Fixpoint get_first_None (limit:nat) (s: ENTROPY.stream): nat :=
match limit with
| O => O (* bogus *)
| S limit' =>
match s O with
| None => O
| Some _ => S (get_first_None limit' (fun i => s (S i)))
end
end
.

(* Specifications: *)
Lemma get_bits_stream_success:
forall k s b s',
ENTROPY.success b s' = ENTROPY.get_bits k s ->
s' = fun i => s (k + i)%nat.
Lemma get_bits_stream_success_Some:
forall k s b s',
ENTROPY.success b s' = ENTROPY.get_bits k s ->
(forall i, (i < k)%nat -> s i <> None).
Lemma get_first_None_limit:
forall k s i,
i = get_first_None k s ->
(i <= k)%nat.
(* TODO convert this to use get_first_None_limit *)
Lemma get_bits_stream_error:
forall k s e s',
ENTROPY.error e s' = ENTROPY.get_bits k s ->
(exists i, (i < k)%nat /\ (forall i', s' i' = match Nat.compare i' i with
| Lt => s i'
| Eq | Gt => s (S i')
end) /\ s i = None /\ (forall i', (i' < i)%nat -> s i' <> None)).
Lemma get_bits_length:
forall k s b s',
ENTROPY.success b s' = ENTROPY.get_bits k s ->
length b = k.
Lemma get_bytes_length:
forall k s b s',
ENTROPY.success b s' = ENTROPY.get_bytes k s ->
length b = k.
Lemma get_bytes_Zlength:
forall k s b s',
k >= 0 ->
ENTROPY.success b s' = ENTROPY.get_bytes (Z.to_nat k) s ->
Zlength b = k.