theory/ — derivations and exact verifications
Each subdirectory holds the mathematical notes behind one section of the paper and the scripts that verify the
corresponding identities with exact arithmetic (Stage 3 of the pipeline). The prose derivations live in
paper/sections/; this directory keeps what can be executed.
| Directory | Paper section | Executable checks |
|---|---|---|
elliptic_curves/ |
§2, §4 | symbolic_checks.py (S1–S6: closure of the group law, φ is an endomorphism, x-only differential addition, Semaev S₃, ECDSA malleability, Schnorr correctness); orbit_quotient_counterexample.py (H05) |
discrete_log/ |
§5 | cost models (cost_models.py): expected iterations for rho/BSGS/kangaroo/preprocessing used as the theoretical curves in the figures |
ecdsa/ |
§6.1 | notes.md (signing/verification derivation, nonce-reuse recovery on synthetic keys in src/wp34/ecdsa.py) |
schnorr/ |
§6.2–6.3 | notes.md (BIP340 construction, batch-verification soundness bound) |
sha256/ |
§7 | notes.md (step inverse, schedule inversion, linearised local collision — formal versions in formal/) |