val secp256k1_ecdsa_verify_sha256 (msg_len:size_t) (msg:lbytes msg_len) (public_key signature:lbytes 64ul) : Stack bool
  (requires fun h ->
    live h msg /\ live h public_key /\ live h signature)
  (ensures fun h0 b h1 -> modifies0 h0 h1 /\
    b == S.secp256k1_ecdsa_verify_sha256 (v msg_len) (as_seq h0 msg) (as_seq h0 public_key) (as_seq h0 signature))
let secp256k1_ecdsa_verify_sha256 msg_len msg public_key signature =
  push_frame ();
  let mHash = create 32ul (u8 0) in
  Hacl.Streaming.SHA2.hash_256 msg msg_len mHash;
  let b = secp256k1_ecdsa_verify_hashed_msg mHash public_key signature in
  pop_frame ();
  b
val secp256k1_ecdsa_verify_sha256 (msg_len:size_t) (msg:lbytes msg_len) (public_key signature:lbytes 64ul) : Stack bool
  (requires fun h ->
    live h msg /\ live h public_key /\ live h signature)
  (ensures fun h0 b h1 -> modifies0 h0 h1 /\
    b == S.secp256k1_ecdsa_verify_sha256 (v msg_len) (as_seq h0 msg) (as_seq h0 public_key) (as_seq h0 signature))
let secp256k1_ecdsa_verify_sha256 msg_len msg public_key signature =
push_frame ();
let mHash = create 32ul (u8 0) in
Hacl.Streaming.SHA2.hash_256 msg msg_len mHash;
let b = secp256k1_ecdsa_verify_hashed_msg mHash public_key signature in
pop_frame ();
b
Hacl.K256.ECDSA.fst.checked
Spec.K256.fst.checked prims.fst.checked Lib.Sequence.fsti.checked Lib.RawIntTypes.fsti.checked Lib.IntTypes.fsti.checked Lib.ByteSequence.fsti.checked Lib.Buffer.fsti.checked Hacl.Streaming.SHA2.fst.checked Hacl.Spec.K256.Field52.Definitions.Lemmas.fst.checked Hacl.K256.Scalar.fsti.checked Hacl.K256.Field.fsti.checked Hacl.Impl.K256.Verify.fst.checked Hacl.Impl.K256.Sign.fst.checked Hacl.Impl.K256.PointMul.fsti.checked Hacl.Impl.K256.Point.fsti.checked Hacl.Bignum.Base.fst.checked FStar.UInt8.fsti.checked FStar.UInt32.fsti.checked FStar.Pervasives.fsti.checked FStar.Mul.fst.checked FStar.HyperStack.ST.fsti.checked FStar.HyperStack.fst.checked
Hacl.K256.ECDSA.fst
Lib.IntTypes.size_t Hacl.K256.ECDSA.lbytes FStar.UInt32.__uint_to_t Prims.bool Prims.unit FStar.HyperStack.ST.pop_frame Hacl.K256.ECDSA.secp256k1_ecdsa_verify_hashed_msg Hacl.Streaming.SHA2.hash_256 Lib.Buffer.lbuffer_t Lib.Buffer.MUT Lib.IntTypes.int_t Lib.IntTypes.U8 Lib.IntTypes.SEC FStar.UInt32.uint_to_t FStar.UInt32.t Lib.Buffer.create Lib.IntTypes.uint8 Lib.IntTypes.u8 Lib.Buffer.lbuffer FStar.HyperStack.ST.push_frame
module Hacl.K256.ECDSA

open FStar.HyperStack
open FStar.HyperStack.ST
open FStar.Mul

open Lib.IntTypes
open Lib.Buffer

module ST = FStar.HyperStack.ST
module LSeq = Lib.Sequence
module BSeq = Lib.ByteSequence

module S = Spec.K256
module BDL = Hacl.Spec.K256.Field52.Definitions.Lemmas

module P = Hacl.Impl.K256.Point
module SK = Hacl.Impl.K256.Sign
module VK = Hacl.Impl.K256.Verify

open Hacl.K256.Field
open Hacl.K256.Scalar

#set-options "--z3rlimit 50 --fuel 0 --ifuel 0"

let ecdsa_sign_hashed_msg signature msgHash private_key nonce =
  SK.ecdsa_sign_hashed_msg signature msgHash private_key nonce


let ecdsa_sign_sha256 signature msg_len msg private_key nonce =
  push_frame ();
  let msgHash = create 32ul (u8 0) in
  Hacl.Streaming.SHA2.hash_256 msg msg_len msgHash;
  let b = ecdsa_sign_hashed_msg signature msgHash private_key nonce in
  pop_frame ();
  b


let ecdsa_verify_hashed_msg m public_key signature =
  VK.ecdsa_verify_hashed_msg m public_key signature


let ecdsa_verify_sha256 msg_len msg public_key signature =
  push_frame ();
  let mHash = create 32ul (u8 0) in
  Hacl.Streaming.SHA2.hash_256 msg msg_len mHash;
  let b = ecdsa_verify_hashed_msg mHash public_key signature in
  pop_frame ();
  b

///  Low-S normalization

let secp256k1_ecdsa_signature_normalize signature =
  push_frame ();
  let s_q = create_qelem () in
  let s = sub signature 32ul 32ul in
  let is_sk_valid = load_qelem_vartime s_q s in
  let b =
    if not is_sk_valid then false
    else begin
      let is_sk_lt_q_halved = is_qelem_le_q_halved_vartime s_q in
      qnegate_conditional_vartime s_q (not is_sk_lt_q_halved);

      let h1 = ST.get () in
      update_sub_f h1 signature 32ul 32ul
        (fun h -> BSeq.nat_to_bytes_be 32 (qas_nat h1 s_q))
        (fun _ -> store_qelem (sub signature 32ul 32ul) s_q);
      true end in
  pop_frame ();
  b


let secp256k1_ecdsa_is_signature_normalized signature =
  push_frame ();
  let s_q = create_qelem () in
  let s = sub signature 32ul 32ul in
  let is_s_valid = load_qelem_vartime s_q s in
  let is_s_lt_q_halved = is_qelem_le_q_halved_vartime s_q in
  pop_frame ();
  is_s_valid && is_s_lt_q_halved


let secp256k1_ecdsa_sign_hashed_msg signature msgHash private_key nonce =
  let b = ecdsa_sign_hashed_msg signature msgHash private_key nonce in
  if b then secp256k1_ecdsa_signature_normalize signature else false


let secp256k1_ecdsa_sign_sha256 signature msg_len msg private_key nonce =
  push_frame ();
  let msgHash = create 32ul (u8 0) in
  Hacl.Streaming.SHA2.hash_256 msg msg_len msgHash;
  let b = secp256k1_ecdsa_sign_hashed_msg signature msgHash private_key nonce in
  pop_frame ();
  b


let secp256k1_ecdsa_verify_hashed_msg msgHash public_key signature =
  let is_s_normalized = secp256k1_ecdsa_is_signature_normalized signature in
  if not is_s_normalized then false
  else ecdsa_verify_hashed_msg msgHash public_key signature
val secp256k1_ecdsa_verify_sha256 (msg_len:size_t) (msg:lbytes msg_len) (public_key signature:lbytes 64ul) : Stack bool
  (requires fun h ->
    live h msg /\ live h public_key /\ live h signature)
  (ensures fun h0 b h1 -> modifies0 h0 h1 /\
    b == S.secp256k1_ecdsa_verify_sha256 (v msg_len) (as_seq h0 msg) (as_seq h0 public_key) (as_seq h0 signature))

    msg_len: Lib.IntTypes.size_t ->
    msg: Hacl.K256.ECDSA.lbytes msg_len ->
    public_key: Hacl.K256.ECDSA.lbytes 64ul ->
    signature: Hacl.K256.ECDSA.lbytes 64ul
  -> FStar.HyperStack.ST.Stack Prims.bool