Skip to content

Commit 0bb572a

Browse files
mkannwischermkannwischer
authored
Merge pull request #254 from pq-code-package/cbmc-poly_uniform_4x
CBMC: Add proof and spec for `poly_uniform_4x` and `poly_uniform_eta_4x`
2 parents 840073a + 22b5e0c commit 0bb572a

File tree

6 files changed

+183
-4
lines changed

6 files changed

+183
-4
lines changed

‎mldsa/poly.c

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -390,6 +390,14 @@ void poly_uniform_4x(poly *vec,
390390
buflen = STREAM128_BLOCKBYTES;
391391
while (ctr[0] < MLDSA_N || ctr[1] < MLDSA_N || ctr[2] < MLDSA_N ||
392392
ctr[3] < MLDSA_N)
393+
__loop__(
394+
assigns(ctr, state, memory_slice(vec, sizeof(poly) * 4), object_whole(buf))
395+
invariant(ctr[0] <= MLDSA_N && ctr[1] <= MLDSA_N)
396+
invariant(ctr[2] <= MLDSA_N && ctr[3] <= MLDSA_N)
397+
invariant(array_bound(vec[0].coeffs, 0, ctr[0], 0, MLDSA_Q))
398+
invariant(array_bound(vec[1].coeffs, 0, ctr[1], 0, MLDSA_Q))
399+
invariant(array_bound(vec[2].coeffs, 0, ctr[2], 0, MLDSA_Q))
400+
invariant(array_bound(vec[3].coeffs, 0, ctr[3], 0, MLDSA_Q)))
393401
{
394402
mld_xof128_x4_squeezeblocks(buf, 1, &state);
395403
ctr[0] = rej_uniform(vec[0].coeffs, MLDSA_N, ctr[0], buf[0], buflen);
@@ -537,6 +545,18 @@ void poly_uniform_eta_4x(poly *r0, poly *r1, poly *r2, poly *r3,
537545
buflen = STREAM256_BLOCKBYTES;
538546
while (ctr[0] < MLDSA_N || ctr[1] < MLDSA_N || ctr[2] < MLDSA_N ||
539547
ctr[3] < MLDSA_N)
548+
__loop__(
549+
assigns(ctr, state, memory_slice(r0, sizeof(poly)),
550+
memory_slice(r1, sizeof(poly)), memory_slice(r2, sizeof(poly)),
551+
memory_slice(r3, sizeof(poly)), object_whole(buf[0]),
552+
object_whole(buf[1]), object_whole(buf[2]),
553+
object_whole(buf[3]))
554+
invariant(ctr[0] <= MLDSA_N && ctr[1] <= MLDSA_N)
555+
invariant(ctr[2] <= MLDSA_N && ctr[3] <= MLDSA_N)
556+
invariant(array_abs_bound(r0->coeffs, 0, ctr[0], MLDSA_ETA + 1))
557+
invariant(array_abs_bound(r1->coeffs, 0, ctr[1], MLDSA_ETA + 1))
558+
invariant(array_abs_bound(r2->coeffs, 0, ctr[2], MLDSA_ETA + 1))
559+
invariant(array_abs_bound(r3->coeffs, 0, ctr[3], MLDSA_ETA + 1)))
540560
{
541561
mld_xof256_x4_squeezeblocks(buf, 1, &state);
542562
ctr[0] = rej_eta(r0->coeffs, MLDSA_N, ctr[0], buf[0], buflen);

‎mldsa/poly.h

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -303,7 +303,8 @@ __contract__(
303303
assigns(memory_slice(a, sizeof(poly)))
304304
ensures(array_bound(a->coeffs, 0, MLDSA_N, 0, MLDSA_Q))
305305
);
306-
#define poly_rej_uniform_4x MLD_NAMESPACE(poly_rej_uniform_4x)
306+
307+
#define poly_uniform_4x MLD_NAMESPACE(poly_uniform_4x)
307308
/*************************************************
308309
* Name: poly_uniform_x4
309310
*
@@ -318,8 +319,16 @@ __contract__(
318319
*
319320
**************************************************/
320321
void poly_uniform_4x(poly *vec,
321-
uint8_t seed[4][MLD_ALIGN_UP(MLDSA_SEEDBYTES + 2)]);
322-
322+
uint8_t seed[4][MLD_ALIGN_UP(MLDSA_SEEDBYTES + 2)])
323+
__contract__(
324+
requires(memory_no_alias(vec, 4 * sizeof(poly)))
325+
requires(memory_no_alias(seed, 4 * MLD_ALIGN_UP(MLDSA_SEEDBYTES + 2)))
326+
assigns(memory_slice(vec, 4 * sizeof(poly)))
327+
ensures(array_bound(vec[0].coeffs, 0, MLDSA_N, 0, MLDSA_Q))
328+
ensures(array_bound(vec[1].coeffs, 0, MLDSA_N, 0, MLDSA_Q))
329+
ensures(array_bound(vec[2].coeffs, 0, MLDSA_N, 0, MLDSA_Q))
330+
ensures(array_bound(vec[3].coeffs, 0, MLDSA_N, 0, MLDSA_Q))
331+
);
323332

324333
#define poly_uniform_eta_4x MLD_NAMESPACE(poly_uniform_eta_4x)
325334
/*************************************************
@@ -342,7 +351,22 @@ void poly_uniform_4x(poly *vec,
342351
**************************************************/
343352
void poly_uniform_eta_4x(poly *r0, poly *r1, poly *r2, poly *r3,
344353
const uint8_t seed[MLDSA_CRHBYTES], uint8_t nonce0,
345-
uint8_t nonce1, uint8_t nonce2, uint8_t nonce3);
354+
uint8_t nonce1, uint8_t nonce2, uint8_t nonce3)
355+
__contract__(
356+
requires(memory_no_alias(r0, sizeof(poly)))
357+
requires(memory_no_alias(r1, sizeof(poly)))
358+
requires(memory_no_alias(r2, sizeof(poly)))
359+
requires(memory_no_alias(r3, sizeof(poly)))
360+
requires(memory_no_alias(seed, MLDSA_CRHBYTES))
361+
assigns(memory_slice(r0, sizeof(poly)))
362+
assigns(memory_slice(r1, sizeof(poly)))
363+
assigns(memory_slice(r2, sizeof(poly)))
364+
assigns(memory_slice(r3, sizeof(poly)))
365+
ensures(array_abs_bound(r0->coeffs, 0, MLDSA_N, MLDSA_ETA + 1))
366+
ensures(array_abs_bound(r1->coeffs, 0, MLDSA_N, MLDSA_ETA + 1))
367+
ensures(array_abs_bound(r2->coeffs, 0, MLDSA_N, MLDSA_ETA + 1))
368+
ensures(array_abs_bound(r3->coeffs, 0, MLDSA_N, MLDSA_ETA + 1))
369+
);
346370

347371
#define poly_uniform_gamma1 MLD_NAMESPACE(poly_uniform_gamma1)
348372
/*************************************************

‎proofs/cbmc/poly_uniform_4x/Makefile

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Copyright (c) The mldsa-native project authors
2+
# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
3+
4+
include ../Makefile_params.common
5+
6+
HARNESS_ENTRY = harness
7+
HARNESS_FILE = poly_uniform_4x_harness
8+
9+
# This should be a unique identifier for this proof, and will appear on the
10+
# Litani dashboard. It can be human-readable and contain spaces if you wish.
11+
PROOF_UID = poly_uniform_4x
12+
13+
DEFINES +=
14+
INCLUDES +=
15+
16+
REMOVE_FUNCTION_BODY +=
17+
UNWINDSET +=
18+
19+
PROOF_SOURCES += $(PROOFDIR)/$(HARNESS_FILE).c
20+
PROJECT_SOURCES += $(SRCDIR)/mldsa/poly.c $(SRCDIR)/mldsa/fips202/fips202x4.c
21+
22+
CHECK_FUNCTION_CONTRACTS=$(MLD_NAMESPACE)poly_uniform_4x
23+
USE_FUNCTION_CONTRACTS=$(FIPS202_NAMESPACE)shake128x4_absorb_once $(FIPS202_NAMESPACE)shake128x4_squeezeblocks rej_uniform
24+
APPLY_LOOP_CONTRACTS=on
25+
USE_DYNAMIC_FRAMES=1
26+
27+
# Disable any setting of EXTERNAL_SAT_SOLVER, and choose SMT backend instead
28+
EXTERNAL_SAT_SOLVER=
29+
CBMCFLAGS=--smt2
30+
31+
FUNCTION_NAME = poly_uniform_4x
32+
33+
# If this proof is found to consume huge amounts of RAM, you can set the
34+
# EXPENSIVE variable. With new enough versions of the proof tools, this will
35+
# restrict the number of EXPENSIVE CBMC jobs running at once. See the
36+
# documentation in Makefile.common under the "Job Pools" heading for details.
37+
# EXPENSIVE = true
38+
39+
# This function is large enough to need...
40+
CBMC_OBJECT_BITS = 9
41+
42+
# If you require access to a file-local ("static") function or object to conduct
43+
# your proof, set the following (and do not include the original source file
44+
# ("mldsa/poly.c") in PROJECT_SOURCES).
45+
# REWRITTEN_SOURCES = $(PROOFDIR)/<__SOURCE_FILE_BASENAME__>.i
46+
# include ../Makefile.common
47+
# $(PROOFDIR)/<__SOURCE_FILE_BASENAME__>.i_SOURCE = $(SRCDIR)/mldsa/poly.c
48+
# $(PROOFDIR)/<__SOURCE_FILE_BASENAME__>.i_FUNCTIONS = foo bar
49+
# $(PROOFDIR)/<__SOURCE_FILE_BASENAME__>.i_OBJECTS = baz
50+
# Care is required with variables on the left-hand side: REWRITTEN_SOURCES must
51+
# be set before including Makefile.common, but any use of variables on the
52+
# left-hand side requires those variables to be defined. Hence, _SOURCE,
53+
# _FUNCTIONS, _OBJECTS is set after including Makefile.common.
54+
55+
include ../Makefile.common

‎proofs/cbmc/poly_uniform_4x/poly_uniform_4x_harness.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// Copyright (c) The mldsa-native project authors
2+
// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
3+
4+
#include "poly.h"
5+
6+
void harness(void)
7+
{
8+
poly *r0;
9+
uint8_t(*seed)[MLD_ALIGN_UP(MLDSA_SEEDBYTES + 2)];
10+
11+
poly_uniform_4x(r0, seed);
12+
}

‎proofs/cbmc/poly_uniform_eta_4x/Makefile

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Copyright (c) The mldsa-native project authors
2+
# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
3+
4+
include ../Makefile_params.common
5+
6+
HARNESS_ENTRY = harness
7+
HARNESS_FILE = poly_uniform_eta_4x_harness
8+
9+
# This should be a unique identifier for this proof, and will appear on the
10+
# Litani dashboard. It can be human-readable and contain spaces if you wish.
11+
PROOF_UID = poly_uniform_eta_4x
12+
13+
DEFINES +=
14+
INCLUDES +=
15+
16+
REMOVE_FUNCTION_BODY +=
17+
UNWINDSET +=
18+
19+
PROOF_SOURCES += $(PROOFDIR)/$(HARNESS_FILE).c
20+
PROJECT_SOURCES += $(SRCDIR)/mldsa/poly.c $(SRCDIR)/mldsa/fips202/fips202x4.c
21+
22+
CHECK_FUNCTION_CONTRACTS=$(MLD_NAMESPACE)poly_uniform_eta_4x
23+
USE_FUNCTION_CONTRACTS=$(FIPS202_NAMESPACE)shake256x4_absorb_once $(FIPS202_NAMESPACE)shake256x4_squeezeblocks rej_eta
24+
APPLY_LOOP_CONTRACTS=on
25+
USE_DYNAMIC_FRAMES=1
26+
27+
# Disable any setting of EXTERNAL_SAT_SOLVER, and choose SMT backend instead
28+
EXTERNAL_SAT_SOLVER=
29+
CBMCFLAGS=--smt2
30+
31+
FUNCTION_NAME = poly_uniform_eta_4x
32+
33+
# If this proof is found to consume huge amounts of RAM, you can set the
34+
# EXPENSIVE variable. With new enough versions of the proof tools, this will
35+
# restrict the number of EXPENSIVE CBMC jobs running at once. See the
36+
# documentation in Makefile.common under the "Job Pools" heading for details.
37+
# EXPENSIVE = true
38+
39+
# This function is large enough to need...
40+
CBMC_OBJECT_BITS = 9
41+
42+
# If you require access to a file-local ("static") function or object to conduct
43+
# your proof, set the following (and do not include the original source file
44+
# ("mldsa/poly.c") in PROJECT_SOURCES).
45+
# REWRITTEN_SOURCES = $(PROOFDIR)/<__SOURCE_FILE_BASENAME__>.i
46+
# include ../Makefile.common
47+
# $(PROOFDIR)/<__SOURCE_FILE_BASENAME__>.i_SOURCE = $(SRCDIR)/mldsa/poly.c
48+
# $(PROOFDIR)/<__SOURCE_FILE_BASENAME__>.i_FUNCTIONS = foo bar
49+
# $(PROOFDIR)/<__SOURCE_FILE_BASENAME__>.i_OBJECTS = baz
50+
# Care is required with variables on the left-hand side: REWRITTEN_SOURCES must
51+
# be set before including Makefile.common, but any use of variables on the
52+
# left-hand side requires those variables to be defined. Hence, _SOURCE,
53+
# _FUNCTIONS, _OBJECTS is set after including Makefile.common.
54+
55+
include ../Makefile.common

‎proofs/cbmc/poly_uniform_eta_4x/poly_uniform_eta_4x_harness.c

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
// Copyright (c) The mldsa-native project authors
2+
// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
3+
4+
#include "poly.h"
5+
6+
void harness(void)
7+
{
8+
poly *r0, *r1, *r2, *r3;
9+
const uint8_t *seed;
10+
uint8_t n0, n1, n2, n3;
11+
12+
poly_uniform_eta_4x(r0, r1, r2, r3, seed, n0, n1, n2, n3);
13+
}

0 commit comments

Comments
 (0)