[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82699-en":3,"doc-seo-82699-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82699,4810365810221,"Aurora","https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d",8,"Research & Report","ShannonProver: Towards Automating Formal Cryptographic Proofs","Cryptographic proofs are increasingly too large to verify manually, motivating scalable machine-checked verification. The main bottleneck remains converting a known high-level proof plan into tactic scripts for expressive proof assistants such as EasyCrypt. This paper introduces ShannonProver, an agentic framework where a cryptographer supplies the security model and decomposes the target theorem into lemma-level obligations, and the system automatically generates EasyCrypt scripts for each obligation. Experiments on EasyCrypt formalizations show automation for substantial proof-engineering effort across primitives and case studies.","ShannonProver: Towards Automating Formal Cryptographic Proofs  \nYiping Ma†, Yu-Lin Tsai†, Mayank Rathee†, Deevashwer Rathee†, François Dupressoir‡, Pierre-Yves Strub§ , Raluca Ada Popa†  \n† UC Berkeley ‡ University of Bristol §PQ Shield  \narXiv :2607 .02847v2 [ cs .CR] 8 Jul 2026  \nAbstract—Cryptographic proofs are produced at a scale that increasingly exceeds the community’s ability to verify them manually. Machine-checked proofs offer a path toward scalable proof verification, but writing proof scripts for expressive proof assistants such as EasyCrypt remains a major bottleneck: even when the high-level proof plan is known, converting it into proof tactics requires substantial reasoning effort. This paper presents ShannonProver, an agentic framework for automating cryptographic proofs. ShannonProver targets the setting in which a cryptographer provides the security model and a decomposition of the target theorem into lemma-level proof obligations, while the system automatically constructs EasyCrypt proof scripts for those obligations.  \nWe evaluate ShannonProver on a dataset of formal cryptographic proofs in EasyCrypt. The dataset spans textbook primitives, deployed protocols, and standardization efforts such as NIST proposals, and includes expert case studies drawn from a corpus that has not previously been available online. We show that ShannonProver can automate substantial portions of cryptographic proof engineering for case studies such as ChaChaPoly1305 and MEE-CBC. More broadly, this work suggests a path toward accelerating cryptographic research: as agents automate the proof-engineering burden, cryptographers can iterate more quickly on new constructions, obtain machinechecked assurance earlier, and bring trustworthy protocols from design to deployment faster.  \n1. Introduction  \nCryptographers “generate more proofs than we carefully verify”, as Halevi observed two decades ago [1] . This concern is even more pressing today. Modern cryptographic protocols are increasingly complex, their proofs are longer and more intricate, and their correctness has consequences far beyond research papers: they have become standards [2– 5], libraries [6–9], and security infrastructure [5,10–12] . Flaws discovered after publication or even standardization underscore the same point [13,14]: the community cannot manually scrutinize cryptographic proofs at the same scale at which it produces them.  \nMachine-checked proofs offer a way to scale proof verification. Once a proof is written in tactic language as a proof script1 , a proof assistant (a deterministic proof checker)  \n1. A sequence of commands which constructs definitions, declarations, theories, and proofs that a proof assistant can mechanically verify.  \nsuch as EasyCrypt [15], Lean [16], and others [17–20] can mechanically check the proof script to certify the claimed theorem, without any expert examining the argument by hand. However, the bottleneck shifts to producing the proof script in the first place.  \nWriting such proof scripts is far more exacting and effortful than writing traditional pen-and-paper proofs, and it is time-consuming even for experts. The reason is that machine-checked proof is not a line-by-line translation of pen-and-paper proof; rather, it expands the cryptographer’s shorthand of a cryptographic argument (e.g., “two games are indistinguishable”) into explicit stateful programs and precisely reasons about the program equivalence. In the past, obtaining formally verified standardized schemes used in TLS such as MEE-CBC [21], CMAC [22], and ChaCha20-Poly1305 [23] required several expert-weeks to several expert-months2 , and the effort for recent post-quantum NIST standardization efforts such as Kyber [24] and MLKEM [13,25] is even larger, involving more than 10 experts for one or two years.  \nA natural question is whether AI agents can accelerate writing these proofs. This setting appears to be well suited to AI agents: proof search can be heuristic, but ","cbCaidiLHLNDrNP9","https://ap.wps.com/l/cbCaidiLHLNDrNP9","pdf",445870,1,20,"English","en",105,"# Introduction\n## Machine-checked proof verification and its bottleneck\n## Agentic approaches and checker-in-the-loop\n## ShannonProver workflow and evaluation","[{\"question\":\"What problem does ShannonProver aim to solve in cryptographic proof engineering?\",\"answer\":\"It reduces the effort of converting high-level cryptographic proof plans into tactic-level scripts for proof assistants like EasyCrypt, which is a major bottleneck for scalable verification.\"},{\"question\":\"What inputs does ShannonProver require from the cryptographer?\",\"answer\":\"The system takes the security model and a decomposition of the target theorem into lemma-level proof obligations.\"},{\"question\":\"How is ShannonProver evaluated and what does it achieve?\",\"answer\":\"It is evaluated on a dataset of formal cryptographic proofs in EasyCrypt, including primitives, deployed protocols, and NIST-related efforts, showing automation of substantial proof-engineering work for cases such as ChaChaPoly1305 and MEE-CBC.\"}]",1784182367,50,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"shannonprover-towards-automating-formal-cryptographic-proofs","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/shannonprover-towards-automating-formal-cryptographic-proofs/82699/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does ShannonProver aim to solve in cryptographic proof engineering?","Question",{"text":75,"@type":76},"It reduces the effort of converting high-level cryptographic proof plans into tactic-level scripts for proof assistants like EasyCrypt, which is a major bottleneck for scalable verification.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What inputs does ShannonProver require from the cryptographer?",{"text":80,"@type":76},"The system takes the security model and a decomposition of the target theorem into lemma-level proof obligations.",{"name":82,"@type":73,"acceptedAnswer":83},"How is ShannonProver evaluated and what does it achieve?",{"text":84,"@type":76},"It is evaluated on a dataset of formal cryptographic proofs in EasyCrypt, including primitives, deployed protocols, and NIST-related efforts, showing automation of substantial proof-engineering work for cases such as ChaChaPoly1305 and MEE-CBC.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,114,119,122,126,129,133],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":28,"slug":113},6,"Technology","technology",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":21,"slug":125},9,"Religion & Spirituality","religion-spirituality",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":127,"show_sort_weight":21,"slug":128},"World Cup","world-cup",{"id":130,"doc_module":4,"doc_module_name":45,"category_name":131,"show_sort_weight":130,"slug":132},10,"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":45,"category_name":135,"show_sort_weight":106,"slug":136},19,"General","general"]