glguy/ascon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Consolidate the zero and non-zero cases

Browse Source
This commit is contained in:
Eric Mertens
2025-09-22 10:04:53 -07:00
parent 2a1309e423
commit 1a52dd9b2d
1 changed files with 22 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
ref-verification/hash.saw
View File

@@ -6,16 +6,19 @@ thm_P12 <- mk_P12;
let ss0 = cryptol_ss (); let ss0 = cryptol_ss ();
thm_null_input <- prove_print rme
(rewrite ss0
{{ \(x : [0][8]) -> Hash256_bytes x ==
[0x0b, 0x3b, 0xe5, 0x85, 0x0f, 0x2f, 0x6b, 0x98,
0xca, 0xf2, 0x9f, 0x8f, 0xde, 0xa8, 0x9b, 0x64,
0xa1, 0xfa, 0x70, 0xaa, 0x24, 0x9b, 0x8f, 0x83,
0x9b, 0xd5, 0x3b, 0xaa, 0x30, 0x4d, 0x92, 0xb2] }});
thm_unfold_iv <- prove_print rme thm_unfold_iv <- prove_print rme
(rewrite ss0 (rewrite ss0
{{ Ascon_p`{12} [Hash256_IV, 0, 0, 0, 0] {{ Ascon_p`{12} [Hash256_IV, 0, 0, 0, 0] ==
== [0x9b1e5494e934d681, 0x4bc3a01e333751d2, 0xae65396c6b34b81a,
[0x9b1e5494e934d681, 0x3c7fd4a4d56a4db3, 0x1a5c464906c5976d] }});
0x4bc3a01e333751d2,
0xae65396c6b34b81a,
0x3c7fd4a4d56a4db3,
0x1a5c464906c5976d]
}});
let verify_hash256 IN_len = let verify_hash256 IN_len =
llvm_verify llvm_verify
@@ -37,9 +40,9 @@ let verify_hash256 IN_len =
// What4 will have completely evaluated the term from symbolic evaluation // What4 will have completely evaluated the term from symbolic evaluation
// so don't try to keep Ascon_p uninterpreted at all. // so don't try to keep Ascon_p uninterpreted at all.
verify_hash256 0 rme; // verify_hash256 0 rme;
for [ 1, 2, 3, 4, 5, 6, 7, for [ 0, 1, 2, 3, 4, 5, 6, 7,
8, 9, 10, 11, 12, 13, 14, 15, 8, 9, 10, 11, 12, 13, 14, 15,
16, 17, 18, 19, 20, 21, 22, 23, 16, 17, 18, 19, 20, 21, 22, 23,
24, 25, 26, 27, 28, 29, 30, 31, 24, 25, 26, 27, 28, 29, 30, 31,
@@ -48,12 +51,15 @@ for [ 1, 2, 3, 4, 5, 6, 7,
print ("Verifying for size", IN_len); print ("Verifying for size", IN_len);
verify_hash256 IN_len verify_hash256 IN_len
do { do {
// What4 will have simplified away the application of // Handle zero case that completely evaluated away
// Ascon_p to the IV, so simplify that away before simplify (addsimp thm_null_input ss0);
// holding all other Ascon_p occurences uninterpreted.
// Expose (Ascon_p [IV,0,0,0,0])
unfolding ["Hash256_bytes", "Hash256", "hashBlocks"]; unfolding ["Hash256_bytes", "Hash256", "hashBlocks"];
// Handle non-zero case where W4 simplified the IV permutation
simplify (addsimp thm_unfold_iv ss0); simplify (addsimp thm_unfold_iv ss0);
w4_unint_rme ["Ascon_p"]; w4_unint_rme ["Ascon_p"];
}; };
}); });