(** * Properties of string comparison *)

Lemma compare_spec (s1 s2 : string) (c : comparison) :
compare s1 s2 = c <->
exists i,
to_Z i <= to_Z (length s1) /\
to_Z i <= to_Z (length s2) /\
(forall j, to_Z j < to_Z i -> get s1 j = get s2 j) /\
match (i =? length s1, i =? length s2)%uint63 with
| (true , true ) => c = Eq
| (true , false) => c = Lt
| (false, true ) => c = Gt
| (false, false) =>
match Uint63.compare (get s1 i) (get s2 i) with
| Eq => False
| ci => c = ci
end
end.