we defined a Coq definition \coqe{Crypto_Scalarmult} mimicking the exact behavior of X25519 in TweetNaCl.
By proving that each functions \coqe{Low.M}; \coqe{Low.A}; \coqe{Low.Sq}; \coqe{Low.Zub};
\coqe{Unpack25519}; \coqe{clamp}; \coqe{Pack25519}; \coqe{car25519} are behaving over \coqe{list Z}
as their equivalent over \coqe{Z} in \coqe{:GF} (in \Zfield), we prove the
correctness of
% \begin{theorem}
% \label{thm:crypto-rfc}
% \coqe{Crypto_Scalarmult} matches the specification of RFC~7748.
% \end{theorem}
\coqe{Unpack25519}; \coqe{clamp}; \coqe{Pack25519}; \coqe{Inv25519}; \coqe{car25519} are behaving over \coqe{list Z}
as their equivalent over \coqe{Z} in \coqe{:GF} (in \Zfield), we prove that given the same inputs \coqe{Crypto_Scalarmult} applies the same computation as \coqe{RFC}.
% This is formalized as follows in Coq:
% \begin{lstlisting}[language=Coq]
% Theorem Crypto_Scalarmult_Eq :
% forall (n p:list Z),
% Zlength n = 32 ->
% Zlength p = 32 ->
% Forall (fun x : Z, 0 <= x /\ x < 2 ^ 8) n ->
% Forall (fun x : Z, 0 <= x /\ x < 2 ^ 8) p ->
% ZofList 8 (Crypto_Scalarmult n p) =
% ZCrypto_Scalarmult (ZofList 8 n) (ZofList 8 p).
% \end{lstlisting}
We prove that \coqe{Crypto_Scalarmult} matches the specification of RFC~7748 (\tref{thm:crypto-rfc}).
With the VST we also prove that \coqe{Crypto_Scalarmult} matches the Clight translation of Tweetnacl (\tref{thm:crypto-vst}).
We infer that the implementation of X25519 in TweetNaCl (\TNaCle{crypto_scalarmult}) matches
the specifications of RFC~7748 (\tref{thm:VST-RFC}).
\begin{lstlisting}[language=Coq]
Lemma Crypto_Scalarmult_RFC_eq :
forall (n: list Z) (p: list Z),
Zlength n = 32 ->
Zlength p = 32 ->
Forall (fun x => 0 <= x /\ x < 2 ^ 8) n ->
Forall (fun x => 0 <= x /\ x < 2 ^ 8) p ->
Crypto_Scalarmult n p = RFC n p.
\end{lstlisting}
This proves that TweetNaCl's X25519 implementation respect RFC~7748.
