The marriage of bisimulations and Kripke logical relations

Hur, Chung-Kil; Dreyer, Derek; Neis, Georg; Vafeiadis, Viktor

doi:10.1145/2103656.2103666

Cited by 59 publications

(47 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Hur and Dreyer [2011] devised a correct compiler from an idealised ML to assembly. The techniques devised in these works were further developed into Relational Transition Systems (RTS) and Parametric Inter-Language Simulations (PILS) in order to prove both vertically-and horizontally-composable compiler correctness [Hur et al, 2012, Neis et al, 2015. A different approach to cross-language relations could have been adopting a Matthews and Findler-style multi-language semantics, where source and target language are combined [Matthews and Findler, 2009].…”

Section: Related Workmentioning

confidence: 99%

Fully-abstract compilation by approximate back-translation

2016

View full text Add to dashboard Cite

A compiler is fully-abstract if the compilation from source language programs to target language programs reflects and preserves behavioural equivalence. Such compilers have important security benefits, as they limit the power of an attacker interacting with the program in the target language to that of an attacker interacting with the program in the source language. Proving compiler full-abstraction is, however, rather complicated. A common proof technique is based on the back-translation of target-level program contexts to behaviourally-equivalent source-level contexts. However, constructing such a backtranslation is problematic when the source language is not strong enough to embed an encoding of the target language. For instance, when compiling from a simply-typed λcalculus (λ τ ) to an untyped λ-calculus (λ u ), the lack of recursive types in λ τ prevents such a back-translation.We propose a general and elegant solution for this problem. The key insight is that it suffices to construct an approximate back-translation. The approximation is only accurate up to a certain number of steps and conservative beyond that, in the sense that the context generated by the back-translation may diverge when the original would not, but not vice versa. Based on this insight, we describe a general technique for proving compiler full-abstraction and demonstrate it on a compiler from λ τ to λ u . The proof uses asymmetric cross-language logical relations and makes innovative use of step-indexing to express the relation between a context and its approximate back-translation. The proof extends easily to common compiler patterns such as modular compilation and, to the best of our knowledge, it is the first compiler full abstraction proof to have been fully mechanised in Coq. We believe this proof technique can scale to challenging settings and enable simpler, more scalable proofs of compiler full-abstraction. 2012 ACM CCS: [Security and privacy Logic and verification]: 300; [Software and its engineering General programming languages]: 300; [Software and its engineering Compilers]: 300.

show abstract

Section: Related Workmentioning

confidence: 99%

Fully-abstract compilation by approximate back-translation

2016

View full text Add to dashboard Cite

show abstract

“…Unlike CompComp, CompCertM generalizes open simulations and memory injections in a more abstract way following [Dreyer et al 2010;Hur et al 2012].…”

Section: Enriched Memorymentioning

confidence: 99%

“…Using interaction semantics, CompComp defines structured simulations relating two open modules. Here we briefly review the key ideas behind them, which also occurred elsewhere, e.g., in [Hur et al 2012;Kang et al 2015;Neis et al 2015]. First, unlike the closed simulations above, structured simulations explicitly specify value and memory relations (evolving over time) because values and memory are shared with external modules.…”

Section: Introductionmentioning

confidence: 99%

CompCertM: CompCert with C-assembly linking and lightweight modular verification

Song

Cho

Kim

et al. 2019

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

Supporting multi-language linking such as linking C and handwritten assembly modules in the verified compiler CompCert requires a more compositional verification technique than that used in CompCert just supporting separate compilation. The two extensions, CompCertX and Compositional CompCert, supporting multi-language linking take different approaches. The former simplifies the problem by imposing restrictions that the source modules should have no mutual dependence and be verified against certain well-behaved specifications. On the other hand, the latter develops a new verification technique that directly solves the problem but at the expense of significantly increasing the verification cost.In this paper, we develop a novel lightweight verification technique, called RUSC (Refinement Under Self-related Contexts), and demonstrate how RUSC can solve the problem without any restrictions but still with low verification overhead. For this, we develop CompCertM, a full extension of the latest version of CompCert supporting multi-language linking. Moreover, we demonstrate the power of RUSC as a program verification technique by modularly verifying interesting programs consisting of C and handwritten assembly against their mathematical specifications.

show abstract

“…Logical relations and bisimulations. Many semantic techniques have been proposed for reasoning about relational properties such as observational equivalence, including techniques based on binary logical relations [Ahmed et al 2009;Benton et al 2009Benton et al , 2013Benton et al , 2014Dreyer et al 2010Dreyer et al , 2011Dreyer et al , 2012Mitchell 1986], bisimulations [Dal Lago et al 2017;Koutavas and Wand 2006;Sangiorgi et al 2011;Sumii 2009] and combinations thereof [Hur et al 2012[Hur et al , 2014. While these powerful techniques are often not directly automated, they can still be used for verification [Timany and Birkedal 2019] and for providing semantic correctness proofs for relational program logics [Dreyer et al 2010[Dreyer et al , 2011 and other verification tools [Benton et al 2016;Gavazzo 2018].…”

Section: Related Workmentioning

confidence: 99%

“…Formally verifying relational properties has a broad range of practical applications. For instance, one might be interested in proving that the observable behaviors of two programs are related, showing for instance that the programs are equivalent [Blanchet et al 2008;Chadha et al 2016;Ştefan Ciobâcă et al 2016;Godlin and Strichman 2010;Hur et al 2012Hur et al , 2014Kundu et al 2009;Timany et al 2018;Wang et al 2018;Yang 2007], or that one refines the other [Timany and Birkedal 2019]. In other cases, one might be interested in relating two runs of a single program, but, as soon as the control flow can differ between the two runs, the compositional verification problem becomes the same as relating two different programs.…”

Section: Introductionmentioning

confidence: 99%

The next 700 relational program logics

Maillard

Hriţcu

Rivas

et al. 2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

We propose the first framework for defining relational program logics for arbitrary monadic effects. The framework is embedded within a relational dependent type theory and is highly expressive. At the semantic level, we provide an algebraic characterization for relational specifications as a class of relative monads, and link computations and specifications by introducing relational effect observations, which map pairs of monadic computations to relational specifications in a way that respects the algebraic structure. For an arbitrary relational effect observation, we generically define the core of a sound relational program logic, and explain how to complete it to a full-fledged logic for the monadic effect at hand. We show that by instantiating our framework with state and unbounded iteration we can embed a variant of Benton's Relational Hoare Logic, and also sketch how to reconstruct Relational Hoare Type Theory. Finally, we identify and overcome conceptual challenges that prevented previous relational program logics from properly dealing with effects such as exceptions, and are the first to provide a proper semantic foundation and a relational program logic for exceptions.

show abstract

The marriage of bisimulations and Kripke logical relations

Cited by 59 publications

References 43 publications

Fully-abstract compilation by approximate back-translation

Fully-abstract compilation by approximate back-translation

CompCertM: CompCert with C-assembly linking and lightweight modular verification

The next 700 relational program logics

Contact Info

Product

Resources

About