1	import Base
2	import ../libs/AES256GCMCore.bend as Core
3	import ./AES_NistKeyScheduleProof.bend as Key
4	
5	# Candidate NIST ctr3 block stages. Only kernel acceptance certifies them.
6	
7	def block() -> List<&2, U32>:
8	    [202, 254, 186, 190, 250, 206, 219, 173, 222, 202, 248, 136, 0, 0, 0, 3]
9	
10	def state_0() -> List<&2, U32>:
11	    [52, 1, 83, 44, 124, 171, 168, 177, 179, 160, 119, 28, 103, 48, 131, 11]
12	
13	def state_1() -> List<&2, U32>:
14	    [182, 12, 31, 123, 0, 240, 211, 194, 158, 235, 100, 65, 172, 140, 90, 1]
15	
16	def state_2() -> List<&2, U32>:
17	    [215, 231, 25, 242, 4, 36, 36, 187, 79, 161, 190, 108, 178, 115, 155, 186]
18	
19	def state_3() -> List<&2, U32>:
20	    [23, 241, 181, 99, 185, 200, 214, 36, 71, 141, 172, 145, 40, 191, 141, 193]
21	
22	def state_4() -> List<&2, U32>:
23	    [0, 207, 200, 130, 161, 162, 108, 28, 252, 172, 173, 222, 204, 143, 178, 17]
24	
25	def state_5() -> List<&2, U32>:
26	    [101, 21, 106, 116, 159, 142, 217, 177, 13, 167, 167, 134, 78, 86, 228, 82]
27	
28	def state_6() -> List<&2, U32>:
29	    [206, 133, 37, 88, 221, 6, 250, 189, 132, 98, 205, 15, 220, 230, 116, 195]
30	
31	def state_7() -> List<&2, U32>:
32	    [120, 83, 33, 216, 164, 114, 29, 3, 197, 22, 198, 230, 73, 56, 148, 234]
33	
34	def state_8() -> List<&2, U32>:
35	    [197, 12, 12, 168, 34, 252, 250, 43, 209, 241, 50, 255, 97, 221, 87, 87]
36	
37	def state_9() -> List<&2, U32>:
38	    [49, 79, 82, 36, 169, 114, 193, 140, 105, 173, 239, 129, 2, 1, 203, 253]
39	
40	def state_10() -> List<&2, U32>:
41	    [222, 237, 251, 42, 10, 77, 20, 144, 58, 227, 224, 190, 47, 56, 133, 51]
42	
43	def state_11() -> List<&2, U32>:
44	    [96, 246, 217, 103, 60, 88, 207, 102, 140, 71, 126, 206, 149, 212, 187, 98]
45	
46	def state_12() -> List<&2, U32>:
47	    [12, 112, 82, 8, 51, 120, 214, 208, 79, 118, 28, 0, 232, 150, 124, 66]
48	
49	def state_13() -> List<&2, U32>:
50	    [239, 198, 235, 39, 33, 33, 205, 200, 237, 229, 133, 164, 122, 161, 100, 33]
51	
52	def result() -> List<&2, U32>:
53	    [226, 157, 37, 143, 170, 209, 55, 19, 91, 212, 146, 128, 175, 100, 91, 216]
54	
55	def initial_matches() ->
56	    {Core.aes_add_key(block(), Key.words_60(), 0n) == state_0() : List<&2, U32>}:
57	    {==}
58	
59	def round_1_matches() ->
60	    {Core.aes_middle_round(state_0(), Key.words_60(), 1n) == state_1() : List<&2, U32>}:
61	    {==}
62	
63	def round_2_matches() ->
64	    {Core.aes_middle_round(state_1(), Key.words_60(), 2n) == state_2() : List<&2, U32>}:
65	    {==}
66	
67	def round_3_matches() ->
68	    {Core.aes_middle_round(state_2(), Key.words_60(), 3n) == state_3() : List<&2, U32>}:
69	    {==}
70	
71	def round_4_matches() ->
72	    {Core.aes_middle_round(state_3(), Key.words_60(), 4n) == state_4() : List<&2, U32>}:
73	    {==}
74	
75	def round_5_matches() ->
76	    {Core.aes_middle_round(state_4(), Key.words_60(), 5n) == state_5() : List<&2, U32>}:
77	    {==}
78	
79	def round_6_matches() ->
80	    {Core.aes_middle_round(state_5(), Key.words_60(), 6n) == state_6() : List<&2, U32>}:
81	    {==}
82	
83	def round_7_matches() ->
84	    {Core.aes_middle_round(state_6(), Key.words_60(), 7n) == state_7() : List<&2, U32>}:
85	    {==}
86	
87	def round_8_matches() ->
88	    {Core.aes_middle_round(state_7(), Key.words_60(), 8n) == state_8() : List<&2, U32>}:
89	    {==}
90	
91	def round_9_matches() ->
92	    {Core.aes_middle_round(state_8(), Key.words_60(), 9n) == state_9() : List<&2, U32>}:
93	    {==}
94	
95	def round_10_matches() ->
96	    {Core.aes_middle_round(state_9(), Key.words_60(), 10n) == state_10() : List<&2, U32>}:
97	    {==}
98	
99	def round_11_matches() ->
100	    {Core.aes_middle_round(state_10(), Key.words_60(), 11n) == state_11() : List<&2, U32>}:
101	    {==}
102	
103	def round_12_matches() ->
104	    {Core.aes_middle_round(state_11(), Key.words_60(), 12n) == state_12() : List<&2, U32>}:
105	    {==}
106	
107	def round_13_matches() ->
108	    {Core.aes_middle_round(state_12(), Key.words_60(), 13n) == state_13() : List<&2, U32>}:
109	    {==}
110	
111	def final_matches() ->
112	    {Core.aes_final_round(state_13(), Key.words_60()) == result() : List<&2, U32>}:
113	    {==}