CryptoLine

Direct answerCryptoLine verifies straight-line arithmetic assembly such as bignum multiplication and NTT butterflies, and has been applied to OpenSSL, BoringSSL, wolfSSL and post-quantum NTT implementations.

Maintainer: Academia Sinica (Bow-Yaw Wang)
Website: https://github.com/fmlab-iis/cryptoline
Repository: https://github.com/fmlab-iis/cryptoline
Category: Verified implementations
Targets: Bignum and NTT assemblyOpenSSLBoringSSLwolfSSLPQC NTTs
Approach: Algebraic and range reasoning on straight-line arithmetic code
Access: Open source
Status (2026-09-13): Active research

Last reviewed 2026-09-13 by the sorryfree editors.

What CryptoLine does

Its algebraic approach scales to code where SMT alone struggles, which is why it is used on the hot loops of production libraries.

Where it is strong

Handles large arithmetic kernels.
Applied to production libraries.
Complements SAW-style equivalence.

Limits and caveats

Straight-line code only.
Specialist tool.
Academic maintenance.

When to choose it

Use CryptoLine for the arithmetic kernels of a classical or post-quantum library.

Who works with CryptoLine

No firm on this index lists CryptoLine as a core tool yet; the firms below cover the same problem class.

Top-listed for implementation verification work: zkSecurity
Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.
Read the zkSecurity profile · Website

Jasmin and libjade, hax, Cryptol and SAW, Fiat-Crypto, HACL*, Vale and EverCrypt, Aeneas, Kani, CBMC, Verus.

Sources

CryptoLine repository

Last reviewed 2026-09-13 by the sorryfree editors. Machine-readable: data.json · summary.txt