val encrypt
  (i: id)
  (w: aead_writer i)
  (n: nonce)
  (aad: ad (wgetinfo w))
  (l: at_least (wgetinfo w))
  (p: plain (wgetinfo w) l)
  : Stack (cipher (wgetinfo w) l)
  (requires (fun h0 ->
    winvariant w h0 /\
    (is_safe i ==> fresh_nonce w n h0)))
  (ensures (fun h0 c h1 ->
    B.modifies (wfootprint w) h0 h1 /\
    winvariant w h1 /\
    (is_safe i ==>
      wlog w h1 == Seq.snoc (wlog w h0) (Entry n aad p c)) /\
    (~ (is_safe i) ==> (
      let a: Spec.supported_alg = I.ae_id_ginfo i in
      let k: Spec.kv a = wkey w in
      let iv : Spec.iv a = Model.Helpers.hide n in
      let p = (wgetinfo w).plain_pkg.as_bytes i l p in
      c == Spec.encrypt #(I.ae_id_ginfo i) k iv aad p))))
val encrypt
  (i: id)
  (w: aead_writer i)
  (n: nonce)
  (aad: ad (wgetinfo w))
  (l: at_least (wgetinfo w))
  (p: plain (wgetinfo w) l)
  : Stack (cipher (wgetinfo w) l)
  (requires (fun h0 ->
    winvariant w h0 /\
    (is_safe i ==> fresh_nonce w n h0)))
  (ensures (fun h0 c h1 ->
    B.modifies (wfootprint w) h0 h1 /\
    winvariant w h1 /\
    (is_safe i ==>
      wlog w h1 == Seq.snoc (wlog w h0) (Entry n aad p c)) /\
    (~ (is_safe i) ==> (
      let a: Spec.supported_alg = I.ae_id_ginfo i in
      let k: Spec.kv a = wkey w in
      let iv : Spec.iv a = Model.Helpers.hide n in
      let p = (wgetinfo w).plain_pkg.as_bytes i l p in
      c == Spec.encrypt #(I.ae_id_ginfo i) k iv aad p))))
let encrypt i w nonce aad plain_length plain =
  if is_safe i then
    let a = (wgetinfo w).alg in
    let w: model_writer i = w in
    let p = dsnd w in
    let log = !*p in
    let cipher_length = (plain_length <: nat) + Spec.tag_length a in
    let cipher = random cipher_length in
    p *= Seq.snoc log (Entry #i #(wgetinfo w) nonce aad #plain_length plain cipher);
    cipher
  else
    let a = (wgetinfo w).alg in
    let k: Spec.kv a = wkey w in
    let iv = Helpers.hide nonce in
    let p = (wgetinfo w).plain_pkg.repr i plain_length plain in
    Spec.encrypt #a k iv aad p
module Model.AEAD

module HS = FStar.HyperStack
module I = Model.Indexing
module U32 = FStar.UInt32
module U128 = FStar.UInt128
module B = LowStar.Buffer
module Spec = Spec.Agile.AEAD

#set-options "--fuel 0 --ifuel 0"

open Mem
open LowStar.BufferOps
open Model.Helpers

let log #i (u: info i): Type0 =
  Seq.seq (entry i u)

let model_writer i: Type u#1 =
  u:info i & B.pointer (log #i u)

let unsafe_writer i =
  info i & Spec.kv (I.ae_id_ginfo i)

let aead_writer (i: id): Type u#1 =
  if is_safe i then
    model_writer i
  else
    unsafe_writer i

let aead_reader #i (w: aead_writer i) =
  w':aead_writer i { w' == w }

let wgetinfo #i (u: aead_writer i) =
  if is_safe i then
    dfst (u <: model_writer i)
  else
    fst (u <: unsafe_writer i)

let rgetinfo #_ #w _ =
  wgetinfo w

let wlog #i w h =
  B.deref h (dsnd (w <: model_writer i))

let wkey #i w =
  snd (w <: unsafe_writer i)

let wfootprint #i w =
  if is_safe i then
    B.loc_addr_of_buffer (dsnd (w <: model_writer i))
  else
    B.loc_none

let winvariant #i w h =
  if is_safe i then
    B.live h (dsnd (w <: model_writer i))
  else
    True

let wframe_invariant #_ w h0 l h1 =
  ()

let frame_log #_ w h0 l h1 =
  ()

let gen i u =
  if is_safe i then
    let l: log #i u = Seq.empty #(entry i u) in
    ((| u, B.malloc q_ae_region l 1ul |) <: model_writer i)
  else
    let key_l = Spec.key_length u.alg in
    (u, random key_l) <: unsafe_writer i

let gen_reader #i w =
  w

let coerce #i u kv =
  (u, kv) <: unsafe_writer i

// With QUIC-specific derivation of key from transport secret
let quic_coerce #i u ts =
  coerce u
    (QUIC.Spec.derive_secret u.halg ts
      QUIC.Spec.label_key (Spec.key_length u.alg))
/
Spec.Agile.AEAD.fsti.checked QUIC.Spec.fsti.checked prims.fst.checked Model.Indexing.fsti.checked Model.Helpers.fsti.checked Mem.fst.checked LowStar.BufferOps.fst.checked LowStar.Buffer.fst.checked FStar.UInt32.fsti.checked FStar.UInt128.fsti.checked FStar.Seq.fst.checked FStar.Pervasives.Native.fst.checked FStar.Pervasives.fsti.checked FStar.HyperStack.fst.checked
Model.AEAD.fst

    i: Model.AEAD.id ->
    w: Model.AEAD.aead_writer i ->
    n: Model.AEAD.nonce ->
    aad: Model.AEAD.ad (Model.AEAD.wgetinfo w) ->
    l: Model.AEAD.at_least (Model.AEAD.wgetinfo w) ->
    p: Model.AEAD.plain (Model.AEAD.wgetinfo w) l
  -> FStar.HyperStack.ST.Stack (Model.AEAD.cipher (Model.AEAD.wgetinfo w) l)
Model.AEAD.id Model.AEAD.aead_writer Model.AEAD.nonce Model.AEAD.ad Model.AEAD.wgetinfo Model.AEAD.at_least Model.AEAD.plain Model.AEAD.is_safe Model.AEAD.cipher Prims.unit LowStar.BufferOps.op_Star_Equals Model.AEAD.log Prims.__proj__Mkdtuple2__item___1 Model.AEAD.info LowStar.Buffer.pointer LowStar.Buffer.trivial_preorder FStar.Seq.Properties.snoc Model.AEAD.entry Model.AEAD.Entry Model.Helpers.lbytes Model.Helpers.random Prims.int Prims.op_Addition Prims.nat Spec.Agile.AEAD.tag_length LowStar.BufferOps.op_Bang_Star FStar.Pervasives.dsnd Model.AEAD.model_writer Model.AEAD.alg Model.AEAD.__proj__Mkinfo'__item__alg Prims.bool Spec.Agile.AEAD.encrypt Spec.Agile.AEAD.lbytes Prims.eq2 Model.AEAD.__proj__PlainPkg__item__as_bytes Model.AEAD.__proj__Mkinfo'__item__min_len Model.AEAD.__proj__Mkinfo'__item__plain_pkg Model.AEAD.__proj__PlainPkg__item__repr FStar.Seq.Base.length FStar.UInt8.t Model.Helpers.hide Spec.Agile.AEAD.kv Model.AEAD.wkey
let encrypt i w nonce aad plain_length plain =
  
if is_safe i
then
  let a = (wgetinfo w).alg in
  let w:model_writer i = w in
  let p = dsnd w in
  let log = !*p in
  let cipher_length = (plain_length <: nat) + Spec.tag_length a in
  let cipher = random cipher_length in
  p *= Seq.snoc log (Entry #i #(wgetinfo w) nonce aad #plain_length plain cipher);
  cipher
else
  let a = (wgetinfo w).alg in
  let k:Spec.kv a = wkey w in
  let iv = Helpers.hide nonce in
  let p = (wgetinfo w).plain_pkg.repr i plain_length plain in
  Spec.encrypt #a k iv aad p