result<&2, &2, Cr.CrError, PK>, pk_of(pk_to(public(sk))), Done{public(sk)}, hf) : {Sg.cr.sign.check(~PK, ~verify, _, m, sign(sk, m)) == True{} : Bool}
410  ha
411
412def Laws.kex_agree_if(SK, PK, secret, public, pk_of, pk_to, shared, a, b, x, y, hx, hy, hfx, hfy, h):
413  %Equal.sym(Result<&2, &2, Cr.CrError, SK>, secret(a), Done{x}, hx) : {Kx.cr.kex.with(~SK, ~PK, ~shared, _, pk_of(pk_to(public(y)))) == Kx.CrKex.agree(~SK, ~PK, ~secret, ~pk_of, ~shared, b, pk_to(public(x))) : Result<&2, &2, Cr.CrError, B.Octets>}
414  %Equal.sym(Result<&2, &2, Cr.CrError, PK>, pk_of(pk_to(public(y))), Done{public(y)}, hfy) : {Kx.cr.kex.with(~SK, ~PK, ~shared, Done{x}, _) == Kx.CrKex.agree(~SK, ~PK, ~secret, ~pk_of, ~shared, b, pk_to(public(x))) : Result<&2, &2, Cr.CrError, B.Octets>}
415  %Equal.sym(Result<&2, &2, Cr.CrError, SK>, secret(b), Done{y}, hy) : {shared(x, public(y)) == Kx.cr.kex.with(~SK, ~PK, ~shared, _, pk_of(pk_to(public(x)))) : Result<&2, &2, Cr.CrError, B.Octets>}
416  %Equal.sym(Result<&2, &2, Cr.CrError, PK>, pk_of(pk_to(public(x))), Done{public(x)}, hfx) : {shared(x, public(y)) == Kx.cr.kex.with(~SK, ~PK, ~shared, Done{y}, _) : Result<&2, &2, Cr.CrError, B.Octets>}
417  h
418
419# Vectors
420
421def Laws.crc32_hash_check():
422  {==}
423
424def Laws.crc32c_hash_check():
425  {==}
426
427def Laws.crc64_xz_hash_check():
428  {==}
429
430def Laws.crc32_hash_length(spec, c):
431  be32_len(C.Crc32Spec.finish(spec, c))
432
433def Laws.hmac_crc32_vector():
434  {==}
435
436def Laws.rc4_empty_key():
437  {==}
438
439def Laws.rc4_iv_refused():
440  {==}
441
442def Laws.ctr_bad_iv():
443  {==}
444
445def Laws.blocks_of_not_whole():
446  {==}
447
448def Laws.hkdf_too_long():
449  {==}
450
451def Laws.aes_fips197_c1():
452  {==}
453
454# CRCs in three pieces: the streaming law twice
455
456def Laws.crc32_hash_split3(spec, a, b, c):
457  %CL.streaming32(spec, C.Crc32Spec.update(spec, C.Crc32Spec.start(spec), a), b, c) : {CR.CrCrc32.final(~spec, _) == CR.CrCrc32.digest(~spec, B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
458  %CL.streaming32(spec, C.Crc32Spec.start(spec), a, B.Octets.append(b, c)) : {CR.CrCrc32.final(~spec, _) == CR.CrCrc32.digest(~spec, B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
459  {==}
460
461def Laws.crc64_hash_split3(spec, a, b, c):
462  %CL.streaming64(spec, C.Crc64Spec.update(spec, C.Crc64Spec.start(spec), a), b, c) : {CR.CrCrc64.final(~spec, _) == CR.CrCrc64.digest(~spec, B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
463  %CL.streaming64(spec, C.Crc64Spec.start(spec), a, B.Octets.append(b, c)) : {CR.CrCrc64.final(~spec, _) == CR.CrCrc64.digest(~spec, B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
464  {==}
465
466# SHA-256 and SHA-512: bend-collections-laws-crypto's laws, through Octets
467
468def append_nil(xs: List<&2, U32>) -> {xs == List.append(&2, U32, xs, Nil{}) : List<&2, U32>}:
469  match xs:
470    case Nil{}:
471      {==}
472    case Con{h, t}:
473      %append_nil(t) : {Con{h, t} == Con{h, _} : List<&2, U32>}
474      {==}
475
476def mask_len(xs: List<&2, U32>) -> {B.len(B.mask(xs)) == B.len(xs) : Nat}:
477  match xs:
478    case Nil{}:
479      {==}
480    case Con{h, t}:
481      %mask_len(t) : {B.len(B.mask(Con{h, t})) == 1n+_ : Nat}
482      {==}
483
484# the length of a list made Octets
485def octets_len_of(+xs: List<&2, U32>) -> {B.Octets.len(B.Octets.of_list(xs)) == B.len(xs) : Nat}:
486  %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(xs)), B.len(B.Octets.to_list(B.Octets.of_list(xs))), BL.octets_len_list(B.Octets.of_list(xs))) : {_ == B.len(xs) : Nat}
487  %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.of_list(xs)), B.mask(xs), BL.octets_to_of(xs)) : {B.len(_) == B.len(xs) : Nat}
488  mask_len(xs)
489
490def Laws.sha256_spec(o):
491  %HL.Sha256.value(B.Octets.to_list(o)) : {SH.CrSha2.sha256(o) == B.Octets.of_list(_) : B.Octets}
492  {==}
493
494def Laws.sha256_hash_split(a, b):
495  %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.new_sha256(), B.Octets.to_list(a)), B.Octets.to_list(b))), Hc.sha256(List.append(&2, U32, B.Octets.to_list(a), B.Octets.to_list(b))), HL.Split.sha256(B.Octets.to_list(a), B.Octets.to_list(b))) : {B.Octets.of_list(_) == SH.CrSha2.sha256(B.Octets.append(a, b)) : B.Octets}
496  %BL.octets_append_list(a, b) : {B.Octets.of_list(Hc.sha256(_)) == SH.CrSha2.sha256(B.Octets.append(a, b)) : B.Octets}
497  {==}
498
499def Laws.sha256_hash_split3(a, b, c):
500  %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.update(Hc.new_sha256(), B.Octets.to_list(a)), B.Octets.to_list(b)), B.Octets.to_list(c))), Hc.sha256(List.concat(&2, U32, [B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])), HL.Incremental.sha256([B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])) : {B.Octets.of_list(_) == SH.CrSha2.sha256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
501  %append_nil(B.Octets.to_list(c)) : {B.Octets.of_list(Hc.sha256(List.append(&2, U32, B.Octets.to_list(a), List.append(&2, U32, B.Octets.to_list(b), _)))) == SH.CrSha2.sha256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
502  %BL.octets_append_list(b, c) : {B.Octets.of_list(Hc.sha256(List.append(&2, U32, B.Octets.to_list(a), _))) == SH.CrSha2.sha256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
503  %BL.octets_append_list(a, B.Octets.append(b, c)) : {B.Octets.of_list(Hc.sha256(_)) == SH.CrSha2.sha256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
504  {==}
505
506def Laws.sha256_hash_length(o):
507  %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Hc.sha256(B.Octets.to_list(o)))), B.len(Hc.sha256(B.Octets.to_list(o))), octets_len_of(Hc.sha256(B.Octets.to_list(o)))) : {_ == 32n : Nat}
508  HL.Sha256.length(B.Octets.to_list(o))
509
510def Laws.sha512_spec(o):
511  %HL.Sha512.value(B.Octets.to_list(o)) : {SH.CrSha2.sha512(o) == B.Octets.of_list(_) : B.Octets}
512  {==}
513
514def Laws.sha512_hash_split(a, b):
515  %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.new_sha512(), B.Octets.to_list(a)), B.Octets.to_list(b))), Hc.sha512(List.append(&2, U32, B.Octets.to_list(a), B.Octets.to_list(b))), HL.Split.sha512(B.Octets.to_list(a), B.Octets.to_list(b))) : {B.Octets.of_list(_) == SH.CrSha2.sha512(B.Octets.append(a, b)) : B.Octets}
516  %BL.octets_append_list(a, b) : {B.Octets.of_list(Hc.sha512(_)) == SH.CrSha2.sha512(B.Octets.append(a, b)) : B.Octets}
517  {==}
518
519def Laws.sha512_hash_split3(a, b, c):
520  %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.update(Hc.new_sha512(), B.Octets.to_list(a)), B.Octets.to_list(b)), B.Octets.to_list(c))), Hc.sha512(List.concat(&2, U32, [B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])), HL.Incremental.sha512([B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])) : {B.Octets.of_list(_) == SH.CrSha2.sha512(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
521  %append_nil(B.Octets.to_list(c)) : {B.Octets.of_list(Hc.sha512(List.append(&2, U32, B.Octets.to_list(a), List.append(&2, U32, B.Octets.to_list(b), _)))) == SH.CrSha2.sha512(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
522  %BL.octets_append_list(b, c) : {B.Octets.of_list(Hc.sha512(List.append(&2, U32, B.Octets.to_list(a), _))) == SH.CrSha2.sha512(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
523  %BL.octets_append_list(a, B.Octets.append(b, c)) : {B.Octets.of_list(Hc.sha512(_)) == SH.CrSha2.sha512(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
524  {==}
525
526def Laws.sha512_hash_length(o):
527  %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Hc.sha512(B.Octets.to_list(o)))), B.len(Hc.sha512(B.Octets.to_list(o))), octets_len_of(Hc.sha512(B.Octets.to_list(o)))) : {_ == 64n : Nat}
528  HL.Sha512.length(B.Octets.to_list(o))
529
530def Laws.sha3_256_spec(o):
531  %HL.Sha3_256.value(B.Octets.to_list(o)) : {S3.CrSha3.sha3_256(o) == B.Octets.of_list(_) : B.Octets}
532  {==}
533
534def Laws.sha3_256_hash_split(a, b):
535  %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.new_sha3_256(), B.Octets.to_list(a)), B.Octets.to_list(b))), Hc.sha3_256(List.append(&2, U32, B.Octets.to_list(a), B.Octets.to_list(b))), HL.Split.sha3_256(B.Octets.to_list(a), B.Octets.to_list(b))) : {B.Octets.of_list(_) == S3.CrSha3.sha3_256(B.Octets.append(a, b)) : B.Octets}
536  %BL.octets_append_list(a, b) : {B.Octets.of_list(Hc.sha3_256(_)) == S3.CrSha3.sha3_256(B.Octets.append(a, b)) : B.Octets}
537  {==}
538
539def Laws.sha3_256_hash_split3(a, b, c):
540  %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.update(Hc.new_sha3_256(), B.Octets.to_list(a)), B.Octets.to_list(b)), B.Octets.to_list(c))), Hc.sha3_256(List.concat(&2, U32, [B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])), HL.Incremental.sha3_256([B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])) : {B.Octets.of_list(_) == S3.CrSha3.sha3_256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
541  %append_nil(B.Octets.to_list(c)) : {B.Octets.of_list(Hc.sha3_256(List.append(&2, U32, B.Octets.to_list(a), List.append(&2, U32, B.Octets.to_list(b), _)))) == S3.CrSha3.sha3_256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
542  %BL.octets_append_list(b, c) : {B.Octets.of_list(Hc.sha3_256(List.append(&2, U32, B.Octets.to_list(a), _))) == S3.CrSha3.sha3_256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
543  %BL.octets_append_list(a, B.Octets.append(b, c)) : {B.Octets.of_list(Hc.sha3_256(_)) == S3.CrSha3.sha3_256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets}
544  {==}
545
546def Laws.sha3_256_hash_length(o):
547  %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Hc.sha3_256(B.Octets.to_list(o)))), B.len(Hc.sha3_256(B.Octets.to_list(o))), octets_len_of(Hc.sha3_256(B.Octets.to_list(o)))) : {_ == 32n : Nat}
548  HL.Sha3_256.length(B.Octets.to_list(o))
549
550def Laws.hkdf_sha256_too_long():
551  {==}
552
553def Laws.sha256_abc():
554  {==}
555
556def Laws.sha3_256_abc():
557  {==}
558
559def Laws.hmac_sha256_rfc4231_2():
560  {==}
561
562# Michael as a MAC
563
564def Laws.michael_accepts(k, m):
565  Laws.mac_verify_tag_accepts(~Hs.HsW2, ~HMI.HsMichael.mic, k, m)
566
567def Laws.michael_key_length():
568  {==}
569
570def Laws.michael_mac_vector():
571  {==}
572
573# PBKDF2: the output generator gives n bytes, whatever the MAC (induction
574# on n), and its first n bytes are the same whatever comes after
575def pbkdf2_out_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, cur: List<&2, U32>, +k: K, +salt: B.Octets, +c: Nat, +i: U32) -> {B.len(Pb.cr.pbkdf2.out(~K, ~compute, n, cur, k, salt, c, i)) == n : Nat}:
576  match n:
577    case 0n:
578      {==}
579    case 1n+p:
580      match cur:
581        case Con{h, t}:
582          %pbkdf2_out_len(~K, ~compute, p, t, k, salt, c, i) : {B.len(Pb.cr.pbkdf2.out(~K, ~compute, 1n+p, Con{h, t}, k, salt, c, i)) == 1n+_ : Nat}
583          {==}
584        case Nil{}:
585          %pbkdf2_out_len(~K, ~compute, p, Pb.cr.pbkdf2.tail(Pb.cr.pbkdf2.block(~K, ~compute, k, salt, c, U32.add(i, 1))), k, salt, c, U32.add(i, 1)) : {B.len(Pb.cr.pbkdf2.out(~K, ~compute, 1n+p, Nil{}, k, salt, c, i)) == 1n+_ : Nat}
586          {==}
587
588def pbkdf2_out_prefix(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, +j: Nat, cur: List<&2, U32>, +k: K, +salt: B.Octets, +c: Nat, +i: U32) -> {B.take(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), cur, k, salt, c, i)) == Pb.cr.pbkdf2.out(~K, ~compute, n, cur, k, salt, c, i) : List<&2, U32>}:
589  match n:
590    case 0n:
591      {==}
592    case 1n+p:
593      match cur:
594        case Con{h, t}:
595          %pbkdf2_out_prefix(~K, ~compute, p, j, t, k, salt, c, i) : {Con{h, B.take(p, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(p, j), t, k, salt, c, i))} == Con{h, _} : List<&2, U32>}
596          {==}
597        case Nil{}:
598          %pbkdf2_out_prefix(~K, ~compute, p, j, Pb.cr.pbkdf2.tail(Pb.cr.pbkdf2.block(~K, ~compute, k, salt, c, U32.add(i, 1))), k, salt, c, U32.add(i, 1)) : {Con{Pb.cr.pbkdf2.head(Pb.cr.pbkdf2.block(~K, ~compute, k, salt, c, U32.add(i, 1))), B.take(p, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(p, j), Pb.cr.pbkdf2.tail(Pb.cr.pbkdf2.block(~K, ~compute, k, salt, c, U32.add(i, 1))), k, salt, c, U32.add(i, 1)))} == Con{Pb.cr.pbkdf2.head(Pb.cr.pbkdf2.block(~K, ~compute, k, salt, c, U32.add(i, 1))), _} : List<&2, U32>}
599          {==}
600
601def Laws.pbkdf2_stream_length(K, compute, k, salt, c, n):
602  %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0))), B.len(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), octets_len_of(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0))) : {_ == n : Nat}
603  pbkdf2_out_len(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)
604
605def pbkdf2_checked_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, zero: Bool, fits: Bool, kr: Result<&2, &2, Cr.CrError, K>, +salt: B.Octets, +c: U32, +n: Nat) -> {Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => B.Octets.len(o), Pb.cr.pbkdf2.checked(~K, ~compute, zero, fits, kr, salt, c, n)) == Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => n, Pb.cr.pbkdf2.checked(~K, ~compute, zero, fits, kr, salt, c, n)) : Result<&2, &2, Cr.CrError, Nat>}:
606  match zero:
607    case True{}:
608      {==}
609    case False{}:
610      match fits:
611        case False{}:
612          {==}
613        case True{}:
614          match kr:
615            case Fail{e}:
616              {==}
617            case Done{+k}:
618              %Laws.pbkdf2_stream_length(~K, ~compute, k, salt, c, n) : {Done{B.Octets.len(Pb.CrPbkdf2.stream(~K, ~compute, k, salt, c, n))} == Done{_} : Result<&2, &2, Cr.CrError, Nat>}
619              {==}
620
621def Laws.pbkdf2_length(K, key, compute, hlen, p, salt, c, n):
622  pbkdf2_checked_len(~K, ~compute, U32.is_eq(c, 0), Pb.cr.pbkdf2.fits(Nat.is_lt(0n, hlen), n, hlen), key(p), salt, c, n)
623
624def Laws.pbkdf2_stream_prefix(K, compute, k, salt, c, n, j):
625  %BL.take_drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : {B.Octets.take(n, B.Octets.of_list(_)) == B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : B.Octets}
626  %Equal.sym(List<&2, U32>, B.take(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0), pbkdf2_out_prefix(~K, ~compute, n, j, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : {B.Octets.take(n, B.Octets.of_list(B.append(_, B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0))))) == B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : B.Octets}
627  %Equal.sym(B.Octets, B.Octets.of_list(B.append(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0), B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)))), B.Octets.append(B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), B.Octets.of_list(B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)))), octets_of_append(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0), B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)))) : {B.Octets.take(n, _) == B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : B.Octets}
628  %pbkdf2_out_len(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), B.Octets.of_list(B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0))))) == B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : B.Octets}
629  %octets_len_of(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), B.Octets.of_list(B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0))))) == B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : B.Octets}
630  BL.octets_take_append(B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), B.Octets.of_list(B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0))))
631
632def Laws.pbkdf2_zero_iterations():
633  {==}
634
635def Laws.pbkdf2_hmac_sha1_rfc6070_1():
636  {==}
637
638def Laws.pbkdf2_hmac_sha1_rfc6070_2():
639  {==}
640
641def Laws.pbkdf2_hmac_sha256_rfc7914_1():
642  {==}
643
644# SP 800-108: the output generators give n bytes, whatever the MAC, and
645# their first n bytes are the same whatever comes after
646
647def kb_ctr_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, cur: List<&2, U32>, +k: K, +rlen: Nat, +fixed: B.Octets, +i: U32) -> {B.len(Kb.cr.kb.ctr(~K, ~compute, n, cur, k, rlen, fixed, i)) == n : Nat}:
648  match n:
649    case 0n:
650      {==}
651    case 1n+p:
652      match cur:
653        case Con{h, t}:
654          %kb_ctr_len(~K, ~compute, p, t, k, rlen, fixed, i) : {B.len(Kb.cr.kb.ctr(~K, ~compute, 1n+p, Con{h, t}, k, rlen, fixed, i)) == 1n+_ : Nat}
655          {==}
656        case Nil{}:
657          %kb_ctr_len(~K, ~compute, p, Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed)))), k, rlen, fixed, U32.add(i, 1)) : {B.len(Kb.cr.kb.ctr(~K, ~compute, 1n+p, Nil{}, k, rlen, fixed, i)) == 1n+_ : Nat}
658          {==}
659
660def kb_ctr_prefix(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, +j: Nat, cur: List<&2, U32>, +k: K, +rlen: Nat, +fixed: B.Octets, +i: U32) -> {B.take(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), cur, k, rlen, fixed, i)) == Kb.cr.kb.ctr(~K, ~compute, n, cur, k, rlen, fixed, i) : List<&2, U32>}:
661  match n:
662    case 0n:
663      {==}
664    case 1n+p:
665      match cur:
666        case Con{h, t}:
667          %kb_ctr_prefix(~K, ~compute, p, j, t, k, rlen, fixed, i) : {Con{h, B.take(p, Kb.cr.kb.ctr(~K, ~compute, Nat.add(p, j), t, k, rlen, fixed, i))} == Con{h, _} : List<&2, U32>}
668          {==}
669        case Nil{}:
670          %kb_ctr_prefix(~K, ~compute, p, j, Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed)))), k, rlen, fixed, U32.add(i, 1)) : {Con{Kb.cr.kb.head(B.Octets.to_list(compute(k, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed)))), B.take(p, Kb.cr.kb.ctr(~K, ~compute, Nat.add(p, j), Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed)))), k, rlen, fixed, U32.add(i, 1)))} == Con{Kb.cr.kb.head(B.Octets.to_list(compute(k, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed)))), _} : List<&2, U32>}
671          {==}
672
673def kb_fb_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, cur: List<&2, U32>, +k: K, +rlen: Nat, +fixed: B.Octets, +prev: B.Octets, +i: U32) -> {B.len(Kb.cr.kb.fb(~K, ~compute, n, cur, k, rlen, fixed, prev, i)) == n : Nat}:
674  match n:
675    case 0n:
676      {==}
677    case 1n+p:
678      match cur:
679        case Con{h, t}:
680          %kb_fb_len(~K, ~compute, p, t, k, rlen, fixed, prev, i) : {B.len(Kb.cr.kb.fb(~K, ~compute, 1n+p, Con{h, t}, k, rlen, fixed, prev, i)) == 1n+_ : Nat}
681          {==}
682        case Nil{}:
683          %kb_fb_len(~K, ~compute, p, Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))))), k, rlen, fixed, compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))), U32.add(i, 1)) : {B.len(Kb.cr.kb.fb(~K, ~compute, 1n+p, Nil{}, k, rlen, fixed, prev, i)) == 1n+_ : Nat}
684          {==}
685
686def kb_fb_prefix(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, +j: Nat, cur: List<&2, U32>, +k: K, +rlen: Nat, +fixed: B.Octets, +prev: B.Octets, +i: U32) -> {B.take(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), cur, k, rlen, fixed, prev, i)) == Kb.cr.kb.fb(~K, ~compute, n, cur, k, rlen, fixed, prev, i) : List<&2, U32>}:
687  match n:
688    case 0n:
689      {==}
690    case 1n+p:
691      match cur:
692        case Con{h, t}:
693          %kb_fb_prefix(~K, ~compute, p, j, t, k, rlen, fixed, prev, i) : {Con{h, B.take(p, Kb.cr.kb.fb(~K, ~compute, Nat.add(p, j), t, k, rlen, fixed, prev, i))} == Con{h, _} : List<&2, U32>}
694          {==}
695        case Nil{}:
696          %kb_fb_prefix(~K, ~compute, p, j, Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))))), k, rlen, fixed, compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))), U32.add(i, 1)) : {Con{Kb.cr.kb.head(B.Octets.to_list(compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))))), B.take(p, Kb.cr.kb.fb(~K, ~compute, Nat.add(p, j), Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))))), k, rlen, fixed, compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))), U32.add(i, 1)))} == Con{Kb.cr.kb.head(B.Octets.to_list(compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))))), _} : List<&2, U32>}
697          {==}
698
699def Laws.kbkdf_counter_stream_length(K, compute, rlen, k, fixed, n):
700  %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0))), B.len(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)), octets_len_of(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0))) : {_ == n : Nat}
701  kb_ctr_len(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)
702
703def Laws.kbkdf_counter_stream_prefix(K, compute, rlen, k, fixed, n, j):
704  %BL.take_drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0)) : {B.Octets.take(n, B.Octets.of_list(_)) == B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : B.Octets}
705  %Equal.sym(List<&2, U32>, B.take(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0)), Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0), kb_ctr_prefix(~K, ~compute, n, j, Nil{}, k, rlen, fixed, 0)) : {B.Octets.take(n, B.Octets.of_list(B.append(_, B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0))))) == B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : B.Octets}
706  %Equal.sym(B.Octets, B.Octets.of_list(B.append(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0), B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0)))), B.Octets.append(B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0)))), octets_of_append(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0), B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0)))) : {B.Octets.take(n, _) == B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : B.Octets}
707  %kb_ctr_len(~K, ~compute, n, Nil{}, k, rlen, fixed, 0) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0))))) == B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : B.Octets}
708  %octets_len_of(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0))))) == B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : B.Octets}
709  BL.octets_take_append(B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0))))
710
711def Laws.kbkdf_feedback_stream_length(K, compute, rlen, k, iv, fixed, n):
712  %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0))), B.len(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)), octets_len_of(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0))) : {_ == n : Nat}
713  kb_fb_len(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)
714
715def Laws.kbkdf_feedback_stream_prefix(K, compute, rlen, k, iv, fixed, n, j):
716  %BL.take_drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0)) : {B.Octets.take(n, B.Octets.of_list(_)) == B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : B.Octets}
717  %Equal.sym(List<&2, U32>, B.take(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0)), Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0), kb_fb_prefix(~K, ~compute, n, j, Nil{}, k, rlen, fixed, iv, 0)) : {B.Octets.take(n, B.Octets.of_list(B.append(_, B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0))))) == B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : B.Octets}
718  %Equal.sym(B.Octets, B.Octets.of_list(B.append(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0), B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0)))), B.Octets.append(B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0)))), octets_of_append(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0), B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0)))) : {B.Octets.take(n, _) == B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : B.Octets}
719  %kb_fb_len(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0))))) == B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : B.Octets}
720  %octets_len_of(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0))))) == B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : B.Octets}
721  BL.octets_take_append(B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0))))
722
723def kb_key_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, ~rlen: Nat, kr: Result<&2, &2, Cr.CrError, K>, +fixed: B.Octets, +n: Nat) -> {Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => B.Octets.len(o), Kb.cr.kb.key(~K, ~compute, ~rlen, kr, fixed, n)) == Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => n, Kb.cr.kb.key(~K, ~compute, ~rlen, kr, fixed, n)) : Result<&2, &2, Cr.CrError, Nat>}:
724  match kr:
725    case Fail{e}:
726      {==}
727    case Done{+k}:
728      %Laws.kbkdf_counter_stream_length(~K, ~compute, ~rlen, k, fixed, n) : {Done{B.Octets.len(Kb.CrKbkdf.counter_stream(~K, ~compute, ~rlen, k, fixed, n))} == Done{_} : Result<&2, &2, Cr.CrError, Nat>}
729      {==}
730
731def kb_checked_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, ~rlen: Nat, fits: Bool, kr: Result<&2, &2, Cr.CrError, K>, +fixed: B.Octets, +n: Nat) -> {Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => B.Octets.len(o), Kb.cr.kb.checked(~K, ~compute, ~rlen, fits, kr, fixed, n)) == Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => n, Kb.cr.kb.checked(~K, ~compute, ~rlen, fits, kr, fixed, n)) : Result<&2, &2, Cr.CrError, Nat>}:
732  match fits:
733    case False{}:
734      {==}
735    case True{}:
736      kb_key_len(~K, ~compute, ~rlen, kr, fixed, n)
737
738def Laws.kbkdf_counter_length(K, key, compute, hlen, rlen, llen, ki, label, context, n):
739  kb_checked_len(~K, ~compute, ~rlen, Kb.cr.kb.fits(hlen, llen, n, Nat.sub(Nat.pow(2n, Nat.mul(8n, rlen)), 1n)), key(ki), Kb.CrKbkdf.fixed(~llen, label, context, n), n)
740
741def kb_fkey_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, ~rlen: Nat, kr: Result<&2, &2, Cr.CrError, K>, +iv: B.Octets, +fixed: B.Octets, +n: Nat) -> {Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => B.Octets.len(o), Kb.cr.kb.fkey(~K, ~compute, ~rlen, kr, iv, fixed, n)) == Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => n, Kb.cr.kb.fkey(~K, ~compute, ~rlen, kr, iv, fixed, n)) : Result<&2, &2, Cr.CrError, Nat>}:
742  match kr:
743    case Fail{e}:
744      {==}
745    case Done{+k}:
746      %Laws.kbkdf_feedback_stream_length(~K, ~compute, ~rlen, k, iv, fixed, n) : {Done{B.Octets.len(Kb.CrKbkdf.feedback_stream(~K, ~compute, ~rlen, k, iv, fixed, n))} == Done{_} : Result<&2, &2, Cr.CrError, Nat>}
747      {==}
748
749def kb_fchecked_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, ~rlen: Nat, fits: Bool, kr: Result<&2, &2, Cr.CrError, K>, +iv: B.Octets, +fixed: B.Octets, +n: Nat) -> {Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => B.Octets.len(o), Kb.cr.kb.fchecked(~K, ~compute, ~rlen, fits, kr, iv, fixed, n)) == Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => n, Kb.cr.kb.fchecked(~K, ~compute, ~rlen, fits, kr, iv, fixed, n)) : Result<&2, &2, Cr.CrError, Nat>}:
750  match fits:
751    case False{}:
752      {==}
753    case True{}:
754      kb_fkey_len(~K, ~compute, ~rlen, kr, iv, fixed, n)
755
756def Laws.kbkdf_feedback_length(K, key, compute, hlen, rlen, llen, ki, iv, label, context, n):
757  kb_fchecked_len(~K, ~compute, ~rlen, Kb.cr.kb.fits(hlen, llen, n, 4294967295n), key(ki), iv, Kb.CrKbkdf.fixed(~llen, label, context, n), n)
758
759def Laws.kbkdf_hmac_sha256_vector():
760  {==}
761
762# Per-instance proofs (gen/instances.py)
763
764# BEGIN GENERATED by gen/instances.py: proofs
765def Laws.des_block_round_trip(k, b):
766  LL.des_round_trip(k, b)
767
768def Laws.des_block_round_trip_dual(k, b):
769  LL.des_round_trip_dual(k, b)
770
771def Laws.des_key_length():
772  {==}
773
774def ecb_rt.des(+k: D.LcDesKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs)) : List<&2, L.LcBlock64>}:
775  match bs:
776    case Nil{}:
777      {==}
778    case Con{b, t}:
779      %Equal.sym(L.LcBlock64, D.LcDes.decrypt(k, D.LcDes.encrypt(k, b)), b, LL.des_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, t))} : List<&2, L.LcBlock64>}
780      %ecb_rt.des(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>}
781      {==}
782
783def Laws.des_ecb_round_trip(k, bs):
784  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs, Nil{}), Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs), ecb_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs)) : {Md.cr.ecb.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>}
785  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs), Nil{}), Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs)), ecb_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>}
786  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs)), ecb_rt.des(k, bs))
787
788def cbc_rt.des(+k: D.LcDesKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
789  match bs:
790    case Nil{}:
791      {==}
792    case Con{+p, t}:
793      %Equal.sym(L.LcBlock64, D.LcDes.decrypt(k, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.des_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, t, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))), D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
794      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, t, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))), D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
795      %cbc_rt.des(k, t, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
796      {==}
797
798def Laws.des_cbc_round_trip(k, iv, bs):
799  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
800  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
801  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.des(k, bs, iv))
802
803def pcbc_rt.des(+k: D.LcDesKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
804  match bs:
805    case Nil{}:
806      {==}
807    case Con{+p, t}:
808      %Equal.sym(L.LcBlock64, D.LcDes.decrypt(k, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.des_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
809      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
810      %pcbc_rt.des(k, t, LC.CrBlk64.xor(p, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
811      {==}
812
813def Laws.des_pcbc_round_trip(k, iv, bs):
814  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
815  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
816  Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.des(k, bs, iv))
817
818def Laws.tdes_block_round_trip(k, b):
819  LL.tdes_round_trip(k, b)
820
821def Laws.tdes_block_round_trip_dual(k, b):
822  LL.tdes_round_trip_dual(k, b)
823
824def Laws.tdes_key_length():
825  {==}
826
827def ecb_rt.tdes(+k: T.LcTdesKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs)) : List<&2, L.LcBlock64>}:
828  match bs:
829    case Nil{}:
830      {==}
831    case Con{b, t}:
832      %Equal.sym(L.LcBlock64, T.LcTdes.decrypt(k, T.LcTdes.encrypt(k, b)), b, LL.tdes_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, t))} : List<&2, L.LcBlock64>}
833      %ecb_rt.tdes(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>}
834      {==}
835
836def Laws.tdes_ecb_round_trip(k, bs):
837  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs, Nil{}), Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs), ecb_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs)) : {Md.cr.ecb.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>}
838  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs), Nil{}), Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs)), ecb_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>}
839  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs)), ecb_rt.tdes(k, bs))
840
841def cbc_rt.tdes(+k: T.LcTdesKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
842  match bs:
843    case Nil{}:
844      {==}
845    case Con{+p, t}:
846      %Equal.sym(L.LcBlock64, T.LcTdes.decrypt(k, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.tdes_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, t, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))), T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
847      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, t, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))), T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
848      %cbc_rt.tdes(k, t, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
849      {==}
850
851def Laws.tdes_cbc_round_trip(k, iv, bs):
852  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
853  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
854  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.tdes(k, bs, iv))
855
856def pcbc_rt.tdes(+k: T.LcTdesKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
857  match bs:
858    case Nil{}:
859      {==}
860    case Con{+p, t}:
861      %Equal.sym(L.LcBlock64, T.LcTdes.decrypt(k, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.tdes_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
862      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
863      %pcbc_rt.tdes(k, t, LC.CrBlk64.xor(p, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
864      {==}
865
866def Laws.tdes_pcbc_round_trip(k, iv, bs):
867  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
868  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
869  Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.tdes(k, bs, iv))
870
871def Laws.sm4_block_round_trip(k, b):
872  LL.sm4_round_trip(k, b)
873
874def Laws.sm4_block_round_trip_dual(k, b):
875  LL.sm4_round_trip_dual(k, b)
876
877def Laws.sm4_key_length():
878  {==}
879
880def ecb_rt.sm4(+k: S.LcSm4Key, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs)) : List<&2, M.CmBlock>}:
881  match bs:
882    case Nil{}:
883      {==}
884    case Con{b, t}:
885      %Equal.sym(M.CmBlock, S.LcSm4.decrypt(k, S.LcSm4.encrypt(k, b)), b, LL.sm4_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, t))} : List<&2, M.CmBlock>}
886      %ecb_rt.sm4(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>}
887      {==}
888
889def Laws.sm4_ecb_round_trip(k, bs):
890  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs, Nil{}), Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs), ecb_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs)) : {Md.cr.ecb.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>}
891  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs), Nil{}), Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs)), ecb_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>}
892  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs)), ecb_rt.sm4(k, bs))
893
894def cbc_rt.sm4(+k: S.LcSm4Key, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
895  match bs:
896    case Nil{}:
897      {==}
898    case Con{+p, t}:
899      %Equal.sym(M.CmBlock, S.LcSm4.decrypt(k, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.sm4_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, t, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))), S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
900      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, t, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))), S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
901      %cbc_rt.sm4(k, t, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
902      {==}
903
904def Laws.sm4_cbc_round_trip(k, iv, bs):
905  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
906  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
907  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.sm4(k, bs, iv))
908
909def pcbc_rt.sm4(+k: S.LcSm4Key, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
910  match bs:
911    case Nil{}:
912      {==}
913    case Con{+p, t}:
914      %Equal.sym(M.CmBlock, S.LcSm4.decrypt(k, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.sm4_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
915      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
916      %pcbc_rt.sm4(k, t, CM.CrBlk128.xor(p, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
917      {==}
918
919def Laws.sm4_pcbc_round_trip(k, iv, bs):
920  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
921  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
922  Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.sm4(k, bs, iv))
923
924def lrw_b.sm4(+k: S.LcSm4Key, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}:
925  match t:
926    case None{}:
927      Equal.sym(M.CmBlock, S.LcSm4.decrypt(k, S.LcSm4.encrypt(k, p)), p, LL.sm4_round_trip(k, p))
928    case Some{+x}:
929      %cmblock_xx(S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(S.LcSm4.decrypt(k, _), x) : M.CmBlock}
930      %Equal.sym(M.CmBlock, S.LcSm4.decrypt(k, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.sm4_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock}
931      cmblock_xx(p, x)
932
933def lrw_rt.sm4(+k: S.LcSm4Key, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}:
934  match bs:
935    case Nil{}:
936      {==}
937    case Con{+p, t}:
938      %lrw_b.sm4(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>}
939      %lrw_rt.sm4(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
940      {==}
941
942def Laws.sm4_lrw_round_trip(k, k2, i, bs):
943  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>}
944  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>}
945  Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.sm4(k, k2, bs, i))
946
947def Laws.camellia_block_round_trip(k, b):
948  LL.camellia_round_trip(k, b)
949
950def Laws.camellia_block_round_trip_dual(k, b):
951  LL.camellia_round_trip_dual(k, b)
952
953def Laws.camellia_key_length():
954  {==}
955
956def ecb_rt.camellia(+k: Ca.LcCamelliaKey, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs)) : List<&2, M.CmBlock>}:
957  match bs:
958    case Nil{}:
959      {==}
960    case Con{b, t}:
961      %Equal.sym(M.CmBlock, Ca.LcCamellia.decrypt(k, Ca.LcCamellia.encrypt(k, b)), b, LL.camellia_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, t))} : List<&2, M.CmBlock>}
962      %ecb_rt.camellia(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>}
963      {==}
964
965def Laws.camellia_ecb_round_trip(k, bs):
966  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs, Nil{}), Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs), ecb_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs)) : {Md.cr.ecb.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>}
967  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs), Nil{}), Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs)), ecb_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>}
968  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs)), ecb_rt.camellia(k, bs))
969
970def cbc_rt.camellia(+k: Ca.LcCamelliaKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
971  match bs:
972    case Nil{}:
973      {==}
974    case Con{+p, t}:
975      %Equal.sym(M.CmBlock, Ca.LcCamellia.decrypt(k, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.camellia_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, t, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))), Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
976      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, t, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))), Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
977      %cbc_rt.camellia(k, t, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
978      {==}
979
980def Laws.camellia_cbc_round_trip(k, iv, bs):
981  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
982  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
983  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.camellia(k, bs, iv))
984
985def pcbc_rt.camellia(+k: Ca.LcCamelliaKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
986  match bs:
987    case Nil{}:
988      {==}
989    case Con{+p, t}:
990      %Equal.sym(M.CmBlock, Ca.LcCamellia.decrypt(k, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.camellia_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
991      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
992      %pcbc_rt.camellia(k, t, CM.CrBlk128.xor(p, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
993      {==}
994
995def Laws.camellia_pcbc_round_trip(k, iv, bs):
996  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
997  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
998  Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.camellia(k, bs, iv))
999
1000def lrw_b.camellia(+k: Ca.LcCamelliaKey, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}:
1001  match t:
1002    case None{}:
1003      Equal.sym(M.CmBlock, Ca.LcCamellia.decrypt(k, Ca.LcCamellia.encrypt(k, p)), p, LL.camellia_round_trip(k, p))
1004    case Some{+x}:
1005      %cmblock_xx(Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(Ca.LcCamellia.decrypt(k, _), x) : M.CmBlock}
1006      %Equal.sym(M.CmBlock, Ca.LcCamellia.decrypt(k, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.camellia_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock}
1007      cmblock_xx(p, x)
1008
1009def lrw_rt.camellia(+k: Ca.LcCamelliaKey, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}:
1010  match bs:
1011    case Nil{}:
1012      {==}
1013    case Con{+p, t}:
1014      %lrw_b.camellia(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>}
1015      %lrw_rt.camellia(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1016      {==}
1017
1018def Laws.camellia_lrw_round_trip(k, k2, i, bs):
1019  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>}
1020  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>}
1021  Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.camellia(k, k2, bs, i))
1022
1023def Laws.serpent_block_round_trip(k, b):
1024  LL.serpent_round_trip(k, b)
1025
1026def Laws.serpent_block_round_trip_dual(k, b):
1027  LL.serpent_round_trip_dual(k, b)
1028
1029def Laws.serpent_key_length():
1030  {==}
1031
1032def ecb_rt.serpent(+k: Sp.LcSerpentKey, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs)) : List<&2, M.CmBlock>}:
1033  match bs:
1034    case Nil{}:
1035      {==}
1036    case Con{b, t}:
1037      %Equal.sym(M.CmBlock, Sp.LcSerpent.decrypt(k, Sp.LcSerpent.encrypt(k, b)), b, LL.serpent_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, t))} : List<&2, M.CmBlock>}
1038      %ecb_rt.serpent(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>}
1039      {==}
1040
1041def Laws.serpent_ecb_round_trip(k, bs):
1042  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs, Nil{}), Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs), ecb_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs)) : {Md.cr.ecb.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>}
1043  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs), Nil{}), Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs)), ecb_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>}
1044  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs)), ecb_rt.serpent(k, bs))
1045
1046def cbc_rt.serpent(+k: Sp.LcSerpentKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
1047  match bs:
1048    case Nil{}:
1049      {==}
1050    case Con{+p, t}:
1051      %Equal.sym(M.CmBlock, Sp.LcSerpent.decrypt(k, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.serpent_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, t, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))), Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
1052      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, t, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))), Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
1053      %cbc_rt.serpent(k, t, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1054      {==}
1055
1056def Laws.serpent_cbc_round_trip(k, iv, bs):
1057  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
1058  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
1059  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.serpent(k, bs, iv))
1060
1061def pcbc_rt.serpent(+k: Sp.LcSerpentKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
1062  match bs:
1063    case Nil{}:
1064      {==}
1065    case Con{+p, t}:
1066      %Equal.sym(M.CmBlock, Sp.LcSerpent.decrypt(k, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.serpent_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
1067      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
1068      %pcbc_rt.serpent(k, t, CM.CrBlk128.xor(p, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1069      {==}
1070
1071def Laws.serpent_pcbc_round_trip(k, iv, bs):
1072  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
1073  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
1074  Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.serpent(k, bs, iv))
1075
1076def lrw_b.serpent(+k: Sp.LcSerpentKey, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}:
1077  match t:
1078    case None{}:
1079      Equal.sym(M.CmBlock, Sp.LcSerpent.decrypt(k, Sp.LcSerpent.encrypt(k, p)), p, LL.serpent_round_trip(k, p))
1080    case Some{+x}:
1081      %cmblock_xx(Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(Sp.LcSerpent.decrypt(k, _), x) : M.CmBlock}
1082      %Equal.sym(M.CmBlock, Sp.LcSerpent.decrypt(k, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.serpent_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock}
1083      cmblock_xx(p, x)
1084
1085def lrw_rt.serpent(+k: Sp.LcSerpentKey, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}:
1086  match bs:
1087    case Nil{}:
1088      {==}
1089    case Con{+p, t}:
1090      %lrw_b.serpent(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>}
1091      %lrw_rt.serpent(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1092      {==}
1093
1094def Laws.serpent_lrw_round_trip(k, k2, i, bs):
1095  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>}
1096  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>}
1097  Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.serpent(k, k2, bs, i))
1098
1099def Laws.twofish_block_round_trip(k, b):
1100  LL.twofish_round_trip(k, b)
1101
1102def Laws.twofish_block_round_trip_dual(k, b):
1103  LL.twofish_round_trip_dual(k, b)
1104
1105def Laws.twofish_key_length():
1106  {==}
1107
1108def ecb_rt.twofish(+k: Tf.LcTwofishKey, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs)) : List<&2, M.CmBlock>}:
1109  match bs:
1110    case Nil{}:
1111      {==}
1112    case Con{b, t}:
1113      %Equal.sym(M.CmBlock, Tf.LcTwofish.decrypt(k, Tf.LcTwofish.encrypt(k, b)), b, LL.twofish_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, t))} : List<&2, M.CmBlock>}
1114      %ecb_rt.twofish(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>}
1115      {==}
1116
1117def Laws.twofish_ecb_round_trip(k, bs):
1118  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs, Nil{}), Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs), ecb_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs)) : {Md.cr.ecb.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>}
1119  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs), Nil{}), Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs)), ecb_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>}
1120  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs)), ecb_rt.twofish(k, bs))
1121
1122def cbc_rt.twofish(+k: Tf.LcTwofishKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
1123  match bs:
1124    case Nil{}:
1125      {==}
1126    case Con{+p, t}:
1127      %Equal.sym(M.CmBlock, Tf.LcTwofish.decrypt(k, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.twofish_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, t, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))), Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
1128      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, t, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))), Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
1129      %cbc_rt.twofish(k, t, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1130      {==}
1131
1132def Laws.twofish_cbc_round_trip(k, iv, bs):
1133  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
1134  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
1135  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.twofish(k, bs, iv))
1136
1137def pcbc_rt.twofish(+k: Tf.LcTwofishKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
1138  match bs:
1139    case Nil{}:
1140      {==}
1141    case Con{+p, t}:
1142      %Equal.sym(M.CmBlock, Tf.LcTwofish.decrypt(k, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.twofish_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
1143      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
1144      %pcbc_rt.twofish(k, t, CM.CrBlk128.xor(p, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1145      {==}
1146
1147def Laws.twofish_pcbc_round_trip(k, iv, bs):
1148  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
1149  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
1150  Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.twofish(k, bs, iv))
1151
1152def lrw_b.twofish(+k: Tf.LcTwofishKey, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}:
1153  match t:
1154    case None{}:
1155      Equal.sym(M.CmBlock, Tf.LcTwofish.decrypt(k, Tf.LcTwofish.encrypt(k, p)), p, LL.twofish_round_trip(k, p))
1156    case Some{+x}:
1157      %cmblock_xx(Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(Tf.LcTwofish.decrypt(k, _), x) : M.CmBlock}
1158      %Equal.sym(M.CmBlock, Tf.LcTwofish.decrypt(k, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.twofish_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock}
1159      cmblock_xx(p, x)
1160
1161def lrw_rt.twofish(+k: Tf.LcTwofishKey, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}:
1162  match bs:
1163    case Nil{}:
1164      {==}
1165    case Con{+p, t}:
1166      %lrw_b.twofish(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>}
1167      %lrw_rt.twofish(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1168      {==}
1169
1170def Laws.twofish_lrw_round_trip(k, k2, i, bs):
1171  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>}
1172  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>}
1173  Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.twofish(k, k2, bs, i))
1174
1175def Laws.aria_block_round_trip(k, b):
1176  LL.aria_round_trip(k, b)
1177
1178def Laws.aria_block_round_trip_dual(k, b):
1179  LL.aria_round_trip_dual(k, b)
1180
1181def Laws.aria_key_length():
1182  {==}
1183
1184def ecb_rt.aria(+k: Ar.LcAriaKey, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs)) : List<&2, M.CmBlock>}:
1185  match bs:
1186    case Nil{}:
1187      {==}
1188    case Con{b, t}:
1189      %Equal.sym(M.CmBlock, Ar.LcAria.decrypt(k, Ar.LcAria.encrypt(k, b)), b, LL.aria_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, t))} : List<&2, M.CmBlock>}
1190      %ecb_rt.aria(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>}
1191      {==}
1192
1193def Laws.aria_ecb_round_trip(k, bs):
1194  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs, Nil{}), Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs), ecb_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs)) : {Md.cr.ecb.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>}
1195  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs), Nil{}), Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs)), ecb_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>}
1196  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs)), ecb_rt.aria(k, bs))
1197
1198def cbc_rt.aria(+k: Ar.LcAriaKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
1199  match bs:
1200    case Nil{}:
1201      {==}
1202    case Con{+p, t}:
1203      %Equal.sym(M.CmBlock, Ar.LcAria.decrypt(k, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.aria_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, t, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))), Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
1204      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, t, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))), Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
1205      %cbc_rt.aria(k, t, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1206      {==}
1207
1208def Laws.aria_cbc_round_trip(k, iv, bs):
1209  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
1210  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
1211  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.aria(k, bs, iv))
1212
1213def pcbc_rt.aria(+k: Ar.LcAriaKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
1214  match bs:
1215    case Nil{}:
1216      {==}
1217    case Con{+p, t}:
1218      %Equal.sym(M.CmBlock, Ar.LcAria.decrypt(k, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.aria_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
1219      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
1220      %pcbc_rt.aria(k, t, CM.CrBlk128.xor(p, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1221      {==}
1222
1223def Laws.aria_pcbc_round_trip(k, iv, bs):
1224  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
1225  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
1226  Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.aria(k, bs, iv))
1227
1228def lrw_b.aria(+k: Ar.LcAriaKey, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}:
1229  match t:
1230    case None{}:
1231      Equal.sym(M.CmBlock, Ar.LcAria.decrypt(k, Ar.LcAria.encrypt(k, p)), p, LL.aria_round_trip(k, p))
1232    case Some{+x}:
1233      %cmblock_xx(Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(Ar.LcAria.decrypt(k, _), x) : M.CmBlock}
1234      %Equal.sym(M.CmBlock, Ar.LcAria.decrypt(k, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.aria_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock}
1235      cmblock_xx(p, x)
1236
1237def lrw_rt.aria(+k: Ar.LcAriaKey, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}:
1238  match bs:
1239    case Nil{}:
1240      {==}
1241    case Con{+p, t}:
1242      %lrw_b.aria(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>}
1243      %lrw_rt.aria(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1244      {==}
1245
1246def Laws.aria_lrw_round_trip(k, k2, i, bs):
1247  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>}
1248  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>}
1249  Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.aria(k, k2, bs, i))
1250
1251def Laws.cast6_block_round_trip(k, b):
1252  LL.cast6_round_trip(k, b)
1253
1254def Laws.cast6_block_round_trip_dual(k, b):
1255  LL.cast6_round_trip_dual(k, b)
1256
1257def Laws.cast6_key_length():
1258  {==}
1259
1260def ecb_rt.cast6(+k: C6.LcCast6Key, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs)) : List<&2, M.CmBlock>}:
1261  match bs:
1262    case Nil{}:
1263      {==}
1264    case Con{b, t}:
1265      %Equal.sym(M.CmBlock, C6.LcCast6.decrypt(k, C6.LcCast6.encrypt(k, b)), b, LL.cast6_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, t))} : List<&2, M.CmBlock>}
1266      %ecb_rt.cast6(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>}
1267      {==}
1268
1269def Laws.cast6_ecb_round_trip(k, bs):
1270  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs, Nil{}), Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs), ecb_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs)) : {Md.cr.ecb.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>}
1271  %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs), Nil{}), Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs)), ecb_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>}
1272  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs)), ecb_rt.cast6(k, bs))
1273
1274def cbc_rt.cast6(+k: C6.LcCast6Key, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
1275  match bs:
1276    case Nil{}:
1277      {==}
1278    case Con{+p, t}:
1279      %Equal.sym(M.CmBlock, C6.LcCast6.decrypt(k, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.cast6_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, t, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))), C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
1280      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, t, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))), C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>}
1281      %cbc_rt.cast6(k, t, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1282      {==}
1283
1284def Laws.cast6_cbc_round_trip(k, iv, bs):
1285  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
1286  %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
1287  Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.cast6(k, bs, iv))
1288
1289def pcbc_rt.cast6(+k: C6.LcCast6Key, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}:
1290  match bs:
1291    case Nil{}:
1292      {==}
1293    case Con{+p, t}:
1294      %Equal.sym(M.CmBlock, C6.LcCast6.decrypt(k, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.cast6_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
1295      %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>}
1296      %pcbc_rt.cast6(k, t, CM.CrBlk128.xor(p, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1297      {==}
1298
1299def Laws.cast6_pcbc_round_trip(k, iv, bs):
1300  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>}
1301  %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>}
1302  Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.cast6(k, bs, iv))
1303
1304def lrw_b.cast6(+k: C6.LcCast6Key, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}:
1305  match t:
1306    case None{}:
1307      Equal.sym(M.CmBlock, C6.LcCast6.decrypt(k, C6.LcCast6.encrypt(k, p)), p, LL.cast6_round_trip(k, p))
1308    case Some{+x}:
1309      %cmblock_xx(C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(C6.LcCast6.decrypt(k, _), x) : M.CmBlock}
1310      %Equal.sym(M.CmBlock, C6.LcCast6.decrypt(k, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.cast6_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock}
1311      cmblock_xx(p, x)
1312
1313def lrw_rt.cast6(+k: C6.LcCast6Key, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}:
1314  match bs:
1315    case Nil{}:
1316      {==}
1317    case Con{+p, t}:
1318      %lrw_b.cast6(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>}
1319      %lrw_rt.cast6(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>}
1320      {==}
1321
1322def Laws.cast6_lrw_round_trip(k, k2, i, bs):
1323  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>}
1324  %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>}
1325  Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.cast6(k, k2, bs, i))
1326
1327def Laws.blowfish_block_round_trip(k, b):
1328  LL.blowfish_round_trip(k, b)
1329
1330def Laws.blowfish_block_round_trip_dual(k, b):
1331  LL.blowfish_round_trip_dual(k, b)
1332
1333def Laws.blowfish_key_length():
1334  {==}
1335
1336def ecb_rt.blowfish(+k: Bf.LcBlowfishKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs)) : List<&2, L.LcBlock64>}:
1337  match bs:
1338    case Nil{}:
1339      {==}
1340    case Con{b, t}:
1341      %Equal.sym(L.LcBlock64, Bf.LcBlowfish.decrypt(k, Bf.LcBlowfish.encrypt(k, b)), b, LL.blowfish_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, t))} : List<&2, L.LcBlock64>}
1342      %ecb_rt.blowfish(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>}
1343      {==}
1344
1345def Laws.blowfish_ecb_round_trip(k, bs):
1346  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs, Nil{}), Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs), ecb_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs)) : {Md.cr.ecb.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>}
1347  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs), Nil{}), Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs)), ecb_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>}
1348  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs)), ecb_rt.blowfish(k, bs))
1349
1350def cbc_rt.blowfish(+k: Bf.LcBlowfishKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
1351  match bs:
1352    case Nil{}:
1353      {==}
1354    case Con{+p, t}:
1355      %Equal.sym(L.LcBlock64, Bf.LcBlowfish.decrypt(k, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.blowfish_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, t, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))), Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
1356      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, t, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))), Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
1357      %cbc_rt.blowfish(k, t, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
1358      {==}
1359
1360def Laws.blowfish_cbc_round_trip(k, iv, bs):
1361  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
1362  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
1363  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.blowfish(k, bs, iv))
1364
1365def pcbc_rt.blowfish(+k: Bf.LcBlowfishKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
1366  match bs:
1367    case Nil{}:
1368      {==}
1369    case Con{+p, t}:
1370      %Equal.sym(L.LcBlock64, Bf.LcBlowfish.decrypt(k, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.blowfish_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
1371      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
1372      %pcbc_rt.blowfish(k, t, LC.CrBlk64.xor(p, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
1373      {==}
1374
1375def Laws.blowfish_pcbc_round_trip(k, iv, bs):
1376  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
1377  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
1378  Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.blowfish(k, bs, iv))
1379
1380def Laws.cast5_block_round_trip(k, b):
1381  LL.cast5_round_trip(k, b)
1382
1383def Laws.cast5_block_round_trip_dual(k, b):
1384  LL.cast5_round_trip_dual(k, b)
1385
1386def Laws.cast5_key_length():
1387  {==}
1388
1389def ecb_rt.cast5(+k: C5.LcCast5Key, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs)) : List<&2, L.LcBlock64>}:
1390  match bs:
1391    case Nil{}:
1392      {==}
1393    case Con{b, t}:
1394      %Equal.sym(L.LcBlock64, C5.LcCast5.decrypt(k, C5.LcCast5.encrypt(k, b)), b, LL.cast5_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, t))} : List<&2, L.LcBlock64>}
1395      %ecb_rt.cast5(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>}
1396      {==}
1397
1398def Laws.cast5_ecb_round_trip(k, bs):
1399  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs, Nil{}), Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs), ecb_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs)) : {Md.cr.ecb.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>}
1400  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs), Nil{}), Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs)), ecb_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>}
1401  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs)), ecb_rt.cast5(k, bs))
1402
1403def cbc_rt.cast5(+k: C5.LcCast5Key, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
1404  match bs:
1405    case Nil{}:
1406      {==}
1407    case Con{+p, t}:
1408      %Equal.sym(L.LcBlock64, C5.LcCast5.decrypt(k, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.cast5_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, t, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))), C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
1409      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, t, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))), C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
1410      %cbc_rt.cast5(k, t, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
1411      {==}
1412
1413def Laws.cast5_cbc_round_trip(k, iv, bs):
1414  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
1415  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
1416  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.cast5(k, bs, iv))
1417
1418def pcbc_rt.cast5(+k: C5.LcCast5Key, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
1419  match bs:
1420    case Nil{}:
1421      {==}
1422    case Con{+p, t}:
1423      %Equal.sym(L.LcBlock64, C5.LcCast5.decrypt(k, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.cast5_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
1424      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
1425      %pcbc_rt.cast5(k, t, LC.CrBlk64.xor(p, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
1426      {==}
1427
1428def Laws.cast5_pcbc_round_trip(k, iv, bs):
1429  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
1430  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
1431  Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.cast5(k, bs, iv))
1432
1433def Laws.tea_block_round_trip(k, b):
1434  LL.tea_round_trip(k, b)
1435
1436def Laws.tea_block_round_trip_dual(k, b):
1437  LL.tea_round_trip_dual(k, b)
1438
1439def Laws.tea_key_length():
1440  {==}
1441
1442def ecb_rt.tea(+k: Te.LcTeaKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs)) : List<&2, L.LcBlock64>}:
1443  match bs:
1444    case Nil{}:
1445      {==}
1446    case Con{b, t}:
1447      %Equal.sym(L.LcBlock64, Te.LcTea.decrypt(k, Te.LcTea.encrypt(k, b)), b, LL.tea_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, t))} : List<&2, L.LcBlock64>}
1448      %ecb_rt.tea(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>}
1449      {==}
1450
1451def Laws.tea_ecb_round_trip(k, bs):
1452  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs, Nil{}), Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs), ecb_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs)) : {Md.cr.ecb.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>}
1453  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs), Nil{}), Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs)), ecb_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>}
1454  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs)), ecb_rt.tea(k, bs))
1455
1456def cbc_rt.tea(+k: Te.LcTeaKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
1457  match bs:
1458    case Nil{}:
1459      {==}
1460    case Con{+p, t}:
1461      %Equal.sym(L.LcBlock64, Te.LcTea.decrypt(k, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.tea_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, t, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))), Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
1462      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, t, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))), Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
1463      %cbc_rt.tea(k, t, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
1464      {==}
1465
1466def Laws.tea_cbc_round_trip(k, iv, bs):
1467  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
1468  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
1469  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.tea(k, bs, iv))
1470
1471def pcbc_rt.tea(+k: Te.LcTeaKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
1472  match bs:
1473    case Nil{}:
1474      {==}
1475    case Con{+p, t}:
1476      %Equal.sym(L.LcBlock64, Te.LcTea.decrypt(k, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.tea_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
1477      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
1478      %pcbc_rt.tea(k, t, LC.CrBlk64.xor(p, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
1479      {==}
1480
1481def Laws.tea_pcbc_round_trip(k, iv, bs):
1482  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
1483  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
1484  Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.tea(k, bs, iv))
1485
1486def Laws.xtea_block_round_trip(k, b):
1487  LL.xtea_round_trip(k, b)
1488
1489def Laws.xtea_block_round_trip_dual(k, b):
1490  LL.xtea_round_trip_dual(k, b)
1491
1492def Laws.xtea_key_length():
1493  {==}
1494
1495def ecb_rt.xtea(+k: Xt.LcXteaKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs)) : List<&2, L.LcBlock64>}:
1496  match bs:
1497    case Nil{}:
1498      {==}
1499    case Con{b, t}:
1500      %Equal.sym(L.LcBlock64, Xt.LcXtea.decrypt(k, Xt.LcXtea.encrypt(k, b)), b, LL.xtea_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, t))} : List<&2, L.LcBlock64>}
1501      %ecb_rt.xtea(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>}
1502      {==}
1503
1504def Laws.xtea_ecb_round_trip(k, bs):
1505  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs, Nil{}), Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs), ecb_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs)) : {Md.cr.ecb.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>}
1506  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs), Nil{}), Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs)), ecb_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>}
1507  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs)), ecb_rt.xtea(k, bs))
1508
1509def cbc_rt.xtea(+k: Xt.LcXteaKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
1510  match bs:
1511    case Nil{}:
1512      {==}
1513    case Con{+p, t}:
1514      %Equal.sym(L.LcBlock64, Xt.LcXtea.decrypt(k, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.xtea_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, t, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))), Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
1515      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, t, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))), Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
1516      %cbc_rt.xtea(k, t, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
1517      {==}
1518
1519def Laws.xtea_cbc_round_trip(k, iv, bs):
1520  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
1521  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
1522  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.xtea(k, bs, iv))
1523
1524def pcbc_rt.xtea(+k: Xt.LcXteaKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
1525  match bs:
1526    case Nil{}:
1527      {==}
1528    case Con{+p, t}:
1529      %Equal.sym(L.LcBlock64, Xt.LcXtea.decrypt(k, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.xtea_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
1530      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
1531      %pcbc_rt.xtea(k, t, LC.CrBlk64.xor(p, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
1532      {==}
1533
1534def Laws.xtea_pcbc_round_trip(k, iv, bs):
1535  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
1536  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
1537  Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.xtea(k, bs, iv))
1538
1539def Laws.fcrypt_block_round_trip(k, b):
1540  LL.fcrypt_round_trip(k, b)
1541
1542def Laws.fcrypt_block_round_trip_dual(k, b):
1543  LL.fcrypt_round_trip_dual(k, b)
1544
1545def Laws.fcrypt_key_length():
1546  {==}
1547
1548def ecb_rt.fcrypt(+k: Fc.LcFcryptKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs)) : List<&2, L.LcBlock64>}:
1549  match bs:
1550    case Nil{}:
1551      {==}
1552    case Con{b, t}:
1553      %Equal.sym(L.LcBlock64, Fc.LcFcrypt.decrypt(k, Fc.LcFcrypt.encrypt(k, b)), b, LL.fcrypt_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, t))} : List<&2, L.LcBlock64>}
1554      %ecb_rt.fcrypt(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>}
1555      {==}
1556
1557def Laws.fcrypt_ecb_round_trip(k, bs):
1558  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs, Nil{}), Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs), ecb_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs)) : {Md.cr.ecb.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>}
1559  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs), Nil{}), Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs)), ecb_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>}
1560  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs)), ecb_rt.fcrypt(k, bs))
1561
1562def cbc_rt.fcrypt(+k: Fc.LcFcryptKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
1563  match bs:
1564    case Nil{}:
1565      {==}
1566    case Con{+p, t}:
1567      %Equal.sym(L.LcBlock64, Fc.LcFcrypt.decrypt(k, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.fcrypt_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, t, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))), Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
1568      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, t, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))), Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>}
1569      %cbc_rt.fcrypt(k, t, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
1570      {==}
1571
1572def Laws.fcrypt_cbc_round_trip(k, iv, bs):
1573  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
1574  %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
1575  Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.fcrypt(k, bs, iv))
1576
1577def pcbc_rt.fcrypt(+k: Fc.LcFcryptKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}:
1578  match bs:
1579    case Nil{}:
1580      {==}
1581    case Con{+p, t}:
1582      %Equal.sym(L.LcBlock64, Fc.LcFcrypt.decrypt(k, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.fcrypt_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
1583      %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>}
1584      %pcbc_rt.fcrypt(k, t, LC.CrBlk64.xor(p, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>}
1585      {==}
1586
1587def Laws.fcrypt_pcbc_round_trip(k, iv, bs):
1588  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>}
1589  %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>}
1590  Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.fcrypt(k, bs, iv))
1591
1592def Laws.aes_key_length():
1593  {==}
1594
1595def Laws.aes_enc_key_length():
1596  {==}
1597
1598def Laws.rc4_stream_involution(s, m):
1599  LL.rc4_involution(s, m)
1600
1601def Laws.rc4_stream_streaming_data(s, a, b):
1602  LL.rc4_streaming_data(s, a, b)
1603
1604def Laws.rc4_stream_streaming_state(s, a, b):
1605  LL.rc4_streaming_state(s, a, b)
1606
1607def Laws.hmac_crc32_streaming(spec, s, a, b):
1608  match s:
1609    case Hm.CrHmacState{h, o}:
1610      %Laws.crc32_hash_streaming(~spec, h, a, b) : {Hm.CrHmacState{CR.CrCrc32.update(~spec, h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState<U32>}
1611      {==}
1612
1613def Laws.hmac_crc32_split(spec, kk, a, b):
1614  match kk:
1615    case Hm.CrHmacKey{+i, +o}:
1616      %Equal.sym(B.Octets, CR.CrCrc32.final(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.init(~spec), i), a), b)), CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))), Laws.crc32_hash_split3(~spec, i, a, b)) : {CR.CrCrc32.final(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.init(~spec), o), _)) == CR.CrCrc32.digest(~spec, B.Octets.append(o, CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1617      %Equal.sym(B.Octets, CR.CrCrc32.final(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.init(~spec), o), CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))), CR.CrCrc32.digest(~spec, B.Octets.append(o, CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))), Laws.crc32_hash_split(~spec, o, CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : {_ == CR.CrCrc32.digest(~spec, B.Octets.append(o, CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1618      {==}
1619
1620def Laws.hmac_crc64_streaming(spec, s, a, b):
1621  match s:
1622    case Hm.CrHmacState{h, o}:
1623      %Laws.crc64_hash_streaming(~spec, h, a, b) : {Hm.CrHmacState{CR.CrCrc64.update(~spec, h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState<W.W64>}
1624      {==}
1625
1626def Laws.hmac_crc64_split(spec, kk, a, b):
1627  match kk:
1628    case Hm.CrHmacKey{+i, +o}:
1629      %Equal.sym(B.Octets, CR.CrCrc64.final(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.init(~spec), i), a), b)), CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))), Laws.crc64_hash_split3(~spec, i, a, b)) : {CR.CrCrc64.final(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.init(~spec), o), _)) == CR.CrCrc64.digest(~spec, B.Octets.append(o, CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1630      %Equal.sym(B.Octets, CR.CrCrc64.final(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.init(~spec), o), CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))), CR.CrCrc64.digest(~spec, B.Octets.append(o, CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))), Laws.crc64_hash_split(~spec, o, CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : {_ == CR.CrCrc64.digest(~spec, B.Octets.append(o, CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1631      {==}
1632
1633def Laws.hmac_sha256_split(kk, a, b):
1634  match kk:
1635    case Hm.CrHmacKey{+i, +o}:
1636      %Equal.sym(B.Octets, SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init256(), i), a), b)), SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))), Laws.sha256_hash_split3(i, a, b)) : {SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init256(), o), _)) == SH.CrSha2.sha256(B.Octets.append(o, SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1637      %Equal.sym(B.Octets, SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init256(), o), SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))))), SH.CrSha2.sha256(B.Octets.append(o, SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))))), Laws.sha256_hash_split(o, SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == SH.CrSha2.sha256(B.Octets.append(o, SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1638      {==}
1639
1640def Laws.hmac_sha512_split(kk, a, b):
1641  match kk:
1642    case Hm.CrHmacKey{+i, +o}:
1643      %Equal.sym(B.Octets, SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init512(), i), a), b)), SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))), Laws.sha512_hash_split3(i, a, b)) : {SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init512(), o), _)) == SH.CrSha2.sha512(B.Octets.append(o, SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1644      %Equal.sym(B.Octets, SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init512(), o), SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))))), SH.CrSha2.sha512(B.Octets.append(o, SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))))), Laws.sha512_hash_split(o, SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == SH.CrSha2.sha512(B.Octets.append(o, SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1645      {==}
1646
1647def Laws.hmac_sha3_256_split(kk, a, b):
1648  match kk:
1649    case Hm.CrHmacKey{+i, +o}:
1650      %Equal.sym(B.Octets, S3.CrSha3.final(S3.CrSha3.update(S3.CrSha3.update(S3.CrSha3.update(S3.CrSha3.init(), i), a), b)), S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))), Laws.sha3_256_hash_split3(i, a, b)) : {S3.CrSha3.final(S3.CrSha3.update(S3.CrSha3.update(S3.CrSha3.init(), o), _)) == S3.CrSha3.sha3_256(B.Octets.append(o, S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1651      %Equal.sym(B.Octets, S3.CrSha3.final(S3.CrSha3.update(S3.CrSha3.update(S3.CrSha3.init(), o), S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))))), S3.CrSha3.sha3_256(B.Octets.append(o, S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))))), Laws.sha3_256_hash_split(o, S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == S3.CrSha3.sha3_256(B.Octets.append(o, S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1652      {==}
1653
1654def Laws.md4_hash_streaming(s, a, b):
1655  HSL.md4_streaming(s, a, b)
1656
1657def Laws.md4_hash_split(a, b):
1658  HSL.md4_split(a, b)
1659
1660def Laws.md4_hash_split3(a, b, c):
1661  HSL.md4_split3(a, b, c)
1662
1663def Laws.md4_hash_length(s):
1664  HSL.md4_length(s)
1665
1666def Laws.hmac_md4_streaming(s, a, b):
1667  match s:
1668    case Hm.CrHmacState{h, o}:
1669      %Laws.md4_hash_streaming(h, a, b) : {Hm.CrHmacState{HM4.HsMd4.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState<Hs.HsMdState<Hs.HsW4>>}
1670      {==}
1671
1672def Laws.hmac_md4_split(kk, a, b):
1673  match kk:
1674    case Hm.CrHmacKey{+i, +o}:
1675      %Equal.sym(B.Octets, HM4.HsMd4.final(HM4.HsMd4.update(HM4.HsMd4.update(HM4.HsMd4.update(HM4.HsMd4.init(), i), a), b)), HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))), Laws.md4_hash_split3(i, a, b)) : {HM4.HsMd4.final(HM4.HsMd4.update(HM4.HsMd4.update(HM4.HsMd4.init(), o), _)) == HM4.HsMd4.digest(B.Octets.append(o, HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1676      %Equal.sym(B.Octets, HM4.HsMd4.final(HM4.HsMd4.update(HM4.HsMd4.update(HM4.HsMd4.init(), o), HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))))), HM4.HsMd4.digest(B.Octets.append(o, HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))))), Laws.md4_hash_split(o, HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HM4.HsMd4.digest(B.Octets.append(o, HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1677      {==}
1678
1679def Laws.md5_hash_streaming(s, a, b):
1680  HSL.md5_streaming(s, a, b)
1681
1682def Laws.md5_hash_split(a, b):
1683  HSL.md5_split(a, b)
1684
1685def Laws.md5_hash_split3(a, b, c):
1686  HSL.md5_split3(a, b, c)
1687
1688def Laws.md5_hash_length(s):
1689  HSL.md5_length(s)
1690
1691def Laws.hmac_md5_streaming(s, a, b):
1692  match s:
1693    case Hm.CrHmacState{h, o}:
1694      %Laws.md5_hash_streaming(h, a, b) : {Hm.CrHmacState{HM5.HsMd5.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState<Hs.HsMdState<Hs.HsW4>>}
1695      {==}
1696
1697def Laws.hmac_md5_split(kk, a, b):
1698  match kk:
1699    case Hm.CrHmacKey{+i, +o}:
1700      %Equal.sym(B.Octets, HM5.HsMd5.final(HM5.HsMd5.update(HM5.HsMd5.update(HM5.HsMd5.update(HM5.HsMd5.init(), i), a), b)), HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))), Laws.md5_hash_split3(i, a, b)) : {HM5.HsMd5.final(HM5.HsMd5.update(HM5.HsMd5.update(HM5.HsMd5.init(), o), _)) == HM5.HsMd5.digest(B.Octets.append(o, HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1701      %Equal.sym(B.Octets, HM5.HsMd5.final(HM5.HsMd5.update(HM5.HsMd5.update(HM5.HsMd5.init(), o), HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))))), HM5.HsMd5.digest(B.Octets.append(o, HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))))), Laws.md5_hash_split(o, HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HM5.HsMd5.digest(B.Octets.append(o, HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1702      {==}
1703
1704def Laws.sha1_hash_streaming(s, a, b):
1705  HSL.sha1_streaming(s, a, b)
1706
1707def Laws.sha1_hash_split(a, b):
1708  HSL.sha1_split(a, b)
1709
1710def Laws.sha1_hash_split3(a, b, c):
1711  HSL.sha1_split3(a, b, c)
1712
1713def Laws.sha1_hash_length(s):
1714  HSL.sha1_length(s)
1715
1716def Laws.hmac_sha1_streaming(s, a, b):
1717  match s:
1718    case Hm.CrHmacState{h, o}:
1719      %Laws.sha1_hash_streaming(h, a, b) : {Hm.CrHmacState{HS1.HsSha1.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState<Hs.HsMdState<Hs.HsW5>>}
1720      {==}
1721
1722def Laws.hmac_sha1_split(kk, a, b):
1723  match kk:
1724    case Hm.CrHmacKey{+i, +o}:
1725      %Equal.sym(B.Octets, HS1.HsSha1.final(HS1.HsSha1.update(HS1.HsSha1.update(HS1.HsSha1.update(HS1.HsSha1.init(), i), a), b)), HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))), Laws.sha1_hash_split3(i, a, b)) : {HS1.HsSha1.final(HS1.HsSha1.update(HS1.HsSha1.update(HS1.HsSha1.init(), o), _)) == HS1.HsSha1.digest(B.Octets.append(o, HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1726      %Equal.sym(B.Octets, HS1.HsSha1.final(HS1.HsSha1.update(HS1.HsSha1.update(HS1.HsSha1.init(), o), HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))))), HS1.HsSha1.digest(B.Octets.append(o, HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))))), Laws.sha1_hash_split(o, HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HS1.HsSha1.digest(B.Octets.append(o, HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1727      {==}
1728
1729def Laws.ripemd160_hash_streaming(s, a, b):
1730  HSL.ripemd160_streaming(s, a, b)
1731
1732def Laws.ripemd160_hash_split(a, b):
1733  HSL.ripemd160_split(a, b)
1734
1735def Laws.ripemd160_hash_split3(a, b, c):
1736  HSL.ripemd160_split3(a, b, c)
1737
1738def Laws.ripemd160_hash_length(s):
1739  HSL.ripemd160_length(s)
1740
1741def Laws.hmac_ripemd160_streaming(s, a, b):
1742  match s:
1743    case Hm.CrHmacState{h, o}:
1744      %Laws.ripemd160_hash_streaming(h, a, b) : {Hm.CrHmacState{HRM.HsRipemd160.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState<Hs.HsMdState<Hs.HsW5>>}
1745      {==}
1746
1747def Laws.hmac_ripemd160_split(kk, a, b):
1748  match kk:
1749    case Hm.CrHmacKey{+i, +o}:
1750      %Equal.sym(B.Octets, HRM.HsRipemd160.final(HRM.HsRipemd160.update(HRM.HsRipemd160.update(HRM.HsRipemd160.update(HRM.HsRipemd160.init(), i), a), b)), HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))), Laws.ripemd160_hash_split3(i, a, b)) : {HRM.HsRipemd160.final(HRM.HsRipemd160.update(HRM.HsRipemd160.update(HRM.HsRipemd160.init(), o), _)) == HRM.HsRipemd160.digest(B.Octets.append(o, HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1751      %Equal.sym(B.Octets, HRM.HsRipemd160.final(HRM.HsRipemd160.update(HRM.HsRipemd160.update(HRM.HsRipemd160.init(), o), HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))))), HRM.HsRipemd160.digest(B.Octets.append(o, HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))))), Laws.ripemd160_hash_split(o, HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HRM.HsRipemd160.digest(B.Octets.append(o, HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1752      {==}
1753
1754def Laws.sm3_hash_streaming(s, a, b):
1755  HSL.sm3_streaming(s, a, b)
1756
1757def Laws.sm3_hash_split(a, b):
1758  HSL.sm3_split(a, b)
1759
1760def Laws.sm3_hash_split3(a, b, c):
1761  HSL.sm3_split3(a, b, c)
1762
1763def Laws.sm3_hash_length(s):
1764  HSL.sm3_length(s)
1765
1766def Laws.hmac_sm3_streaming(s, a, b):
1767  match s:
1768    case Hm.CrHmacState{h, o}:
1769      %Laws.sm3_hash_streaming(h, a, b) : {Hm.CrHmacState{HSM.HsSm3.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState<Hs.HsMdState<Hs.HsW8>>}
1770      {==}
1771
1772def Laws.hmac_sm3_split(kk, a, b):
1773  match kk:
1774    case Hm.CrHmacKey{+i, +o}:
1775      %Equal.sym(B.Octets, HSM.HsSm3.final(HSM.HsSm3.update(HSM.HsSm3.update(HSM.HsSm3.update(HSM.HsSm3.init(), i), a), b)), HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))), Laws.sm3_hash_split3(i, a, b)) : {HSM.HsSm3.final(HSM.HsSm3.update(HSM.HsSm3.update(HSM.HsSm3.init(), o), _)) == HSM.HsSm3.digest(B.Octets.append(o, HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1776      %Equal.sym(B.Octets, HSM.HsSm3.final(HSM.HsSm3.update(HSM.HsSm3.update(HSM.HsSm3.init(), o), HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))))), HSM.HsSm3.digest(B.Octets.append(o, HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))))), Laws.sm3_hash_split(o, HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HSM.HsSm3.digest(B.Octets.append(o, HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1777      {==}
1778
1779def Laws.streebog256_hash_streaming(s, a, b):
1780  HSL.streebog256_streaming(s, a, b)
1781
1782def Laws.streebog256_hash_split(a, b):
1783  HSL.streebog256_split(a, b)
1784
1785def Laws.streebog256_hash_split3(a, b, c):
1786  HSL.streebog256_split3(a, b, c)
1787
1788def Laws.streebog256_hash_length(s):
1789  HSL.streebog256_length(s)
1790
1791def Laws.hmac_streebog256_streaming(s, a, b):
1792  match s:
1793    case Hm.CrHmacState{h, o}:
1794      %Laws.streebog256_hash_streaming(h, a, b) : {Hm.CrHmacState{HST.HsStreebog.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState<Hs.HsMdState<HST.HsStbCv>>}
1795      {==}
1796
1797def Laws.hmac_streebog256_split(kk, a, b):
1798  match kk:
1799    case Hm.CrHmacKey{+i, +o}:
1800      %Equal.sym(B.Octets, HST.HsStreebog.final256(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init256(), i), a), b)), HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))), Laws.streebog256_hash_split3(i, a, b)) : {HST.HsStreebog.final256(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init256(), o), _)) == HST.HsStreebog.digest256(B.Octets.append(o, HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1801      %Equal.sym(B.Octets, HST.HsStreebog.final256(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init256(), o), HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))))), HST.HsStreebog.digest256(B.Octets.append(o, HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))))), Laws.streebog256_hash_split(o, HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HST.HsStreebog.digest256(B.Octets.append(o, HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1802      {==}
1803
1804def Laws.streebog512_hash_streaming(s, a, b):
1805  HSL.streebog512_streaming(s, a, b)
1806
1807def Laws.streebog512_hash_split(a, b):
1808  HSL.streebog512_split(a, b)
1809
1810def Laws.streebog512_hash_split3(a, b, c):
1811  HSL.streebog512_split3(a, b, c)
1812
1813def Laws.streebog512_hash_length(s):
1814  HSL.streebog512_length(s)
1815
1816def Laws.hmac_streebog512_streaming(s, a, b):
1817  match s:
1818    case Hm.CrHmacState{h, o}:
1819      %Laws.streebog512_hash_streaming(h, a, b) : {Hm.CrHmacState{HST.HsStreebog.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState<Hs.HsMdState<HST.HsStbCv>>}
1820      {==}
1821
1822def Laws.hmac_streebog512_split(kk, a, b):
1823  match kk:
1824    case Hm.CrHmacKey{+i, +o}:
1825      %Equal.sym(B.Octets, HST.HsStreebog.final512(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init512(), i), a), b)), HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))), Laws.streebog512_hash_split3(i, a, b)) : {HST.HsStreebog.final512(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init512(), o), _)) == HST.HsStreebog.digest512(B.Octets.append(o, HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1826      %Equal.sym(B.Octets, HST.HsStreebog.final512(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init512(), o), HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))))), HST.HsStreebog.digest512(B.Octets.append(o, HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))))), Laws.streebog512_hash_split(o, HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HST.HsStreebog.digest512(B.Octets.append(o, HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets}
1827      {==}
1828# END GENERATED: proofs