Certified computer-aided cryptography

Abstract

We present a computer-aided framework for proving concrete security bounds for cryptographic machine code implementations. The front-end of the framework is an interactive verification tool that extends the EasyCrypt framework to reason about relational properties of C-like programs extended with idealised probabilistic operations in the style of code-based security proofs. The framework also incorporates an extension of the CompCert certified compiler to support trusted libraries providing complex arithmetic calculations or instantiating idealized components such as sampling operations. This certified compiler allows us to carry to executable code the security guarantees established at the high-level, and is also instrumented to detect when compilation may interfere with side-channel countermeasures deployed in source code.We demonstrate the applicability of the framework by applying it to the RSA-OAEP encryption scheme, as standardized in PKCS#1 v2.1. The outcome is a rigorous analysis of the advantage of an adversary to break the security of assembly implementations of the algorithms specified by the standard. The example also provides two contributions of independent interest: it bridges the gap between computerassisted security proofs and real-world cryptographic implementations as described by standards such as PKCS,and demonstrates the use of the CompCert certified compiler in the context of cryptographic software development.

On Compositional Information Flow Aware Refinement

“…Finally, several other works focus on secure refinement for a certain class of programs, e.g., stream processing functions [36], schedulers [11], cryptographic algorithms [37,38], or security protocols [39,40]. These approaches typically employ models tailored to their use case and the specific desired information flow properties.…”

Machine-Checked Proofs for Cryptographic Standards

“…In the following, we use Keccak-p as shorthand for this permutation. 2 In this section we first describe the Sponge construction and the SHA-3 functions. Then we explain how the Sponge construction offers very strong security properties, when the underlying permutation is modelled as a purely random object, and why this gives strong heuristic evidence for the security of the SHA-3 functions in real world use.…”

“…the padding algorithm pad, and iii. the rate (or block size) r. We write c for the construction's 2 We note that the standard in fact defines a family of permutations, indexed by state size and number of rounds, but only approves Keccak-p[1600, 24] for use in SHA-3 and other standards. All discussions related to the permutation in this paper focus on Keccak-p[1600, 24] unless otherwise specified.…”

“…Almeida et al [2] use EasyCrypt to prove security (of RSA-OAEP) on C-like programs with notions of timing leaks. They modify Com-pCert to strictly enforce preservation of timing behaviour in compiled programs.…”