val va_wp_Ctr32_ghash_6_prelude
      (alg: algorithm)
      (scratch_b: buffer128)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b: buffer128)
      (ctr_orig: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> unit -> Type0))
    : Type0
let va_wp_Ctr32_ghash_6_prelude (alg:algorithm) (scratch_b:buffer128) (key_words:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (ctr_orig:quad32) (va_s0:va_state) (va_k:(va_state
  -> unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ (sse_enabled /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0)
    (va_get_reg64 rRbp va_s0) scratch_b 8 (va_get_mem_layout va_s0) Secret /\ aes_reqs_offset alg
    key_words round_keys keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0)
    (va_get_mem_layout va_s0) /\ va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 0)) /\ (forall (va_x_mem:vale_heap) (va_x_xmm2:quad32)
    (va_x_xmm4:quad32) (va_x_xmm9:quad32) (va_x_xmm10:quad32) (va_x_xmm11:quad32)
    (va_x_xmm12:quad32) (va_x_xmm13:quad32) (va_x_xmm14:quad32) (va_x_xmm15:quad32)
    (va_x_r11:nat64) (va_x_heap3:vale_heap) (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags
    va_x_efl (va_upd_mem_heaplet 3 va_x_heap3 (va_upd_reg64 rR11 va_x_r11 (va_upd_xmm 15 va_x_xmm15
    (va_upd_xmm 14 va_x_xmm14 (va_upd_xmm 13 va_x_xmm13 (va_upd_xmm 12 va_x_xmm12 (va_upd_xmm 11
    va_x_xmm11 (va_upd_xmm 10 va_x_xmm10 (va_upd_xmm 9 va_x_xmm9 (va_upd_xmm 4 va_x_xmm4
    (va_upd_xmm 2 va_x_xmm2 (va_upd_mem va_x_mem va_s0)))))))))))) in va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 1 /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32
    round_keys 0 /\ va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 0)) (va_get_xmm 15
    va_sM) /\ (let counter = Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_orig `op_Modulus` 256
    in (counter + 6 < 256 ==> va_get_xmm 10 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 1)) /\ (counter + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 2)) /\ (counter + 6 <
    256 ==> va_get_xmm 12 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_orig 3)) /\ (counter + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 4)) /\ (counter + 6 <
    256 ==> va_get_xmm 14 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_orig 5)) /\ Vale.X64.Decls.buffer128_read scratch_b 1 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0 /\ va_get_xmm 4 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0)) ==> va_k va_sM (())))
val va_wp_Ctr32_ghash_6_prelude
      (alg: algorithm)
      (scratch_b: buffer128)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b: buffer128)
      (ctr_orig: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> unit -> Type0))
    : Type0
let va_wp_Ctr32_ghash_6_prelude
      (alg: algorithm)
      (scratch_b: buffer128)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b: buffer128)
      (ctr_orig: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> unit -> Type0))
    : Type0 =
(va_get_ok va_s0 /\
  (sse_enabled /\
    Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0)
      (va_get_reg64 rRbp va_s0)
      scratch_b
      8
      (va_get_mem_layout va_s0)
      Secret /\
    aes_reqs_offset alg
      key_words
      round_keys
      keys_b
      (va_get_reg64 rRcx va_s0)
      (va_get_mem_heaplet 0 va_s0)
      (va_get_mem_layout va_s0) /\
    va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 0)
  ) /\
  (forall (va_x_mem: vale_heap) (va_x_xmm2: quad32) (va_x_xmm4: quad32) (va_x_xmm9: quad32)
      (va_x_xmm10: quad32) (va_x_xmm11: quad32) (va_x_xmm12: quad32) (va_x_xmm13: quad32)
      (va_x_xmm14: quad32) (va_x_xmm15: quad32) (va_x_r11: nat64) (va_x_heap3: vale_heap)
      (va_x_efl: Vale.X64.Flags.t).
      let va_sM =
        va_upd_flags va_x_efl
          (va_upd_mem_heaplet 3
              va_x_heap3
              (va_upd_reg64 rR11
                  va_x_r11
                  (va_upd_xmm 15
                      va_x_xmm15
                      (va_upd_xmm 14
                          va_x_xmm14
                          (va_upd_xmm 13
                              va_x_xmm13
                              (va_upd_xmm 12
                                  va_x_xmm12
                                  (va_upd_xmm 11
                                      va_x_xmm11
                                      (va_upd_xmm 10
                                          va_x_xmm10
                                          (va_upd_xmm 9
                                              va_x_xmm9
                                              (va_upd_xmm 4
                                                  va_x_xmm4
                                                  (va_upd_xmm 2
                                                      va_x_xmm2
                                                      (va_upd_mem va_x_mem va_s0))))))))))))
      in
      va_get_ok va_sM /\
      (Vale.X64.Decls.modifies_buffer_specific128 scratch_b
          (va_get_mem_heaplet 3 va_s0)
          (va_get_mem_heaplet 3 va_sM)
          1
          1 /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
        va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys 0 /\
        va_get_xmm 9 va_sM ==
        Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig
                  0))
          (va_get_xmm 15 va_sM) /\
        (let counter = (Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_orig) `op_Modulus` 256 in
          (counter + 6 < 256 ==>
            va_get_xmm 10 va_sM ==
            Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 1)) /\
          (counter + 6 < 256 ==>
            va_get_xmm 11 va_sM ==
            Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 2)) /\
          (counter + 6 < 256 ==>
            va_get_xmm 12 va_sM ==
            Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 3)) /\
          (counter + 6 < 256 ==>
            va_get_xmm 13 va_sM ==
            Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 4)) /\
          (counter + 6 < 256 ==>
            va_get_xmm 14 va_sM ==
            Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 5)) /\
          Vale.X64.Decls.buffer128_read scratch_b 1 (va_get_mem_heaplet 3 va_sM) ==
          Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0 /\
          va_get_xmm 4 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0)) ==>
      va_k va_sM (())))
Vale.AES.X64.AESGCM.fst.checked
Vale.X64.State.fsti.checked Vale.X64.QuickCodes.fsti.checked Vale.X64.QuickCode.fst.checked Vale.X64.Memory.fsti.checked Vale.X64.Machine_s.fst.checked Vale.X64.InsVector.fsti.checked Vale.X64.InsMem.fsti.checked Vale.X64.InsBasic.fsti.checked Vale.X64.InsAes.fsti.checked Vale.X64.Flags.fsti.checked Vale.X64.Decls.fsti.checked Vale.X64.CPU_Features_s.fst.checked Vale.Math.Poly2_s.fsti.checked Vale.Math.Poly2.Words.fsti.checked Vale.Math.Poly2.Lemmas.fsti.checked Vale.Math.Poly2.Bits_s.fsti.checked Vale.Math.Poly2.Bits.fsti.checked Vale.Math.Poly2.fsti.checked Vale.Def.Words_s.fsti.checked Vale.Def.Types_s.fst.checked Vale.Def.Prop_s.fst.checked Vale.Def.Opaque_s.fsti.checked Vale.Arch.TypesNative.fsti.checked Vale.Arch.Types.fsti.checked Vale.AES.X64.PolyOps.fsti.checked Vale.AES.X64.AESopt2.fsti.checked Vale.AES.X64.AESopt.fsti.checked Vale.AES.GHash.fsti.checked Vale.AES.GF128_s.fsti.checked Vale.AES.GF128.fsti.checked Vale.AES.GCTR_s.fst.checked Vale.AES.GCTR.fsti.checked Vale.AES.GCM_helpers.fsti.checked Vale.AES.AES_s.fst.checked Vale.AES.AES_helpers.fsti.checked Vale.AES.AES_common_s.fst.checked prims.fst.checked FStar.Seq.Base.fsti.checked FStar.Seq.fst.checked FStar.Pervasives.Native.fst.checked FStar.Pervasives.fsti.checked FStar.Mul.fst.checked
Vale.AES.X64.AESGCM.fst
Vale.AES.AES_common_s.algorithm Vale.X64.Memory.buffer128 FStar.Seq.Base.seq Vale.X64.Memory.nat32 Vale.X64.Decls.quad32 Vale.X64.Decls.va_state Prims.unit Prims.l_and Prims.b2t Vale.X64.Decls.va_get_ok Vale.X64.CPU_Features_s.sse_enabled Vale.X64.Decls.validDstAddrs128 Vale.X64.Decls.va_get_mem_heaplet Vale.X64.Decls.va_get_reg64 Vale.X64.Machine_s.rRbp Vale.X64.Decls.va_get_mem_layout Vale.Arch.HeapTypes_s.Secret Vale.AES.X64.AESopt.aes_reqs_offset Vale.X64.Machine_s.rRcx Prims.eq2 Vale.Def.Types_s.quad32 Vale.X64.Decls.va_get_xmm Vale.Def.Types_s.reverse_bytes_quad32 Vale.AES.GCTR.inc32lite Prims.l_Forall Vale.X64.InsBasic.vale_heap Vale.X64.Memory.nat64 Vale.X64.Flags.t Prims.l_imp Vale.X64.Decls.modifies_buffer_specific128 Vale.Def.Words_s.four Vale.Def.Types_s.nat32 Vale.Def.Words_s.Mkfour FStar.Seq.Base.index Vale.Def.Types_s.quad32_xor Prims.op_LessThan Prims.op_Addition Vale.X64.Decls.buffer128_read Prims.int Prims.op_Modulus Vale.Def.Words_s.__proj__Mkfour__item__lo0 Vale.X64.State.vale_state Vale.X64.Decls.va_upd_flags Vale.X64.Decls.va_upd_mem_heaplet Vale.X64.Decls.va_upd_reg64 Vale.X64.Machine_s.rR11 Vale.X64.Decls.va_upd_xmm Vale.X64.Decls.va_upd_mem
module Vale.AES.X64.AESGCM
open FStar.Mul
open Vale.Def.Prop_s
open Vale.Def.Opaque_s
open Vale.Def.Words_s
open Vale.Def.Types_s
open FStar.Seq
open Vale.AES.AES_s
open Vale.X64.Machine_s
open Vale.X64.Memory
open Vale.X64.State
open Vale.X64.Decls
open Vale.X64.InsBasic
open Vale.X64.InsMem
open Vale.X64.InsVector
open Vale.X64.InsAes
open Vale.X64.QuickCode
open Vale.X64.QuickCodes
open Vale.Arch.Types
open Vale.AES.AES_helpers
//open Vale.Poly1305.Math    // For lemma_poly_bits64()
open Vale.AES.GCM_helpers
open Vale.AES.GCTR_s
open Vale.AES.GCTR
open Vale.Arch.TypesNative
open Vale.X64.CPU_Features_s
open Vale.AES.X64.PolyOps
open Vale.Math.Poly2_s
open Vale.Math.Poly2
open Vale.Math.Poly2.Bits_s
open Vale.Math.Poly2.Bits
open Vale.Math.Poly2.Lemmas
open Vale.AES.GF128_s
open Vale.AES.GF128
open Vale.AES.GHash
open Vale.AES.X64.AESopt
open Vale.AES.X64.AESopt2
unfold let lo(x:poly):poly = mask x 64
unfold let hi(x:poly):poly = shift x (-64)

//let scratch_reqs (scratch_b:buffer128) (count:nat) (heap3:vale_heap) (s:seq quad32) (z3:quad32) : prop0 =
//  count * 6 + 6 <= length s /\
//  (let data = slice s (count * 6) (count * 6 + 6) in
//   z3 == reverse_bytes_quad32 (index data 5) /\
//   buffer128_read scratch_b 3 heap3 == reverse_bytes_quad32 (index data 4) /\
//   buffer128_read scratch_b 4 heap3 == reverse_bytes_quad32 (index data 3) /\
//   buffer128_read scratch_b 5 heap3 == reverse_bytes_quad32 (index data 2) /\
//   buffer128_read scratch_b 6 heap3 == reverse_bytes_quad32 (index data 1) /\
//   buffer128_read scratch_b 7 heap3 == reverse_bytes_quad32 (index data 0))


let scratch_reqs_simple (scratch_b:buffer128) (heap3:vale_heap) (data:seq quad32) (z3:quad32) : prop0 =
   length data == 6 /\
   z3 == reverse_bytes_quad32 (index data 5) /\
   buffer128_read scratch_b 3 heap3 == reverse_bytes_quad32 (index data 4) /\
   buffer128_read scratch_b 4 heap3 == reverse_bytes_quad32 (index data 3) /\
   buffer128_read scratch_b 5 heap3 == reverse_bytes_quad32 (index data 2) /\
   buffer128_read scratch_b 6 heap3 == reverse_bytes_quad32 (index data 1) /\
   buffer128_read scratch_b 7 heap3 == reverse_bytes_quad32 (index data 0)
//-- finish_aes_encrypt_le


val finish_aes_encrypt_le : alg:algorithm -> input_LE:quad32 -> key:(seq nat32)
  -> Lemma
  (requires (Vale.AES.AES_s.is_aes_key_LE alg key))
  (ensures (Vale.AES.AES_s.aes_encrypt_LE alg key input_LE == Vale.AES.AES_s.eval_cipher alg
    input_LE (Vale.AES.AES_s.key_to_round_keys_LE alg key)))
let finish_aes_encrypt_le alg input_LE key =
  Vale.AES.AES_s.aes_encrypt_LE_reveal ();
  Vale.AES.AES_s.eval_cipher_reveal ();
  ()
//--
let va_subscript_FStar__Seq__Base__seq = Seq.index
#reset-options "--z3rlimit 30"
//-- Load_one_msb

val va_code_Load_one_msb : va_dummy:unit -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Load_one_msb () =
  (va_Block (va_CCons (va_code_ZeroXmm (va_op_xmm_xmm 2)) (va_CCons (va_code_PinsrqImm
    (va_op_xmm_xmm 2) 72057594037927936 1 (va_op_reg_opr64_reg64 rR11)) (va_CNil ()))))

val va_codegen_success_Load_one_msb : va_dummy:unit -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Load_one_msb () =
  (va_pbool_and (va_codegen_success_ZeroXmm (va_op_xmm_xmm 2)) (va_pbool_and
    (va_codegen_success_PinsrqImm (va_op_xmm_xmm 2) 72057594037927936 1 (va_op_reg_opr64_reg64
    rR11)) (va_ttrue ())))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Load_one_msb (va_mods:va_mods_t) : (va_quickCode unit (va_code_Load_one_msb ())) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 145 column 12 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_ZeroXmm (va_op_xmm_xmm 2)) (fun (va_s:va_state) _ -> va_qAssert va_range1
    "***** PRECONDITION NOT MET AT line 146 column 5 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.Arch.Types.two_to_nat32 (Vale.Def.Words_s.Mktwo #Vale.Def.Words_s.nat32 0 16777216) ==
    72057594037927936) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 147 column 14 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_PinsrqImm (va_op_xmm_xmm 2) 72057594037927936 1 (va_op_reg_opr64_reg64 rR11)) (fun
    (va_s:va_state) _ -> va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 148 column 24 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.Def.Types_s.insert_nat64_reveal ()) (va_QEmpty (())))))))


val va_lemma_Load_one_msb : va_b0:va_code -> va_s0:va_state
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Load_one_msb ()) va_s0 /\ va_get_ok va_s0 /\
    sse_enabled))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 /\
    va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 2 va_sM (va_update_reg64 rR11 va_sM
    (va_update_ok va_sM va_s0))))))
[@"opaque_to_smt"]
let va_lemma_Load_one_msb va_b0 va_s0 =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_xmm 2; va_Mod_reg64 rR11; va_Mod_ok] in
  let va_qc = va_qcode_Load_one_msb va_mods in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Load_one_msb ()) va_qc va_s0 (fun va_s0
    va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 138 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 143 column 46 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216)) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 2; va_Mod_reg64 rR11; va_Mod_ok]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Load_one_msb (va_s0:va_state) (va_k:(va_state -> unit -> Type0)) : Type0 =
  (va_get_ok va_s0 /\ sse_enabled /\ (forall (va_x_r11:nat64) (va_x_xmm2:quad32)
    (va_x_efl:Vale.X64.Flags.t) . let va_sM = va_upd_flags va_x_efl (va_upd_xmm 2 va_x_xmm2
    (va_upd_reg64 rR11 va_x_r11 va_s0)) in va_get_ok va_sM /\ va_get_xmm 2 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216 ==> va_k va_sM (())))


val va_wpProof_Load_one_msb : va_s0:va_state -> va_k:(va_state -> unit -> Type0)
  -> Ghost (va_state & va_fuel & unit)
  (requires (va_t_require va_s0 /\ va_wp_Load_one_msb va_s0 va_k))
  (ensures (fun (va_sM, va_f0, va_g) -> va_t_ensure (va_code_Load_one_msb ()) ([va_Mod_flags;
    va_Mod_xmm 2; va_Mod_reg64 rR11]) va_s0 va_k ((va_sM, va_f0, va_g))))
[@"opaque_to_smt"]
let va_wpProof_Load_one_msb va_s0 va_k =
  let (va_sM, va_f0) = va_lemma_Load_one_msb (va_code_Load_one_msb ()) va_s0 in
  va_lemma_upd_update va_sM;
  assert (va_state_eq va_sM (va_update_flags va_sM (va_update_xmm 2 va_sM (va_update_reg64 rR11
    va_sM (va_update_ok va_sM va_s0)))));
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_xmm 2; va_Mod_reg64 rR11]) va_sM va_s0;
  let va_g = () in
  (va_sM, va_f0, va_g)

[@ "opaque_to_smt" va_qattr]
let va_quick_Load_one_msb () : (va_quickCode unit (va_code_Load_one_msb ())) =
  (va_QProc (va_code_Load_one_msb ()) ([va_Mod_flags; va_Mod_xmm 2; va_Mod_reg64 rR11])
    va_wp_Load_one_msb va_wpProof_Load_one_msb)
//--
//-- Ctr32_ghash_6_prelude

val va_code_Ctr32_ghash_6_prelude : alg:algorithm -> Tot va_code
[@ "opaque_to_smt" va_qattr]
let va_code_Ctr32_ghash_6_prelude alg =
  (va_Block (va_CCons (va_code_Load_one_msb ()) (va_CCons (va_code_VPxor (va_op_xmm_xmm 4)
    (va_op_xmm_xmm 4) (va_op_opr128_xmm 4)) (va_CCons (va_code_Load128_buffer
    (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 15) (va_op_reg_opr64_reg64 rRcx) (0 - 128) Secret)
    (va_CCons (va_code_VPaddd (va_op_xmm_xmm 10) (va_op_xmm_xmm 1) (va_op_xmm_xmm 2)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 10) (va_op_xmm_xmm 2)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 11) (va_op_xmm_xmm 2)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 12) (va_op_xmm_xmm 2)) (va_CCons
    (va_code_VPaddd (va_op_xmm_xmm 14) (va_op_xmm_xmm 13) (va_op_xmm_xmm 2)) (va_CCons
    (va_code_VPxor (va_op_xmm_xmm 9) (va_op_xmm_xmm 1) (va_op_opr128_xmm 15)) (va_CCons
    (va_code_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 4) 16 Secret) (va_CNil ()))))))))))))

val va_codegen_success_Ctr32_ghash_6_prelude : alg:algorithm -> Tot va_pbool
[@ "opaque_to_smt" va_qattr]
let va_codegen_success_Ctr32_ghash_6_prelude alg =
  (va_pbool_and (va_codegen_success_Load_one_msb ()) (va_pbool_and (va_codegen_success_VPxor
    (va_op_xmm_xmm 4) (va_op_xmm_xmm 4) (va_op_opr128_xmm 4)) (va_pbool_and
    (va_codegen_success_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 15)
    (va_op_reg_opr64_reg64 rRcx) (0 - 128) Secret) (va_pbool_and (va_codegen_success_VPaddd
    (va_op_xmm_xmm 10) (va_op_xmm_xmm 1) (va_op_xmm_xmm 2)) (va_pbool_and
    (va_codegen_success_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 10) (va_op_xmm_xmm 2))
    (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 11) (va_op_xmm_xmm
    2)) (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 12)
    (va_op_xmm_xmm 2)) (va_pbool_and (va_codegen_success_VPaddd (va_op_xmm_xmm 14) (va_op_xmm_xmm
    13) (va_op_xmm_xmm 2)) (va_pbool_and (va_codegen_success_VPxor (va_op_xmm_xmm 9) (va_op_xmm_xmm
    1) (va_op_opr128_xmm 15)) (va_pbool_and (va_codegen_success_Store128_buffer
    (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp) (va_op_xmm_xmm 4) 16 Secret)
    (va_ttrue ())))))))))))

[@ "opaque_to_smt" va_qattr]
let va_qcode_Ctr32_ghash_6_prelude (va_mods:va_mods_t) (alg:algorithm) (scratch_b:buffer128)
  (key_words:(seq nat32)) (round_keys:(seq quad32)) (keys_b:buffer128) (ctr_orig:quad32) :
  (va_quickCode unit (va_code_Ctr32_ghash_6_prelude alg)) =
  (qblock va_mods (fun (va_s:va_state) -> let (va_old_s:va_state) = va_s in va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 211 column 17 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load_one_msb ()) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 212 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 4) (va_op_xmm_xmm 4) (va_op_opr128_xmm 4)) (fun (va_s:va_state)
    _ -> va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 213 column 21 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.Arch.Types.lemma_quad32_xor ()) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 214 column 19 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Load128_buffer (va_op_heaplet_mem_heaplet 0) (va_op_xmm_xmm 15)
    (va_op_reg_opr64_reg64 rRcx) (0 - 128) Secret keys_b 0) (va_QBind va_range1
    "***** PRECONDITION NOT MET AT line 215 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 10) (va_op_xmm_xmm 1) (va_op_xmm_xmm 2)) (fun (va_s:va_state) _
    -> let (va_arg44:Vale.Def.Types_s.quad32) = va_get_xmm 10 va_s in let
    (va_arg43:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg42:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 215 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg42 va_arg43 va_arg44 1) (va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 216 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 11) (va_op_xmm_xmm 10) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg41:Vale.Def.Types_s.quad32) = va_get_xmm 11 va_s in let
    (va_arg40:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg39:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 216 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg39 va_arg40 va_arg41 2) (va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 217 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 12) (va_op_xmm_xmm 11) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg38:Vale.Def.Types_s.quad32) = va_get_xmm 12 va_s in let
    (va_arg37:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg36:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 217 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg36 va_arg37 va_arg38 3) (va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 218 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 13) (va_op_xmm_xmm 12) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg35:Vale.Def.Types_s.quad32) = va_get_xmm 13 va_s in let
    (va_arg34:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg33:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 218 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg33 va_arg34 va_arg35 4) (va_QBind
    va_range1
    "***** PRECONDITION NOT MET AT line 219 column 11 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPaddd (va_op_xmm_xmm 14) (va_op_xmm_xmm 13) (va_op_xmm_xmm 2)) (fun (va_s:va_state)
    _ -> let (va_arg32:Vale.Def.Types_s.quad32) = va_get_xmm 14 va_s in let
    (va_arg31:Vale.Def.Types_s.quad32) = va_get_xmm 1 va_old_s in let
    (va_arg30:Vale.Def.Types_s.quad32) = Vale.AES.GCTR.inc32lite ctr_orig 0 in va_qPURE va_range1
    "***** PRECONDITION NOT MET AT line 219 column 48 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (fun (_:unit) -> Vale.AES.AES_helpers.lemma_incr_msb va_arg30 va_arg31 va_arg32 5) (va_QSeq
    va_range1
    "***** PRECONDITION NOT MET AT line 220 column 10 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_VPxor (va_op_xmm_xmm 9) (va_op_xmm_xmm 1) (va_op_opr128_xmm 15)) (va_QSeq va_range1
    "***** PRECONDITION NOT MET AT line 221 column 20 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_quick_Store128_buffer (va_op_heaplet_mem_heaplet 3) (va_op_reg_opr64_reg64 rRbp)
    (va_op_xmm_xmm 4) 16 Secret scratch_b 1) (va_QEmpty (())))))))))))))))))))


val va_lemma_Ctr32_ghash_6_prelude : va_b0:va_code -> va_s0:va_state -> alg:algorithm ->
  scratch_b:buffer128 -> key_words:(seq nat32) -> round_keys:(seq quad32) -> keys_b:buffer128 ->
  ctr_orig:quad32
  -> Ghost (va_state & va_fuel)
  (requires (va_require_total va_b0 (va_code_Ctr32_ghash_6_prelude alg) va_s0 /\ va_get_ok va_s0 /\
    (sse_enabled /\ Vale.X64.Decls.validDstAddrs128 (va_get_mem_heaplet 3 va_s0) (va_get_reg64 rRbp
    va_s0) scratch_b 8 (va_get_mem_layout va_s0) Secret /\ aes_reqs_offset alg key_words round_keys
    keys_b (va_get_reg64 rRcx va_s0) (va_get_mem_heaplet 0 va_s0) (va_get_mem_layout va_s0) /\
    va_get_xmm 1 va_s0 == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig
    0))))
  (ensures (fun (va_sM, va_fM) -> va_ensure_total va_b0 va_s0 va_sM va_fM /\ va_get_ok va_sM /\
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 1 /\ va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour
    #Vale.Def.Types_s.nat32 0 0 0 16777216 /\ va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32
    round_keys 0 /\ va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor
    (Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 0)) (va_get_xmm 15
    va_sM) /\ (let counter = Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_orig `op_Modulus` 256
    in (counter + 6 < 256 ==> va_get_xmm 10 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 1)) /\ (counter + 6 < 256 ==> va_get_xmm 11 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 2)) /\ (counter + 6 <
    256 ==> va_get_xmm 12 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_orig 3)) /\ (counter + 6 < 256 ==> va_get_xmm 13 va_sM ==
    Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite ctr_orig 4)) /\ (counter + 6 <
    256 ==> va_get_xmm 14 va_sM == Vale.Def.Types_s.reverse_bytes_quad32 (Vale.AES.GCTR.inc32lite
    ctr_orig 5)) /\ Vale.X64.Decls.buffer128_read scratch_b 1 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0 /\ va_get_xmm 4 va_sM ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0)) /\ va_state_eq va_sM (va_update_flags
    va_sM (va_update_mem_heaplet 3 va_sM (va_update_reg64 rR11 va_sM (va_update_xmm 15 va_sM
    (va_update_xmm 14 va_sM (va_update_xmm 13 va_sM (va_update_xmm 12 va_sM (va_update_xmm 11 va_sM
    (va_update_xmm 10 va_sM (va_update_xmm 9 va_sM (va_update_xmm 4 va_sM (va_update_xmm 2 va_sM
    (va_update_ok va_sM (va_update_mem va_sM va_s0))))))))))))))))
[@"opaque_to_smt"]
let va_lemma_Ctr32_ghash_6_prelude va_b0 va_s0 alg scratch_b key_words round_keys keys_b ctr_orig =
  let (va_mods:va_mods_t) = [va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_reg64 rR11; va_Mod_xmm 15;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9;
    va_Mod_xmm 4; va_Mod_xmm 2; va_Mod_ok; va_Mod_mem] in
  let va_qc = va_qcode_Ctr32_ghash_6_prelude va_mods alg scratch_b key_words round_keys keys_b
    ctr_orig in
  let (va_sM, va_fM, va_g) = va_wp_sound_code_norm (va_code_Ctr32_ghash_6_prelude alg) va_qc va_s0
    (fun va_s0 va_sM va_g -> let () = va_g in label va_range1
    "***** POSTCONDITION NOT MET AT line 151 column 1 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_ok va_sM) /\ (label va_range1
    "***** POSTCONDITION NOT MET AT line 194 column 72 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.modifies_buffer_specific128 scratch_b (va_get_mem_heaplet 3 va_s0)
    (va_get_mem_heaplet 3 va_sM) 1 1) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 196 column 41 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 2 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 16777216) /\ label
    va_range1
    "***** POSTCONDITION NOT MET AT line 197 column 39 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 15 va_sM == FStar.Seq.Base.index #quad32 round_keys 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 199 column 83 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 9 va_sM == Vale.Def.Types_s.quad32_xor (Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 0)) (va_get_xmm 15 va_sM)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 200 column 9 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (let counter = Vale.Def.Words_s.__proj__Mkfour__item__lo0 ctr_orig `op_Modulus` 256 in label
    va_range1
    "***** POSTCONDITION NOT MET AT line 201 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (counter + 6 < 256 ==> va_get_xmm 10 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 1)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 202 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (counter + 6 < 256 ==> va_get_xmm 11 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 2)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 203 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (counter + 6 < 256 ==> va_get_xmm 12 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 3)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 204 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (counter + 6 < 256 ==> va_get_xmm 13 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 4)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 205 column 85 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (counter + 6 < 256 ==> va_get_xmm 14 va_sM == Vale.Def.Types_s.reverse_bytes_quad32
    (Vale.AES.GCTR.inc32lite ctr_orig 5)) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 207 column 66 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (Vale.X64.Decls.buffer128_read scratch_b 1 (va_get_mem_heaplet 3 va_sM) ==
    Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0) /\ label va_range1
    "***** POSTCONDITION NOT MET AT line 208 column 33 of file /home/gebner/everest/hacl-star/vale/code/thirdPartyPorts/OpenSSL/aes/Vale.AES.X64.AESGCM.vaf *****"
    (va_get_xmm 4 va_sM == Vale.Def.Words_s.Mkfour #Vale.Def.Types_s.nat32 0 0 0 0)))) in
  assert_norm (va_qc.mods == va_mods);
  va_lemma_norm_mods ([va_Mod_flags; va_Mod_mem_heaplet 3; va_Mod_reg64 rR11; va_Mod_xmm 15;
    va_Mod_xmm 14; va_Mod_xmm 13; va_Mod_xmm 12; va_Mod_xmm 11; va_Mod_xmm 10; va_Mod_xmm 9;
    va_Mod_xmm 4; va_Mod_xmm 2; va_Mod_ok; va_Mod_mem]) va_sM va_s0;
  (va_sM, va_fM)

[@ va_qattr]
let va_wp_Ctr32_ghash_6_prelude (alg:algorithm) (scratch_b:buffer128) (key_words:(seq nat32))
  (round_keys:(seq quad32)) (keys_b:buffer128) (ctr_orig:quad32) (va_s0:va_state) (va_k:(va_state
val va_wp_Ctr32_ghash_6_prelude
      (alg: algorithm)
      (scratch_b: buffer128)
      (key_words: (seq nat32))
      (round_keys: (seq quad32))
      (keys_b: buffer128)
      (ctr_orig: quad32)
      (va_s0: va_state)
      (va_k: (va_state -> unit -> Type0))
    : Type0

    alg: Vale.AES.AES_common_s.algorithm ->
    scratch_b: Vale.X64.Memory.buffer128 ->
    key_words: FStar.Seq.Base.seq Vale.X64.Memory.nat32 ->
    round_keys: FStar.Seq.Base.seq Vale.X64.Decls.quad32 ->
    keys_b: Vale.X64.Memory.buffer128 ->
    ctr_orig: Vale.X64.Decls.quad32 ->
    va_s0: Vale.X64.Decls.va_state ->
    va_k: (_: Vale.X64.Decls.va_state -> _: Prims.unit -> Type0)
  -> Type0