ShannonProver: Towards Automating Formal Cryptographic Proofs

Abstract: Cryptographic proofs are produced at a scale that increasingly exceeds the community's ability to verify them manually. Machine-checked proofs offer a path toward scalable proof verification, but writing proof scripts for expressive proof assistants such as EasyCrypt remains a major bottleneck: even when the high-level proof plan is known, converting it into proof tactics requires substantial reasoning effort. This paper presents ShannonProver, an agentic framework for automating cryptographic proofs. ShannonProver targets the setting in which a cryptographer provides the security model and a decomposition of the target theorem into lemma-level proof obligations, while the system automatically constructs EasyCrypt proof scripts for those obligations. We evaluate ShannonProver on a dataset of formal cryptographic proofs in EasyCrypt. The dataset spans textbook primitives, deployed protocols, and standardization efforts such as NIST proposals, and includes expert case studies drawn from a corpus that has not previously been available online. We show that ShannonProver can automate substantial portions of cryptographic proof engineering for case studies such as ChaChaPoly1305 and MEE-CBC. More broadly, this work suggests a path toward accelerating cryptographic research: as agents automate the proof-engineering burden, cryptographers can iterate more quickly on new constructions, obtain machine-checked assurance earlier, and bring trustworthy protocols from design to deployment faster.

• The paper demonstrates that agent-based automation can drastically reduce cryptographic proof engineering time, cutting expert efforts from weeks to days.
• It introduces a proof-state compiler that efficiently extracts live resources and a tree-based multi-agent orchestration that optimizes tactic-level lemma proving.
• Empirical evaluations on protocols like ChaCha20-Poly1305 show cost efficiency improvements under $250 per proof pass and enhanced proof script quality.

ShannonProver: Automating Formal Cryptographic Proof Construction

Motivation and Problem Statement

The paper "ShannonProver: Towards Automating Formal Cryptographic Proofs" (2607.02847) addresses the increasing gap between the rate at which cryptographers generate proofs and the community's ability to manually verify them. Cryptographic protocols have become standards and underpin critical security infrastructure. While proof assistants like EasyCrypt allow for machine-checked verification, the bottleneck is in producing executable, tactic-level proof scripts that require explicit reasoning, detailed program structure management, and intricate lemma decomposition.

Manual formalization for large-scale protocols (e.g., TLS, NIST post-quantum standardization efforts) is highly labor-intensive, often requiring expert-months of effort. The central research question is whether agentic AI systems can automate significant portions of cryptographic proof engineering, specifically the last phase—tactic-level lemma proving—once the protocol model and lemma decomposition are available.

System Architecture and Design Innovations

ShannonProver implements two novel design concepts: state-aware proof context management and multi-agent tree-based proof orchestration.

The first, the proof-state compiler, deterministically produces an agent-facing context view, extracting live proof resources (lemmas, modules, types), argument instantiations, structural matches, and diagnostics relative to the evolving EasyCrypt proof state. This context is dynamically projected to the agent after each tactic execution, eliminating the need for the agent to repeatedly reconstruct the relevant state from static files.

The second innovation, the multi-agent collaborative tree-search policy, orchestrates diverse proof strategies by maintaining a proof tree of accepted prefixes. Multiple agents explore branches, backtrack upon dead ends, and negative memory prevents redundant retries along failed routes. This dual design shifts agents from brute-force tactic enumeration to informed search over relevant proof contexts and strategies.

Proof-State Compiler: Structure and Mechanisms

The proof-state compiler operates in four layers:

• State Projection: Identifies the committed proof snapshot after each change, preventing contamination from failed transitions or rollbacks.
• ProofIR (Intermediate Representation): Assigns semantic meaning to the current goal, distinguishing proof layers (probability algebra, pRHL equivalence, procedure boundary) and marking relevant proof resources.
• Resource Liveness and Frontier Analysis: Determines which resources are currently usable at the state’s program frontier, which are blocked, and which are stale.
• Action Surface: Exposes a compact interface of resource references, argument bindings, inspection tools, probing actions, and state-aware diagnostics for targeted agent queries.

This structure ensures that agents allocate their reasoning budget toward proof strategy, rather than context reconstruction or mechanical debugging.

Tree-Based Orchestration: Exploration and Coordination

Proof construction is non-linear in cryptographic verification, especially for invariant-synthesis and game-hop lemmas. ShannonProver's orchestrator manages agent spawning and pruning across the proof tree, utilizing negative memory and backtracking to achieve deeper exploration and higher solve rates. Key metrics empirically demonstrate that multi-agent orchestration substantially increases success rates for challenging lemma classes.

Evaluation: Ablations, Performance, and Quality Analysis

The evaluation spans a controlled ablation study and case studies on benchmark cryptographic projects ChaCha20-Poly1305, MEE-CBC, and CMAC. Error-generation rates are similar between raw checker-in-the-loop agents and ShannonProver, but ShannonProver sharply reduces agent time spent in error recovery (mechanical friction). Notably, ShannonProver expedites lemma-level proof automation at scale, reducing required expert-weeks to expert-days or less.

ShannonProver achieves impressive API cost efficiency: for ChaCha20-Poly1305, a complete proof pass costs under $250 and finishes in a day, with most costs concentrated in difficult lemmas. The system is practical for iterative formalization, where cryptographers revise decompositions and re-run proofs for rapid feedback.

Proof quality annotations on generated scripts show improvement in concision, maintainability, and semantic idiom for ShannonProver over human or baseline proofs, particularly for hard lemmas marked with "tesuji" moves—short, elegant proof strategies discovered by the agent.

Benchmark and Contamination-Free Evaluation

A newly constructed benchmark of 1.6K EasyCrypt lemmas is released, analogized to established math theorem-proving corpora but tailored to game-based cryptography. The CMAC dataset, previously unavailable online, is used as a held-out contamination control, demonstrating that ShannonProver success is not attributable to LLM memorization but genuine proof construction.

Related Work and Broader Context

ShannonProver builds atop game-based computational proof assistants (EasyCrypt, CertiCrypt, CryptHOL, SSProve), contrasting with symbolic protocol analysis tools (Tamarin, ProVerif) and code verification frameworks (HACL*, EverCrypt, Jasmin, F*). Unlike prior LLM-driven theorem proving focused on mathematical reasoning or static script generation, ShannonProver targets live, tactic-level proof construction in cryptographic protocol security. Related recent works (CatCrypt) and Lean-based verification projects suggest potential generalization to other formal verification domains.

Implications and Future Directions

ShannonProver demonstrates that agentic automation is feasible for non-trivial formal cryptographic proofs at reasonable compute costs. Theoretical implications include the possibility of shifting proof engineering workloads toward agents, freeing cryptographers to focus on decomposition, abstraction, and critical modeling. Practically, ShannonProver can accelerate standardization, reduce latency from design proposal to machine-checked deployment, and potentially revolutionize collaborative cryptographic research.

Future developments are envisioned along several axes: automating the lemma decomposition phase (not just tactic-level scripting), scaling to larger post-quantum projects with extensive proof dependencies, and extending the harness-compiler paradigm to Lean, Coq, and implementation verification contexts. Integrating ShannonProver with secure implementation verification will be critical for bridging design-level proofs and executable cryptographic code.

Conclusion

ShannonProver enables substantial automation of formal cryptographic proof engineering by harmonizing deterministic proof-state compilation and agentic orchestration. Empirical results substantiate its efficacy across challenging benchmarks and real-world protocols. This work lays the foundation for scalable AI-assisted formal verification in cryptography and invites further research into agent-centric proof development frameworks.