1	import Base
2	import ../../../src/crypto/secp256k1.bend as K
3	import ../../../spec/crypto/secp256k1/ecdsa.bend as ES
4	import ../../../spec/crypto/secp256k1/schnorr.bend as SS
5	
6	# The clauses of src/crypto/secp256k1.bend: every function is its
7	# specification (spec/crypto/secp256k1/, over the natural numbers, from
8	# SEC 1 v2, SEC 2, RFC 6979, BIP-340 and the Ethereum yellow paper) for
9	# every input (any byte lists, any Bool). The specification takes `one`,
10	# the number 1 kept symbolic (h1: one == 1), so that its 256-bit constants
11	# p, n and G are never expanded by the checker; every clause holds for the
12	# one `one` there is.
13	#
14	# The clauses are in five files, each proved by its own root (so that
15	# each root checks alone): laws.bend (keys and addresses, proof.bend),
16	# laws_sign.bend (proof_sign.bend), laws_verify.bend (proof_verify.bend),
17	# laws_recover.bend (proof_recover.bend) and laws_schnorr.bend
18	# (proof_schnorr.bend). This file: proof.bend.
19	
20	# the SEC 1 public key (33 bytes compressed, 65 uncompressed) of [d] G
21	law PublicKey.correct:
22	  for +one: Nat
23	  for +h1: {one == 1n : Nat}
24	  for +sk: List<&2, U32>
25	  for c: Bool
26	  {K.public_key(sk, c) == ES.public_key(one, sk, c) : Maybe<&2, List<&2, U32>>}
27	
28	# a key pair from a 32-byte seed: the seed and its compressed public key
29	law GenerateKeypair.correct:
30	  for +one: Nat
31	  for +h1: {one == 1n : Nat}
32	  for +seed: List<&2, U32>
33	  {K.generate_keypair(seed) == K.keypair_of(seed, ES.public_key(one, seed, True{})) : Maybe<&2, K.Keypair>}
34	
35	# the Ethereum address of an uncompressed public key
36	law EthAddress.correct:
37	  for +pk: List<&2, U32>
38	  {K.eth_address(pk) == ES.eth_address(pk) : Maybe<&2, List<&2, U32>>}