Skip to content

refactor(crypto): migrate the remaining Crypto clients to OracleComp.sumHandler #2202

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SamuelSchlesinger merged 1 commit into from
Nov 1, 2026
Merged

refactor(crypto): migrate the remaining Crypto clients to OracleComp.sumHandler #2202

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 15 additions & 15 deletions Complexity/Crypto/Computational/CramerShoup.lean
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ noncomputable def cramerShoupMsgCCA2Game
let pkVal := F.cramerShoupPublicKey d α σ τ σ₁ τ₁ σ₂ τ₂
let pk := F.encodeCramerShoupPublicKeyValues d pkVal
let choiceOut ← ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase1Oracle hasAD H isElem d sk))
(adversary.choose n pk)).run ())
let choice := choiceOut.1
Expand All @@ -202,7 +202,7 @@ noncomputable def cramerShoupMsgCCA2Game
F.encode d (csPkH₁ pkVal), F.encode d (csPkH₂ pkVal))
m ad β.val
let guessOut ← ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase2Oracle hasAD H isElem d sk ct ad))
(adversary.guess n choice.2 ct)).run ())
return guessOut.1
Expand Down Expand Up @@ -315,7 +315,7 @@ noncomputable def cramerShoupGame1
let w := F.encode d ((α * β) • F.generator d)
let pk := F.encodeCramerShoupPublicKey d u sk
let choiceOut ← ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase1Oracle hasAD H isElem d sk))
(adversary.choose n pk)).run ())
let choice := choiceOut.1
Expand All @@ -326,7 +326,7 @@ noncomputable def cramerShoupGame1
let m := if bit then m₁ else m₀
let ct := F.encodeCramerShoupChallenge H d sk v w m ad
let guessOut ← ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase2Oracle hasAD H isElem d sk ct ad))
(adversary.guess n choice.2 ct)).run ())
return guessOut.1
Expand Down Expand Up @@ -392,7 +392,7 @@ noncomputable def cramerShoupGame2
let w := F.encode d (γ • F.generator d)
let pk := F.encodeCramerShoupPublicKey d u sk
let choiceOut ← ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase1Oracle hasAD H isElem d sk))
(adversary.choose n pk)).run ())
let choice := choiceOut.1
Expand All @@ -403,7 +403,7 @@ noncomputable def cramerShoupGame2
let m := if bit then m₁ else m₀
let ct := F.encodeCramerShoupChallenge H d sk v w m ad
let guessOut ← ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase2Oracle hasAD H isElem d sk ct ad))
(adversary.guess n choice.2 ct)).run ())
return guessOut.1
Expand Down Expand Up @@ -526,7 +526,7 @@ private noncomputable def cramerShoupExactCollisionGame
let w := F.encode d (γ • F.generator d)
let pk := F.encodeCramerShoupPublicKey d u sk
let choiceOut ← ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase1Oracle hasAD H isElem d sk))
(adversary.choose n pk)).run ())
let choice := choiceOut.1
Expand Down Expand Up @@ -584,7 +584,7 @@ private theorem advantage_cramerShoupGame2_game3_le_exactCollision
let ct := F.encodeCramerShoupChallenge H d sk v w m ad
have hrun :
(ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase2Oracle hasAD H isElem d sk ct ad))
(adversary.guess n choiceOut.1.2 ct)).run ())).bind
(fun guessOut => PMF.pure guessOut.1) =
Expand Down Expand Up @@ -639,7 +639,7 @@ private theorem succProbability_cramerShoupExactCollisionGame_le
let w := F.encode d (γ • F.generator d)
let pk := F.encodeCramerShoupPublicKey d u sk
(ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase1Oracle hasAD H isElem d sk))
(adversary.choose n pk)).run ())).bind fun choiceOut =>
let choice := choiceOut.1
Expand All @@ -666,7 +666,7 @@ private theorem succProbability_cramerShoupExactCollisionGame_le
let w := F.encode d (γ • F.generator d)
let pk := F.encodeCramerShoupPublicKey d u sk
(ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase1Oracle hasAD H isElem d sk))
(adversary.choose n pk)).run ())).bind fun choiceOut =>
let choice := choiceOut.1
Expand All @@ -677,7 +677,7 @@ private theorem succProbability_cramerShoupExactCollisionGame_le
let ad := encodeAD (d, choice.1.2)
let ct := F.encodeCramerShoupChallenge H d sk v w m ad
((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupCollisionPhase2Oracle hasAD H isElem d sk ct ad))
(adversary.guess n choice.2 ct)).run none) >>= fun out =>
let target := extractCramerShoupTuple ct ad
Expand Down Expand Up @@ -1336,10 +1336,10 @@ private theorem eval_run_interpret_map_bind
(f : α → β) (oa : WordOracleComp Unit α) (s : State)
(k : β × State → PMF γ) :
(ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m)) oracle)
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m)) oracle)
(f <$> oa)).run s)).bind k =
(ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m)) oracle)
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m)) oracle)
oa).run s)).bind (fun p => k (f p.1, p.2)) := by
rw [OracleComp.interpret_map, StateT.run_map]
simp only [← bind_pure_comp, ProbComp.eval_bind, ProbComp.eval_pure,
Expand All @@ -1361,7 +1361,7 @@ private noncomputable def cramerShoupCCA2InnerB
(F.encode d pkVal.1, F.encode d pkVal.2.1,
F.encode d pkVal.2.2.1, F.encode d pkVal.2.2.2) m adBits β.val
(ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase2Oracle hasAD H isElem d sk ct adBits))
(adversary.guess n choiceOut.1.2 ct)).run ())).bind (fun guessOut => PMF.pure guessOut.1)

Expand All @@ -1374,7 +1374,7 @@ private noncomputable def cramerShoupCCA2InnerSK
let sk := F.skNatOfZMod d σ τ σ₁ τ₁ σ₂ τ₂
let pk := F.encodeCramerShoupPublicKey d (F.encode d (α • F.generator d)) sk
(ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase1Oracle hasAD H isElem d sk))
(adversary.choose n pk)).run ())).bind fun choiceOut =>
if isElem (d, choiceOut.1.1.1.1) && isElem (d, choiceOut.1.1.1.2) then
Expand Down
14 changes: 7 additions & 7 deletions Complexity/Crypto/Computational/CramerShoup/Reductions.lean
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -532,7 +532,7 @@ private theorem isPPTOn_run_cramerShoupPhase1Oracle
IsPPTOn encIn
(encPair (encPair (encPair (encPair encMsg encMsg) encAD) encBits) (encFinEnum Unit))
(fun a => (OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase1Oracle hasAD H isElem (d a) (sk a)))
(adversary.choose (n a) (pk a))).run ()) := by
have hp1 := ComputableTidilyInPolyTime.fst encIn encBits
Expand Down Expand Up @@ -576,7 +576,7 @@ private theorem isPPTOn_run_cramerShoupPhase2Oracle
(had : ComputableTidilyInPolyTime ad encIn encBits) :
IsPPTOn encIn (encPair encBool (encFinEnum Unit))
(fun a => (OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase2Oracle hasAD H isElem (d a) (sk a) (ct a) (ad a)))
(adversary.guess (n a) (state a) (ct a))).run ()) := by
have hp1 := ComputableTidilyInPolyTime.fst encIn encBits
Expand Down Expand Up @@ -623,7 +623,7 @@ private theorem isPPTOn_run_cramerShoupCollisionPhase2Oracle
(had : ComputableTidilyInPolyTime ad encIn encBits) :
IsPPTOn encIn (encPair encBool (encOption encBits))
(fun a => (OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupCollisionPhase2Oracle hasAD H isElem (d a) (sk a) (ct a) (ad a)))
(adversary.guess (n a) (state a) (ct a))).run none) := by
have hp1 := ComputableTidilyInPolyTime.fst encIn encBits
Expand Down Expand Up @@ -695,7 +695,7 @@ noncomputable def cramerShoupMsgToDDHDistinguisher
F.sampleCramerShoupSK n input.1 >>= fun sk =>
let pk := F.encodeCramerShoupPublicKey input.1 (csDdhU input) sk
((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase1Oracle hasAD H isElem input.1 sk))
(adversary.choose n pk)).run ()) >>= fun choiceOut =>
let choice := choiceOut.1
Expand All @@ -706,7 +706,7 @@ noncomputable def cramerShoupMsgToDDHDistinguisher
let m := if bit then m₁ else m₀
let ct := F.encodeCramerShoupChallenge H input.1 sk (csDdhV input) (csDdhW input) m ad
((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase2Oracle hasAD H isElem input.1 sk ct ad))
(adversary.guess n choice.2 ct)).run ()) >>= fun guessOut =>
pure guessOut.1
Expand Down Expand Up @@ -837,7 +837,7 @@ noncomputable def cramerShoupMsgToCollisionFinder
let w := F.smul (d, csExpC abc, gen)
let pk := F.encodeCramerShoupPublicKey d u sk
((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupPhase1Oracle hasAD H isElem d sk))
(adversary.choose n pk)).run ()) >>= fun choiceOut =>
let choice := choiceOut.1
Expand All @@ -848,7 +848,7 @@ noncomputable def cramerShoupMsgToCollisionFinder
let m := if bit then m₁ else m₀
let ct := F.encodeCramerShoupChallenge H d sk v w m ad
((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(F.cramerShoupCollisionPhase2Oracle hasAD H isElem d sk ct ad))
(adversary.guess n choice.2 ct)).run none) >>= fun out =>
let target := extractCramerShoupTuple ct ad
Expand Down
8 changes: 4 additions & 4 deletions Complexity/Crypto/Computational/CramerShoup/Scheme.lean
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -364,7 +364,7 @@
(∀ n pk (State : Type)
(oracle : Unit × List Bool → StateT State PMF (List Bool)) s s' choice,
(choice, s') ∈ ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifOracle m)) oracle)
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifOracle m)) oracle)
(adversary.choose n pk)).run s).support →
choice.2.length ≤ cs * (n + pk.length + 2) ^ ds) := by
obtain ⟨c₁, d₁, hchoose⟩ := hA.choose.query_bounds
Expand Down Expand Up @@ -473,15 +473,15 @@
(adversary : ADCCA2AdversaryOf Msg AD) (bit : Bool) (n : ℕ) : ProbComp Bool := do
let keys ← keyGen n
let choiceOut ← (OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(cca2ADPhase1Oracle encOut decrypt n keys.2))
(adversary.choose n keys.1)).run ()
let choice := choiceOut.1
if valid n keys.1 (csChoiceMsg₀ choice) (csChoiceMsg₁ choice) then
let ct ← encrypt n keys.1 (if bit then csChoiceMsg₁ choice else csChoiceMsg₀ choice)
(csChoiceAD choice)
let guessOut ← (OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(cca2ADPhase2Oracle encOut decrypt n keys.2 ct (encAD (csChoiceAD choice))))
(adversary.guess n (csChoiceState choice) ct)).run ()
return guessOut.1
Expand Down Expand Up @@ -1602,13 +1602,13 @@
(F.skNatOfZMod d δ 0 δ₁ 0 δ₂ 0))).IsQueryBounded Q₁

/-- Phase 2 query bound on honest Phase 1 states and challenge ciphertexts at parameter `n`. -/
def HonestPhase2QueryBound (hasAD : Bool) {Msg AD : Type}

Check notice on line 1605 in Complexity/Crypto/Computational/CramerShoup/Scheme.lean

View workflow job for this annotation

GitHub Actions / ci-checks

Possible parallel definition 

`Cslib.Crypto.PrimeOrderGroupFamily.HonestPhase2QueryBound` and `Cslib.Crypto.ProjectiveHash.projHash2QueryFiberEquiv` (Complexity/Crypto/Computational/CramerShoup/ProjectiveHash.lean:450) share a 725-node subterm, 54% of the smaller body, built from `ZMod`, `Cslib.Crypto.PrimeOrderGroupFamily.order`. Advisory only; see the job summary.

Check notice on line 1605 in Complexity/Crypto/Computational/CramerShoup/Scheme.lean

View workflow job for this annotation

GitHub Actions / ci-checks

Possible parallel definition 

`Cslib.Crypto.PrimeOrderGroupFamily.HonestPhase2QueryBound` and `Cslib.Crypto.ProjectiveHash.projHash2QueryFiberEquiv` (Complexity/Crypto/Computational/CramerShoup/ProjectiveHash.lean:449) share a 725-node subterm, 54% of the smaller body, built from `ZMod`, `Cslib.Crypto.PrimeOrderGroupFamily.order`. Advisory only; see the job summary.
(encodeAD : F.Desc × AD → List Bool) (setup : ℕ → PMF F.Desc)
(H : F.Desc × List Bool → List Bool) (isElem : F.Desc × List Bool → Bool)
(adversary : ADCCA2AdversaryOf Msg AD) (n Q₂ : ℕ) : Prop :=
∀ d ∈ (setup n).support, ∀ α β γ δ τ δ₁ δ₂ ξ : ZMod (F.order d),
∀ choiceOut ∈ (ProbComp.eval ((OracleComp.interpret
(ProbOracleComp.handler (fun m => StateT.lift (ProbComp.unifFin m))
(OracleComp.sumHandler (fun m => StateT.lift (ProbComp.unifFin m))
(fun req (s : Unit) =>
pure (F.cramerShoupDHPhase1Reply hasAD H isElem d α δ δ₁ δ₂ req.2, s)))
(adversary.choose n
Expand Down
Loading
Loading