~/bend-docscommunity

proofs/crypto/secp256k1/bounds.bend source

proofs/crypto/secp256k1/bounds.bend on the hub · documented module

# GENERATED by tools/generators/rw.py from ../../../tools/generators/secp256k1_hand/bounds.src; edit the .srcimport Baseimport ../../../spec/lib/common.bend as Cimport ../../../spec/crypto/secp256k1/field.bend as FSimport ../../../src/crypto/secp256k1/limbs.bend as Limport ../../lib/logic.bend as Lgimport ../../math/natural/arith.bend as NRimport ../../math/typed/width.bend as WWimport ./semiring.bend as SRimport ./limbs.bend as LVimport ./ineq.bend as I# Limb bounds: a carry pass leaves limbs below 2^16 = C.shift(16n, one);# n such limbs have a value below 2^(16 n) = LV.pos(n, one).def lt_one(+one: Nat, +h1: {one == 1n : Nat}) -> {Nat.is_lt(0n, one) == True{} : Bool}:  %Equal.sym(Nat, one, 1n, h1) : {Nat.is_lt(0n, _) == True{} : Bool}  {==}def pos_pos(+one: Nat, +h1: {one == 1n : Nat}, k: Nat) -> {Nat.is_lt(0n, LV.pos(k, one)) == True{} : Bool}:  match k:    case 0n:      lt_one(one, h1)    case 1n+ +j:      %Equal.sym(Nat, 0n, C.shift(16n, 0n), Equal.sym(Nat, C.shift(16n, 0n), 0n, WW.shift_zero(16n))) : {Nat.is_lt(_, C.shift(16n, LV.pos(j, one))) == True{} : Bool}      I.shift_lt(16n, 0n, LV.pos(j, one), pos_pos(one, h1, j))# 2^(16 n) ydef pos_shift(n: Nat, +y: Nat) -> {LV.pos(n, y) == C.shift(Nat.mul(n, 16n), y) : Nat}:  match n:    case 0n:      {==}    case 1n+ +k:      %Equal.sym(Nat, LV.pos(k, y), C.shift(Nat.mul(k, 16n), y), pos_shift(k, y)) : {C.shift(16n, _) == C.shift(Nat.add(16n, Nat.mul(k, 16n)), y) : Nat}      %Equal.sym(Nat, C.shift(Nat.add(16n, Nat.mul(k, 16n)), y), C.shift(16n, C.shift(Nat.mul(k, 16n), y)), Equal.sym(Nat, C.shift(16n, C.shift(Nat.mul(k, 16n), y)), C.shift(Nat.add(16n, Nat.mul(k, 16n)), y), SR.shift_shift(16n, Nat.mul(k, 16n), y))) : {C.shift(16n, C.shift(Nat.mul(k, 16n), y)) == _ : Nat}      {==}# 2^256 ydef pos16(+y: Nat) -> {LV.pos(16n, y) == C.shift(256n, y) : Nat}:  pos_shift(16n, y)# s mod 256 < 2^8, and the low 16 bits of s below 2^16def mod256_lt(+one: Nat, +h1: {one == 1n : Nat}, +s: Nat) -> {Nat.is_lt(Nat.mod(s, 256n), C.shift(8n, one)) == True{} : Bool}:  %Equal.sym(Nat, C.shift(8n, one), 256n, LV.b8(one, h1)) : {Nat.is_lt(Nat.mod(s, 256n), _) == True{} : Bool}  NR.dm_lt(255n, s)def lo16_lt(+one: Nat, +h1: {one == 1n : Nat}, +s: Nat) -> {Nat.is_lt(L.lo16(s), C.shift(16n, one)) == True{} : Bool}:  %Equal.sym(Nat, Nat.mul(Nat.mod(Nat.div(s, 256n), 256n), 256n), C.shift(8n, Nat.mod(Nat.div(s, 256n), 256n)), LV.m256(Nat.mod(Nat.div(s, 256n), 256n))) : {Nat.is_lt(Nat.add(Nat.mod(s, 256n), _), C.shift(16n, one)) == True{} : Bool}  %Equal.sym(Nat, C.shift(16n, one), C.shift(8n, C.shift(8n, one)), Equal.sym(Nat, C.shift(8n, C.shift(8n, one)), C.shift(16n, one), SR.shift_shift(8n, 8n, one))) : {Nat.is_lt(Nat.add(Nat.mod(s, 256n), C.shift(8n, Nat.mod(Nat.div(s, 256n), 256n))), _) == True{} : Bool}  I.digit_lt(8n, one, h1, Nat.mod(s, 256n), Nat.mod(Nat.div(s, 256n), 256n), C.shift(8n, one), mod256_lt(one, h1, s), mod256_lt(one, h1, Nat.div(s, 256n)))# the first j <= n limbs of a carry pass: exactly j limbs below 2^16def carry_limbs(+one: Nat, +h1: {one == 1n : Nat}, n: Nat, j: Nat, xs: List<&2, Nat>, +u: Nat, +hj: {Nat.is_le(j, n) == True{} : Bool}) -> {FS.limbs16(one, j, L.take(j, L.carry(n, xs, u))) == True{} : Bool}:  match n j xs:    case 0n 0n Nil{}:      {==}    case 0n 0n x <> t:      {==}    case 0n 1n+i _:      Empty.absurd({FS.limbs16(one, 1n+i, L.take(1n+i, L.carry(0n, xs, u))) == True{} : Bool}, Lg.false_true(hj))    case 1n+k 0n Nil{}:      {==}    case 1n+k 0n x <> t:      {==}    case 1n+ +k 1n+ +i Nil{}:      +s = Nat.add(u, 0n)      Lg.and_intro(Nat.is_lt(L.lo16(s), C.shift(16n, one)), FS.limbs16(one, i, L.take(i, L.carry(k, [], L.hi16(s)))), lo16_lt(one, h1, s), carry_limbs(one, h1, k, i, [], L.hi16(s), hj))    case 1n+ +k 1n+ +i +x <> +t:      +s = Nat.add(u, x)      Lg.and_intro(Nat.is_lt(L.lo16(s), C.shift(16n, one)), FS.limbs16(one, i, L.take(i, L.carry(k, t, L.hi16(s)))), lo16_lt(one, h1, s), carry_limbs(one, h1, k, i, t, L.hi16(s), hj))# k limbs below 2^16 have a value below 2^(16 k)def limbs_lt(+one: Nat, +h1: {one == 1n : Nat}, k: Nat, ys: List<&2, Nat>, +h: {FS.limbs16(one, k, ys) == True{} : Bool}) -> {Nat.is_lt(LV.ev(ys), LV.pos(k, one)) == True{} : Bool}:  match k ys:    case 0n Nil{}:      lt_one(one, h1)    case 0n y <> t:      Empty.absurd({Nat.is_lt(LV.ev(y <> t), LV.pos(0n, one)) == True{} : Bool}, Lg.false_true(h))    case 1n+i Nil{}:      Empty.absurd({Nat.is_lt(LV.ev([]), LV.pos(1n+i, one)) == True{} : Bool}, Lg.false_true(h))    case 1n+ +i +y <> +t:      +hy = Lg.and_left(Nat.is_lt(y, C.shift(16n, one)), FS.limbs16(one, i, t), h)      +ht = Lg.and_right(Nat.is_lt(y, C.shift(16n, one)), FS.limbs16(one, i, t), h)      I.digit_lt(16n, one, h1, y, LV.ev(t), LV.pos(i, one), hy, limbs_lt(one, h1, i, t, ht))# the first j limbs of a list whose first n >= j limbs are finedef limbs_take(+one: Nat, n: Nat, j: Nat, +xs: List<&2, Nat>, +hj: {Nat.is_le(j, n) == True{} : Bool}, +h: {FS.limbs16(one, n, L.take(n, xs)) == True{} : Bool}) -> {FS.limbs16(one, j, L.take(j, xs)) == True{} : Bool}:  match n j xs:    case 0n 0n _:      {==}    case 0n 1n+i _:      Empty.absurd({FS.limbs16(one, 1n+i, L.take(1n+i, xs)) == True{} : Bool}, Lg.false_true(hj))    case 1n+k 0n _:      {==}    case 1n+k 1n+i Nil{}:      Empty.absurd({FS.limbs16(one, 1n+i, L.take(1n+i, [])) == True{} : Bool}, Lg.false_true(h))    case 1n+ +k 1n+ +i +x <> +t:      +hx = Lg.and_left(Nat.is_lt(x, C.shift(16n, one)), FS.limbs16(one, k, L.take(k, t)), h)      +ht = Lg.and_right(Nat.is_lt(x, C.shift(16n, one)), FS.limbs16(one, k, L.take(k, t)), h)      Lg.and_intro(Nat.is_lt(x, C.shift(16n, one)), FS.limbs16(one, i, L.take(i, t)), hx, limbs_take(one, k, i, t, hj, ht))