{
  "slug": "fiat-crypto",
  "name": "Fiat-Crypto",
  "tagline": "Rocq-verified generation of field arithmetic",
  "maintainer": "MIT PLV",
  "url": "https://github.com/mit-plv/fiat-crypto",
  "repo": "https://github.com/mit-plv/fiat-crypto",
  "category": "implementations",
  "targets": [
    "Finite-field arithmetic",
    "Curve25519",
    "P-256",
    "Custom primes"
  ],
  "approach": "Correct-by-construction code generation from Rocq proofs",
  "license": "Open source",
  "status": "Active, mature; deployed in BoringSSL and Go",
  "summary": "Fiat-Crypto generates field-arithmetic code (C, Rust, Go, Zig and more) from parameters with a Rocq proof that the output is correct. Its Curve25519 and P-256 code ships in BoringSSL and Go's standard library.",
  "details": [
    "It is the clearest success of correct-by-construction cryptography: no one verifies the generated code because the generator is proved. It does not cover ML-KEM style polynomial arithmetic."
  ],
  "strengths": [
    "Proved generator, no per-output proof needed.",
    "Massive deployment.",
    "Any prime, several languages."
  ],
  "limits": [
    "Field arithmetic only.",
    "Performance below the best hand-written assembly.",
    "No post-quantum coverage."
  ],
  "fit": [
    "Use it for any new curve or prime-field arithmetic, including ZK-friendly fields."
  ],
  "references": [
    [
      "Fiat-Crypto repository",
      "https://github.com/mit-plv/fiat-crypto"
    ]
  ],
  "category_name": "Verified implementations",
  "page": "https://sorryfree.com/frameworks/fiat-crypto/",
  "updated": "2026-09-13"
}