mirror of
https://github.com/rosenpass/rosenpass.git
synced 2025-12-05 20:40:02 -08:00
137cd5e85a
The analysis was conducted as joint effort between @koraa and @blipp. Co-authored-by: Benjamin Lipp <blipp@mailbox.org>
48 lines
1.6 KiB
Plaintext
48 lines
1.6 KiB
Plaintext
#pragma once
|
|
#include "prelude/basic.mpv"
|
|
#include "prelude/bits.mpv"
|
|
#include "crypto/key.mpv"
|
|
@module aead
|
|
|
|
// TODO: Technically this models deterministic encryption;
|
|
fun xaead_enc(key, bits, bits) : bits.
|
|
fun xaead_dec(key, bits, bits) : bits
|
|
reduc forall k:key, pt:bits, ad:bits;
|
|
xaead_dec(k, xaead_enc(k, pt, ad), ad) = pt.
|
|
|
|
#if SIMPLE_MODEL
|
|
letfun aead_enc(k:key, pt:bits) = xaead_enc(k, pt, empty).
|
|
letfun aead_dec(k:key, ct:bits) = xaead_dec(k, ct, empty).
|
|
#endif
|
|
|
|
#if FULL_MODEL
|
|
fun xaead_ad(bits) : bits
|
|
reduc forall k:key, pt:bits, ad:bits;
|
|
xaead_ad(xaead_enc(k, pt, ad)) = ad.
|
|
|
|
fun xaead_keyeq(bits, bits) : bool
|
|
reduc forall k:key, pt1:bits, ad1:bits, pt2:bits, ad2:bits;
|
|
xaead_keyeq(xaead_enc(k, pt1, ad1), xaead_enc(k, pt2, ad2)) = true
|
|
otherwise forall k1:key, pt1:bits, ad1:bits, k2:key, pt2:bits, ad2:bits;
|
|
xaead_keyeq(xaead_enc(k1, pt1, ad1), xaead_enc(k2, pt2, ad2)) = false.
|
|
#endif
|
|
|
|
#if FULL_MODEL
|
|
fun aead_enc(key, bits) : bits.
|
|
fun aead_dec(key, bits) : bits
|
|
reduc forall k:key, pt:bits;
|
|
aead_dec(k, aead_enc(k, pt)) = pt.
|
|
|
|
// TODO: Alternative: Model using events (never invoke aead with nonces reused)
|
|
// TODO: Model key commitment (key must be used for one purpose only)
|
|
fun aead_key_reuse(bits, bits) : key
|
|
reduc forall k:key, pt1:bits, pt2:bits;
|
|
aead_key_reuse(aead_enc(k, pt1), aead_enc(k, pt2)) = k.
|
|
|
|
fun aead_keyeq(bits, bits) : bool
|
|
reduc forall k:key, pt1:bits, pt2:bits;
|
|
aead_keyeq(aead_enc(k, pt1), aead_enc(k, pt2)) = true
|
|
otherwise forall k1:key, pt1:bits, k2:key, pt2:bits;
|
|
aead_keyeq(aead_enc(k1, pt1), aead_enc(k2, pt2)) = false.
|
|
#endif
|