Local Open Scope Z.
Definition encryption_loop_body : statement :=
ltac:(find_statement_in_body
f_mbedtls_aes_encrypt
reassociate_stmt
ltac:(fun body => match body with
context [  Sloop
(Ssequence
(Sifthenelse (Ebinop Ogt (Etempvar _i _) (Econst_int (Int.repr 0) _)  _)
Sskip  Sbreak)
?S) _ ] => S
end)).
Definition encryption_loop_body_proof_statement :=
forall
(Espec : OracleKind)
(ctx input output : val)
(ctx_sh in_sh out_sh : share)
(plaintext exp_key : list Z)
(gv : globals)
(H : Zlength plaintext = 16)
(H0 : Zlength exp_key = 60)
(SH : readable_share ctx_sh)
(SH0 : readable_share in_sh)
(SH1 : writable_share out_sh)
(buf : list Z)
(Heqbuf : buf = exp_key ++ list_repeat 8 0)
(Fctx : field_compatible t_struct_aesctx [StructField _buf] ctx)
(LenBuf : Zlength buf = 68)
(Eq : forall i : Z,
0 <= i < 60 ->
force_val
(sem_add_ptr_int tuint Signed
(field_address t_struct_aesctx [ArraySubsc i; StructField _buf] ctx)
(Vint (Int.repr 1))) =
field_address t_struct_aesctx [ArraySubsc (i + 1); StructField _buf] ctx)
(S12 S0 : four_ints)
(HeqS0 : S0 = mbed_tls_initial_add_round_key plaintext buf)
(HeqS12 : S12 = mbed_tls_enc_rounds 12 S0 buf 4)
(i : Z)
(H1 : 0 < i <= 6),
semax (func_tycontext f_mbedtls_aes_encrypt Vprog Gprog nil)
(PROP ( )
LOCAL (temp _i (Vint (Int.repr i));
temp _RK
(field_address t_struct_aesctx
[ArraySubsc (52 - i * 8); StructField _buf] ctx);
temp _X3
(Vint (col 3 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat i) S0 buf 4)));
temp _X2
(Vint (col 2 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat i) S0 buf 4)));
temp _X1
(Vint (col 1 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat i) S0 buf 4)));
temp _X0
(Vint (col 0 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat i) S0 buf 4)));
temp _output output;
gvars gv)
SEP (data_at_ out_sh (tarray tuchar 16) output;
data_at Ews t_struct_tables
(map Vint FSb,
(map Vint FT0,
(map Vint FT1,
(map Vint FT2,
(map Vint FT3,
(map Vint RSb,
(map Vint RT0,
(map Vint RT1, (map Vint RT2, (map Vint RT3, map Vint RCON))))))))))
(gv _tables);
data_at in_sh (tarray tuchar 16) (map Vint (map Int.repr plaintext)) input;
data_at ctx_sh t_struct_aesctx
(Vint (Int.repr Nr),
(field_address t_struct_aesctx [ArraySubsc 0; StructField _buf] ctx,
map Vint (map Int.repr buf))) ctx))
encryption_loop_body
(normal_ret_assert
(EX a : Z,
PROP (0 < a <= 6)
LOCAL (temp _i (Vint (Int.repr a));
temp _RK
(field_address t_struct_aesctx
[ArraySubsc (52 - (a - 1) * 8); StructField _buf] ctx);
temp _X3
(Vint
(col 3 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat (a - 1)) S0 buf 4)));
temp _X2
(Vint
(col 2 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat (a - 1)) S0 buf 4)));
temp _X1
(Vint
(col 1 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat (a - 1)) S0 buf 4)));
temp _X0
(Vint
(col 0 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat (a - 1)) S0 buf 4)));
temp _output output; gvars gv)
SEP (data_at_ out_sh (tarray tuchar 16) output;
data_at Ews t_struct_tables
(map Vint FSb,
(map Vint FT0,
(map Vint FT1,
(map Vint FT2,
(map Vint FT3,
(map Vint RSb,
(map Vint RT0,
(map Vint RT1, (map Vint RT2, (map Vint RT3, map Vint RCON))))))))))
(gv _tables);
data_at in_sh (tarray tuchar 16) (map Vint (map Int.repr plaintext))
input;
data_at ctx_sh t_struct_aesctx
(Vint (Int.repr Nr),
(field_address t_struct_aesctx [ArraySubsc 0; StructField _buf] ctx,
map Vint (map Int.repr buf))) ctx))%assert).
(* previous version used loop1_ret_assert, for the same proof Definition encryption_loop_body_proof_statement := forall (Espec : OracleKind) (DS: PTree.t funspec) (ctx input output : val) (ctx_sh in_sh out_sh : share) (plaintext exp_key : list Z) (tables : val) (H : Zlength plaintext = 16) (H0 : Zlength exp_key = 60) (SH : readable_share ctx_sh) (SH0 : readable_share in_sh) (SH1 : writable_share out_sh) (buf : list Z) (Heqbuf : buf = exp_key ++ list_repeat 8 0) (Fctx : field_compatible t_struct_aesctx [StructField _buf] ctx) (LenBuf : Zlength buf = 68) (Eq : forall i : Z, 0 <= i < 60 -> force_val (sem_add_pi tuint (field_address t_struct_aesctx [ArraySubsc i; StructField _buf] ctx) (Vint (Int.repr 1))) = field_address t_struct_aesctx [ArraySubsc (i + 1); StructField _buf] ctx) (S12 S0 : four_ints) (HeqS0 : S0 = mbed_tls_initial_add_round_key plaintext buf) (HeqS12 : S12 = mbed_tls_enc_rounds 12 S0 buf 4) (i : Z) (H1 : 0 < i <= 6), semax (encryption_loop_body_Delta DS) (PROP ( ) LOCAL (temp _i (Vint (Int.repr i)); temp _RK (field_address t_struct_aesctx [ArraySubsc (52 - i * 8); StructField _buf] ctx); temp _X3 (Vint (col 3 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat i) S0 buf 4))); temp _X2 (Vint (col 2 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat i) S0 buf 4))); temp _X1 (Vint (col 1 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat i) S0 buf 4))); temp _X0 (Vint (col 0 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat i) S0 buf 4))); temp _output output; gvar _tables tables) SEP (data_at_ out_sh (tarray tuchar 16) output; data_at Ews t_struct_tables (map Vint FSb, (map Vint FT0, (map Vint FT1, (map Vint FT2, (map Vint FT3, (map Vint RSb, (map Vint RT0, (map Vint RT1, (map Vint RT2, (map Vint RT3, map Vint RCON)))))))))) tables; data_at in_sh (tarray tuchar 16) (map Vint (map Int.repr plaintext)) input; data_at ctx_sh t_struct_aesctx (Vint (Int.repr Nr), (field_address t_struct_aesctx [ArraySubsc 0; StructField _buf] ctx, map Vint (map Int.repr buf))) ctx)) encryption_loop_body (loop1_ret_assert (EX i0 : Z, PROP (0 < i0 <= 6) LOCAL (temp _i (Vint (Int.repr i0)); temp _RK (field_address t_struct_aesctx [ArraySubsc (52 - (i0 - 1) * 8); StructField _buf] ctx); temp _X3 (Vint (col 3 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat (i0 - 1)) S0 buf 4))); temp _X2 (Vint (col 2 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat (i0 - 1)) S0 buf 4))); temp _X1 (Vint (col 1 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat (i0 - 1)) S0 buf 4))); temp _X0 (Vint (col 0 (mbed_tls_enc_rounds (12 - 2 * Z.to_nat (i0 - 1)) S0 buf 4))); temp _output output; gvar _tables tables) SEP (data_at_ out_sh (tarray tuchar 16) output; tables_initialized tables; data_at in_sh (tarray tuchar 16) (map Vint (map Int.repr plaintext)) input; data_at ctx_sh t_struct_aesctx (Vint (Int.repr Nr), (field_address t_struct_aesctx [ArraySubsc 0; StructField _buf] ctx, map Vint (map Int.repr buf))) ctx))%assert (normal_ret_assert (PROP ( ) LOCAL (temp _RK (field_address t_struct_aesctx [ArraySubsc 52; StructField _buf] ctx); temp _X3 (Vint (col 3 S12)); temp _X2 (Vint (col 2 S12)); temp _X1 (Vint (col 1 S12)); temp _X0 (Vint (col 0 S12)); temp _output output; gvar _tables tables) SEP (data_at_ out_sh (tarray tuchar 16) output; tables_initialized tables; data_at in_sh (tarray tuchar 16) (map Vint (map Int.repr plaintext)) input; data_at ctx_sh t_struct_aesctx (Vint (Int.repr Nr), (field_address t_struct_aesctx [ArraySubsc 0; StructField _buf] ctx, map Vint (map Int.repr buf))) ctx)))).*)
Hint Resolve 0%Z : inhabited.

Lemma encryption_loop_body_proof: encryption_loop_body_proof_statement.