1	import Base
2	import ../libs/AES256GCMCore.bend as Core
3	
4	# Substitute a certified initial word list with a symbolic fuel parameter.
5	# The public bridge below compares function aliases before applying the key,
6	# avoiding normalization of all 52 rounds merely to compare the aliases.
7	def expand_input_matches(+fuel: Nat, +key: List<&2, U32>,
8	    +initial_words: List<&2, U32>, +expected: List<&2, U32>,
9	    initial_match: {Core.aes_words(key) == initial_words : List<&2, U32>},
10	    expanded_match: {Core.aes_expand.go(fuel, 8, 1, initial_words) == expected : List<&2, U32>}) ->
11	    {Core.aes_expand.go(fuel, 8, 1, Core.aes_words(key)) == expected : List<&2, U32>}:
12	    Equal.trans(List<&2, U32>, Core.aes_expand.go(fuel, 8, 1, Core.aes_words(key)),
13	        Core.aes_expand.go(fuel, 8, 1, initial_words), expected,
14	        Equal.cong(List<&2, U32>, List<&2, U32>, values => Core.aes_expand.go(fuel, 8, 1, values),
15	            Core.aes_words(key), initial_words, initial_match), expanded_match)
16	
17	def expand_key_matches(+fuel: Nat, +key: List<&2, U32>,
18	    +initial_words: List<&2, U32>, +expected: List<&2, U32>,
19	    +initial_match: {Core.aes_words(key) == initial_words : List<&2, U32>},
20	    +expanded_match: {Core.aes_expand.go(fuel, 8, 1, initial_words) == expected : List<&2, U32>}) ->
21	    {Core.aes_expand_key(fuel, key) == expected : List<&2, U32>}:
22	    match key:
23	        case Nil{}: expand_input_matches(fuel, key, initial_words, expected, initial_match, expanded_match)
24	        case head <> tail: expand_input_matches(fuel, key, initial_words, expected, initial_match, expanded_match)
25	
26	def expansion_alias() ->
27	    {Core.aes256_expand == (+key => Core.aes_expand_key(52n, key)) :
28	        @+key: List<&2, U32> -> List<&2, U32>}:
29	    {==}
30	
31	def public_expansion_matches(+key: List<&2, U32>, +expected: List<&2, U32>,
32	    same: {Core.aes_expand_key(52n, key) == expected : List<&2, U32>}) ->
33	    {Core.aes256_expand(key) == expected : List<&2, U32>}:
34	    Equal.trans(List<&2, U32>, Core.aes256_expand(key), Core.aes_expand_key(52n, key), expected,
35	        Equal.cong((@+input: List<&2, U32> -> List<&2, U32>), List<&2, U32>,
36	            function => function(key), Core.aes256_expand,
37	            +input => Core.aes_expand_key(52n, input), expansion_alias()), same)