{
  "slug": "implementations",
  "name": "Verified implementations",
  "short": "implementation verification",
  "title": "Verified cryptographic implementations: Jasmin, hax, Cryptol/SAW, Fiat-Crypto, HACL*, CryptoLine, Kani compared",
  "summary": "Frameworks that prove properties of the code that ships: functional correctness against a specification, memory safety, and constant-time behaviour, for C, Rust, assembly and generated field arithmetic. This is where post-quantum verification happens in practice: ML-KEM and ML-DSA implementations in libjade, libcrux, AWS-LC, mlkem-native and Apple corecrypto all carry machine-checked proofs from tools in this category.",
  "intro": [
    "A verified specification is not a verified deployment. Implementation-level tools connect the two, either by generating code from a proof (Fiat-Crypto, Jasmin), by proving hand-written code equivalent to a spec (Cryptol/SAW, CryptoLine, HACL*), or by extracting a model from production Rust into a prover (hax, Aeneas). Bounded model checkers (Kani, CBMC) sit at the cheaper end: they prove memory safety and absence of panics within loop bounds, with no specification needed.",
    "Two lessons from 2026 shape how to read this category. Verified code has shipped at scale (Firefox, Linux, Go, BoringSSL, Signal, AWS). And verification has a boundary: the February 2026 Verification Theatre paper documented 13 vulnerabilities in verified libraries, four inside code covered by proofs, all caused by properties that were never specified. Ask every implementation-verification vendor to state the boundary."
  ],
  "choose": [
    "High-speed assembly for a primitive with a matching EasyCrypt proof: **Jasmin** and **libjade**.",
    "Production Rust that must stay readable: **hax** (to F*, Rocq, Lean, ProVerif) or **Aeneas** (to Lean), with **Kani** for panic and memory-safety proofs on the rest.",
    "Hand-optimised C or assembly against a reference: **Cryptol and SAW**, **CryptoLine** for bignum and NTT arithmetic, **CBMC** for memory safety.",
    "Field arithmetic for a new curve or field: **Fiat-Crypto** generates it with a proof.",
    "A whole verified library rather than a proof of your own code: HACL* / EverCrypt or **libcrux**."
  ],
  "tools": [
    {
      "name": "Jasmin and libjade",
      "page": "https://sorryfree.com/frameworks/jasmin/"
    },
    {
      "name": "hax",
      "page": "https://sorryfree.com/frameworks/hax/"
    },
    {
      "name": "Cryptol and SAW",
      "page": "https://sorryfree.com/frameworks/cryptol-saw/"
    },
    {
      "name": "Fiat-Crypto",
      "page": "https://sorryfree.com/frameworks/fiat-crypto/"
    },
    {
      "name": "HACL*, Vale and EverCrypt",
      "page": "https://sorryfree.com/frameworks/hacl-star/"
    },
    {
      "name": "Aeneas",
      "page": "https://sorryfree.com/frameworks/aeneas/"
    },
    {
      "name": "Kani",
      "page": "https://sorryfree.com/frameworks/kani/"
    },
    {
      "name": "CBMC",
      "page": "https://sorryfree.com/frameworks/cbmc/"
    },
    {
      "name": "CryptoLine",
      "page": "https://sorryfree.com/frameworks/cryptoline/"
    },
    {
      "name": "Verus",
      "page": "https://sorryfree.com/frameworks/verus/"
    }
  ],
  "page": "https://sorryfree.com/categories/implementations/",
  "updated": "2026-09-13"
}