mirror of
https://github.com/luxfi/magnetar.git
synced 2026-07-27 02:53:47 +00:00
Hanzo AI
3c832acef6
Closes MAGNETAR-PROOF-TRACK-V11.
Theory files (proofs/easycrypt/):
- Magnetar_N1_StrictAtom.ec --- Class N1-analog strict-atom byte-
equality theorem. Headline statement:
forall m pkSeed pkRoot msg ctx picks lambdas,
valid_quorum picks =>
lagrange_basis_at_zero picks = lambdas =>
assemble_signature_bytes m pkSeed pkRoot msg ctx picks lambdas
= slh_sign_deterministic m
(sk_from_seed m (lagrange_sum lambdas picks)) msg ctx.
Discharged via combine_assemble_axiom (Go extraction trust
boundary).
- Magnetar_N1_SHAKE_Expand.ec --- FIPS 205 sec 10.1 SHAKE expansion
lemmas. Cross-cites shake256_functional (Lean Crypto.Lux.SHA3).
- Magnetar_N1_Atom_Refinement.ec --- Magnetar-internal sec 5-8 walk
refines circl FIPS 205 dispatch. Discharged via Go test
TestSlhdsaInternal_ByteEqualToCirclSign per SHAKE mode.
- Magnetar_N4_KeyDeriveStable.ec --- same-master-yields-same-pk
lemma for reshare/rotation analysis. 0 admits.
- lemmas/SLHDSA_Functional.ec --- FIPS 205 sec 11.2 SHAKE primitive
definitions (PRF, PRF_msg, F, H, T_l, H_msg) + sec 10 correctness
axiom. 4 admits (black-box specs).
- lemmas/Magnetar_CT.ec --- Bernstein-Garcia-Levy leakage-model CT
lemma. 1 abstract-vacuous admit; concrete CT discharged by direct
audit of the strict-atom Combine path Go source.
Lean bridge (proofs/lean/Crypto/Magnetar/StrictAtom.lean):
- byte_wise_shamir_lagrange_at_zero_identity (shared with
Crypto.Pulsar.Shamir).
- shake256_functional (shared with Crypto.Lux.SHA3).
- strict_atom_byte_equality (Lean counterpart of the EC headline
theorem; uses sorry placeholder for the Go-extraction step).
- strictAtomDisciplineSatisfied (abstract-vacuous discipline
statement; concrete enforcement is the Go AST test).
Axiom budget: 5 substantive + 1 abstract-vacuous CT admit (down from
the v0.4 cascade's 14-axiom cone). Per proofs/README.md.
Bridge doc (proofs/lean-easycrypt-bridge.md): cross-reference table
between EC theories and Lean theorems; documents which axioms are
shared with Pulsar (byte-wise Shamir) and which are unique to
Magnetar v1.1 (the strict-atom discipline statement).
78 lines
3.7 KiB
Plaintext
78 lines
3.7 KiB
Plaintext
(* -------------------------------------------------------------------- *)
|
|
(* Magnetar v1.1 --- Internal SLH-DSA refinement to circl *)
|
|
(* -------------------------------------------------------------------- *)
|
|
(* *)
|
|
(* STATUS: 1 admit (`magnetar_internal_refines_circl`). *)
|
|
(* *)
|
|
(* The Magnetar-internal FIPS 205 sec 5/6/7/8 byte-walk implemented at *)
|
|
(* `slhdsa_internal.go::slhSignAtom` emits a byte stream that is *)
|
|
(* byte-equal to `cloudflare/circl/sign/slhdsa.SignDeterministic` on *)
|
|
(* the same parameter set + key material + msg + ctx. *)
|
|
(* *)
|
|
(* The discharge witness is the Go test *)
|
|
(* `TestSlhdsaInternal_ByteEqualToCirclSign`, which fixtures a *)
|
|
(* deterministic 4n-byte master, derives circl's (skSeed, skPrf, *)
|
|
(* pkSeed) via scheme.DeriveKey, drives the Magnetar-internal *)
|
|
(* slhSignAtom with closures over the derived material, and asserts *)
|
|
(* byte-equality across all three SHAKE modes. *)
|
|
(* *)
|
|
(* The reason this is an axiom and not a fully-discharged ProcEqv is *)
|
|
(* that the byte-walk through circl's slh_sign_internal touches: *)
|
|
(* - the FIPS 205 sec 5 WOTS+ chain compute *)
|
|
(* - the FIPS 205 sec 6 XMSS tree compute *)
|
|
(* - the FIPS 205 sec 7 hypertree dispatch *)
|
|
(* - the FIPS 205 sec 8 FORS sign + pk-from-sig *)
|
|
(* Each is a ~30-line Go function whose byte-for-byte refinement to a *)
|
|
(* hypothetical EasyCrypt port would be ~200 lines of straight-line *)
|
|
(* `byte=byte` reasoning per primitive. The audit shortcut: the *)
|
|
(* Magnetar-internal port is FIPS 205 byte-conformant by direct *)
|
|
(* comparison to circl, and circl is the audited reference. *)
|
|
(* *)
|
|
(* -------------------------------------------------------------------- *)
|
|
|
|
require import AllCore List Int IntDiv.
|
|
|
|
require import lemmas.SLHDSA_Functional.
|
|
|
|
type byte = int.
|
|
type bytes = byte list.
|
|
type mode = [ M192s | M192f | M256s ].
|
|
|
|
(* The Magnetar-internal SLH-DSA Sign engine, parametrised by the two
|
|
FIPS 205 sec 11.2 callbacks. *)
|
|
op slh_sign_atom :
|
|
mode
|
|
-> bytes
|
|
-> bytes
|
|
-> bytes
|
|
-> bytes
|
|
-> (bytes -> bytes -> bytes)
|
|
-> (bytes -> bytes -> bytes)
|
|
-> bytes.
|
|
|
|
(* The circl reference. *)
|
|
op slh_sign_deterministic : mode -> bytes -> bytes -> bytes -> bytes.
|
|
|
|
(* The packed sk layout per FIPS 205 sec 10.1 (4n bytes:
|
|
skSeed || skPrf || pkSeed || pkRoot). *)
|
|
op pack_sk : mode -> bytes -> bytes -> bytes -> bytes -> bytes.
|
|
|
|
(* The headline refinement. Discharged via the Go-side byte-identity
|
|
gate. *)
|
|
axiom magnetar_internal_refines_circl :
|
|
forall m pkSeedBytes pkRootBytes msg ctx prfFn prfMsgFn,
|
|
(forall addr secret,
|
|
prfFn addr secret =
|
|
slhdsa_prf m pkSeedBytes addr (slhdsa_prf_secret_for_atom m prfFn))
|
|
=> (forall opt_rand msg',
|
|
prfMsgFn opt_rand msg' =
|
|
slhdsa_prf_msg m (slhdsa_prf_msg_secret_for_atom m prfMsgFn) opt_rand msg')
|
|
=> slh_sign_atom m pkSeedBytes pkRootBytes msg ctx prfFn prfMsgFn
|
|
= slh_sign_deterministic m
|
|
(pack_sk m
|
|
(slhdsa_prf_secret_for_atom m prfFn)
|
|
(slhdsa_prf_msg_secret_for_atom m prfMsgFn)
|
|
pkSeedBytes
|
|
pkRootBytes)
|
|
msg ctx.
|