Verified low-level programming embedded in F*

Abstract

We present Low * , a language for low-level programming and verification, and its application to high-assurance optimized cryptographic libraries. Low * is a shallow embedding of a small, sequential, well-behaved subset of C in F * , a dependently-typed variant of ML aimed at program verification. Departing from ML, Low * does not involve any garbage collection or implicit heap allocation; instead, it has a structured memory model à la CompCert, and it provides the control required for writing efficient low-level security-critical code. By virtue of typing, any Low * program is memory safe. In addition, the programmer can make full use of the verification power of F * to write high-level specifications and verify the functional correctness of Low * code using a combination of SMT automation and sophisticated manual proofs. At extraction time, specifications and proofs are erased, and the remaining code enjoys a predictable translation to C. We prove that this translation preserves semantics and side-channel resistance. We provide a new compiler back-end from Low * to C and, to evaluate our approach, we implement and verify various cryptographic algorithms, constructions, and tools for a total of about 28,000 lines of code, specification and proof. We show that our Low * code delivers performance competitive with existing (unverified) C cryptographic libraries, suggesting our approach may be applicable to larger-scale low-level software.

ConSORT: Context- and Flow-Sensitive Ownership Refinement Types for Imperative Programs

“…However, while ConSORT automatically infers many ownership transfers, Viper requires extensive annotations for each transfer. F*, a dependently typed dialect of ML, includes an update/select theory of heaps and requires explicit annotations summarizing the heap effects of a method [44,57,58]. This approach enables modular reasoning and precise specification of pre-and post-conditions with respect to the heap, but precludes full automation.…”

Formally Verified Cryptographic Web Applications in WebAssembly

“…Once proven correct with regards to their specification, programs written in F * can be compiled to OCaml or F#. Recently [9], F * gained the ability to generate C code, as long as the run-time parts of the program are written in a low-level subset called Low * . This allows the programmer to use the full power of F * for proofs and verification and, relying on the fact that proofs are computationally irrelevant and hence erased, extract the remaining Low * code to C. This approach was successfully used by the HACL * [18] verified crypto library, and the resulting C code is currently used in the Firefox browser and Wireguard VPN.…”

“…Our approach is to compile WebAssembly code from formally verified source code written in Low * [9], a subset of the F * programming language [10]. As far as we know, this is the first verification toolchain for WebAssembly that supports correctness, memory safety, and side-channel resistance.…”

Meta-F $$^\star $$ : Proof Automation with SMT, Tactics, and Metaprograms

“…Whereas those specifications are ghost code, we would like to generate implementations that can be extracted to C. To this end, we generate stateful implementations written in the Low set of F [56], operating on buffers, which are Low mutable data structures representing C arrays. There, instead of a sequence of bytes, the parser implementation is given an input buffer and its length; and the serializer implementation is given an output buffer (along with its length) onto which it is to serialize the data.…”