Open Scope Z.
Definition encryption_after_loop : statement :=
ltac:(find_statement_in_body
f_mbedtls_aes_encrypt
reassociate_stmt
ltac:(fun body => match body with
context [Ssequence
(Sloop
(Ssequence
(Sifthenelse (Ebinop Ogt (Etempvar _i _) (Econst_int (Int.repr 0) _)  _)
Sskip  Sbreak)
_) _) ?S ] => S
end)).
Ltac remember_temp_Vints done :=
lazymatch goal with
| |- context [ ?T :: done ] => match T with
| temp ?Id (Vint ?V) =>
let V0 := fresh "V" in remember V as V0;
remember_temp_Vints ((temp Id (Vint V0)) :: done)
| _ => remember_temp_Vints (T :: done)
end
| |- semax _ (PROPx _ (LOCALx done (SEPx _))) _ _ => idtac
| _ => fail 100 "assertion failure: did not find" done
end.

Lemma encryption_after_loop_proof:
forall (Espec : OracleKind) (ctx input output : val)
(ctx_sh in_sh out_sh : share) (plaintext (*exp_key*) : list Z) (gv: globals)
(H: Zlength plaintext = 16)
(SH: readable_share ctx_sh)
(SH0: readable_share in_sh)
(SH1: writable_share out_sh)
(buf : list Z)
(Fctx: field_compatible t_struct_aesctx [StructField _buf] ctx)
(LenBuf: Zlength buf = 68)
(Eq: forall i : Z,
0 <= i < 60 ->
force_val
(sem_add_ptr_int tuint Signed
(field_address t_struct_aesctx [ArraySubsc i; StructField _buf] ctx)
(Vint (Int.repr 1))) =
field_address t_struct_aesctx [ArraySubsc (i + 1); StructField _buf] ctx),
let S0 := mbed_tls_initial_add_round_key plaintext buf in
forall (S12 : four_ints)
(HeqS12: S12 = mbed_tls_enc_rounds 12 S0 buf 4),
semax (func_tycontext f_mbedtls_aes_encrypt Vprog Gprog nil)
(PROP ( )
LOCAL (temp _RK
(field_address t_struct_aesctx [ArraySubsc 52; StructField _buf]
ctx); temp _X3 (Vint (col 3 S12));
temp _X2 (Vint (col 2 S12)); temp _X1 (Vint (col 1 S12));
temp _X0 (Vint (col 0 S12));
temp _output output; gvars gv)
SEP (data_at_ out_sh (tarray tuchar 16) output; tables_initialized (gv _tables);
data_at in_sh (tarray tuchar 16) (map Vint (map Int.repr plaintext)) input;
data_at ctx_sh t_struct_aesctx
(Vint (Int.repr Nr),
(field_address t_struct_aesctx [ArraySubsc 0; StructField _buf] ctx,
map Vint (map Int.repr buf)))
ctx))
encryption_after_loop
(frame_ret_assert
(function_body_ret_assert tvoid
(PROP ( )
LOCAL ()
SEP (data_at ctx_sh t_struct_aesctx
(Vint (Int.repr spec_utils_LL.Nr),
(field_address t_struct_aesctx [StructField _buf] ctx,
map Vint (map Int.repr buf))) ctx;
data_at in_sh (tarray tuchar 16) (map Vint (map Int.repr plaintext))
input;
data_at out_sh (tarray tuchar 16)
(map Vint (mbed_tls_aes_enc plaintext buf)) output;
tables_initialized (gv _tables)))) emp).