1	import Base
2	import ../../../../src/crypto/blake/blake2s/types.bend as T
3	import ../../../../src/crypto/blake/blake2s/compress.bend as C
4	import ../../../../src/crypto/blake/blake2s/blake2s.bend as K
5	import ../../../../spec/crypto/blake/blake2s.bend as R
6	
7	# The public API: for every packed input array and every byte length, the
8	# implementation returns exactly what the RFC 7693 specification returns
9	# (Some digest when length <= 4 * capacity, None otherwise).
10	law blake2s:
11	  for a: Array<U32>
12	  for +length: Nat
13	  {K.blake2s(a,length) == R.blake2s(a,length) : Maybe<&1,Array<U32>>}
14	
15	# The unrolled compression function is F with r = 10 rounds, for every
16	# chaining value, message block, counter and final-block flag.
17	law compress:
18	  for +h: T.State
19	  for +m0: U32
20	  for +m1: U32
21	  for +m2: U32
22	  for +m3: U32
23	  for +m4: U32
24	  for +m5: U32
25	  for +m6: U32
26	  for +m7: U32
27	  for +m8: U32
28	  for +m9: U32
29	  for +m10: U32
30	  for +m11: U32
31	  for +m12: U32
32	  for +m13: U32
33	  for +m14: U32
34	  for +m15: U32
35	  for +t0: U32
36	  for +t1: U32
37	  for +last: Bool
38	  {C.compress(h,m0,m1,m2,m3,m4,m5,m6,m7,m8,m9,m10,m11,m12,m13,m14,m15,t0,t1,last) == R.compress(10n,h,[m0,m1,m2,m3,m4,m5,m6,m7,m8,m9,m10,m11,m12,m13,m14,m15],t0,t1,last) : T.State}
39	
40	law digest_size:
41	  for s: T.State
42	  {Pair.snd(Array<U32>,U32,Array.size(U32,K.digest(s))) == 8 : U32}
43	
44	law capacity_rejection:
45	  for a: Array<U32>
46	  for +n: Nat
47	  for +capacity: U32
48	  for invalid: {Nat.is_le(n,Nat.mul(4n,U32.to_nat(capacity))) == False{} : Bool}
49	  {K.sized(n,(a,capacity)) == None{} : Maybe<&1,Array<U32>>}