(** Correctness proofs about [Z.shiftr] and [Z.shiftl] *)

(* Specifications: *)
Lemma shiftr_spec_aux a n m : 0<=n -> 0<=m ->
testbit (shiftr a n) m = testbit a (m+n).
Lemma shiftl_spec_low a n m : m<n ->
testbit (shiftl a n) m = false.
Lemma shiftl_spec_high a n m : 0<=m -> n<=m ->
testbit (shiftl a n) m = testbit a (m-n).
Lemma shiftr_spec a n m : 0<=m ->
testbit (shiftr a n) m = testbit a (m+n).