# theory/ — derivations and exact verifications

Each subdirectory holds the mathematical notes behind one section of the paper and the scripts that verify the
corresponding identities with exact arithmetic (Stage 3 of the pipeline). The prose derivations live in
`paper/sections/`; this directory keeps what can be *executed*.

| Directory | Paper section | Executable checks |
|---|---|---|
| `elliptic_curves/` | §2, §4 | `symbolic_checks.py` (S1–S6: closure of the group law, φ is an endomorphism, x-only differential addition, Semaev S₃, ECDSA malleability, Schnorr correctness); `orbit_quotient_counterexample.py` (H05) |
| `discrete_log/` | §5 | cost models (`cost_models.py`): expected iterations for rho/BSGS/kangaroo/preprocessing used as the theoretical curves in the figures |
| `ecdsa/` | §6.1 | `notes.md` (signing/verification derivation, nonce-reuse recovery on synthetic keys in `src/wp34/ecdsa.py`) |
| `schnorr/` | §6.2–6.3 | `notes.md` (BIP340 construction, batch-verification soundness bound) |
| `sha256/` | §7 | `notes.md` (step inverse, schedule inversion, linearised local collision — formal versions in `formal/`) |