Fiat-Crypto
Direct answerFiat-Crypto generates field-arithmetic code (C, Rust, Go, Zig and more) from parameters with a Rocq proof that the output is correct. Its Curve25519 and P-256 code ships in BoringSSL and Go's standard library.
- Maintainer
- MIT PLV
- Website
- https://github.com/mit-plv/fiat-crypto
- Repository
- https://github.com/mit-plv/fiat-crypto
- Category
- Verified implementations
- Targets
- Finite-field arithmeticCurve25519P-256Custom primes
- Approach
- Correct-by-construction code generation from Rocq proofs
- Access
- Open source
- Status (2026-09-13)
- Active, mature; deployed in BoringSSL and Go
What Fiat-Crypto does
It is the clearest success of correct-by-construction cryptography: no one verifies the generated code because the generator is proved. It does not cover ML-KEM style polynomial arithmetic.
Where it is strong
- Proved generator, no per-output proof needed.
- Massive deployment.
- Any prime, several languages.
Limits and caveats
- Field arithmetic only.
- Performance below the best hand-written assembly.
- No post-quantum coverage.
When to choose it
Use it for any new curve or prime-field arithmetic, including ZK-friendly fields.
Who works with Fiat-Crypto
No firm on this index lists Fiat-Crypto as a core tool yet; the firms below cover the same problem class.
Top-listed for implementation verification work: zkSecurity
Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.
Read the zkSecurity profile · Website
Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.
Read the zkSecurity profile · Website
Related frameworks in Verified implementations
Jasmin and libjade, hax, Cryptol and SAW, HACL*, Vale and EverCrypt, Aeneas, Kani, CBMC, CryptoLine, Verus.