6,883 research outputs found
Modular, Fully-abstract Compilation by Approximate Back-translation
A compiler is fully-abstract if the compilation from source language programs
to target language programs reflects and preserves behavioural equivalence.
Such compilers have important security benefits, as they limit the power of an
attacker interacting with the program in the target language to that of an
attacker interacting with the program in the source language. Proving compiler
full-abstraction is, however, rather complicated. A common proof technique is
based on the back-translation of target-level program contexts to
behaviourally-equivalent source-level contexts. However, constructing such a
back- translation is problematic when the source language is not strong enough
to embed an encoding of the target language. For instance, when compiling from
STLC to ULC, the lack of recursive types in the former prevents such a
back-translation.
We propose a general and elegant solution for this problem. The key insight
is that it suffices to construct an approximate back-translation. The
approximation is only accurate up to a certain number of steps and conservative
beyond that, in the sense that the context generated by the back-translation
may diverge when the original would not, but not vice versa. Based on this
insight, we describe a general technique for proving compiler full-abstraction
and demonstrate it on a compiler from STLC to ULC. The proof uses asymmetric
cross-language logical relations and makes innovative use of step-indexing to
express the relation between a context and its approximate back-translation.
The proof extends easily to common compiler patterns such as modular
compilation and it, to the best of our knowledge, it is the first compiler full
abstraction proof to have been fully mechanised in Coq. We believe this proof
technique can scale to challenging settings and enable simpler, more scalable
proofs of compiler full-abstraction
Beyond Good and Evil: Formalizing the Security Guarantees of Compartmentalizing Compilation
Compartmentalization is good security-engineering practice. By breaking a
large software system into mutually distrustful components that run with
minimal privileges, restricting their interactions to conform to well-defined
interfaces, we can limit the damage caused by low-level attacks such as
control-flow hijacking. When used to defend against such attacks,
compartmentalization is often implemented cooperatively by a compiler and a
low-level compartmentalization mechanism. However, the formal guarantees
provided by such compartmentalizing compilation have seen surprisingly little
investigation.
We propose a new security property, secure compartmentalizing compilation
(SCC), that formally characterizes the guarantees provided by
compartmentalizing compilation and clarifies its attacker model. We reconstruct
our property by starting from the well-established notion of fully abstract
compilation, then identifying and lifting three important limitations that make
standard full abstraction unsuitable for compartmentalization. The connection
to full abstraction allows us to prove SCC by adapting established proof
techniques; we illustrate this with a compiler from a simple unsafe imperative
language with procedures to a compartmentalized abstract machine.Comment: Nit
CapablePtrs: Securely Compiling Partial Programs using the Pointers-as-Capabilities Principle
Capability machines such as CHERI provide memory capabilities that can be
used by compilers to provide security benefits for compiled code (e.g., memory
safety). The C to CHERI compiler, for example, achieves memory safety by
following a principle called "pointers as capabilities" (PAC). Informally, PAC
says that a compiler should represent a source language pointer as a machine
code capability. But the security properties of PAC compilers are not yet well
understood. We show that memory safety is only one aspect, and that PAC
compilers can provide significant additional security guarantees for partial
programs: the compiler can provide guarantees for a compilation unit, even if
that compilation unit is later linked to attacker-controlled machine code. This
paper is the first to study the security of PAC compilers for partial programs
formally. We prove for a model of such a compiler that it is fully abstract.
The proof uses a novel proof technique (dubbed TrICL, read trickle), which is
of broad interest because it reuses and extends the compiler correctness
relation in a natural way, as we demonstrate. We implement our compiler on top
of the CHERI platform and show that it can compile legacy C code with minimal
code changes. We provide performance benchmarks that show how performance
overhead is proportional to the number of cross-compilation-unit function
calls
On the Semantic Expressiveness of Iso- and Equi-Recursive Types
Recursive types extend the simply-typed lambda calculus (STLC) with the
additional expressive power to enable diverging computation and to encode
recursive data-types (e.g., lists). Two formulations of recursive types exist:
iso-recursive and equi-recursive. The relative advantages of iso- and
equi-recursion are well-studied when it comes to their impact on
type-inference. However, the relative semantic expressiveness of the two
formulations remains unclear so far. This paper studies the semantic
expressiveness of STLC with iso- and equi-recursive types, proving that these
formulations are equally expressive. In fact, we prove that they are both as
expressive as STLC with only term-level recursion. We phrase these
equi-expressiveness results in terms of full abstraction of three canonical
compilers between these three languages (STLC with iso-, with equi-recursive
types and with term-level recursion). Our choice of languages allows us to
study expressiveness when interacting over both a simply-typed and a
recursively-typed interface. The three proofs all rely on a typed version of a
proof technique called approximate backtranslation. Together, our results show
that there is no difference in semantic expressiveness between STLCs with iso-
and equi-recursive types. In this paper, we focus on a simply-typed setting but
we believe our results scale to more powerful type systems like System F
In defense of compilation: A response to Davis' form and content in model-based reasoning
In a recent paper entitled 'Form and Content in Model Based Reasoning', Randy Davis argues that model based reasoning research aimed at compiling task specific rules from underlying device models is mislabeled, misguided, and diversionary. Some of Davis' claims are examined and his basic conclusions are challenged about the value of compilation research to the model based reasoning community. In particular, Davis' claim is refuted that model based reasoning is exempt from the efficiency benefits provided by knowledge compilation techniques. In addition, several misconceptions are clarified about the role of representational form in compilation. It is concluded that techniques have the potential to make a substantial contribution to solving tractability problems in model based reasoning
A generic, context sensitive analysis framework for object oriented programs
Abstract interpreters rely on the existence of a nxpoint algorithm that calculates a least upper bound approximation of the semantics of the program. Usually, that algorithm is described in terms of the particular language in study and therefore it is not directly applicable to programs written in a different source language. In this paper we introduce
a generic, block-based, and uniform representation of the program control flow graph and a language-independent nxpoint algorithm that can be applied to a variety of languages and, in particular, Java. Two major characteristics of our approach are accuracy (obtained through a topdown, context sensitive approach) and reasonable efficiency (achieved by means of memoization and dependency tracking techniques). We have also implemented the proposed framework and show some initial experimental
results for standard benchmarks, which further support the
feasibility of the solution adopted
Universal Composability is Secure Compilation
Universal composability is a framework for the specification and analysis of
cryptographic protocols with a strong compositionality guarantee: UC protocols
are secure even when composed with other protocols. Secure compilation tells
whether compiled programs are as secure as their source-level counterparts, no
matter what target-level code they interact with. These two disciplines are
studied in isolation, but we believe there is a deeper connection between them
with benefits from both worlds to reap. This paper outlines the connection
between universal composability and robust compilation, the latest of secure
compilation theories. We show how to read the universal composability theorem
in terms of a robust compilation theorem and vice-versa. This, in turn, shows
which elements of one theory corresponds to which element in the other theory.
We believe this is the first step towards understanding how can secure
compilation theories be used in universal composability settings and
vice-versa
- …