val is_safe (#ip: ipkg) (i: ip.Pkg.t{ip.Pkg.registered i})
    : ST bool
      (requires fun h0 -> True)
      (ensures fun h0 b h1 -> modifies_none h0 h1 /\ (b <==> safe i))
val is_safe (#ip: ipkg) (i: ip.Pkg.t{ip.Pkg.registered i})
    : ST bool
      (requires fun h0 -> True)
      (ensures fun h0 b h1 -> modifies_none h0 h1 /\ (b <==> safe i))
let is_safe (#ip:ipkg) (i:ip.Pkg.t{ip.Pkg.registered i}): ST bool 
  (requires fun h0 -> True)
  (ensures fun h0 b h1 -> modifies_none h0 h1 /\ (b <==> safe i))
  =
  let b = ip.Pkg.get_honesty i in
  ideal && b
(**! Idealizing agile HMAC; independent of TLS, used for TLS 1.3 Finished message payloads and Binders. *)
module MiTLS.HMAC.UFCMA
open MiTLS

open FStar.Bytes
open MiTLS.Mem

module MDM = FStar.Monotonic.DependentMap

#set-options "--initial_fuel 1 --max_fuel 1 --initial_ifuel 1 --max_ifuel 1"

type lbytes32 n = FStar.Bytes.lbytes (UInt32.v n)

let ipkg = Pkg.ipkg

let model = Flags.model
let ideal = Flags.ideal_HMAC // secret idealization flag for the UFCMA assumption

type safe (#ip:ipkg) (i:ip.Pkg.t) = b2t ideal /\ ip.Pkg.honest i
/
Spec.Hash.Definitions.fst.checked Spec.Agile.HMAC.fsti.checked Spec.Agile.Hash.fsti.checked prims.fst.checked MiTLS.Random.fst.checked MiTLS.Pkg.fst.checked MiTLS.Mem.fst.checked MiTLS.HMAC.fsti.checked MiTLS.Hashing.Spec.fst.checked MiTLS.Hashing.fsti.checked MiTLS.Flags.fst.checked Hacl.Hash.Definitions.fst.checked FStar.UInt8.fsti.checked FStar.UInt32.fsti.checked FStar.Set.fsti.checked FStar.Pervasives.Native.fst.checked FStar.Pervasives.fsti.checked FStar.Monotonic.DependentMap.fsti.checked FStar.IO.fst.checked FStar.Bytes.fsti.checked
MiTLS.HMAC.UFCMA.fst
i: Idx?.t ip {Idx?.registered ip i} -> FStar.HyperStack.ST.ST Prims.bool
MiTLS.HMAC.UFCMA.ipkg MiTLS.Pkg.__proj__Idx__item__t MiTLS.Pkg.__proj__Idx__item__registered Prims.op_AmpAmp MiTLS.HMAC.UFCMA.ideal Prims.bool MiTLS.Pkg.__proj__Idx__item__get_honesty FStar.Monotonic.HyperStack.mem Prims.l_True Prims.l_and FStar.HyperStack.ST.modifies_none Prims.l_iff Prims.b2t MiTLS.HMAC.UFCMA.safe
let is_safe (#ip: ipkg) (i: ip.Pkg.t{ip.Pkg.registered i})
    : ST bool
      (requires fun h0 -> True)
      (ensures fun h0 b h1 -> modifies_none h0 h1 /\ (b <==> safe i)) =
  
let b = ip.Pkg.get_honesty i in
ideal && b