https://github.com/oxarbitrage/poseidon-formal
Lean 4 formalization of Poseidon hash — machine-verified permutation bijectivity over the Pallas base field
https://github.com/oxarbitrage/poseidon-formal
cryptography formal-verification hash-functions lean4 poseidon zcash
Last synced: 1 day ago
JSON representation
Lean 4 formalization of Poseidon hash — machine-verified permutation bijectivity over the Pallas base field
- Host: GitHub
- URL: https://github.com/oxarbitrage/poseidon-formal
- Owner: oxarbitrage
- License: mit
- Created: 2026-05-01T15:34:04.000Z (2 months ago)
- Default Branch: main
- Last Pushed: 2026-06-01T23:38:09.000Z (about 1 month ago)
- Last Synced: 2026-06-02T01:19:25.353Z (about 1 month ago)
- Topics: cryptography, formal-verification, hash-functions, lean4, poseidon, zcash
- Language: Lean
- Homepage: https://oxarbitrage.github.io/blog/formally-verifying-the-zcash-orchard-stack/
- Size: 34.2 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# poseidon-formal
**Status:** Fully proven — zero `sorry` statements.
Lean 4 formalization of the Poseidon hash function as instantiated in Zcash's Orchard protocol (t=3, R_F=8, R_P=56, α=5, over the Pallas base field 𝔽_p).
## What's formalized
**Key result: `permutation_bijective`** — the full Poseidon permutation on 𝔽_p³ is a bijection.
Proof chain:
1. `alpha_coprime` — gcd(5, p−1) = 1, so x ↦ x⁵ is a bijection on 𝔽_p (Fermat's little theorem).
2. `mds_mul_inv` — the 3×3 Cauchy MDS matrix has an explicit verified inverse.
3. Each full/partial round is a bijection (composition of bijective layers).
4. `applyRounds_bijective` — iterating bijective rounds preserves bijectivity (induction).
**Sponge-level properties** — connecting `permutation_bijective` to hash security:
- `poseidonHash_eq` — hash decomposes as squeeze ∘ permutation ∘ absorb.
- `absorb_permute_injective` — distinct inputs produce distinct post-permutation states (determinism).
- `domain_separation` — different capacity values can never produce the same output state.
- `capacity_hiding` — for any rate output, multiple internal states produce it (the capacity is not revealed).
**Algebraic degree growth** — defense against interpolation attacks:
- `symFullRound_degBound` / `symPartialRound_degBound` — one round multiplies algebraic degree by ≤ 5.
- `permutation_degree_bound` — after all 64 rounds, output degree ≤ 5⁶⁴ (interpolation requires ≥ 5⁶⁴ + 1 queries).
**CICO (Constrained-Input Constrained-Output)** — formal security reduction:
- `CICOInstance` / `IsSolution` — defines the CICO problem as a Lean predicate.
- `eval_symPermutation` — symbolic permutation agrees with concrete under evaluation.
- `cico_is_polynomial_root` / `cico_polynomial_degree` — any CICO attack reduces to finding roots of degree-5⁶⁴ polynomials.
**S-box differential uniformity** — defense against differential cryptanalysis:
- `sbox_differential_uniformity` — for any nonzero difference a, the equation (x+a)⁵ - x⁵ = b has at most 4 solutions (δ ≤ 4).
**MDS branch number** — defense against differential/linear cryptanalysis:
- `mds_branch_number` — for any nonzero v, hw(v) + hw(Mv) ≥ 4 (maximal branch number for a 3×3 matrix).
Preimage and collision resistance are **not** proven — they are conjectured from algebraic degree bounds, not derivable from bijectivity alone.
The 192 round constants are concrete 𝔽_p values from the Grain LFSR, cross-checked against the Halo 2 reference implementation.
## Axioms
None. All results are proven from first principles; `native_decide` is used for the MDS inverse and coprimality checks (Lean kernel primitive, not an axiom).
## Build
```shell
lake build
```
## Dependencies
Lean 4 (`v4.30.0-rc2`), [Mathlib4](https://github.com/leanprover-community/mathlib4), [pasta-formal](https://github.com/oxarbitrage/pasta-formal).
## References
- [Zcash Protocol Spec §5.4.1.10](https://zips.z.cash/protocol/protocol.pdf)
- [Grassi et al., "Poseidon: A New Hash Function for ZK Proof Systems"](https://eprint.iacr.org/2019/458)
- [pasta-hadeshash](https://github.com/zcash/pasta-hadeshash) — Grain LFSR round constant reference
---
## Part of a series
Six repositories formally verifying the Zcash Orchard cryptographic stack:
| Layer | Repository |
|-------|-----------|
| Curves | [pasta-formal](https://github.com/oxarbitrage/pasta-formal) |
| Hash | [poseidon-formal](https://github.com/oxarbitrage/poseidon-formal) |
| Hash-to-curve | [sinsemilla-formal](https://github.com/oxarbitrage/sinsemilla-formal) |
| Signatures | [redpallas-formal](https://github.com/oxarbitrage/redpallas-formal) |
| Protocol | [orchard-formal](https://github.com/oxarbitrage/orchard-formal) |
| Proof system | [halo2-formal](https://github.com/oxarbitrage/halo2-formal) |