Verifying cryptographic software correctness with respect to reference implementations

This paper presents techniques developed to check program equivalences in the context of cryptographic software development, where specifications are typically reference implementations. The techniques allow for the integration of interactive proof techniques (required given the difficulty and generality of the results sought) in a verification infrastructure that is capable of discharging many verification conditions automatically. To this end, the difficult results in the verification process (to be proved interactively) are isolated as a set of lemmas. The fundamental notion of natural invariant is used to link the specification level and the interactive proof construction process.Fundação para a Ciência e a Tecnologia (FCT

Evaluating Static Source Code Analysis Tools

This thesis presents the results of an evaluation of source code analyzers. Such tools constitute an inexpensive, efficient and fast way of removing the most common vulnerabilities in a software project, even though not all security flaws can be detected. This evaluation was conducted at CERN, the European Organization for Nuclear Research, in the intent of providing its programmers with a list of dedicated software verification/static source code analysis tools. Particular focus of these tools should be on efficiently finding security flaws. The evaluation covered close to thirty different tools for the major programming languages