Signed Cryptographic Program Verification with Typed CryptoLine

We develop an automated formal technique to specify and verify signed computation in cryptographic programs. In addition to new instructions, we introduce a type system to detect type errors in programs. A type inference algorithm is also provided to deduce types and instruction variants in cryptographic programs. In order to verify signed cryptographic C programs, we develop a translator from the GCC intermediate representation to our language. Using our technique, we have verified 82 C functions in cryptography libraries including NaCl, wolfSSL, bitcoin, OpenSSL, and BoringSSL.

[1]  Magnus O. Myreen,et al.  Hoare Logic for Realistically Modelled Machine Code , 2007, TACAS.

[2]  Magnus O. Myreen,et al.  Proof Pearl: A Verified Bignum Implementation in x86-64 Machine Code , 2013, CPP.

[3]  Adam Chlipala,et al.  Simple High-Level Code for Cryptographic Arithmetic - With Proofs, Without Compromises , 2019, 2019 IEEE Symposium on Security and Privacy (SP).

[4]  Andrew W. Appel,et al.  Verification of a Cryptographic Primitive: SHA-256 , 2015, TOPL.

[5]  Carl A. Gunter.  Semantics of programming languages: structures and techniques , 1993, Choice Reviews Online.

[6]  Andrew W. Appel,et al.  Verified Correctness and Security of mbedTLS HMAC-DRBG , 2017, CCS.

[7]  Karthikeyan Bhargavan,et al.  HACL*: A Verified Modern Cryptographic Library , 2017, CCS.

[8]  Lauretta O. Osho,et al.  Axiomatic Basis for Computer Programming , 2013 .

[9]  Reynald Affeldt,et al.  An Approach to Formal Verification of Arithmetic Functions in Assembly , 2006, ASIAN.

[10]  Peter Schwabe,et al.  Verifying Curve25519 Software , 2014, CCS.

[11]  Ming-Hsien Tsai,et al.  Verifying Arithmetic Assembly Programs in Cryptographic Primitives (Invited Talk) , 2018, CONCUR.

[12]  Reynald Affeldt.  On construction of a library of formally verified low-level arithmetic functions , 2012, SAC '12.

[13]  Andrew W. Appel,et al.  Verified Correctness and Security of OpenSSL HMAC , 2015, USENIX Security Symposium.

[14]  Reynald Affeldt,et al.  Certifying assembly with formal security proofs: The case of BBS , 2012, Sci. Comput. Program..

[15]  Nikhil Swamy,et al.  A verified, efficient embedding of a verifiable assembly language , 2019, Proc. ACM Program. Lang..

[16]  Srinath T. V. Setty,et al.  Vale: Verifying High-Performance Cryptographic Assembly Code , 2017, USENIX Security Symposium.

[17]  Bow-Yaw Wang,et al.  Verifying Arithmetic in Cryptographic C Programs , 2019, 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE).

[18]  A. Polyakov,et al.  Verifying Arithmetic Assembly Programs in Cryptographic Primitives , 2018 .

[19]  Benjamin Grégoire,et al.  Jasmin: High-Assurance and High-Speed Cryptography , 2017, CCS.

[20]  Ming-Hsien Tsai,et al.  Certified Verification of Algebraic Properties on Low-Level Mathematical Constructs in Cryptographic Programs , 2017, CCS.