Definition FT0b0(i: Z): int := GF_ops_LL.times2 (Znth i FSb).
Definition FT0b1(i: Z): int := Znth i FSb.
Definition FT0b2(i: Z): int := Znth i FSb.
Definition FT0b3(i: Z): int := GF_ops_LL.times3 (Znth i FSb).
(* Note: according to calc_FT0, it should FT0b3 is (Int.and (Int.xor (GF_ops_LL.times2 (Znth i FSb)) (Znth i FSb)) (Int.repr 255)) but we prefer to use an equivalent "medium-level" formulation *)

(* Specifications: *)
Lemma times3_times2: forall i,
0 <= Int.unsigned i < 256 ->
Int.and (Int.xor (times2 i) i) (Int.repr 255) = times3 i.
Lemma calc_FT0_expose_bytes: forall i,
0 <= i < 256 ->
calc_FT0 i = word_to_int (FT0b0 i, FT0b1 i, FT0b2 i, FT0b3 i).
Lemma calc_FT1_expose_bytes: forall i,
0 <= i < 256 ->
calc_FT1 i = word_to_int (FT0b3 i, FT0b0 i, FT0b1 i, FT0b2 i).
Lemma calc_FT2_expose_bytes: forall i,
0 <= i < 256 ->
calc_FT2 i = word_to_int (FT0b2 i, FT0b3 i, FT0b0 i, FT0b1 i).
Lemma calc_FT3_expose_bytes: forall i,
0 <= i < 256 ->
calc_FT3 i = word_to_int (FT0b1 i, FT0b2 i, FT0b3 i, FT0b0 i).
Lemma split_quad_eq': forall {T : Type} (c0 c1 c2 c3 c0' c1' c2' c3' : T),
c0 = c0' -> c1 = c1' -> c2 = c2' -> c3 = c3' -> (c0, (c1, (c2, c3))) = (c0', (c1', (c2', c3'))).
Lemma xor_assoc_5: forall i0 i1 i2 i3 i4,
Int.xor (Int.xor (Int.xor (Int.xor i4 i0) i1) i2) i3 =
Int.xor (Int.xor (Int.xor (Int.xor i0 i1) i2) i3) i4.
Axiom byte_range_admit: forall b, 0 <= Int.unsigned b < 256.
Lemma round_equiv: forall S K,
(mbed_tls_fround
(state_to_four_ints S)
(map Int.unsigned (block_to_ints K))
0
) = state_to_four_ints (round S K).
Lemma final_round_equiv: forall S K,
(mbed_tls_final_fround
(state_to_four_ints S)
(map Int.unsigned (block_to_ints K))
0
) = state_to_four_ints (last_round S K).