SSProve: A Foundational Framework for Modular Cryptographic Proofs in Coq

Abstract

State-separating proofs (SSP) is a recent methodology for structuring game-based cryptographic proofs in a modular way. While very promising, this methodology was previously not fully formalized and came with little tool support. We address this by introducing SSProve, the first general verification framework for machine-checked state-separating proofs. SSProve combines high-level modular proofs about composed protocols, as proposed in SSP, with a probabilistic relational program logic for formalizing the lower-level details, which together enable constructing fully machine-checked cryptographic proofs in the Coq proof assistant. Moreover, SSProve is itself formalized in Coq, including the algebraic laws of SSP, the soundness of the program logic, and the connection between these two verification styles. To illustrate the formal SSP methodology we prove security of ElGamal and PRF-based encryption. We also validate the SSProve approach by conducting two extended case studies. First, we formalize a security proof of the KEM-DEM public key encryption scheme. Second, we formalize security of the sigma-protocol zero-knowledge construction and the associated construction of commitment schemes. We then instantiate the proof and give concrete security bounds for Schnorr's protocol.

Extracting functional programs from Coq, in Coq

“…Note that, due to this verification done by the contract, the contract is able to detect if a party misbehaves. However, we do not prove formally that incorrect proofs do not verify since this is a probabilistic statement better suited for tools like EasyCrypt or SSProve (Abate et al, 2021).…”

Reflection, rewinding, and coin-toss in EasyCrypt

“…Step (1) applies "the averaging technique" by representing 𝐴.init() as a family of distributions 𝐷 m 𝐴 . (𝐷 m 𝐴 denotes the distribution in the family corresponding to memory m.) We write 𝜇 1 (𝐷 m 𝐴 , n) for the probability that 𝐷 m 𝐴 assigns to memory configuraion n. Then 𝜇 1 (𝐷 m 𝐴 , n) is the probability of 𝐴.𝑖𝑛𝑖𝑡 () terminating in the memory state n given that it starts in the initial state m. The rest of the computations are run starting from memory configuration n.…”

“…In particular, a program with variables of type "real" (which is uncountable) would not be rewindable in that sense. 1 A security proof using rewinding would then only apply to rewindable adversaries which is not a restriction from the cryptographic point of view. (Typically, cryptographic adversaries are assumed to operate on data that is representable in a computer.…”

“…To the best of our knowledge, rewinding has not been implemented in EasyCrypt, nor in other frameworks for reasoning about cryptographic proofs such as CryptHOL [7] in Isabelle, FCF [17] in Coq, CryptoVerif [9] in OCaml, Verypto [8] in Isabelle, CertiCrypt [6] in Coq, SSProve [1] in Coq.…”

Oblivious algebraic data types

“…In our mechanized formalization, the correctness and security guarantees provided by the underlying cryptographic primitives are baked into our semantics and notion of indistinguishability. There is a body of work about formally verified cryptography [Abate et al 2021;Barthe et al 2011Barthe et al , 2009, which could be integrated into our work in the future to provide a stronger formal guarantee. Some of these solutions have focused on verifying multiparty computation [Backes et al 2010;Haagh et al 2018].…”