{
  "slug": "easycrypt",
  "name": "EasyCrypt",
  "tagline": "Computational security proofs with relational Hoare logic",
  "maintainer": "Formosa Crypto (MPI-SP, Inria, Boston University, TU/e, Porto, Radboud)",
  "url": "https://easycrypt.info",
  "category": "proof-systems",
  "targets": [
    "KEMs and signatures (ML-KEM, X-Wing)",
    "Hash functions (SHA-3)",
    "Curve arithmetic (X25519)",
    "ZK verifiers"
  ],
  "approach": "Interactive prover for game-based, code-based security proofs over probabilistic programs; paired with Jasmin for verified implementations",
  "license": "Open source",
  "status": "Active, mature",
  "summary": "EasyCrypt is the reference tool for machine-checked computational security proofs: game-based reductions expressed over probabilistic programs with a relational Hoare logic. It underpins the verified ML-KEM, X-Wing, SHA-3 and X25519 implementations in libjade, and Nethermind used it for the first honesty proof of a production ZK verifier (ZKsync).",
  "details": [
    "EasyCrypt proofs mirror the structure of cryptographers' pen-and-paper arguments, which is both its strength (specialists can read and write them) and its cost (they are labour intensive). Its pairing with Jasmin is the most complete verified pipeline from security proof to constant-time assembly that exists."
  ],
  "strengths": [
    "Proofs match how cryptographers reason.",
    "End-to-end with Jasmin: proof, spec and assembly agree.",
    "Post-quantum track record: ML-KEM and X-Wing."
  ],
  "limits": [
    "Steep learning curve; small pool of practitioners.",
    "Proofs do not transfer automatically to code outside Jasmin.",
    "Not a circuit tool."
  ],
  "fit": [
    "Choose EasyCrypt for a primitive or protocol that needs a computational proof reviewers will trust, or when shipping libjade-verified code."
  ],
  "references": [
    [
      "EasyCrypt",
      "https://easycrypt.info"
    ],
    [
      "Formosa Crypto",
      "https://formosa-crypto.org"
    ]
  ],
  "category_name": "Proof systems and computational proofs",
  "page": "https://sorryfree.com/frameworks/easycrypt/",
  "updated": "2026-09-13"
}