Skip to content
GitLab
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
Benoit Viguier
coq-verif-tweetnacl
Commits
d6da5176
Commit
d6da5176
authored
Oct 03, 2020
by
Peter Schwabe
Browse files
Removed negative \vspace everywhere
parent
96822330
Changes
3
Hide whitespace changes
Inline
Side-by-side
paper/abstract.tex
0 → 100644
View file @
d6da5176
% \subsection*{Abstract}
\begin{abstract}
We formally prove that the C implementation of
the X25519 key-exchange protocol
in the TweetNaCl library is correct.
We prove both that it correctly implements the protocol from
Bernstein's 2006 paper, as standardized in RFC~7748,
as well as the absence of undefined behavior
like arithmetic overflows
and array out of bounds errors.
We also formally prove, based on the work of Bartzia and Strub,
that X25519 is mathematically correct, i.e.,
that it correctly computes scalar multiplication on
the elliptic curve Curve25519.
The proofs are all computer-verified using the Coq theorem prover.
To establish the link between C and Coq we use the
Verified Software Toolchain (VST).
\end{abstract}
paper/highlevel.tex
View file @
d6da5176
...
...
@@ -193,11 +193,11 @@ After having verified the group properties, it follows that the bijection is a g
\begin{lemma}
\label
{
lemma:bij-ecc
}
Let
$
M
_{
a,b
}$
be a Montgomery curve, define
\vspace
{
-0.3em
}
%
\vspace{-0.3em}
$$
a'
=
\frac
{
3
-
a
^
2
}{
3
b
^
2
}
\text
{
\ \ \ \
and
\ \ \ \
}
b'
=
\frac
{
2
a
^
3
-
9
a
}{
27
b
^
3
}
.
$$
then
$
E
_{
a',b'
}$
is a Weierstra
{
\ss
}
curve, and the mapping
$
\varphi
: M
_{
a,b
}
\mapsto
E
_{
a',b'
}$
defined as:
\vspace
{
-0.5em
}
%
\vspace{-0.5em}
\begin{align*}
\varphi
(
\Oinf
_
M)
&
=
\Oinf
_
E
\\
\varphi
( (x , y) )
&
=
\left
(
\frac
{
x
}{
b
}
+
\frac
{
a
}{
3b
}
,
\frac
{
y
}{
b
}
\right
)
...
...
@@ -255,7 +255,7 @@ Hypothesis mcu_no_square :
We define
$
\chi
$
and
$
\chi
_
0
$
to return the
\xcoord
of points on a curve.
\begin{dfn}
Let
$
\chi
: M
_{
a,b
}
(
\K
)
\mapsto
\K
\cup
\{\infty\}
$
and
$
\chi
_
0
: M
_{
a,b
}
(
\K
)
\mapsto
\K
$
such that
\vspace
{
-0.5em
}
%
\vspace{-0.5em}
\begin{align*}
\chi
((x,y))
&
= x,
&
\chi
(
\Oinf
)
&
=
\infty
,
&
&
\text
{
and
}
\\
[-0.5ex]
\chi
_
0((x,y))
&
= x,
&
\chi
_
0(
\Oinf
)
&
= 0.
...
...
@@ -269,7 +269,7 @@ Using projective coordinates we prove the formula for differential addition.% (\
let
$
X
_
1
, Z
_
1
, X
_
2
, Z
_
2
, X
_
4
, Z
_
4
\in
\K
$
, such that
$
(
X
_
1
,Z
_
1
)
\neq
(
0
,
0
)
$
,
$
(
X
_
2
,Z
_
2
)
\neq
(
0
,
0
)
$
,
$
X
_
4
\neq
0
$
and
$
Z
_
4
\neq
0
$
.
Define
\vspace
{
-0.5em
}
%
\vspace{-0.5em}
\begin{align*}
X
_
3
&
= Z
_
4((X
_
1 - Z
_
1)(X
_
2+Z
_
2) + (X
_
1+Z
_
1)(X
_
2-Z
_
2))
^
2
\\
[-0.5ex]
Z
_
3
&
= X
_
4((X
_
1 - Z
_
1)(X
_
2+Z
_
2) - (X
_
1+Z
_
1)(X
_
2-Z
_
2))
^
2
...
...
@@ -558,14 +558,14 @@ We now study the case of the scalar multiplication and show similar proofs.
\label
{
lemma:proj
}
For all
$
n
\in
\N
$
, for all point
$
P
\in\F
{
p
}
\times\F
{
p
}$
on the curve
$
M
_{
486662
,
1
}
(
\F
{
p
}
)
$
(respectively on the quadratic twist
$
M
_{
486662
,
2
}
(
\F
{
p
}
)
$
), we have
\vspace
{
-0.3em
}
%
\vspace{-0.3em}
\begin{align*}
P
&
\in
M
_{
486662,1
}
(
\F
{
p
}
)
&
\implies
\varphi
_
c(n
\cdot
P)
&
= n
\cdot
\varphi
_
c(P),
&
&
\text
{
and
}
\\
P
&
\in
M
_{
486662,2
}
(
\F
{
p
}
)
&
\implies
\varphi
_
t(n
\cdot
P)
&
= n
\cdot
\varphi
_
t(P).
\end{align*}
\end{lemma}
Notice that
\vspace
{
-0.5em
}
%
\vspace{-0.5em}
\begin{align*}
\forall
P
\in
M
_{
486662,1
}
(
\F
{
p
}
),
&
&
\psi
(
\chi
_
0(
\varphi
_
c(P)))
&
=
\chi
_
0(P),
&
&
\text
{
and
}
\\
\forall
P
\in
M
_{
486662,2
}
(
\F
{
p
}
),
&
&
\psi
(
\chi
_
0(
\varphi
_
t(P)))
&
=
\chi
_
0(P).
...
...
paper/tweetverif.tex
View file @
d6da5176
...
...
@@ -46,6 +46,8 @@
\maketitle
\input
{
abstract.tex
}
\input
{
intro.tex
}
\input
{
preliminaries.tex
}
\input
{
rfc.tex
}
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment