1 import Base 2 import bend-osdev-bytes@0.1.0.0/bytes.bend as B 3 import bend-osdev-bytes@0.1.0.0/LAWS.bend as BL 4 import bend-osdev-bytes@0.1.0.0/PROOF.bend as BP 5 import bend-osdev-word64@0.1.0.0/word64.bend as W 6 import bend-osdev-cipher-modes@0.1.0.0/cipher_modes.bend as M 7 import bend-osdev-cipher-modes@0.1.0.0/aes.bend as X 8 import bend-osdev-cipher-modes@0.1.0.0/ccm.bend as MC 9 import bend-osdev-legacy-ciphers@0.1.0.0/legacy_ciphers.bend as L 10 import bend-osdev-legacy-ciphers@0.1.0.0/des.bend as D 11 import bend-osdev-legacy-ciphers@0.1.0.0/tdes.bend as T 12 import bend-osdev-legacy-ciphers@0.1.0.0/sm4.bend as S 13 import bend-osdev-legacy-ciphers@0.1.0.0/camellia.bend as Ca 14 import bend-osdev-legacy-ciphers@0.1.0.0/serpent.bend as Sp 15 import bend-osdev-legacy-ciphers@0.1.0.0/twofish.bend as Tf 16 import bend-osdev-legacy-ciphers@0.1.0.0/rc4.bend as R 17 import bend-osdev-legacy-ciphers@0.1.0.0/aria.bend as Ar 18 import bend-osdev-legacy-ciphers@0.1.0.0/cast6.bend as C6 19 import bend-osdev-legacy-ciphers@0.1.0.0/blowfish.bend as Bf 20 import bend-osdev-legacy-ciphers@0.1.0.0/cast5.bend as C5 21 import bend-osdev-legacy-ciphers@0.1.0.0/tea.bend as Te 22 import bend-osdev-legacy-ciphers@0.1.0.0/xtea.bend as Xt 23 import bend-osdev-legacy-ciphers@0.1.0.0/fcrypt.bend as Fc 24 import bend-osdev-legacy-ciphers@0.1.0.0/LAWS.bend as LL 25 import bend-osdev-legacy-ciphers@0.1.0.0/PROOF.bend as LP 26 import bend-osdev-crc@0.1.0.0/crc.bend as C 27 import bend-osdev-crc@0.1.0.0/LAWS.bend as CL 28 import bend-osdev-crc@0.1.0.0/PROOF.bend as CP 29 import ./crypto.bend as Cr 30 import ./stream.bend as St 31 import ./block.bend as Bk 32 import ./modes.bend as Md 33 import ./pcbc.bend as Pc 34 import ./lrw.bend as Lw 35 import ./xcbc.bend as Xc 36 import ./vmac.bend as Vm 37 import ./cts.bend as Ct 38 import ./octets.bend as Oc 39 import bend-osdev-gf@0.1.0.0/gf128.bend as G 40 import ./hash.bend as H 41 import ./mac.bend as Mc 42 import ./hmac.bend as Hm 43 import ./hkdf.bend as Hk 44 import ./sign.bend as Sg 45 import ./kex.bend as Kx 46 import ./inst_cm.bend as CM 47 import ./inst_lc.bend as LC 48 import ./inst_aes.bend as A 49 import ./inst_rc4.bend as RC 50 import ./inst_ccm.bend as CC 51 import ./inst_cmac.bend as CMI 52 import ./inst_crc.bend as CR 53 import ./inst_sha2.bend as SH 54 import ./inst_sha3.bend as S3 55 import bend-osdev-hashes@0.1.0.0/hashes.bend as Hs 56 import bend-osdev-hashes@0.1.0.0/md4.bend as HM4 57 import bend-osdev-hashes@0.1.0.0/md5.bend as HM5 58 import bend-osdev-hashes@0.1.0.0/sha1.bend as HS1 59 import bend-osdev-hashes@0.1.0.0/ripemd160.bend as HRM 60 import bend-osdev-hashes@0.1.0.0/sm3.bend as HSM 61 import bend-osdev-hashes@0.1.0.0/streebog.bend as HST 62 import bend-osdev-hashes@0.1.0.0/michael.bend as HMI 63 import ./inst_michael.bend as MIC 64 import ./pbkdf2.bend as Pb 65 import ./inst_pbkdf2.bend as PbI 66 import ./kbkdf.bend as Kb 67 import ./inst_kbkdf.bend as KbI 68 import bend-osdev-hashes@0.1.0.0/LAWS.bend as HSL 69 import bend-osdev-hashes@0.1.0.0/PROOF.bend as HSP 70 import bend-collections-laws-crypto@1.0.0.0/spec/crypto/sha.bend as F256 71 import bend-collections-laws-crypto@1.0.0.0/spec/crypto/sha512.bend as F512 72 import bend-collections-laws-crypto@1.0.0.0/spec/crypto/sha3.bend as F202 73 import bend-collections-laws-crypto@1.0.0.0/src/crypto/hash.bend as Hc 74 import bend-collections-laws-crypto@1.0.0.0/proofs/crypto/hash/laws.bend as HL 75 import bend-collections-laws-crypto@1.0.0.0/proofs/crypto/hash/proof.bend as HP 76 import ./LAWS.bend as Laws 77 78 # BEGIN GENERATED by gen/proof.py: bits 79 # the low byte of a XOR depends only on the low byte of its first operand 80 def byte_xor_byte(z: U32, k: U32) -> {B.byte(U32.xor(z, k)) == B.byte(U32.xor(B.byte(z), k)) : U32}: 81 match z k: 82 case U32{WCon{a0, WCon{a1, WCon{a2, WCon{a3, WCon{a4, WCon{a5, WCon{a6, WCon{a7, WCon{a8, WCon{a9, WCon{a10, WCon{a11, WCon{a12, WCon{a13, WCon{a14, WCon{a15, WCon{a16, WCon{a17, WCon{a18, WCon{a19, WCon{a20, WCon{a21, WCon{a22, WCon{a23, WCon{a24, WCon{a25, WCon{a26, WCon{a27, WCon{a28, WCon{a29, WCon{a30, WCon{a31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}} U32{WCon{b0, WCon{b1, WCon{b2, WCon{b3, WCon{b4, WCon{b5, WCon{b6, WCon{b7, WCon{b8, WCon{b9, WCon{b10, WCon{b11, WCon{b12, WCon{b13, WCon{b14, WCon{b15, WCon{b16, WCon{b17, WCon{b18, WCon{b19, WCon{b20, WCon{b21, WCon{b22, WCon{b23, WCon{b24, WCon{b25, WCon{b26, WCon{b27, WCon{b28, WCon{b29, WCon{b30, WCon{b31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}: 83 {==} 84 85 # a word's big-endian bytes are four 86 def be32_len(v: U32) -> {B.Octets.len(B.Octets.be32(v)) == 4n : Nat}: 87 match v: 88 case U32{WCon{a0, WCon{a1, WCon{a2, WCon{a3, WCon{a4, WCon{a5, WCon{a6, WCon{a7, WCon{a8, WCon{a9, WCon{a10, WCon{a11, WCon{a12, WCon{a13, WCon{a14, WCon{a15, WCon{a16, WCon{a17, WCon{a18, WCon{a19, WCon{a20, WCon{a21, WCon{a22, WCon{a23, WCon{a24, WCon{a25, WCon{a26, WCon{a27, WCon{a28, WCon{a29, WCon{a30, WCon{a31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}: 89 {==} 90 91 # a 128-bit block's 16 bytes, masked and read back 92 def f128_bytes(b: M.CmBlock) -> {CM.cr.f128.block(B.mask(CM.cr.f128.bytes(b))) == Some{b} : Maybe<&2, M.CmBlock>}: 93 match b: 94 case M.CmBlock{U32{WCon{a0, WCon{a1, WCon{a2, WCon{a3, WCon{a4, WCon{a5, WCon{a6, WCon{a7, WCon{a8, WCon{a9, WCon{a10, WCon{a11, WCon{a12, WCon{a13, WCon{a14, WCon{a15, WCon{a16, WCon{a17, WCon{a18, WCon{a19, WCon{a20, WCon{a21, WCon{a22, WCon{a23, WCon{a24, WCon{a25, WCon{a26, WCon{a27, WCon{a28, WCon{a29, WCon{a30, WCon{a31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{d0, WCon{d1, WCon{d2, WCon{d3, WCon{d4, WCon{d5, WCon{d6, WCon{d7, WCon{d8, WCon{d9, WCon{d10, WCon{d11, WCon{d12, WCon{d13, WCon{d14, WCon{d15, WCon{d16, WCon{d17, WCon{d18, WCon{d19, WCon{d20, WCon{d21, WCon{d22, WCon{d23, WCon{d24, WCon{d25, WCon{d26, WCon{d27, WCon{d28, WCon{d29, WCon{d30, WCon{d31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{e0, WCon{e1, WCon{e2, WCon{e3, WCon{e4, WCon{e5, WCon{e6, WCon{e7, WCon{e8, WCon{e9, WCon{e10, WCon{e11, WCon{e12, WCon{e13, WCon{e14, WCon{e15, WCon{e16, WCon{e17, WCon{e18, WCon{e19, WCon{e20, WCon{e21, WCon{e22, WCon{e23, WCon{e24, WCon{e25, WCon{e26, WCon{e27, WCon{e28, WCon{e29, WCon{e30, WCon{e31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}: 95 {==} 96 # END GENERATED: bits 97 98 # XOR undone: a == (a xor b) xor b, for every bit, word and byte. Each lemma 99 # is stated simple side first, the form a rewrite (%e : P) takes. 100 101 def bool_xx(a: Bool, b: Bool) -> {a == Bool.xor(Bool.xor(a, b), b) : Bool}: 102 match a b: 103 case True{} True{}: 104 {==} 105 case True{} False{}: 106 {==} 107 case False{} True{}: 108 {==} 109 case False{} False{}: 110 {==} 111 112 def word_xx(n: Nat, a: Word(n), b: Word(n)) -> {a == Word.xor(n, Word.xor(n, a, b), b) : Word(n)}: 113 match n: 114 case 0n: 115 match a b: 116 case WNil{} WNil{}: 117 {==} 118 case 1n+p: 119 match a b: 120 case WCon{ah, at} WCon{bh, bt}: 121 %bool_xx(ah, bh) : {WCon{ah, at} == WCon{_, Word.xor(p, Word.xor(p, at, bt), bt)} : Word(1n+p)} 122 %word_xx(p, at, bt) : {WCon{ah, at} == WCon{ah, _} : Word(1n+p)} 123 {==} 124 125 def u32_xx(a: U32, b: U32) -> {a == U32.xor(U32.xor(a, b), b) : U32}: 126 match a b: 127 case U32{x} U32{y}: 128 %word_xx(32n, x, y) : {U32{x} == U32{_} : U32} 129 {==} 130 131 def byte_xx(+h: U32, +k: U32) -> {B.byte(h) == B.byte(U32.xor(B.byte(U32.xor(h, k)), k)) : U32}: 132 %byte_xor_byte(U32.xor(h, k), k) : {B.byte(h) == _ : U32} 133 %u32_xx(h, k) : {B.byte(h) == B.byte(_) : U32} 134 {==} 135 136 # Lists and Octets 137 138 def rev2(l: List<&2, U32>, +a: List<&2, U32>) -> {St.cr.rev_onto(St.cr.rev_onto(l, a), Nil{}) == St.cr.rev_onto(a, l) : List<&2, U32>}: 139 match l: 140 case Nil{}: 141 {==} 142 case Con{h, t}: 143 rev2(t, Con{h, a}) 144 145 def mask_append(p: List<&2, U32>, +q: List<&2, U32>) -> {B.mask(B.append(p, q)) == B.append(B.mask(p), B.mask(q)) : List<&2, U32>}: 146 match p: 147 case Nil{}: 148 {==} 149 case Con{+h, +t}: 150 %mask_append(t, q) : {Con{B.byte(h), B.mask(B.append(t, q))} == Con{B.byte(h), _} : List<&2, U32>} 151 {==} 152 153 # Octets.of_list of an append is the append of the Octets (from bytes' laws) 154 def octets_of_append(+p: List<&2, U32>, +q: List<&2, U32>) -> {B.Octets.of_list(B.append(p, q)) == B.Octets.append(B.Octets.of_list(p), B.Octets.of_list(q)) : B.Octets}: 155 %BL.octets_of_to(B.Octets.append(B.Octets.of_list(p), B.Octets.of_list(q))) : {B.Octets.of_list(B.append(p, q)) == _ : B.Octets} 156 %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.append(B.Octets.of_list(p), B.Octets.of_list(q))), B.append(B.Octets.to_list(B.Octets.of_list(p)), B.Octets.to_list(B.Octets.of_list(q))), BL.octets_append_list(B.Octets.of_list(p), B.Octets.of_list(q))) : {B.Octets.of_list(B.append(p, q)) == B.Octets.of_list(_) : B.Octets} 157 %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.of_list(p)), B.mask(p), BL.octets_to_of(p)) : {B.Octets.of_list(B.append(p, q)) == B.Octets.of_list(B.append(_, B.Octets.to_list(B.Octets.of_list(q)))) : B.Octets} 158 %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.of_list(q)), B.mask(q), BL.octets_to_of(q)) : {B.Octets.of_list(B.append(p, q)) == B.Octets.of_list(B.append(B.mask(p), _)) : B.Octets} 159 %mask_append(p, q) : {B.Octets.of_list(B.append(p, q)) == B.Octets.of_list(_) : B.Octets} 160 %BL.octets_to_of(B.append(p, q)) : {B.Octets.of_list(B.append(p, q)) == B.Octets.of_list(_) : B.Octets} 161 %Equal.sym(B.Octets, B.Octets.of_list(B.Octets.to_list(B.Octets.of_list(B.append(p, q)))), B.Octets.of_list(B.append(p, q)), BL.octets_of_list_idempotent(B.append(p, q))) : {B.Octets.of_list(B.append(p, q)) == _ : B.Octets} 162 {==} 163 164 # Stream ciphers from keystream generators (stream.bend) 165 166 # the loop, for every list and state, is the structural output reversed onto 167 # what it had 168 def ks_go_ref(~S: Data, ~next: S -> St.CrKsStep, ys: List<&2, U32>, +s: S, +acc: List<&2, U32>) -> {St.cr.ks.go(~S, ~next, ys, s, acc) == St.CrKsRun{St.cr.ks.after(~S, ~next, ys, s), St.cr.rev_onto(St.cr.ks.xs(~S, ~next, ys, s), acc)} : St.CrKsRun}: 169 match ys: 170 case Nil{}: 171 {==} 172 case Con{x, t}: 173 ks_go_ref(~S, ~next, t, St.CrKsStep.st(~S, next(s)), Con{B.byte(U32.xor(x, St.CrKsStep.k(~S, next(s)))), acc}) 174 175 def xor_update_ref(~S: Data, ~next: S -> St.CrKsStep, +s: S, +m: B.Octets) -> {St.CrXorOut{St.cr.ks.after(~S, ~next, B.Octets.to_list(m), s), B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s))} == St.CrXor.update(~S, ~next, s, m) : St.CrXorOut}: 176 %Equal.sym(St.CrKsRun, St.cr.ks.go(~S, ~next, B.Octets.to_list(m), s, Nil{}), St.CrKsRun{St.cr.ks.after(~S, ~next, B.Octets.to_list(m), s), St.cr.rev_onto(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s), Nil{})}, ks_go_ref(~S, ~next, B.Octets.to_list(m), s, Nil{})) : {St.CrXorOut{St.cr.ks.after(~S, ~next, B.Octets.to_list(m), s), B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s))} == St.cr.ks.out(~S, _) : St.CrXorOut} 177 %rev2(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s), Nil{}) : {St.CrXorOut{St.cr.ks.after(~S, ~next, B.Octets.to_list(m), s), B.Octets.of_list(_)} == St.CrXorOut{St.cr.ks.after(~S, ~next, B.Octets.to_list(m), s), B.Octets.of_list(St.cr.rev_onto(St.cr.rev_onto(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s), Nil{}), Nil{}))} : St.CrXorOut} 178 {==} 179 180 def ks_mask_xs(~S: Data, ~next: S -> St.CrKsStep, ys: List<&2, U32>, +s: S) -> {St.cr.ks.xs(~S, ~next, ys, s) == St.cr.ks.xs(~S, ~next, B.mask(ys), s) : List<&2, U32>}: 181 match ys: 182 case Nil{}: 183 {==} 184 case Con{+h, +t}: 185 %byte_xor_byte(h, St.CrKsStep.k(~S, next(s))) : {Con{B.byte(U32.xor(h, St.CrKsStep.k(~S, next(s)))), St.cr.ks.xs(~S, ~next, t, St.CrKsStep.st(~S, next(s)))} == Con{_, St.cr.ks.xs(~S, ~next, B.mask(t), St.CrKsStep.st(~S, next(s)))} : List<&2, U32>} 186 %ks_mask_xs(~S, ~next, t, St.CrKsStep.st(~S, next(s))) : {Con{B.byte(U32.xor(h, St.CrKsStep.k(~S, next(s)))), St.cr.ks.xs(~S, ~next, t, St.CrKsStep.st(~S, next(s)))} == Con{B.byte(U32.xor(h, St.CrKsStep.k(~S, next(s)))), _} : List<&2, U32>} 187 {==} 188 189 def ks_xs_xs(~S: Data, ~next: S -> St.CrKsStep, ys: List<&2, U32>, +s: S) -> {B.mask(ys) == St.cr.ks.xs(~S, ~next, St.cr.ks.xs(~S, ~next, ys, s), s) : List<&2, U32>}: 190 match ys: 191 case Nil{}: 192 {==} 193 case Con{+h, +t}: 194 %byte_xx(h, St.CrKsStep.k(~S, next(s))) : {Con{B.byte(h), B.mask(t)} == Con{_, St.cr.ks.xs(~S, ~next, St.cr.ks.xs(~S, ~next, t, St.CrKsStep.st(~S, next(s))), St.CrKsStep.st(~S, next(s)))} : List<&2, U32>} 195 %ks_xs_xs(~S, ~next, t, St.CrKsStep.st(~S, next(s))) : {Con{B.byte(h), B.mask(t)} == Con{B.byte(h), _} : List<&2, U32>} 196 {==} 197 198 def Laws.xor_involution(S, next, s, m): 199 %xor_update_ref(~S, ~next, s, m) : {St.CrXor.out_data(~S, St.CrXor.update(~S, ~next, s, St.CrXor.out_data(~S, _))) == m : B.Octets} 200 %xor_update_ref(~S, ~next, s, B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s))) : {St.CrXor.out_data(~S, _) == m : B.Octets} 201 %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s))), B.mask(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s)), BL.octets_to_of(St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s))) : {B.Octets.of_list(St.cr.ks.xs(~S, ~next, _, s)) == m : B.Octets} 202 %ks_mask_xs(~S, ~next, St.cr.ks.xs(~S, ~next, B.Octets.to_list(m), s), s) : {B.Octets.of_list(_) == m : B.Octets} 203 %ks_xs_xs(~S, ~next, B.Octets.to_list(m), s) : {B.Octets.of_list(_) == m : B.Octets} 204 %BL.octets_to_of(B.Octets.to_list(m)) : {B.Octets.of_list(_) == m : B.Octets} 205 %Equal.sym(B.Octets, B.Octets.of_list(B.Octets.to_list(B.Octets.of_list(B.Octets.to_list(m)))), B.Octets.of_list(B.Octets.to_list(m)), BL.octets_of_list_idempotent(B.Octets.to_list(m))) : {_ == m : B.Octets} 206 BL.octets_of_to(m) 207 208 def ks_after_append(~S: Data, ~next: S -> St.CrKsStep, xs: List<&2, U32>, +ys: List<&2, U32>, +s: S) -> {St.cr.ks.after(~S, ~next, B.append(xs, ys), s) == St.cr.ks.after(~S, ~next, ys, St.cr.ks.after(~S, ~next, xs, s)) : S}: 209 match xs: 210 case Nil{}: 211 {==} 212 case Con{x, t}: 213 ks_after_append(~S, ~next, t, ys, St.CrKsStep.st(~S, next(s))) 214 215 def ks_xs_append(~S: Data, ~next: S -> St.CrKsStep, xs: List<&2, U32>, +ys: List<&2, U32>, +s: S) -> {St.cr.ks.xs(~S, ~next, B.append(xs, ys), s) == B.append(St.cr.ks.xs(~S, ~next, xs, s), St.cr.ks.xs(~S, ~next, ys, St.cr.ks.after(~S, ~next, xs, s))) : List<&2, U32>}: 216 match xs: 217 case Nil{}: 218 {==} 219 case Con{+x, +t}: 220 %ks_xs_append(~S, ~next, t, ys, St.CrKsStep.st(~S, next(s))) : {Con{B.byte(U32.xor(x, St.CrKsStep.k(~S, next(s)))), St.cr.ks.xs(~S, ~next, B.append(t, ys), St.CrKsStep.st(~S, next(s)))} == Con{B.byte(U32.xor(x, St.CrKsStep.k(~S, next(s)))), _} : List<&2, U32>} 221 {==} 222 223 def Laws.xor_streaming_state(S, next, s, a, b): 224 %xor_update_ref(~S, ~next, s, a) : {St.CrXor.out_state(~S, St.CrXor.update(~S, ~next, s, B.Octets.append(a, b))) == St.CrXor.out_state(~S, St.CrXor.update(~S, ~next, St.CrXor.out_state(~S, _), b)) : S} 225 %xor_update_ref(~S, ~next, St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s), b) : {St.CrXor.out_state(~S, St.CrXor.update(~S, ~next, s, B.Octets.append(a, b))) == St.CrXor.out_state(~S, _) : S} 226 %xor_update_ref(~S, ~next, s, B.Octets.append(a, b)) : {St.CrXor.out_state(~S, _) == St.cr.ks.after(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s)) : S} 227 %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.append(a, b)), B.append(B.Octets.to_list(a), B.Octets.to_list(b)), BL.octets_append_list(a, b)) : {St.cr.ks.after(~S, ~next, _, s) == St.cr.ks.after(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s)) : S} 228 ks_after_append(~S, ~next, B.Octets.to_list(a), B.Octets.to_list(b), s) 229 230 def Laws.xor_streaming_data(S, next, s, a, b): 231 %xor_update_ref(~S, ~next, s, a) : {St.CrXor.out_data(~S, St.CrXor.update(~S, ~next, s, B.Octets.append(a, b))) == B.Octets.append(St.CrXor.out_data(~S, _), St.CrXor.out_data(~S, St.CrXor.update(~S, ~next, St.CrXor.out_state(~S, _), b))) : B.Octets} 232 %xor_update_ref(~S, ~next, St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s), b) : {St.CrXor.out_data(~S, St.CrXor.update(~S, ~next, s, B.Octets.append(a, b))) == B.Octets.append(B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s)), St.CrXor.out_data(~S, _)) : B.Octets} 233 %xor_update_ref(~S, ~next, s, B.Octets.append(a, b)) : {St.CrXor.out_data(~S, _) == B.Octets.append(B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s)), B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s)))) : B.Octets} 234 %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.append(a, b)), B.append(B.Octets.to_list(a), B.Octets.to_list(b)), BL.octets_append_list(a, b)) : {B.Octets.of_list(St.cr.ks.xs(~S, ~next, _, s)) == B.Octets.append(B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s)), B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s)))) : B.Octets} 235 %Equal.sym(List<&2, U32>, St.cr.ks.xs(~S, ~next, B.append(B.Octets.to_list(a), B.Octets.to_list(b)), s), B.append(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s), St.cr.ks.xs(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s))), ks_xs_append(~S, ~next, B.Octets.to_list(a), B.Octets.to_list(b), s)) : {B.Octets.of_list(_) == B.Octets.append(B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s)), B.Octets.of_list(St.cr.ks.xs(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s)))) : B.Octets} 236 octets_of_append(St.cr.ks.xs(~S, ~next, B.Octets.to_list(a), s), St.cr.ks.xs(~S, ~next, B.Octets.to_list(b), St.cr.ks.after(~S, ~next, B.Octets.to_list(a), s))) 237 238 # CTR: CrXor over CTR's keystream generator 239 240 def Laws.ctr_involution(K, Blk, enc, blk_of, blk_to, s, m): 241 Laws.xor_involution(~Md.CrCtrState, ~Md.CrCtr.next(~K, ~Blk, ~enc, ~blk_of, ~blk_to), s, m) 242 243 def Laws.ctr_streaming_data(K, Blk, enc, blk_of, blk_to, s, a, b): 244 Laws.xor_streaming_data(~Md.CrCtrState, ~Md.CrCtr.next(~K, ~Blk, ~enc, ~blk_of, ~blk_to), s, a, b) 245 246 def Laws.ctr_streaming_state(K, Blk, enc, blk_of, blk_to, s, a, b): 247 Laws.xor_streaming_state(~Md.CrCtrState, ~Md.CrCtr.next(~K, ~Blk, ~enc, ~blk_of, ~blk_to), s, a, b) 248 249 # The block formats 250 251 def Laws.cmblock_format(b): 252 %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.of_list(CM.cr.f128.bytes(b))), B.mask(CM.cr.f128.bytes(b)), BL.octets_to_of(CM.cr.f128.bytes(b))) : {CM.cr.f128.block(_) == Some{b} : Maybe<&2, M.CmBlock>} 253 f128_bytes(b) 254 255 def cmblock_xx(s: M.CmBlock, k: M.CmBlock) -> {s == CM.CrBlk128.xor(CM.CrBlk128.xor(s, k), k) : M.CmBlock}: 256 match s k: 257 case M.CmBlock{+a0, +a1, +a2, +a3} M.CmBlock{+b0, +b1, +b2, +b3}: 258 %u32_xx(a0, b0) : {M.CmBlock{a0, a1, a2, a3} == M.CmBlock{_, U32.xor(U32.xor(a1, b1), b1), U32.xor(U32.xor(a2, b2), b2), U32.xor(U32.xor(a3, b3), b3)} : M.CmBlock} 259 %u32_xx(a1, b1) : {M.CmBlock{a0, a1, a2, a3} == M.CmBlock{a0, _, U32.xor(U32.xor(a2, b2), b2), U32.xor(U32.xor(a3, b3), b3)} : M.CmBlock} 260 %u32_xx(a2, b2) : {M.CmBlock{a0, a1, a2, a3} == M.CmBlock{a0, a1, _, U32.xor(U32.xor(a3, b3), b3)} : M.CmBlock} 261 %u32_xx(a3, b3) : {M.CmBlock{a0, a1, a2, a3} == M.CmBlock{a0, a1, a2, _} : M.CmBlock} 262 {==} 263 264 def Laws.cmblock_xor(a, b): 265 Equal.sym(M.CmBlock, a, CM.CrBlk128.xor(CM.CrBlk128.xor(a, b), b), cmblock_xx(a, b)) 266 267 def Laws.lcblock64_format(b): 268 LL.block64_octets_round_trip(b) 269 270 def lcblock64_xx(s: L.LcBlock64, k: L.LcBlock64) -> {s == LC.CrBlk64.xor(LC.CrBlk64.xor(s, k), k) : L.LcBlock64}: 271 match s k: 272 case L.LcBlock64{+a0, +a1} L.LcBlock64{+b0, +b1}: 273 %u32_xx(a0, b0) : {L.LcBlock64{a0, a1} == L.LcBlock64{_, U32.xor(U32.xor(a1, b1), b1)} : L.LcBlock64} 274 %u32_xx(a1, b1) : {L.LcBlock64{a0, a1} == L.LcBlock64{a0, _} : L.LcBlock64} 275 {==} 276 277 def Laws.lcblock64_xor(a, b): 278 Equal.sym(L.LcBlock64, a, LC.CrBlk64.xor(LC.CrBlk64.xor(a, b), b), lcblock64_xx(a, b)) 279 280 # ECB and CBC: the loops that run are the structural forms (for every block 281 # cipher; the round trips, which need the cipher's own law, are per instance) 282 283 def ecb_tr(~K: Data, ~Blk: Data, ~f: K -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +acc: List<&2, Blk>) -> {Md.cr.ecb.go(~K, ~Blk, ~f, k, bs, acc) == Md.cr.blks.rev_onto(~Blk, acc, Md.cr.ecb(~K, ~Blk, ~f, k, bs)) : List<&2, Blk>}: 284 match bs: 285 case Nil{}: 286 {==} 287 case Con{b, t}: 288 ecb_tr(~K, ~Blk, ~f, k, t, Con{f(k, b), acc}) 289 290 def ecb_pub(~K: Data, ~Blk: Data, ~f: K -> Blk -> Blk, +k: K, bs: List<&2, Blk>) -> {Md.cr.ecb.go(~K, ~Blk, ~f, k, bs, Nil{}) == Md.cr.ecb(~K, ~Blk, ~f, k, bs) : List<&2, Blk>}: 291 ecb_tr(~K, ~Blk, ~f, k, bs, Nil{}) 292 293 def cbc_enc_tr(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +iv: Blk, +acc: List<&2, Blk>) -> {Md.cr.cbc.enc.go(~K, ~Blk, ~enc, ~bxor, k, bs, iv, acc) == Md.cr.blks.rev_onto(~Blk, acc, Md.cr.cbc.enc(~K, ~Blk, ~enc, ~bxor, k, bs, iv)) : List<&2, Blk>}: 294 match bs: 295 case Nil{}: 296 {==} 297 case Con{+p, t}: 298 cbc_enc_tr(~K, ~Blk, ~enc, ~bxor, k, t, enc(k, bxor(p, iv)), Con{enc(k, bxor(p, iv)), acc}) 299 300 def cbc_dec_tr(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +iv: Blk, +acc: List<&2, Blk>) -> {Md.cr.cbc.dec.go(~K, ~Blk, ~dec, ~bxor, k, bs, iv, acc) == Md.cr.blks.rev_onto(~Blk, acc, Md.cr.cbc.dec(~K, ~Blk, ~dec, ~bxor, k, bs, iv)) : List<&2, Blk>}: 301 match bs: 302 case Nil{}: 303 {==} 304 case Con{+c, t}: 305 cbc_dec_tr(~K, ~Blk, ~dec, ~bxor, k, t, c, Con{bxor(dec(k, c), iv), acc}) 306 307 def cbc_enc_pub(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +iv: Blk) -> {Md.cr.cbc.enc.go(~K, ~Blk, ~enc, ~bxor, k, bs, iv, Nil{}) == Md.cr.cbc.enc(~K, ~Blk, ~enc, ~bxor, k, bs, iv) : List<&2, Blk>}: 308 cbc_enc_tr(~K, ~Blk, ~enc, ~bxor, k, bs, iv, Nil{}) 309 310 def cbc_dec_pub(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +iv: Blk) -> {Md.cr.cbc.dec.go(~K, ~Blk, ~dec, ~bxor, k, bs, iv, Nil{}) == Md.cr.cbc.dec(~K, ~Blk, ~dec, ~bxor, k, bs, iv) : List<&2, Blk>}: 311 cbc_dec_tr(~K, ~Blk, ~dec, ~bxor, k, bs, iv, Nil{}) 312 313 # PCBC (pcbc.bend): the loops that run are the structural forms 314 315 def pcbc_enc_tr(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +v: Blk, +acc: List<&2, Blk>) -> {Pc.cr.pcbc.enc.go(~K, ~Blk, ~enc, ~bxor, k, bs, v, acc) == Md.cr.blks.rev_onto(~Blk, acc, Pc.cr.pcbc.enc(~K, ~Blk, ~enc, ~bxor, k, bs, v)) : List<&2, Blk>}: 316 match bs: 317 case Nil{}: 318 {==} 319 case Con{+p, t}: 320 pcbc_enc_tr(~K, ~Blk, ~enc, ~bxor, k, t, bxor(p, enc(k, bxor(p, v))), Con{enc(k, bxor(p, v)), acc}) 321 322 def pcbc_dec_tr(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +v: Blk, +acc: List<&2, Blk>) -> {Pc.cr.pcbc.dec.go(~K, ~Blk, ~dec, ~bxor, k, bs, v, acc) == Md.cr.blks.rev_onto(~Blk, acc, Pc.cr.pcbc.dec(~K, ~Blk, ~dec, ~bxor, k, bs, v)) : List<&2, Blk>}: 323 match bs: 324 case Nil{}: 325 {==} 326 case Con{+c, t}: 327 pcbc_dec_tr(~K, ~Blk, ~dec, ~bxor, k, t, bxor(bxor(dec(k, c), v), c), Con{bxor(dec(k, c), v), acc}) 328 329 def pcbc_enc_pub(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +v: Blk) -> {Pc.cr.pcbc.enc.go(~K, ~Blk, ~enc, ~bxor, k, bs, v, Nil{}) == Pc.cr.pcbc.enc(~K, ~Blk, ~enc, ~bxor, k, bs, v) : List<&2, Blk>}: 330 pcbc_enc_tr(~K, ~Blk, ~enc, ~bxor, k, bs, v, Nil{}) 331 332 def pcbc_dec_pub(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, +k: K, bs: List<&2, Blk>, +v: Blk) -> {Pc.cr.pcbc.dec.go(~K, ~Blk, ~dec, ~bxor, k, bs, v, Nil{}) == Pc.cr.pcbc.dec(~K, ~Blk, ~dec, ~bxor, k, bs, v) : List<&2, Blk>}: 333 pcbc_dec_tr(~K, ~Blk, ~dec, ~bxor, k, bs, v, Nil{}) 334 335 # LRW (lrw.bend): the loops that run are the structural forms 336 337 def lrw_enc_tr(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, ~blk_of: B.Octets -> Maybe<&2, Blk>, +k: K, +k2: G.Gf128, bs: List<&2, Blk>, +i: G.Gf128, +acc: List<&2, Blk>) -> {Lw.cr.lrw.enc.go(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, bs, i, acc) == Md.cr.blks.rev_onto(~Blk, acc, Lw.cr.lrw.enc(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, bs, i)) : List<&2, Blk>}: 338 match bs: 339 case Nil{}: 340 {==} 341 case Con{p, t}: 342 lrw_enc_tr(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, t, Lw.cr.lrw.inc(i), Con{Lw.cr.lrw.benc(~K, ~Blk, ~enc, ~bxor, k, Lw.cr.lrw.tweak(~Blk, ~blk_of, k2, i), p), acc}) 343 344 def lrw_dec_tr(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, ~blk_of: B.Octets -> Maybe<&2, Blk>, +k: K, +k2: G.Gf128, bs: List<&2, Blk>, +i: G.Gf128, +acc: List<&2, Blk>) -> {Lw.cr.lrw.dec.go(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, bs, i, acc) == Md.cr.blks.rev_onto(~Blk, acc, Lw.cr.lrw.dec(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, bs, i)) : List<&2, Blk>}: 345 match bs: 346 case Nil{}: 347 {==} 348 case Con{c, t}: 349 lrw_dec_tr(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, t, Lw.cr.lrw.inc(i), Con{Lw.cr.lrw.bdec(~K, ~Blk, ~dec, ~bxor, k, Lw.cr.lrw.tweak(~Blk, ~blk_of, k2, i), c), acc}) 350 351 def lrw_enc_pub(~K: Data, ~Blk: Data, ~enc: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, ~blk_of: B.Octets -> Maybe<&2, Blk>, +k: K, +k2: G.Gf128, bs: List<&2, Blk>, +i: G.Gf128) -> {Lw.cr.lrw.enc.go(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, bs, i, Nil{}) == Lw.cr.lrw.enc(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, bs, i) : List<&2, Blk>}: 352 lrw_enc_tr(~K, ~Blk, ~enc, ~bxor, ~blk_of, k, k2, bs, i, Nil{}) 353 354 def lrw_dec_pub(~K: Data, ~Blk: Data, ~dec: K -> Blk -> Blk, ~bxor: Blk -> Blk -> Blk, ~blk_of: B.Octets -> Maybe<&2, Blk>, +k: K, +k2: G.Gf128, bs: List<&2, Blk>, +i: G.Gf128) -> {Lw.cr.lrw.dec.go(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, bs, i, Nil{}) == Lw.cr.lrw.dec(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, bs, i) : List<&2, Blk>}: 355 lrw_dec_tr(~K, ~Blk, ~dec, ~bxor, ~blk_of, k, k2, bs, i, Nil{}) 356 357 # MACs 358 359 def Laws.mac_verify_tag_accepts(K, compute, k, m): 360 BL.octets_is_eq_refl(compute(k, m)) 361 362 def Laws.mac_verify_tag_agrees(K, compute, k, m, t): 363 {==} 364 365 def Laws.hmac_accepts(digest, kk, m): 366 Laws.mac_verify_tag_accepts(~Hm.CrHmacKey, ~Hm.CrHmac.mac(~digest), kk, m) 367 368 def Laws.cmac_accepts(K, enc, k, m): 369 Laws.mac_verify_tag_accepts(~K, ~CMI.CrCmac.mac(~K, ~enc), k, m) 370 371 def Laws.xcbc_accepts(K, Blk, bsize, enc, blk_of, blk_to, kk, m): 372 Laws.mac_verify_tag_accepts(~Xc.CrXcbcKey, ~Xc.CrXcbc.mac(~K, ~Blk, ~bsize, ~enc, ~blk_of, ~blk_to), kk, m) 373 374 def Laws.vmac_accepts(K, Blk, bsize, enc, blk_of, blk_to, nlen, kk, m): 375 Laws.mac_verify_tag_accepts(~Vm.CrVmacKey, ~Vm.CrVmac.mac(~K, ~Blk, ~bsize, ~enc, ~blk_of, ~blk_to, ~nlen), kk, m) 376 377 # CRCs as hashes: from crc's streaming laws 378 379 def Laws.crc32_hash_streaming(spec, c, a, b): 380 CL.streaming32(spec, c, a, b) 381 382 def Laws.crc32_hash_split(spec, a, b): 383 %CL.streaming32(spec, C.Crc32Spec.start(spec), a, b) : {CR.CrCrc32.final(~spec, _) == CR.CrCrc32.digest(~spec, B.Octets.append(a, b)) : B.Octets} 384 {==} 385 386 def Laws.crc64_hash_streaming(spec, c, a, b): 387 CL.streaming64(spec, c, a, b) 388 389 def Laws.crc64_hash_split(spec, a, b): 390 %CL.streaming64(spec, C.Crc64Spec.start(spec), a, b) : {CR.CrCrc64.final(~spec, _) == CR.CrCrc64.digest(~spec, B.Octets.append(a, b)) : B.Octets} 391 {==} 392 393 # AEADs 394 395 def Laws.lift_round_trip(E, f, d, r, p, h): 396 match r: 397 case Fail{e}: 398 {==} 399 case Done{c}: 400 %Equal.sym(Result<&2, &2, E, B.Octets>, d(c), Done{p}, h) : {Cr.CrError.lift(~E, ~B.Octets, ~f, _) == Done{p} : Result<&2, &2, Cr.CrError, B.Octets>} 401 {==} 402 403 def Laws.ccm_round_trip_if(K, enc, tlen, k, nonce, aad, p, h): 404 Laws.lift_round_trip(~M.CmError, ~CM.CrCm.err, c => MC.Ccm.decrypt(~K, ~enc, k, tlen, nonce, aad, c), MC.Ccm.encrypt(~K, ~enc, k, tlen, nonce, aad, p), p, h) 405 406 # Signatures and key agreement 407 408 def Laws.sign_verify_bytes_if(SK, PK, public, pk_of, pk_to, sign, verify, sk, m, hf, ha): 409 %Equal.sym(Result<&2, &2, Cr.CrError, PK>, pk_of(pk_to(public(sk))), Done{public(sk)}, hf) : {Sg.cr.sign.check(~PK, ~verify, _, m, sign(sk, m)) == True{} : Bool} 410 ha 411 412 def Laws.kex_agree_if(SK, PK, secret, public, pk_of, pk_to, shared, a, b, x, y, hx, hy, hfx, hfy, h): 413 %Equal.sym(Result<&2, &2, Cr.CrError, SK>, secret(a), Done{x}, hx) : {Kx.cr.kex.with(~SK, ~PK, ~shared, _, pk_of(pk_to(public(y)))) == Kx.CrKex.agree(~SK, ~PK, ~secret, ~pk_of, ~shared, b, pk_to(public(x))) : Result<&2, &2, Cr.CrError, B.Octets>} 414 %Equal.sym(Result<&2, &2, Cr.CrError, PK>, pk_of(pk_to(public(y))), Done{public(y)}, hfy) : {Kx.cr.kex.with(~SK, ~PK, ~shared, Done{x}, _) == Kx.CrKex.agree(~SK, ~PK, ~secret, ~pk_of, ~shared, b, pk_to(public(x))) : Result<&2, &2, Cr.CrError, B.Octets>} 415 %Equal.sym(Result<&2, &2, Cr.CrError, SK>, secret(b), Done{y}, hy) : {shared(x, public(y)) == Kx.cr.kex.with(~SK, ~PK, ~shared, _, pk_of(pk_to(public(x)))) : Result<&2, &2, Cr.CrError, B.Octets>} 416 %Equal.sym(Result<&2, &2, Cr.CrError, PK>, pk_of(pk_to(public(x))), Done{public(x)}, hfx) : {shared(x, public(y)) == Kx.cr.kex.with(~SK, ~PK, ~shared, Done{y}, _) : Result<&2, &2, Cr.CrError, B.Octets>} 417 h 418 419 # Vectors 420 421 def Laws.crc32_hash_check(): 422 {==} 423 424 def Laws.crc32c_hash_check(): 425 {==} 426 427 def Laws.crc64_xz_hash_check(): 428 {==} 429 430 def Laws.crc32_hash_length(spec, c): 431 be32_len(C.Crc32Spec.finish(spec, c)) 432 433 def Laws.hmac_crc32_vector(): 434 {==} 435 436 def Laws.rc4_empty_key(): 437 {==} 438 439 def Laws.rc4_iv_refused(): 440 {==} 441 442 def Laws.ctr_bad_iv(): 443 {==} 444 445 def Laws.blocks_of_not_whole(): 446 {==} 447 448 def Laws.hkdf_too_long(): 449 {==} 450 451 def Laws.aes_fips197_c1(): 452 {==} 453 454 # CRCs in three pieces: the streaming law twice 455 456 def Laws.crc32_hash_split3(spec, a, b, c): 457 %CL.streaming32(spec, C.Crc32Spec.update(spec, C.Crc32Spec.start(spec), a), b, c) : {CR.CrCrc32.final(~spec, _) == CR.CrCrc32.digest(~spec, B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 458 %CL.streaming32(spec, C.Crc32Spec.start(spec), a, B.Octets.append(b, c)) : {CR.CrCrc32.final(~spec, _) == CR.CrCrc32.digest(~spec, B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 459 {==} 460 461 def Laws.crc64_hash_split3(spec, a, b, c): 462 %CL.streaming64(spec, C.Crc64Spec.update(spec, C.Crc64Spec.start(spec), a), b, c) : {CR.CrCrc64.final(~spec, _) == CR.CrCrc64.digest(~spec, B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 463 %CL.streaming64(spec, C.Crc64Spec.start(spec), a, B.Octets.append(b, c)) : {CR.CrCrc64.final(~spec, _) == CR.CrCrc64.digest(~spec, B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 464 {==} 465 466 # SHA-256 and SHA-512: bend-collections-laws-crypto's laws, through Octets 467 468 def append_nil(xs: List<&2, U32>) -> {xs == List.append(&2, U32, xs, Nil{}) : List<&2, U32>}: 469 match xs: 470 case Nil{}: 471 {==} 472 case Con{h, t}: 473 %append_nil(t) : {Con{h, t} == Con{h, _} : List<&2, U32>} 474 {==} 475 476 def mask_len(xs: List<&2, U32>) -> {B.len(B.mask(xs)) == B.len(xs) : Nat}: 477 match xs: 478 case Nil{}: 479 {==} 480 case Con{h, t}: 481 %mask_len(t) : {B.len(B.mask(Con{h, t})) == 1n+_ : Nat} 482 {==} 483 484 # the length of a list made Octets 485 def octets_len_of(+xs: List<&2, U32>) -> {B.Octets.len(B.Octets.of_list(xs)) == B.len(xs) : Nat}: 486 %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(xs)), B.len(B.Octets.to_list(B.Octets.of_list(xs))), BL.octets_len_list(B.Octets.of_list(xs))) : {_ == B.len(xs) : Nat} 487 %Equal.sym(List<&2, U32>, B.Octets.to_list(B.Octets.of_list(xs)), B.mask(xs), BL.octets_to_of(xs)) : {B.len(_) == B.len(xs) : Nat} 488 mask_len(xs) 489 490 def Laws.sha256_spec(o): 491 %HL.Sha256.value(B.Octets.to_list(o)) : {SH.CrSha2.sha256(o) == B.Octets.of_list(_) : B.Octets} 492 {==} 493 494 def Laws.sha256_hash_split(a, b): 495 %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.new_sha256(), B.Octets.to_list(a)), B.Octets.to_list(b))), Hc.sha256(List.append(&2, U32, B.Octets.to_list(a), B.Octets.to_list(b))), HL.Split.sha256(B.Octets.to_list(a), B.Octets.to_list(b))) : {B.Octets.of_list(_) == SH.CrSha2.sha256(B.Octets.append(a, b)) : B.Octets} 496 %BL.octets_append_list(a, b) : {B.Octets.of_list(Hc.sha256(_)) == SH.CrSha2.sha256(B.Octets.append(a, b)) : B.Octets} 497 {==} 498 499 def Laws.sha256_hash_split3(a, b, c): 500 %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.update(Hc.new_sha256(), B.Octets.to_list(a)), B.Octets.to_list(b)), B.Octets.to_list(c))), Hc.sha256(List.concat(&2, U32, [B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])), HL.Incremental.sha256([B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])) : {B.Octets.of_list(_) == SH.CrSha2.sha256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 501 %append_nil(B.Octets.to_list(c)) : {B.Octets.of_list(Hc.sha256(List.append(&2, U32, B.Octets.to_list(a), List.append(&2, U32, B.Octets.to_list(b), _)))) == SH.CrSha2.sha256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 502 %BL.octets_append_list(b, c) : {B.Octets.of_list(Hc.sha256(List.append(&2, U32, B.Octets.to_list(a), _))) == SH.CrSha2.sha256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 503 %BL.octets_append_list(a, B.Octets.append(b, c)) : {B.Octets.of_list(Hc.sha256(_)) == SH.CrSha2.sha256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 504 {==} 505 506 def Laws.sha256_hash_length(o): 507 %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Hc.sha256(B.Octets.to_list(o)))), B.len(Hc.sha256(B.Octets.to_list(o))), octets_len_of(Hc.sha256(B.Octets.to_list(o)))) : {_ == 32n : Nat} 508 HL.Sha256.length(B.Octets.to_list(o)) 509 510 def Laws.sha512_spec(o): 511 %HL.Sha512.value(B.Octets.to_list(o)) : {SH.CrSha2.sha512(o) == B.Octets.of_list(_) : B.Octets} 512 {==} 513 514 def Laws.sha512_hash_split(a, b): 515 %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.new_sha512(), B.Octets.to_list(a)), B.Octets.to_list(b))), Hc.sha512(List.append(&2, U32, B.Octets.to_list(a), B.Octets.to_list(b))), HL.Split.sha512(B.Octets.to_list(a), B.Octets.to_list(b))) : {B.Octets.of_list(_) == SH.CrSha2.sha512(B.Octets.append(a, b)) : B.Octets} 516 %BL.octets_append_list(a, b) : {B.Octets.of_list(Hc.sha512(_)) == SH.CrSha2.sha512(B.Octets.append(a, b)) : B.Octets} 517 {==} 518 519 def Laws.sha512_hash_split3(a, b, c): 520 %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.update(Hc.new_sha512(), B.Octets.to_list(a)), B.Octets.to_list(b)), B.Octets.to_list(c))), Hc.sha512(List.concat(&2, U32, [B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])), HL.Incremental.sha512([B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])) : {B.Octets.of_list(_) == SH.CrSha2.sha512(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 521 %append_nil(B.Octets.to_list(c)) : {B.Octets.of_list(Hc.sha512(List.append(&2, U32, B.Octets.to_list(a), List.append(&2, U32, B.Octets.to_list(b), _)))) == SH.CrSha2.sha512(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 522 %BL.octets_append_list(b, c) : {B.Octets.of_list(Hc.sha512(List.append(&2, U32, B.Octets.to_list(a), _))) == SH.CrSha2.sha512(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 523 %BL.octets_append_list(a, B.Octets.append(b, c)) : {B.Octets.of_list(Hc.sha512(_)) == SH.CrSha2.sha512(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 524 {==} 525 526 def Laws.sha512_hash_length(o): 527 %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Hc.sha512(B.Octets.to_list(o)))), B.len(Hc.sha512(B.Octets.to_list(o))), octets_len_of(Hc.sha512(B.Octets.to_list(o)))) : {_ == 64n : Nat} 528 HL.Sha512.length(B.Octets.to_list(o)) 529 530 def Laws.sha3_256_spec(o): 531 %HL.Sha3_256.value(B.Octets.to_list(o)) : {S3.CrSha3.sha3_256(o) == B.Octets.of_list(_) : B.Octets} 532 {==} 533 534 def Laws.sha3_256_hash_split(a, b): 535 %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.new_sha3_256(), B.Octets.to_list(a)), B.Octets.to_list(b))), Hc.sha3_256(List.append(&2, U32, B.Octets.to_list(a), B.Octets.to_list(b))), HL.Split.sha3_256(B.Octets.to_list(a), B.Octets.to_list(b))) : {B.Octets.of_list(_) == S3.CrSha3.sha3_256(B.Octets.append(a, b)) : B.Octets} 536 %BL.octets_append_list(a, b) : {B.Octets.of_list(Hc.sha3_256(_)) == S3.CrSha3.sha3_256(B.Octets.append(a, b)) : B.Octets} 537 {==} 538 539 def Laws.sha3_256_hash_split3(a, b, c): 540 %Equal.sym(List<&2, U32>, Hc.digest(Hc.update(Hc.update(Hc.update(Hc.new_sha3_256(), B.Octets.to_list(a)), B.Octets.to_list(b)), B.Octets.to_list(c))), Hc.sha3_256(List.concat(&2, U32, [B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])), HL.Incremental.sha3_256([B.Octets.to_list(a), B.Octets.to_list(b), B.Octets.to_list(c)])) : {B.Octets.of_list(_) == S3.CrSha3.sha3_256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 541 %append_nil(B.Octets.to_list(c)) : {B.Octets.of_list(Hc.sha3_256(List.append(&2, U32, B.Octets.to_list(a), List.append(&2, U32, B.Octets.to_list(b), _)))) == S3.CrSha3.sha3_256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 542 %BL.octets_append_list(b, c) : {B.Octets.of_list(Hc.sha3_256(List.append(&2, U32, B.Octets.to_list(a), _))) == S3.CrSha3.sha3_256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 543 %BL.octets_append_list(a, B.Octets.append(b, c)) : {B.Octets.of_list(Hc.sha3_256(_)) == S3.CrSha3.sha3_256(B.Octets.append(a, B.Octets.append(b, c))) : B.Octets} 544 {==} 545 546 def Laws.sha3_256_hash_length(o): 547 %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Hc.sha3_256(B.Octets.to_list(o)))), B.len(Hc.sha3_256(B.Octets.to_list(o))), octets_len_of(Hc.sha3_256(B.Octets.to_list(o)))) : {_ == 32n : Nat} 548 HL.Sha3_256.length(B.Octets.to_list(o)) 549 550 def Laws.hkdf_sha256_too_long(): 551 {==} 552 553 def Laws.sha256_abc(): 554 {==} 555 556 def Laws.sha3_256_abc(): 557 {==} 558 559 def Laws.hmac_sha256_rfc4231_2(): 560 {==} 561 562 # Michael as a MAC 563 564 def Laws.michael_accepts(k, m): 565 Laws.mac_verify_tag_accepts(~Hs.HsW2, ~HMI.HsMichael.mic, k, m) 566 567 def Laws.michael_key_length(): 568 {==} 569 570 def Laws.michael_mac_vector(): 571 {==} 572 573 # PBKDF2: the output generator gives n bytes, whatever the MAC (induction 574 # on n), and its first n bytes are the same whatever comes after 575 def pbkdf2_out_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, cur: List<&2, U32>, +k: K, +salt: B.Octets, +c: Nat, +i: U32) -> {B.len(Pb.cr.pbkdf2.out(~K, ~compute, n, cur, k, salt, c, i)) == n : Nat}: 576 match n: 577 case 0n: 578 {==} 579 case 1n+p: 580 match cur: 581 case Con{h, t}: 582 %pbkdf2_out_len(~K, ~compute, p, t, k, salt, c, i) : {B.len(Pb.cr.pbkdf2.out(~K, ~compute, 1n+p, Con{h, t}, k, salt, c, i)) == 1n+_ : Nat} 583 {==} 584 case Nil{}: 585 %pbkdf2_out_len(~K, ~compute, p, Pb.cr.pbkdf2.tail(Pb.cr.pbkdf2.block(~K, ~compute, k, salt, c, U32.add(i, 1))), k, salt, c, U32.add(i, 1)) : {B.len(Pb.cr.pbkdf2.out(~K, ~compute, 1n+p, Nil{}, k, salt, c, i)) == 1n+_ : Nat} 586 {==} 587 588 def pbkdf2_out_prefix(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, +j: Nat, cur: List<&2, U32>, +k: K, +salt: B.Octets, +c: Nat, +i: U32) -> {B.take(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), cur, k, salt, c, i)) == Pb.cr.pbkdf2.out(~K, ~compute, n, cur, k, salt, c, i) : List<&2, U32>}: 589 match n: 590 case 0n: 591 {==} 592 case 1n+p: 593 match cur: 594 case Con{h, t}: 595 %pbkdf2_out_prefix(~K, ~compute, p, j, t, k, salt, c, i) : {Con{h, B.take(p, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(p, j), t, k, salt, c, i))} == Con{h, _} : List<&2, U32>} 596 {==} 597 case Nil{}: 598 %pbkdf2_out_prefix(~K, ~compute, p, j, Pb.cr.pbkdf2.tail(Pb.cr.pbkdf2.block(~K, ~compute, k, salt, c, U32.add(i, 1))), k, salt, c, U32.add(i, 1)) : {Con{Pb.cr.pbkdf2.head(Pb.cr.pbkdf2.block(~K, ~compute, k, salt, c, U32.add(i, 1))), B.take(p, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(p, j), Pb.cr.pbkdf2.tail(Pb.cr.pbkdf2.block(~K, ~compute, k, salt, c, U32.add(i, 1))), k, salt, c, U32.add(i, 1)))} == Con{Pb.cr.pbkdf2.head(Pb.cr.pbkdf2.block(~K, ~compute, k, salt, c, U32.add(i, 1))), _} : List<&2, U32>} 599 {==} 600 601 def Laws.pbkdf2_stream_length(K, compute, k, salt, c, n): 602 %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0))), B.len(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), octets_len_of(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0))) : {_ == n : Nat} 603 pbkdf2_out_len(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0) 604 605 def pbkdf2_checked_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, zero: Bool, fits: Bool, kr: Result<&2, &2, Cr.CrError, K>, +salt: B.Octets, +c: U32, +n: Nat) -> {Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => B.Octets.len(o), Pb.cr.pbkdf2.checked(~K, ~compute, zero, fits, kr, salt, c, n)) == Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => n, Pb.cr.pbkdf2.checked(~K, ~compute, zero, fits, kr, salt, c, n)) : Result<&2, &2, Cr.CrError, Nat>}: 606 match zero: 607 case True{}: 608 {==} 609 case False{}: 610 match fits: 611 case False{}: 612 {==} 613 case True{}: 614 match kr: 615 case Fail{e}: 616 {==} 617 case Done{+k}: 618 %Laws.pbkdf2_stream_length(~K, ~compute, k, salt, c, n) : {Done{B.Octets.len(Pb.CrPbkdf2.stream(~K, ~compute, k, salt, c, n))} == Done{_} : Result<&2, &2, Cr.CrError, Nat>} 619 {==} 620 621 def Laws.pbkdf2_length(K, key, compute, hlen, p, salt, c, n): 622 pbkdf2_checked_len(~K, ~compute, U32.is_eq(c, 0), Pb.cr.pbkdf2.fits(Nat.is_lt(0n, hlen), n, hlen), key(p), salt, c, n) 623 624 def Laws.pbkdf2_stream_prefix(K, compute, k, salt, c, n, j): 625 %BL.take_drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : {B.Octets.take(n, B.Octets.of_list(_)) == B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : B.Octets} 626 %Equal.sym(List<&2, U32>, B.take(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0), pbkdf2_out_prefix(~K, ~compute, n, j, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : {B.Octets.take(n, B.Octets.of_list(B.append(_, B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0))))) == B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : B.Octets} 627 %Equal.sym(B.Octets, B.Octets.of_list(B.append(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0), B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)))), B.Octets.append(B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), B.Octets.of_list(B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)))), octets_of_append(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0), B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)))) : {B.Octets.take(n, _) == B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : B.Octets} 628 %pbkdf2_out_len(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), B.Octets.of_list(B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0))))) == B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : B.Octets} 629 %octets_len_of(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), B.Octets.of_list(B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0))))) == B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)) : B.Octets} 630 BL.octets_take_append(B.Octets.of_list(Pb.cr.pbkdf2.out(~K, ~compute, n, Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)), B.Octets.of_list(B.drop(n, Pb.cr.pbkdf2.out(~K, ~compute, Nat.add(n, j), Nil{}, k, salt, Nat.sub(U32.to_nat(c), 1n), 0)))) 631 632 def Laws.pbkdf2_zero_iterations(): 633 {==} 634 635 def Laws.pbkdf2_hmac_sha1_rfc6070_1(): 636 {==} 637 638 def Laws.pbkdf2_hmac_sha1_rfc6070_2(): 639 {==} 640 641 def Laws.pbkdf2_hmac_sha256_rfc7914_1(): 642 {==} 643 644 # SP 800-108: the output generators give n bytes, whatever the MAC, and 645 # their first n bytes are the same whatever comes after 646 647 def kb_ctr_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, cur: List<&2, U32>, +k: K, +rlen: Nat, +fixed: B.Octets, +i: U32) -> {B.len(Kb.cr.kb.ctr(~K, ~compute, n, cur, k, rlen, fixed, i)) == n : Nat}: 648 match n: 649 case 0n: 650 {==} 651 case 1n+p: 652 match cur: 653 case Con{h, t}: 654 %kb_ctr_len(~K, ~compute, p, t, k, rlen, fixed, i) : {B.len(Kb.cr.kb.ctr(~K, ~compute, 1n+p, Con{h, t}, k, rlen, fixed, i)) == 1n+_ : Nat} 655 {==} 656 case Nil{}: 657 %kb_ctr_len(~K, ~compute, p, Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed)))), k, rlen, fixed, U32.add(i, 1)) : {B.len(Kb.cr.kb.ctr(~K, ~compute, 1n+p, Nil{}, k, rlen, fixed, i)) == 1n+_ : Nat} 658 {==} 659 660 def kb_ctr_prefix(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, +j: Nat, cur: List<&2, U32>, +k: K, +rlen: Nat, +fixed: B.Octets, +i: U32) -> {B.take(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), cur, k, rlen, fixed, i)) == Kb.cr.kb.ctr(~K, ~compute, n, cur, k, rlen, fixed, i) : List<&2, U32>}: 661 match n: 662 case 0n: 663 {==} 664 case 1n+p: 665 match cur: 666 case Con{h, t}: 667 %kb_ctr_prefix(~K, ~compute, p, j, t, k, rlen, fixed, i) : {Con{h, B.take(p, Kb.cr.kb.ctr(~K, ~compute, Nat.add(p, j), t, k, rlen, fixed, i))} == Con{h, _} : List<&2, U32>} 668 {==} 669 case Nil{}: 670 %kb_ctr_prefix(~K, ~compute, p, j, Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed)))), k, rlen, fixed, U32.add(i, 1)) : {Con{Kb.cr.kb.head(B.Octets.to_list(compute(k, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed)))), B.take(p, Kb.cr.kb.ctr(~K, ~compute, Nat.add(p, j), Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed)))), k, rlen, fixed, U32.add(i, 1)))} == Con{Kb.cr.kb.head(B.Octets.to_list(compute(k, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed)))), _} : List<&2, U32>} 671 {==} 672 673 def kb_fb_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, cur: List<&2, U32>, +k: K, +rlen: Nat, +fixed: B.Octets, +prev: B.Octets, +i: U32) -> {B.len(Kb.cr.kb.fb(~K, ~compute, n, cur, k, rlen, fixed, prev, i)) == n : Nat}: 674 match n: 675 case 0n: 676 {==} 677 case 1n+p: 678 match cur: 679 case Con{h, t}: 680 %kb_fb_len(~K, ~compute, p, t, k, rlen, fixed, prev, i) : {B.len(Kb.cr.kb.fb(~K, ~compute, 1n+p, Con{h, t}, k, rlen, fixed, prev, i)) == 1n+_ : Nat} 681 {==} 682 case Nil{}: 683 %kb_fb_len(~K, ~compute, p, Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))))), k, rlen, fixed, compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))), U32.add(i, 1)) : {B.len(Kb.cr.kb.fb(~K, ~compute, 1n+p, Nil{}, k, rlen, fixed, prev, i)) == 1n+_ : Nat} 684 {==} 685 686 def kb_fb_prefix(~K: Data, ~compute: K -> B.Octets -> B.Octets, n: Nat, +j: Nat, cur: List<&2, U32>, +k: K, +rlen: Nat, +fixed: B.Octets, +prev: B.Octets, +i: U32) -> {B.take(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), cur, k, rlen, fixed, prev, i)) == Kb.cr.kb.fb(~K, ~compute, n, cur, k, rlen, fixed, prev, i) : List<&2, U32>}: 687 match n: 688 case 0n: 689 {==} 690 case 1n+p: 691 match cur: 692 case Con{h, t}: 693 %kb_fb_prefix(~K, ~compute, p, j, t, k, rlen, fixed, prev, i) : {Con{h, B.take(p, Kb.cr.kb.fb(~K, ~compute, Nat.add(p, j), t, k, rlen, fixed, prev, i))} == Con{h, _} : List<&2, U32>} 694 {==} 695 case Nil{}: 696 %kb_fb_prefix(~K, ~compute, p, j, Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))))), k, rlen, fixed, compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))), U32.add(i, 1)) : {Con{Kb.cr.kb.head(B.Octets.to_list(compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))))), B.take(p, Kb.cr.kb.fb(~K, ~compute, Nat.add(p, j), Kb.cr.kb.tail(B.Octets.to_list(compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))))), k, rlen, fixed, compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))), U32.add(i, 1)))} == Con{Kb.cr.kb.head(B.Octets.to_list(compute(k, B.Octets.append(prev, B.Octets.append(Kb.CrKbkdf.counter(rlen, U32.add(i, 1)), fixed))))), _} : List<&2, U32>} 697 {==} 698 699 def Laws.kbkdf_counter_stream_length(K, compute, rlen, k, fixed, n): 700 %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0))), B.len(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)), octets_len_of(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0))) : {_ == n : Nat} 701 kb_ctr_len(~K, ~compute, n, Nil{}, k, rlen, fixed, 0) 702 703 def Laws.kbkdf_counter_stream_prefix(K, compute, rlen, k, fixed, n, j): 704 %BL.take_drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0)) : {B.Octets.take(n, B.Octets.of_list(_)) == B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : B.Octets} 705 %Equal.sym(List<&2, U32>, B.take(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0)), Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0), kb_ctr_prefix(~K, ~compute, n, j, Nil{}, k, rlen, fixed, 0)) : {B.Octets.take(n, B.Octets.of_list(B.append(_, B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0))))) == B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : B.Octets} 706 %Equal.sym(B.Octets, B.Octets.of_list(B.append(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0), B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0)))), B.Octets.append(B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0)))), octets_of_append(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0), B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0)))) : {B.Octets.take(n, _) == B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : B.Octets} 707 %kb_ctr_len(~K, ~compute, n, Nil{}, k, rlen, fixed, 0) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0))))) == B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : B.Octets} 708 %octets_len_of(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0))))) == B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)) : B.Octets} 709 BL.octets_take_append(B.Octets.of_list(Kb.cr.kb.ctr(~K, ~compute, n, Nil{}, k, rlen, fixed, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.ctr(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, 0)))) 710 711 def Laws.kbkdf_feedback_stream_length(K, compute, rlen, k, iv, fixed, n): 712 %Equal.sym(Nat, B.Octets.len(B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0))), B.len(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)), octets_len_of(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0))) : {_ == n : Nat} 713 kb_fb_len(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0) 714 715 def Laws.kbkdf_feedback_stream_prefix(K, compute, rlen, k, iv, fixed, n, j): 716 %BL.take_drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0)) : {B.Octets.take(n, B.Octets.of_list(_)) == B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : B.Octets} 717 %Equal.sym(List<&2, U32>, B.take(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0)), Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0), kb_fb_prefix(~K, ~compute, n, j, Nil{}, k, rlen, fixed, iv, 0)) : {B.Octets.take(n, B.Octets.of_list(B.append(_, B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0))))) == B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : B.Octets} 718 %Equal.sym(B.Octets, B.Octets.of_list(B.append(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0), B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0)))), B.Octets.append(B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0)))), octets_of_append(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0), B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0)))) : {B.Octets.take(n, _) == B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : B.Octets} 719 %kb_fb_len(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0))))) == B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : B.Octets} 720 %octets_len_of(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : {B.Octets.take(_, B.Octets.append(B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0))))) == B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)) : B.Octets} 721 BL.octets_take_append(B.Octets.of_list(Kb.cr.kb.fb(~K, ~compute, n, Nil{}, k, rlen, fixed, iv, 0)), B.Octets.of_list(B.drop(n, Kb.cr.kb.fb(~K, ~compute, Nat.add(n, j), Nil{}, k, rlen, fixed, iv, 0)))) 722 723 def kb_key_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, ~rlen: Nat, kr: Result<&2, &2, Cr.CrError, K>, +fixed: B.Octets, +n: Nat) -> {Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => B.Octets.len(o), Kb.cr.kb.key(~K, ~compute, ~rlen, kr, fixed, n)) == Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => n, Kb.cr.kb.key(~K, ~compute, ~rlen, kr, fixed, n)) : Result<&2, &2, Cr.CrError, Nat>}: 724 match kr: 725 case Fail{e}: 726 {==} 727 case Done{+k}: 728 %Laws.kbkdf_counter_stream_length(~K, ~compute, ~rlen, k, fixed, n) : {Done{B.Octets.len(Kb.CrKbkdf.counter_stream(~K, ~compute, ~rlen, k, fixed, n))} == Done{_} : Result<&2, &2, Cr.CrError, Nat>} 729 {==} 730 731 def kb_checked_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, ~rlen: Nat, fits: Bool, kr: Result<&2, &2, Cr.CrError, K>, +fixed: B.Octets, +n: Nat) -> {Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => B.Octets.len(o), Kb.cr.kb.checked(~K, ~compute, ~rlen, fits, kr, fixed, n)) == Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => n, Kb.cr.kb.checked(~K, ~compute, ~rlen, fits, kr, fixed, n)) : Result<&2, &2, Cr.CrError, Nat>}: 732 match fits: 733 case False{}: 734 {==} 735 case True{}: 736 kb_key_len(~K, ~compute, ~rlen, kr, fixed, n) 737 738 def Laws.kbkdf_counter_length(K, key, compute, hlen, rlen, llen, ki, label, context, n): 739 kb_checked_len(~K, ~compute, ~rlen, Kb.cr.kb.fits(hlen, llen, n, Nat.sub(Nat.pow(2n, Nat.mul(8n, rlen)), 1n)), key(ki), Kb.CrKbkdf.fixed(~llen, label, context, n), n) 740 741 def kb_fkey_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, ~rlen: Nat, kr: Result<&2, &2, Cr.CrError, K>, +iv: B.Octets, +fixed: B.Octets, +n: Nat) -> {Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => B.Octets.len(o), Kb.cr.kb.fkey(~K, ~compute, ~rlen, kr, iv, fixed, n)) == Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => n, Kb.cr.kb.fkey(~K, ~compute, ~rlen, kr, iv, fixed, n)) : Result<&2, &2, Cr.CrError, Nat>}: 742 match kr: 743 case Fail{e}: 744 {==} 745 case Done{+k}: 746 %Laws.kbkdf_feedback_stream_length(~K, ~compute, ~rlen, k, iv, fixed, n) : {Done{B.Octets.len(Kb.CrKbkdf.feedback_stream(~K, ~compute, ~rlen, k, iv, fixed, n))} == Done{_} : Result<&2, &2, Cr.CrError, Nat>} 747 {==} 748 749 def kb_fchecked_len(~K: Data, ~compute: K -> B.Octets -> B.Octets, ~rlen: Nat, fits: Bool, kr: Result<&2, &2, Cr.CrError, K>, +iv: B.Octets, +fixed: B.Octets, +n: Nat) -> {Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => B.Octets.len(o), Kb.cr.kb.fchecked(~K, ~compute, ~rlen, fits, kr, iv, fixed, n)) == Result.map(&2, &2, Cr.CrError, B.Octets, Nat, o => n, Kb.cr.kb.fchecked(~K, ~compute, ~rlen, fits, kr, iv, fixed, n)) : Result<&2, &2, Cr.CrError, Nat>}: 750 match fits: 751 case False{}: 752 {==} 753 case True{}: 754 kb_fkey_len(~K, ~compute, ~rlen, kr, iv, fixed, n) 755 756 def Laws.kbkdf_feedback_length(K, key, compute, hlen, rlen, llen, ki, iv, label, context, n): 757 kb_fchecked_len(~K, ~compute, ~rlen, Kb.cr.kb.fits(hlen, llen, n, 4294967295n), key(ki), iv, Kb.CrKbkdf.fixed(~llen, label, context, n), n) 758 759 def Laws.kbkdf_hmac_sha256_vector(): 760 {==} 761 762 # Per-instance proofs (gen/instances.py) 763 764 # BEGIN GENERATED by gen/instances.py: proofs 765 def Laws.des_block_round_trip(k, b): 766 LL.des_round_trip(k, b) 767 768 def Laws.des_block_round_trip_dual(k, b): 769 LL.des_round_trip_dual(k, b) 770 771 def Laws.des_key_length(): 772 {==} 773 774 def ecb_rt.des(+k: D.LcDesKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs)) : List<&2, L.LcBlock64>}: 775 match bs: 776 case Nil{}: 777 {==} 778 case Con{b, t}: 779 %Equal.sym(L.LcBlock64, D.LcDes.decrypt(k, D.LcDes.encrypt(k, b)), b, LL.des_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, t))} : List<&2, L.LcBlock64>} 780 %ecb_rt.des(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>} 781 {==} 782 783 def Laws.des_ecb_round_trip(k, bs): 784 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs, Nil{}), Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs), ecb_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs)) : {Md.cr.ecb.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>} 785 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs), Nil{}), Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs)), ecb_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>} 786 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, k, Md.cr.ecb(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, k, bs)), ecb_rt.des(k, bs)) 787 788 def cbc_rt.des(+k: D.LcDesKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 789 match bs: 790 case Nil{}: 791 {==} 792 case Con{+p, t}: 793 %Equal.sym(L.LcBlock64, D.LcDes.decrypt(k, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.des_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, t, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))), D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 794 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, t, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))), D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 795 %cbc_rt.des(k, t, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 796 {==} 797 798 def Laws.des_cbc_round_trip(k, iv, bs): 799 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 800 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 801 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.des(k, bs, iv)) 802 803 def pcbc_rt.des(+k: D.LcDesKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 804 match bs: 805 case Nil{}: 806 {==} 807 case Con{+p, t}: 808 %Equal.sym(L.LcBlock64, D.LcDes.decrypt(k, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.des_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 809 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 810 %pcbc_rt.des(k, t, LC.CrBlk64.xor(p, D.LcDes.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 811 {==} 812 813 def Laws.des_pcbc_round_trip(k, iv, bs): 814 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 815 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 816 Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~D.LcDesKey, ~L.LcBlock64, ~D.LcDes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.des(k, bs, iv)) 817 818 def Laws.tdes_block_round_trip(k, b): 819 LL.tdes_round_trip(k, b) 820 821 def Laws.tdes_block_round_trip_dual(k, b): 822 LL.tdes_round_trip_dual(k, b) 823 824 def Laws.tdes_key_length(): 825 {==} 826 827 def ecb_rt.tdes(+k: T.LcTdesKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs)) : List<&2, L.LcBlock64>}: 828 match bs: 829 case Nil{}: 830 {==} 831 case Con{b, t}: 832 %Equal.sym(L.LcBlock64, T.LcTdes.decrypt(k, T.LcTdes.encrypt(k, b)), b, LL.tdes_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, t))} : List<&2, L.LcBlock64>} 833 %ecb_rt.tdes(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>} 834 {==} 835 836 def Laws.tdes_ecb_round_trip(k, bs): 837 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs, Nil{}), Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs), ecb_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs)) : {Md.cr.ecb.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>} 838 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs), Nil{}), Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs)), ecb_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>} 839 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, k, Md.cr.ecb(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, k, bs)), ecb_rt.tdes(k, bs)) 840 841 def cbc_rt.tdes(+k: T.LcTdesKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 842 match bs: 843 case Nil{}: 844 {==} 845 case Con{+p, t}: 846 %Equal.sym(L.LcBlock64, T.LcTdes.decrypt(k, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.tdes_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, t, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))), T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 847 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, t, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))), T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 848 %cbc_rt.tdes(k, t, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 849 {==} 850 851 def Laws.tdes_cbc_round_trip(k, iv, bs): 852 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 853 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 854 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.tdes(k, bs, iv)) 855 856 def pcbc_rt.tdes(+k: T.LcTdesKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 857 match bs: 858 case Nil{}: 859 {==} 860 case Con{+p, t}: 861 %Equal.sym(L.LcBlock64, T.LcTdes.decrypt(k, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.tdes_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 862 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 863 %pcbc_rt.tdes(k, t, LC.CrBlk64.xor(p, T.LcTdes.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 864 {==} 865 866 def Laws.tdes_pcbc_round_trip(k, iv, bs): 867 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 868 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 869 Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~T.LcTdesKey, ~L.LcBlock64, ~T.LcTdes.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.tdes(k, bs, iv)) 870 871 def Laws.sm4_block_round_trip(k, b): 872 LL.sm4_round_trip(k, b) 873 874 def Laws.sm4_block_round_trip_dual(k, b): 875 LL.sm4_round_trip_dual(k, b) 876 877 def Laws.sm4_key_length(): 878 {==} 879 880 def ecb_rt.sm4(+k: S.LcSm4Key, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs)) : List<&2, M.CmBlock>}: 881 match bs: 882 case Nil{}: 883 {==} 884 case Con{b, t}: 885 %Equal.sym(M.CmBlock, S.LcSm4.decrypt(k, S.LcSm4.encrypt(k, b)), b, LL.sm4_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, t))} : List<&2, M.CmBlock>} 886 %ecb_rt.sm4(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>} 887 {==} 888 889 def Laws.sm4_ecb_round_trip(k, bs): 890 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs, Nil{}), Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs), ecb_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs)) : {Md.cr.ecb.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>} 891 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs), Nil{}), Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs)), ecb_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>} 892 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, k, Md.cr.ecb(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, k, bs)), ecb_rt.sm4(k, bs)) 893 894 def cbc_rt.sm4(+k: S.LcSm4Key, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 895 match bs: 896 case Nil{}: 897 {==} 898 case Con{+p, t}: 899 %Equal.sym(M.CmBlock, S.LcSm4.decrypt(k, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.sm4_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, t, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))), S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 900 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, t, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))), S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 901 %cbc_rt.sm4(k, t, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 902 {==} 903 904 def Laws.sm4_cbc_round_trip(k, iv, bs): 905 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 906 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 907 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.sm4(k, bs, iv)) 908 909 def pcbc_rt.sm4(+k: S.LcSm4Key, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 910 match bs: 911 case Nil{}: 912 {==} 913 case Con{+p, t}: 914 %Equal.sym(M.CmBlock, S.LcSm4.decrypt(k, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.sm4_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 915 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 916 %pcbc_rt.sm4(k, t, CM.CrBlk128.xor(p, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 917 {==} 918 919 def Laws.sm4_pcbc_round_trip(k, iv, bs): 920 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 921 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 922 Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.sm4(k, bs, iv)) 923 924 def lrw_b.sm4(+k: S.LcSm4Key, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}: 925 match t: 926 case None{}: 927 Equal.sym(M.CmBlock, S.LcSm4.decrypt(k, S.LcSm4.encrypt(k, p)), p, LL.sm4_round_trip(k, p)) 928 case Some{+x}: 929 %cmblock_xx(S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(S.LcSm4.decrypt(k, _), x) : M.CmBlock} 930 %Equal.sym(M.CmBlock, S.LcSm4.decrypt(k, S.LcSm4.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.sm4_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock} 931 cmblock_xx(p, x) 932 933 def lrw_rt.sm4(+k: S.LcSm4Key, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}: 934 match bs: 935 case Nil{}: 936 {==} 937 case Con{+p, t}: 938 %lrw_b.sm4(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>} 939 %lrw_rt.sm4(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 940 {==} 941 942 def Laws.sm4_lrw_round_trip(k, k2, i, bs): 943 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>} 944 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>} 945 Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~S.LcSm4Key, ~M.CmBlock, ~S.LcSm4.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.sm4(k, k2, bs, i)) 946 947 def Laws.camellia_block_round_trip(k, b): 948 LL.camellia_round_trip(k, b) 949 950 def Laws.camellia_block_round_trip_dual(k, b): 951 LL.camellia_round_trip_dual(k, b) 952 953 def Laws.camellia_key_length(): 954 {==} 955 956 def ecb_rt.camellia(+k: Ca.LcCamelliaKey, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs)) : List<&2, M.CmBlock>}: 957 match bs: 958 case Nil{}: 959 {==} 960 case Con{b, t}: 961 %Equal.sym(M.CmBlock, Ca.LcCamellia.decrypt(k, Ca.LcCamellia.encrypt(k, b)), b, LL.camellia_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, t))} : List<&2, M.CmBlock>} 962 %ecb_rt.camellia(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>} 963 {==} 964 965 def Laws.camellia_ecb_round_trip(k, bs): 966 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs, Nil{}), Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs), ecb_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs)) : {Md.cr.ecb.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>} 967 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs), Nil{}), Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs)), ecb_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>} 968 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, k, Md.cr.ecb(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, k, bs)), ecb_rt.camellia(k, bs)) 969 970 def cbc_rt.camellia(+k: Ca.LcCamelliaKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 971 match bs: 972 case Nil{}: 973 {==} 974 case Con{+p, t}: 975 %Equal.sym(M.CmBlock, Ca.LcCamellia.decrypt(k, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.camellia_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, t, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))), Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 976 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, t, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))), Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 977 %cbc_rt.camellia(k, t, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 978 {==} 979 980 def Laws.camellia_cbc_round_trip(k, iv, bs): 981 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 982 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 983 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.camellia(k, bs, iv)) 984 985 def pcbc_rt.camellia(+k: Ca.LcCamelliaKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 986 match bs: 987 case Nil{}: 988 {==} 989 case Con{+p, t}: 990 %Equal.sym(M.CmBlock, Ca.LcCamellia.decrypt(k, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.camellia_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 991 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 992 %pcbc_rt.camellia(k, t, CM.CrBlk128.xor(p, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 993 {==} 994 995 def Laws.camellia_pcbc_round_trip(k, iv, bs): 996 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 997 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 998 Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.camellia(k, bs, iv)) 999 1000 def lrw_b.camellia(+k: Ca.LcCamelliaKey, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}: 1001 match t: 1002 case None{}: 1003 Equal.sym(M.CmBlock, Ca.LcCamellia.decrypt(k, Ca.LcCamellia.encrypt(k, p)), p, LL.camellia_round_trip(k, p)) 1004 case Some{+x}: 1005 %cmblock_xx(Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(Ca.LcCamellia.decrypt(k, _), x) : M.CmBlock} 1006 %Equal.sym(M.CmBlock, Ca.LcCamellia.decrypt(k, Ca.LcCamellia.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.camellia_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock} 1007 cmblock_xx(p, x) 1008 1009 def lrw_rt.camellia(+k: Ca.LcCamelliaKey, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}: 1010 match bs: 1011 case Nil{}: 1012 {==} 1013 case Con{+p, t}: 1014 %lrw_b.camellia(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>} 1015 %lrw_rt.camellia(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1016 {==} 1017 1018 def Laws.camellia_lrw_round_trip(k, k2, i, bs): 1019 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>} 1020 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>} 1021 Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ca.LcCamelliaKey, ~M.CmBlock, ~Ca.LcCamellia.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.camellia(k, k2, bs, i)) 1022 1023 def Laws.serpent_block_round_trip(k, b): 1024 LL.serpent_round_trip(k, b) 1025 1026 def Laws.serpent_block_round_trip_dual(k, b): 1027 LL.serpent_round_trip_dual(k, b) 1028 1029 def Laws.serpent_key_length(): 1030 {==} 1031 1032 def ecb_rt.serpent(+k: Sp.LcSerpentKey, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs)) : List<&2, M.CmBlock>}: 1033 match bs: 1034 case Nil{}: 1035 {==} 1036 case Con{b, t}: 1037 %Equal.sym(M.CmBlock, Sp.LcSerpent.decrypt(k, Sp.LcSerpent.encrypt(k, b)), b, LL.serpent_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, t))} : List<&2, M.CmBlock>} 1038 %ecb_rt.serpent(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>} 1039 {==} 1040 1041 def Laws.serpent_ecb_round_trip(k, bs): 1042 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs, Nil{}), Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs), ecb_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs)) : {Md.cr.ecb.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>} 1043 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs), Nil{}), Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs)), ecb_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>} 1044 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, k, Md.cr.ecb(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, k, bs)), ecb_rt.serpent(k, bs)) 1045 1046 def cbc_rt.serpent(+k: Sp.LcSerpentKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 1047 match bs: 1048 case Nil{}: 1049 {==} 1050 case Con{+p, t}: 1051 %Equal.sym(M.CmBlock, Sp.LcSerpent.decrypt(k, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.serpent_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, t, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))), Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 1052 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, t, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))), Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 1053 %cbc_rt.serpent(k, t, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1054 {==} 1055 1056 def Laws.serpent_cbc_round_trip(k, iv, bs): 1057 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 1058 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 1059 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.serpent(k, bs, iv)) 1060 1061 def pcbc_rt.serpent(+k: Sp.LcSerpentKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 1062 match bs: 1063 case Nil{}: 1064 {==} 1065 case Con{+p, t}: 1066 %Equal.sym(M.CmBlock, Sp.LcSerpent.decrypt(k, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.serpent_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 1067 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 1068 %pcbc_rt.serpent(k, t, CM.CrBlk128.xor(p, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1069 {==} 1070 1071 def Laws.serpent_pcbc_round_trip(k, iv, bs): 1072 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 1073 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 1074 Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.serpent(k, bs, iv)) 1075 1076 def lrw_b.serpent(+k: Sp.LcSerpentKey, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}: 1077 match t: 1078 case None{}: 1079 Equal.sym(M.CmBlock, Sp.LcSerpent.decrypt(k, Sp.LcSerpent.encrypt(k, p)), p, LL.serpent_round_trip(k, p)) 1080 case Some{+x}: 1081 %cmblock_xx(Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(Sp.LcSerpent.decrypt(k, _), x) : M.CmBlock} 1082 %Equal.sym(M.CmBlock, Sp.LcSerpent.decrypt(k, Sp.LcSerpent.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.serpent_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock} 1083 cmblock_xx(p, x) 1084 1085 def lrw_rt.serpent(+k: Sp.LcSerpentKey, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}: 1086 match bs: 1087 case Nil{}: 1088 {==} 1089 case Con{+p, t}: 1090 %lrw_b.serpent(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>} 1091 %lrw_rt.serpent(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1092 {==} 1093 1094 def Laws.serpent_lrw_round_trip(k, k2, i, bs): 1095 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>} 1096 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>} 1097 Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Sp.LcSerpentKey, ~M.CmBlock, ~Sp.LcSerpent.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.serpent(k, k2, bs, i)) 1098 1099 def Laws.twofish_block_round_trip(k, b): 1100 LL.twofish_round_trip(k, b) 1101 1102 def Laws.twofish_block_round_trip_dual(k, b): 1103 LL.twofish_round_trip_dual(k, b) 1104 1105 def Laws.twofish_key_length(): 1106 {==} 1107 1108 def ecb_rt.twofish(+k: Tf.LcTwofishKey, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs)) : List<&2, M.CmBlock>}: 1109 match bs: 1110 case Nil{}: 1111 {==} 1112 case Con{b, t}: 1113 %Equal.sym(M.CmBlock, Tf.LcTwofish.decrypt(k, Tf.LcTwofish.encrypt(k, b)), b, LL.twofish_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, t))} : List<&2, M.CmBlock>} 1114 %ecb_rt.twofish(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>} 1115 {==} 1116 1117 def Laws.twofish_ecb_round_trip(k, bs): 1118 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs, Nil{}), Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs), ecb_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs)) : {Md.cr.ecb.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>} 1119 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs), Nil{}), Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs)), ecb_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>} 1120 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, k, Md.cr.ecb(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, k, bs)), ecb_rt.twofish(k, bs)) 1121 1122 def cbc_rt.twofish(+k: Tf.LcTwofishKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 1123 match bs: 1124 case Nil{}: 1125 {==} 1126 case Con{+p, t}: 1127 %Equal.sym(M.CmBlock, Tf.LcTwofish.decrypt(k, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.twofish_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, t, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))), Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 1128 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, t, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))), Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 1129 %cbc_rt.twofish(k, t, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1130 {==} 1131 1132 def Laws.twofish_cbc_round_trip(k, iv, bs): 1133 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 1134 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 1135 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.twofish(k, bs, iv)) 1136 1137 def pcbc_rt.twofish(+k: Tf.LcTwofishKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 1138 match bs: 1139 case Nil{}: 1140 {==} 1141 case Con{+p, t}: 1142 %Equal.sym(M.CmBlock, Tf.LcTwofish.decrypt(k, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.twofish_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 1143 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 1144 %pcbc_rt.twofish(k, t, CM.CrBlk128.xor(p, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1145 {==} 1146 1147 def Laws.twofish_pcbc_round_trip(k, iv, bs): 1148 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 1149 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 1150 Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.twofish(k, bs, iv)) 1151 1152 def lrw_b.twofish(+k: Tf.LcTwofishKey, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}: 1153 match t: 1154 case None{}: 1155 Equal.sym(M.CmBlock, Tf.LcTwofish.decrypt(k, Tf.LcTwofish.encrypt(k, p)), p, LL.twofish_round_trip(k, p)) 1156 case Some{+x}: 1157 %cmblock_xx(Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(Tf.LcTwofish.decrypt(k, _), x) : M.CmBlock} 1158 %Equal.sym(M.CmBlock, Tf.LcTwofish.decrypt(k, Tf.LcTwofish.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.twofish_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock} 1159 cmblock_xx(p, x) 1160 1161 def lrw_rt.twofish(+k: Tf.LcTwofishKey, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}: 1162 match bs: 1163 case Nil{}: 1164 {==} 1165 case Con{+p, t}: 1166 %lrw_b.twofish(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>} 1167 %lrw_rt.twofish(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1168 {==} 1169 1170 def Laws.twofish_lrw_round_trip(k, k2, i, bs): 1171 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>} 1172 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>} 1173 Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Tf.LcTwofishKey, ~M.CmBlock, ~Tf.LcTwofish.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.twofish(k, k2, bs, i)) 1174 1175 def Laws.aria_block_round_trip(k, b): 1176 LL.aria_round_trip(k, b) 1177 1178 def Laws.aria_block_round_trip_dual(k, b): 1179 LL.aria_round_trip_dual(k, b) 1180 1181 def Laws.aria_key_length(): 1182 {==} 1183 1184 def ecb_rt.aria(+k: Ar.LcAriaKey, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs)) : List<&2, M.CmBlock>}: 1185 match bs: 1186 case Nil{}: 1187 {==} 1188 case Con{b, t}: 1189 %Equal.sym(M.CmBlock, Ar.LcAria.decrypt(k, Ar.LcAria.encrypt(k, b)), b, LL.aria_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, t))} : List<&2, M.CmBlock>} 1190 %ecb_rt.aria(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>} 1191 {==} 1192 1193 def Laws.aria_ecb_round_trip(k, bs): 1194 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs, Nil{}), Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs), ecb_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs)) : {Md.cr.ecb.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>} 1195 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs), Nil{}), Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs)), ecb_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>} 1196 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, k, Md.cr.ecb(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, k, bs)), ecb_rt.aria(k, bs)) 1197 1198 def cbc_rt.aria(+k: Ar.LcAriaKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 1199 match bs: 1200 case Nil{}: 1201 {==} 1202 case Con{+p, t}: 1203 %Equal.sym(M.CmBlock, Ar.LcAria.decrypt(k, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.aria_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, t, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))), Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 1204 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, t, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))), Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 1205 %cbc_rt.aria(k, t, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1206 {==} 1207 1208 def Laws.aria_cbc_round_trip(k, iv, bs): 1209 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 1210 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 1211 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.aria(k, bs, iv)) 1212 1213 def pcbc_rt.aria(+k: Ar.LcAriaKey, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 1214 match bs: 1215 case Nil{}: 1216 {==} 1217 case Con{+p, t}: 1218 %Equal.sym(M.CmBlock, Ar.LcAria.decrypt(k, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.aria_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 1219 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 1220 %pcbc_rt.aria(k, t, CM.CrBlk128.xor(p, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1221 {==} 1222 1223 def Laws.aria_pcbc_round_trip(k, iv, bs): 1224 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 1225 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 1226 Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.aria(k, bs, iv)) 1227 1228 def lrw_b.aria(+k: Ar.LcAriaKey, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}: 1229 match t: 1230 case None{}: 1231 Equal.sym(M.CmBlock, Ar.LcAria.decrypt(k, Ar.LcAria.encrypt(k, p)), p, LL.aria_round_trip(k, p)) 1232 case Some{+x}: 1233 %cmblock_xx(Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(Ar.LcAria.decrypt(k, _), x) : M.CmBlock} 1234 %Equal.sym(M.CmBlock, Ar.LcAria.decrypt(k, Ar.LcAria.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.aria_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock} 1235 cmblock_xx(p, x) 1236 1237 def lrw_rt.aria(+k: Ar.LcAriaKey, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}: 1238 match bs: 1239 case Nil{}: 1240 {==} 1241 case Con{+p, t}: 1242 %lrw_b.aria(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>} 1243 %lrw_rt.aria(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1244 {==} 1245 1246 def Laws.aria_lrw_round_trip(k, k2, i, bs): 1247 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>} 1248 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>} 1249 Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~Ar.LcAriaKey, ~M.CmBlock, ~Ar.LcAria.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.aria(k, k2, bs, i)) 1250 1251 def Laws.cast6_block_round_trip(k, b): 1252 LL.cast6_round_trip(k, b) 1253 1254 def Laws.cast6_block_round_trip_dual(k, b): 1255 LL.cast6_round_trip_dual(k, b) 1256 1257 def Laws.cast6_key_length(): 1258 {==} 1259 1260 def ecb_rt.cast6(+k: C6.LcCast6Key, bs: List<&2, M.CmBlock>) -> {bs == Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs)) : List<&2, M.CmBlock>}: 1261 match bs: 1262 case Nil{}: 1263 {==} 1264 case Con{b, t}: 1265 %Equal.sym(M.CmBlock, C6.LcCast6.decrypt(k, C6.LcCast6.encrypt(k, b)), b, LL.cast6_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, t))} : List<&2, M.CmBlock>} 1266 %ecb_rt.cast6(k, t) : {Con{b, t} == Con{b, _} : List<&2, M.CmBlock>} 1267 {==} 1268 1269 def Laws.cast6_ecb_round_trip(k, bs): 1270 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs, Nil{}), Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs), ecb_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs)) : {Md.cr.ecb.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, _, Nil{}) == bs : List<&2, M.CmBlock>} 1271 %Equal.sym(List<&2, M.CmBlock>, Md.cr.ecb.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs), Nil{}), Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs)), ecb_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs))) : {_ == bs : List<&2, M.CmBlock>} 1272 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, k, Md.cr.ecb(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, k, bs)), ecb_rt.cast6(k, bs)) 1273 1274 def cbc_rt.cast6(+k: C6.LcCast6Key, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Md.cr.cbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 1275 match bs: 1276 case Nil{}: 1277 {==} 1278 case Con{+p, t}: 1279 %Equal.sym(M.CmBlock, C6.LcCast6.decrypt(k, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.cast6_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Md.cr.cbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, t, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))), C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 1280 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, t, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))), C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv)))} : List<&2, M.CmBlock>} 1281 %cbc_rt.cast6(k, t, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1282 {==} 1283 1284 def Laws.cast6_cbc_round_trip(k, iv, bs): 1285 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.enc.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), cbc_enc_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 1286 %Equal.sym(List<&2, M.CmBlock>, Md.cr.cbc.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_dec_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 1287 Equal.sym(List<&2, M.CmBlock>, bs, Md.cr.cbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Md.cr.cbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), cbc_rt.cast6(k, bs, iv)) 1288 1289 def pcbc_rt.cast6(+k: C6.LcCast6Key, bs: List<&2, M.CmBlock>, +iv: M.CmBlock) -> {bs == Pc.cr.pcbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv) : List<&2, M.CmBlock>}: 1290 match bs: 1291 case Nil{}: 1292 {==} 1293 case Con{+p, t}: 1294 %Equal.sym(M.CmBlock, C6.LcCast6.decrypt(k, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))), CM.CrBlk128.xor(p, iv), LL.cast6_round_trip(k, CM.CrBlk128.xor(p, iv))) : {Con{p, t} == Con{CM.CrBlk128.xor(_, iv), Pc.cr.pcbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(CM.CrBlk128.xor(_, iv), C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 1295 %cmblock_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, t, CM.CrBlk128.xor(p, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv)))), CM.CrBlk128.xor(_, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv))))} : List<&2, M.CmBlock>} 1296 %pcbc_rt.cast6(k, t, CM.CrBlk128.xor(p, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1297 {==} 1298 1299 def Laws.cast6_pcbc_round_trip(k, iv, bs): 1300 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.enc.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), pcbc_enc_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, _, iv, Nil{}) == bs : List<&2, M.CmBlock>} 1301 %Equal.sym(List<&2, M.CmBlock>, Pc.cr.pcbc.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_dec_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv)) : {_ == bs : List<&2, M.CmBlock>} 1302 Equal.sym(List<&2, M.CmBlock>, bs, Pc.cr.pcbc.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, Pc.cr.pcbc.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, bs, iv), iv), pcbc_rt.cast6(k, bs, iv)) 1303 1304 def lrw_b.cast6(+k: C6.LcCast6Key, t: Maybe<&2, M.CmBlock>, +p: M.CmBlock) -> {p == Lw.cr.lrw.bdec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, k, t, Lw.cr.lrw.benc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, k, t, p)) : M.CmBlock}: 1305 match t: 1306 case None{}: 1307 Equal.sym(M.CmBlock, C6.LcCast6.decrypt(k, C6.LcCast6.encrypt(k, p)), p, LL.cast6_round_trip(k, p)) 1308 case Some{+x}: 1309 %cmblock_xx(C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, x)), x) : {p == CM.CrBlk128.xor(C6.LcCast6.decrypt(k, _), x) : M.CmBlock} 1310 %Equal.sym(M.CmBlock, C6.LcCast6.decrypt(k, C6.LcCast6.encrypt(k, CM.CrBlk128.xor(p, x))), CM.CrBlk128.xor(p, x), LL.cast6_round_trip(k, CM.CrBlk128.xor(p, x))) : {p == CM.CrBlk128.xor(_, x) : M.CmBlock} 1311 cmblock_xx(p, x) 1312 1313 def lrw_rt.cast6(+k: C6.LcCast6Key, +k2: G.Gf128, bs: List<&2, M.CmBlock>, +i: G.Gf128) -> {bs == Lw.cr.lrw.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i) : List<&2, M.CmBlock>}: 1314 match bs: 1315 case Nil{}: 1316 {==} 1317 case Con{+p, t}: 1318 %lrw_b.cast6(k, Lw.cr.lrw.tweak(~M.CmBlock, ~CM.CrBlk128.of_octets, k2, i), p) : {Con{p, t} == Con{_, Lw.cr.lrw.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, t, Lw.cr.lrw.inc(i)), Lw.cr.lrw.inc(i))} : List<&2, M.CmBlock>} 1319 %lrw_rt.cast6(k, k2, t, Lw.cr.lrw.inc(i)) : {Con{p, t} == Con{p, _} : List<&2, M.CmBlock>} 1320 {==} 1321 1322 def Laws.cast6_lrw_round_trip(k, k2, i, bs): 1323 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.enc.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i, Nil{}), Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), lrw_enc_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i)) : {Lw.cr.lrw.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, _, i, Nil{}) == bs : List<&2, M.CmBlock>} 1324 %Equal.sym(List<&2, M.CmBlock>, Lw.cr.lrw.dec.go(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i, Nil{}), Lw.cr.lrw.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_dec_pub(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i)) : {_ == bs : List<&2, M.CmBlock>} 1325 Equal.sym(List<&2, M.CmBlock>, bs, Lw.cr.lrw.dec(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.decrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, Lw.cr.lrw.enc(~C6.LcCast6Key, ~M.CmBlock, ~C6.LcCast6.encrypt, ~CM.CrBlk128.xor, ~CM.CrBlk128.of_octets, k, k2, bs, i), i), lrw_rt.cast6(k, k2, bs, i)) 1326 1327 def Laws.blowfish_block_round_trip(k, b): 1328 LL.blowfish_round_trip(k, b) 1329 1330 def Laws.blowfish_block_round_trip_dual(k, b): 1331 LL.blowfish_round_trip_dual(k, b) 1332 1333 def Laws.blowfish_key_length(): 1334 {==} 1335 1336 def ecb_rt.blowfish(+k: Bf.LcBlowfishKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs)) : List<&2, L.LcBlock64>}: 1337 match bs: 1338 case Nil{}: 1339 {==} 1340 case Con{b, t}: 1341 %Equal.sym(L.LcBlock64, Bf.LcBlowfish.decrypt(k, Bf.LcBlowfish.encrypt(k, b)), b, LL.blowfish_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, t))} : List<&2, L.LcBlock64>} 1342 %ecb_rt.blowfish(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>} 1343 {==} 1344 1345 def Laws.blowfish_ecb_round_trip(k, bs): 1346 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs, Nil{}), Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs), ecb_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs)) : {Md.cr.ecb.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>} 1347 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs), Nil{}), Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs)), ecb_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>} 1348 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, k, Md.cr.ecb(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, k, bs)), ecb_rt.blowfish(k, bs)) 1349 1350 def cbc_rt.blowfish(+k: Bf.LcBlowfishKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 1351 match bs: 1352 case Nil{}: 1353 {==} 1354 case Con{+p, t}: 1355 %Equal.sym(L.LcBlock64, Bf.LcBlowfish.decrypt(k, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.blowfish_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, t, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))), Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 1356 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, t, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))), Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 1357 %cbc_rt.blowfish(k, t, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 1358 {==} 1359 1360 def Laws.blowfish_cbc_round_trip(k, iv, bs): 1361 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 1362 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 1363 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.blowfish(k, bs, iv)) 1364 1365 def pcbc_rt.blowfish(+k: Bf.LcBlowfishKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 1366 match bs: 1367 case Nil{}: 1368 {==} 1369 case Con{+p, t}: 1370 %Equal.sym(L.LcBlock64, Bf.LcBlowfish.decrypt(k, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.blowfish_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 1371 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 1372 %pcbc_rt.blowfish(k, t, LC.CrBlk64.xor(p, Bf.LcBlowfish.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 1373 {==} 1374 1375 def Laws.blowfish_pcbc_round_trip(k, iv, bs): 1376 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 1377 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 1378 Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Bf.LcBlowfishKey, ~L.LcBlock64, ~Bf.LcBlowfish.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.blowfish(k, bs, iv)) 1379 1380 def Laws.cast5_block_round_trip(k, b): 1381 LL.cast5_round_trip(k, b) 1382 1383 def Laws.cast5_block_round_trip_dual(k, b): 1384 LL.cast5_round_trip_dual(k, b) 1385 1386 def Laws.cast5_key_length(): 1387 {==} 1388 1389 def ecb_rt.cast5(+k: C5.LcCast5Key, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs)) : List<&2, L.LcBlock64>}: 1390 match bs: 1391 case Nil{}: 1392 {==} 1393 case Con{b, t}: 1394 %Equal.sym(L.LcBlock64, C5.LcCast5.decrypt(k, C5.LcCast5.encrypt(k, b)), b, LL.cast5_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, t))} : List<&2, L.LcBlock64>} 1395 %ecb_rt.cast5(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>} 1396 {==} 1397 1398 def Laws.cast5_ecb_round_trip(k, bs): 1399 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs, Nil{}), Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs), ecb_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs)) : {Md.cr.ecb.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>} 1400 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs), Nil{}), Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs)), ecb_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>} 1401 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, k, Md.cr.ecb(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, k, bs)), ecb_rt.cast5(k, bs)) 1402 1403 def cbc_rt.cast5(+k: C5.LcCast5Key, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 1404 match bs: 1405 case Nil{}: 1406 {==} 1407 case Con{+p, t}: 1408 %Equal.sym(L.LcBlock64, C5.LcCast5.decrypt(k, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.cast5_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, t, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))), C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 1409 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, t, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))), C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 1410 %cbc_rt.cast5(k, t, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 1411 {==} 1412 1413 def Laws.cast5_cbc_round_trip(k, iv, bs): 1414 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 1415 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 1416 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.cast5(k, bs, iv)) 1417 1418 def pcbc_rt.cast5(+k: C5.LcCast5Key, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 1419 match bs: 1420 case Nil{}: 1421 {==} 1422 case Con{+p, t}: 1423 %Equal.sym(L.LcBlock64, C5.LcCast5.decrypt(k, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.cast5_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 1424 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 1425 %pcbc_rt.cast5(k, t, LC.CrBlk64.xor(p, C5.LcCast5.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 1426 {==} 1427 1428 def Laws.cast5_pcbc_round_trip(k, iv, bs): 1429 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 1430 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 1431 Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~C5.LcCast5Key, ~L.LcBlock64, ~C5.LcCast5.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.cast5(k, bs, iv)) 1432 1433 def Laws.tea_block_round_trip(k, b): 1434 LL.tea_round_trip(k, b) 1435 1436 def Laws.tea_block_round_trip_dual(k, b): 1437 LL.tea_round_trip_dual(k, b) 1438 1439 def Laws.tea_key_length(): 1440 {==} 1441 1442 def ecb_rt.tea(+k: Te.LcTeaKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs)) : List<&2, L.LcBlock64>}: 1443 match bs: 1444 case Nil{}: 1445 {==} 1446 case Con{b, t}: 1447 %Equal.sym(L.LcBlock64, Te.LcTea.decrypt(k, Te.LcTea.encrypt(k, b)), b, LL.tea_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, t))} : List<&2, L.LcBlock64>} 1448 %ecb_rt.tea(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>} 1449 {==} 1450 1451 def Laws.tea_ecb_round_trip(k, bs): 1452 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs, Nil{}), Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs), ecb_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs)) : {Md.cr.ecb.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>} 1453 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs), Nil{}), Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs)), ecb_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>} 1454 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, k, Md.cr.ecb(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, k, bs)), ecb_rt.tea(k, bs)) 1455 1456 def cbc_rt.tea(+k: Te.LcTeaKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 1457 match bs: 1458 case Nil{}: 1459 {==} 1460 case Con{+p, t}: 1461 %Equal.sym(L.LcBlock64, Te.LcTea.decrypt(k, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.tea_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, t, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))), Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 1462 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, t, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))), Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 1463 %cbc_rt.tea(k, t, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 1464 {==} 1465 1466 def Laws.tea_cbc_round_trip(k, iv, bs): 1467 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 1468 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 1469 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.tea(k, bs, iv)) 1470 1471 def pcbc_rt.tea(+k: Te.LcTeaKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 1472 match bs: 1473 case Nil{}: 1474 {==} 1475 case Con{+p, t}: 1476 %Equal.sym(L.LcBlock64, Te.LcTea.decrypt(k, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.tea_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 1477 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 1478 %pcbc_rt.tea(k, t, LC.CrBlk64.xor(p, Te.LcTea.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 1479 {==} 1480 1481 def Laws.tea_pcbc_round_trip(k, iv, bs): 1482 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 1483 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 1484 Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Te.LcTeaKey, ~L.LcBlock64, ~Te.LcTea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.tea(k, bs, iv)) 1485 1486 def Laws.xtea_block_round_trip(k, b): 1487 LL.xtea_round_trip(k, b) 1488 1489 def Laws.xtea_block_round_trip_dual(k, b): 1490 LL.xtea_round_trip_dual(k, b) 1491 1492 def Laws.xtea_key_length(): 1493 {==} 1494 1495 def ecb_rt.xtea(+k: Xt.LcXteaKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs)) : List<&2, L.LcBlock64>}: 1496 match bs: 1497 case Nil{}: 1498 {==} 1499 case Con{b, t}: 1500 %Equal.sym(L.LcBlock64, Xt.LcXtea.decrypt(k, Xt.LcXtea.encrypt(k, b)), b, LL.xtea_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, t))} : List<&2, L.LcBlock64>} 1501 %ecb_rt.xtea(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>} 1502 {==} 1503 1504 def Laws.xtea_ecb_round_trip(k, bs): 1505 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs, Nil{}), Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs), ecb_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs)) : {Md.cr.ecb.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>} 1506 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs), Nil{}), Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs)), ecb_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>} 1507 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, k, Md.cr.ecb(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, k, bs)), ecb_rt.xtea(k, bs)) 1508 1509 def cbc_rt.xtea(+k: Xt.LcXteaKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 1510 match bs: 1511 case Nil{}: 1512 {==} 1513 case Con{+p, t}: 1514 %Equal.sym(L.LcBlock64, Xt.LcXtea.decrypt(k, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.xtea_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, t, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))), Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 1515 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, t, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))), Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 1516 %cbc_rt.xtea(k, t, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 1517 {==} 1518 1519 def Laws.xtea_cbc_round_trip(k, iv, bs): 1520 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 1521 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 1522 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.xtea(k, bs, iv)) 1523 1524 def pcbc_rt.xtea(+k: Xt.LcXteaKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 1525 match bs: 1526 case Nil{}: 1527 {==} 1528 case Con{+p, t}: 1529 %Equal.sym(L.LcBlock64, Xt.LcXtea.decrypt(k, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.xtea_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 1530 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 1531 %pcbc_rt.xtea(k, t, LC.CrBlk64.xor(p, Xt.LcXtea.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 1532 {==} 1533 1534 def Laws.xtea_pcbc_round_trip(k, iv, bs): 1535 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 1536 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 1537 Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Xt.LcXteaKey, ~L.LcBlock64, ~Xt.LcXtea.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.xtea(k, bs, iv)) 1538 1539 def Laws.fcrypt_block_round_trip(k, b): 1540 LL.fcrypt_round_trip(k, b) 1541 1542 def Laws.fcrypt_block_round_trip_dual(k, b): 1543 LL.fcrypt_round_trip_dual(k, b) 1544 1545 def Laws.fcrypt_key_length(): 1546 {==} 1547 1548 def ecb_rt.fcrypt(+k: Fc.LcFcryptKey, bs: List<&2, L.LcBlock64>) -> {bs == Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs)) : List<&2, L.LcBlock64>}: 1549 match bs: 1550 case Nil{}: 1551 {==} 1552 case Con{b, t}: 1553 %Equal.sym(L.LcBlock64, Fc.LcFcrypt.decrypt(k, Fc.LcFcrypt.encrypt(k, b)), b, LL.fcrypt_round_trip(k, b)) : {Con{b, t} == Con{_, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, t))} : List<&2, L.LcBlock64>} 1554 %ecb_rt.fcrypt(k, t) : {Con{b, t} == Con{b, _} : List<&2, L.LcBlock64>} 1555 {==} 1556 1557 def Laws.fcrypt_ecb_round_trip(k, bs): 1558 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs, Nil{}), Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs), ecb_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs)) : {Md.cr.ecb.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, _, Nil{}) == bs : List<&2, L.LcBlock64>} 1559 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.ecb.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs), Nil{}), Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs)), ecb_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs))) : {_ == bs : List<&2, L.LcBlock64>} 1560 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, k, Md.cr.ecb(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, k, bs)), ecb_rt.fcrypt(k, bs)) 1561 1562 def cbc_rt.fcrypt(+k: Fc.LcFcryptKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Md.cr.cbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 1563 match bs: 1564 case Nil{}: 1565 {==} 1566 case Con{+p, t}: 1567 %Equal.sym(L.LcBlock64, Fc.LcFcrypt.decrypt(k, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.fcrypt_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Md.cr.cbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, t, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))), Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 1568 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Md.cr.cbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, t, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))), Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv)))} : List<&2, L.LcBlock64>} 1569 %cbc_rt.fcrypt(k, t, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 1570 {==} 1571 1572 def Laws.fcrypt_cbc_round_trip(k, iv, bs): 1573 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.enc.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), cbc_enc_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Md.cr.cbc.dec.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 1574 %Equal.sym(List<&2, L.LcBlock64>, Md.cr.cbc.dec.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Md.cr.cbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_dec_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 1575 Equal.sym(List<&2, L.LcBlock64>, bs, Md.cr.cbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Md.cr.cbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), cbc_rt.fcrypt(k, bs, iv)) 1576 1577 def pcbc_rt.fcrypt(+k: Fc.LcFcryptKey, bs: List<&2, L.LcBlock64>, +iv: L.LcBlock64) -> {bs == Pc.cr.pcbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv) : List<&2, L.LcBlock64>}: 1578 match bs: 1579 case Nil{}: 1580 {==} 1581 case Con{+p, t}: 1582 %Equal.sym(L.LcBlock64, Fc.LcFcrypt.decrypt(k, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))), LC.CrBlk64.xor(p, iv), LL.fcrypt_round_trip(k, LC.CrBlk64.xor(p, iv))) : {Con{p, t} == Con{LC.CrBlk64.xor(_, iv), Pc.cr.pcbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(LC.CrBlk64.xor(_, iv), Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 1583 %lcblock64_xx(p, iv) : {Con{p, t} == Con{_, Pc.cr.pcbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, t, LC.CrBlk64.xor(p, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv)))), LC.CrBlk64.xor(_, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv))))} : List<&2, L.LcBlock64>} 1584 %pcbc_rt.fcrypt(k, t, LC.CrBlk64.xor(p, Fc.LcFcrypt.encrypt(k, LC.CrBlk64.xor(p, iv)))) : {Con{p, t} == Con{p, _} : List<&2, L.LcBlock64>} 1585 {==} 1586 1587 def Laws.fcrypt_pcbc_round_trip(k, iv, bs): 1588 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.enc.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv, Nil{}), Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), pcbc_enc_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv)) : {Pc.cr.pcbc.dec.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, _, iv, Nil{}) == bs : List<&2, L.LcBlock64>} 1589 %Equal.sym(List<&2, L.LcBlock64>, Pc.cr.pcbc.dec.go(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv, Nil{}), Pc.cr.pcbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_dec_pub(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv)) : {_ == bs : List<&2, L.LcBlock64>} 1590 Equal.sym(List<&2, L.LcBlock64>, bs, Pc.cr.pcbc.dec(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.decrypt, ~LC.CrBlk64.xor, k, Pc.cr.pcbc.enc(~Fc.LcFcryptKey, ~L.LcBlock64, ~Fc.LcFcrypt.encrypt, ~LC.CrBlk64.xor, k, bs, iv), iv), pcbc_rt.fcrypt(k, bs, iv)) 1591 1592 def Laws.aes_key_length(): 1593 {==} 1594 1595 def Laws.aes_enc_key_length(): 1596 {==} 1597 1598 def Laws.rc4_stream_involution(s, m): 1599 LL.rc4_involution(s, m) 1600 1601 def Laws.rc4_stream_streaming_data(s, a, b): 1602 LL.rc4_streaming_data(s, a, b) 1603 1604 def Laws.rc4_stream_streaming_state(s, a, b): 1605 LL.rc4_streaming_state(s, a, b) 1606 1607 def Laws.hmac_crc32_streaming(spec, s, a, b): 1608 match s: 1609 case Hm.CrHmacState{h, o}: 1610 %Laws.crc32_hash_streaming(~spec, h, a, b) : {Hm.CrHmacState{CR.CrCrc32.update(~spec, h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState} 1611 {==} 1612 1613 def Laws.hmac_crc32_split(spec, kk, a, b): 1614 match kk: 1615 case Hm.CrHmacKey{+i, +o}: 1616 %Equal.sym(B.Octets, CR.CrCrc32.final(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.init(~spec), i), a), b)), CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))), Laws.crc32_hash_split3(~spec, i, a, b)) : {CR.CrCrc32.final(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.init(~spec), o), _)) == CR.CrCrc32.digest(~spec, B.Octets.append(o, CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1617 %Equal.sym(B.Octets, CR.CrCrc32.final(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.update(~spec, CR.CrCrc32.init(~spec), o), CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))), CR.CrCrc32.digest(~spec, B.Octets.append(o, CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))), Laws.crc32_hash_split(~spec, o, CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : {_ == CR.CrCrc32.digest(~spec, B.Octets.append(o, CR.CrCrc32.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1618 {==} 1619 1620 def Laws.hmac_crc64_streaming(spec, s, a, b): 1621 match s: 1622 case Hm.CrHmacState{h, o}: 1623 %Laws.crc64_hash_streaming(~spec, h, a, b) : {Hm.CrHmacState{CR.CrCrc64.update(~spec, h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState} 1624 {==} 1625 1626 def Laws.hmac_crc64_split(spec, kk, a, b): 1627 match kk: 1628 case Hm.CrHmacKey{+i, +o}: 1629 %Equal.sym(B.Octets, CR.CrCrc64.final(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.init(~spec), i), a), b)), CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))), Laws.crc64_hash_split3(~spec, i, a, b)) : {CR.CrCrc64.final(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.init(~spec), o), _)) == CR.CrCrc64.digest(~spec, B.Octets.append(o, CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1630 %Equal.sym(B.Octets, CR.CrCrc64.final(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.update(~spec, CR.CrCrc64.init(~spec), o), CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))), CR.CrCrc64.digest(~spec, B.Octets.append(o, CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))), Laws.crc64_hash_split(~spec, o, CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : {_ == CR.CrCrc64.digest(~spec, B.Octets.append(o, CR.CrCrc64.digest(~spec, B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1631 {==} 1632 1633 def Laws.hmac_sha256_split(kk, a, b): 1634 match kk: 1635 case Hm.CrHmacKey{+i, +o}: 1636 %Equal.sym(B.Octets, SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init256(), i), a), b)), SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))), Laws.sha256_hash_split3(i, a, b)) : {SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init256(), o), _)) == SH.CrSha2.sha256(B.Octets.append(o, SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1637 %Equal.sym(B.Octets, SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init256(), o), SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))))), SH.CrSha2.sha256(B.Octets.append(o, SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))))), Laws.sha256_hash_split(o, SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == SH.CrSha2.sha256(B.Octets.append(o, SH.CrSha2.sha256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1638 {==} 1639 1640 def Laws.hmac_sha512_split(kk, a, b): 1641 match kk: 1642 case Hm.CrHmacKey{+i, +o}: 1643 %Equal.sym(B.Octets, SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init512(), i), a), b)), SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))), Laws.sha512_hash_split3(i, a, b)) : {SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init512(), o), _)) == SH.CrSha2.sha512(B.Octets.append(o, SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1644 %Equal.sym(B.Octets, SH.CrSha2.final(SH.CrSha2.update(SH.CrSha2.update(SH.CrSha2.init512(), o), SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))))), SH.CrSha2.sha512(B.Octets.append(o, SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))))), Laws.sha512_hash_split(o, SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == SH.CrSha2.sha512(B.Octets.append(o, SH.CrSha2.sha512(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1645 {==} 1646 1647 def Laws.hmac_sha3_256_split(kk, a, b): 1648 match kk: 1649 case Hm.CrHmacKey{+i, +o}: 1650 %Equal.sym(B.Octets, S3.CrSha3.final(S3.CrSha3.update(S3.CrSha3.update(S3.CrSha3.update(S3.CrSha3.init(), i), a), b)), S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))), Laws.sha3_256_hash_split3(i, a, b)) : {S3.CrSha3.final(S3.CrSha3.update(S3.CrSha3.update(S3.CrSha3.init(), o), _)) == S3.CrSha3.sha3_256(B.Octets.append(o, S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1651 %Equal.sym(B.Octets, S3.CrSha3.final(S3.CrSha3.update(S3.CrSha3.update(S3.CrSha3.init(), o), S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))))), S3.CrSha3.sha3_256(B.Octets.append(o, S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))))), Laws.sha3_256_hash_split(o, S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == S3.CrSha3.sha3_256(B.Octets.append(o, S3.CrSha3.sha3_256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1652 {==} 1653 1654 def Laws.md4_hash_streaming(s, a, b): 1655 HSL.md4_streaming(s, a, b) 1656 1657 def Laws.md4_hash_split(a, b): 1658 HSL.md4_split(a, b) 1659 1660 def Laws.md4_hash_split3(a, b, c): 1661 HSL.md4_split3(a, b, c) 1662 1663 def Laws.md4_hash_length(s): 1664 HSL.md4_length(s) 1665 1666 def Laws.hmac_md4_streaming(s, a, b): 1667 match s: 1668 case Hm.CrHmacState{h, o}: 1669 %Laws.md4_hash_streaming(h, a, b) : {Hm.CrHmacState{HM4.HsMd4.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState>} 1670 {==} 1671 1672 def Laws.hmac_md4_split(kk, a, b): 1673 match kk: 1674 case Hm.CrHmacKey{+i, +o}: 1675 %Equal.sym(B.Octets, HM4.HsMd4.final(HM4.HsMd4.update(HM4.HsMd4.update(HM4.HsMd4.update(HM4.HsMd4.init(), i), a), b)), HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))), Laws.md4_hash_split3(i, a, b)) : {HM4.HsMd4.final(HM4.HsMd4.update(HM4.HsMd4.update(HM4.HsMd4.init(), o), _)) == HM4.HsMd4.digest(B.Octets.append(o, HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1676 %Equal.sym(B.Octets, HM4.HsMd4.final(HM4.HsMd4.update(HM4.HsMd4.update(HM4.HsMd4.init(), o), HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))))), HM4.HsMd4.digest(B.Octets.append(o, HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))))), Laws.md4_hash_split(o, HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HM4.HsMd4.digest(B.Octets.append(o, HM4.HsMd4.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1677 {==} 1678 1679 def Laws.md5_hash_streaming(s, a, b): 1680 HSL.md5_streaming(s, a, b) 1681 1682 def Laws.md5_hash_split(a, b): 1683 HSL.md5_split(a, b) 1684 1685 def Laws.md5_hash_split3(a, b, c): 1686 HSL.md5_split3(a, b, c) 1687 1688 def Laws.md5_hash_length(s): 1689 HSL.md5_length(s) 1690 1691 def Laws.hmac_md5_streaming(s, a, b): 1692 match s: 1693 case Hm.CrHmacState{h, o}: 1694 %Laws.md5_hash_streaming(h, a, b) : {Hm.CrHmacState{HM5.HsMd5.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState>} 1695 {==} 1696 1697 def Laws.hmac_md5_split(kk, a, b): 1698 match kk: 1699 case Hm.CrHmacKey{+i, +o}: 1700 %Equal.sym(B.Octets, HM5.HsMd5.final(HM5.HsMd5.update(HM5.HsMd5.update(HM5.HsMd5.update(HM5.HsMd5.init(), i), a), b)), HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))), Laws.md5_hash_split3(i, a, b)) : {HM5.HsMd5.final(HM5.HsMd5.update(HM5.HsMd5.update(HM5.HsMd5.init(), o), _)) == HM5.HsMd5.digest(B.Octets.append(o, HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1701 %Equal.sym(B.Octets, HM5.HsMd5.final(HM5.HsMd5.update(HM5.HsMd5.update(HM5.HsMd5.init(), o), HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))))), HM5.HsMd5.digest(B.Octets.append(o, HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))))), Laws.md5_hash_split(o, HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HM5.HsMd5.digest(B.Octets.append(o, HM5.HsMd5.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1702 {==} 1703 1704 def Laws.sha1_hash_streaming(s, a, b): 1705 HSL.sha1_streaming(s, a, b) 1706 1707 def Laws.sha1_hash_split(a, b): 1708 HSL.sha1_split(a, b) 1709 1710 def Laws.sha1_hash_split3(a, b, c): 1711 HSL.sha1_split3(a, b, c) 1712 1713 def Laws.sha1_hash_length(s): 1714 HSL.sha1_length(s) 1715 1716 def Laws.hmac_sha1_streaming(s, a, b): 1717 match s: 1718 case Hm.CrHmacState{h, o}: 1719 %Laws.sha1_hash_streaming(h, a, b) : {Hm.CrHmacState{HS1.HsSha1.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState>} 1720 {==} 1721 1722 def Laws.hmac_sha1_split(kk, a, b): 1723 match kk: 1724 case Hm.CrHmacKey{+i, +o}: 1725 %Equal.sym(B.Octets, HS1.HsSha1.final(HS1.HsSha1.update(HS1.HsSha1.update(HS1.HsSha1.update(HS1.HsSha1.init(), i), a), b)), HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))), Laws.sha1_hash_split3(i, a, b)) : {HS1.HsSha1.final(HS1.HsSha1.update(HS1.HsSha1.update(HS1.HsSha1.init(), o), _)) == HS1.HsSha1.digest(B.Octets.append(o, HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1726 %Equal.sym(B.Octets, HS1.HsSha1.final(HS1.HsSha1.update(HS1.HsSha1.update(HS1.HsSha1.init(), o), HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))))), HS1.HsSha1.digest(B.Octets.append(o, HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))))), Laws.sha1_hash_split(o, HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HS1.HsSha1.digest(B.Octets.append(o, HS1.HsSha1.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1727 {==} 1728 1729 def Laws.ripemd160_hash_streaming(s, a, b): 1730 HSL.ripemd160_streaming(s, a, b) 1731 1732 def Laws.ripemd160_hash_split(a, b): 1733 HSL.ripemd160_split(a, b) 1734 1735 def Laws.ripemd160_hash_split3(a, b, c): 1736 HSL.ripemd160_split3(a, b, c) 1737 1738 def Laws.ripemd160_hash_length(s): 1739 HSL.ripemd160_length(s) 1740 1741 def Laws.hmac_ripemd160_streaming(s, a, b): 1742 match s: 1743 case Hm.CrHmacState{h, o}: 1744 %Laws.ripemd160_hash_streaming(h, a, b) : {Hm.CrHmacState{HRM.HsRipemd160.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState>} 1745 {==} 1746 1747 def Laws.hmac_ripemd160_split(kk, a, b): 1748 match kk: 1749 case Hm.CrHmacKey{+i, +o}: 1750 %Equal.sym(B.Octets, HRM.HsRipemd160.final(HRM.HsRipemd160.update(HRM.HsRipemd160.update(HRM.HsRipemd160.update(HRM.HsRipemd160.init(), i), a), b)), HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))), Laws.ripemd160_hash_split3(i, a, b)) : {HRM.HsRipemd160.final(HRM.HsRipemd160.update(HRM.HsRipemd160.update(HRM.HsRipemd160.init(), o), _)) == HRM.HsRipemd160.digest(B.Octets.append(o, HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1751 %Equal.sym(B.Octets, HRM.HsRipemd160.final(HRM.HsRipemd160.update(HRM.HsRipemd160.update(HRM.HsRipemd160.init(), o), HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))))), HRM.HsRipemd160.digest(B.Octets.append(o, HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))))), Laws.ripemd160_hash_split(o, HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HRM.HsRipemd160.digest(B.Octets.append(o, HRM.HsRipemd160.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1752 {==} 1753 1754 def Laws.sm3_hash_streaming(s, a, b): 1755 HSL.sm3_streaming(s, a, b) 1756 1757 def Laws.sm3_hash_split(a, b): 1758 HSL.sm3_split(a, b) 1759 1760 def Laws.sm3_hash_split3(a, b, c): 1761 HSL.sm3_split3(a, b, c) 1762 1763 def Laws.sm3_hash_length(s): 1764 HSL.sm3_length(s) 1765 1766 def Laws.hmac_sm3_streaming(s, a, b): 1767 match s: 1768 case Hm.CrHmacState{h, o}: 1769 %Laws.sm3_hash_streaming(h, a, b) : {Hm.CrHmacState{HSM.HsSm3.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState>} 1770 {==} 1771 1772 def Laws.hmac_sm3_split(kk, a, b): 1773 match kk: 1774 case Hm.CrHmacKey{+i, +o}: 1775 %Equal.sym(B.Octets, HSM.HsSm3.final(HSM.HsSm3.update(HSM.HsSm3.update(HSM.HsSm3.update(HSM.HsSm3.init(), i), a), b)), HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))), Laws.sm3_hash_split3(i, a, b)) : {HSM.HsSm3.final(HSM.HsSm3.update(HSM.HsSm3.update(HSM.HsSm3.init(), o), _)) == HSM.HsSm3.digest(B.Octets.append(o, HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1776 %Equal.sym(B.Octets, HSM.HsSm3.final(HSM.HsSm3.update(HSM.HsSm3.update(HSM.HsSm3.init(), o), HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))))), HSM.HsSm3.digest(B.Octets.append(o, HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))))), Laws.sm3_hash_split(o, HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HSM.HsSm3.digest(B.Octets.append(o, HSM.HsSm3.digest(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1777 {==} 1778 1779 def Laws.streebog256_hash_streaming(s, a, b): 1780 HSL.streebog256_streaming(s, a, b) 1781 1782 def Laws.streebog256_hash_split(a, b): 1783 HSL.streebog256_split(a, b) 1784 1785 def Laws.streebog256_hash_split3(a, b, c): 1786 HSL.streebog256_split3(a, b, c) 1787 1788 def Laws.streebog256_hash_length(s): 1789 HSL.streebog256_length(s) 1790 1791 def Laws.hmac_streebog256_streaming(s, a, b): 1792 match s: 1793 case Hm.CrHmacState{h, o}: 1794 %Laws.streebog256_hash_streaming(h, a, b) : {Hm.CrHmacState{HST.HsStreebog.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState>} 1795 {==} 1796 1797 def Laws.hmac_streebog256_split(kk, a, b): 1798 match kk: 1799 case Hm.CrHmacKey{+i, +o}: 1800 %Equal.sym(B.Octets, HST.HsStreebog.final256(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init256(), i), a), b)), HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))), Laws.streebog256_hash_split3(i, a, b)) : {HST.HsStreebog.final256(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init256(), o), _)) == HST.HsStreebog.digest256(B.Octets.append(o, HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1801 %Equal.sym(B.Octets, HST.HsStreebog.final256(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init256(), o), HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))))), HST.HsStreebog.digest256(B.Octets.append(o, HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))))), Laws.streebog256_hash_split(o, HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HST.HsStreebog.digest256(B.Octets.append(o, HST.HsStreebog.digest256(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1802 {==} 1803 1804 def Laws.streebog512_hash_streaming(s, a, b): 1805 HSL.streebog512_streaming(s, a, b) 1806 1807 def Laws.streebog512_hash_split(a, b): 1808 HSL.streebog512_split(a, b) 1809 1810 def Laws.streebog512_hash_split3(a, b, c): 1811 HSL.streebog512_split3(a, b, c) 1812 1813 def Laws.streebog512_hash_length(s): 1814 HSL.streebog512_length(s) 1815 1816 def Laws.hmac_streebog512_streaming(s, a, b): 1817 match s: 1818 case Hm.CrHmacState{h, o}: 1819 %Laws.streebog512_hash_streaming(h, a, b) : {Hm.CrHmacState{HST.HsStreebog.update(h, B.Octets.append(a, b)), o} == Hm.CrHmacState{_, o} : Hm.CrHmacState>} 1820 {==} 1821 1822 def Laws.hmac_streebog512_split(kk, a, b): 1823 match kk: 1824 case Hm.CrHmacKey{+i, +o}: 1825 %Equal.sym(B.Octets, HST.HsStreebog.final512(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init512(), i), a), b)), HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))), Laws.streebog512_hash_split3(i, a, b)) : {HST.HsStreebog.final512(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init512(), o), _)) == HST.HsStreebog.digest512(B.Octets.append(o, HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1826 %Equal.sym(B.Octets, HST.HsStreebog.final512(HST.HsStreebog.update(HST.HsStreebog.update(HST.HsStreebog.init512(), o), HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))))), HST.HsStreebog.digest512(B.Octets.append(o, HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))))), Laws.streebog512_hash_split(o, HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))))) : {_ == HST.HsStreebog.digest512(B.Octets.append(o, HST.HsStreebog.digest512(B.Octets.append(i, B.Octets.append(a, b))))) : B.Octets} 1827 {==} 1828 # END GENERATED: proofs