{
  "slug": "cryptoverif",
  "name": "CryptoVerif",
  "tagline": "Automatic game sequences in the computational model",
  "maintainer": "Bruno Blanchet, Inria (Prosecco)",
  "url": "https://bblanche.gitlabpages.inria.fr/CryptoVerif/",
  "category": "proof-systems",
  "targets": [
    "Protocols: TLS 1.3, Signal, WireGuard",
    "Key exchange",
    "Authenticated encryption compositions"
  ],
  "approach": "Automatic and guided sequences of games with concrete security bounds",
  "license": "Open source",
  "status": "Active, mature",
  "summary": "CryptoVerif automates game-hopping proofs in the computational model, producing concrete security bounds for protocols. It has been applied to TLS 1.3, Signal and WireGuard and is the computational counterpart to ProVerif.",
  "details": [
    "Where EasyCrypt is interactive and expressive, CryptoVerif is more automatic and best on protocol compositions. Many analyses run both a symbolic (ProVerif or Tamarin) and a computational (CryptoVerif) model of the same protocol."
  ],
  "strengths": [
    "Automation reduces proof effort.",
    "Concrete bounds, not just yes/no.",
    "Long record on major protocols."
  ],
  "limits": [
    "Less flexible than EasyCrypt for novel primitives.",
    "Modelling effort still significant.",
    "Small user community."
  ],
  "fit": [
    "Choose CryptoVerif for protocol-level computational guarantees, especially hybrid post-quantum handshakes."
  ],
  "references": [
    [
      "CryptoVerif",
      "https://bblanche.gitlabpages.inria.fr/CryptoVerif/"
    ]
  ],
  "category_name": "Proof systems and computational proofs",
  "page": "https://sorryfree.com/frameworks/cryptoverif/",
  "updated": "2026-09-13"
}