Among many theories supported by SMT solvers, the theory of finite-precision bit-vector arithmetic is one of the most useful, for both hardware and software systems verification. This theory is also particularly useful for some specific domains such as cryptography, in which algorithms are naturally expressed in terms of bit-vectors. Cryptol is an example of a domain-specific language (DSL) and toolset for cryptography developed by Galois, Inc.; providing an SMT backend that relies on bit-vector decision procedures to certify the correctness of cryptographic specifications [3]. Most of these decision procedures use bit-blasting to reduce a bit-vector problem into pure propositional SAT. Unfortunately bit-blasting does not scale very well, especially in the presence of operators like multiplication or division.(undefined

Abal, Iago

Cunha, Alcino

Hurd, Joe

Pinto, Jorge Sousa

Universidade do Minho: RepositoriUM

Using term rewriting to solve Bit-vector arithmetic problems (Poster Presentation)

Using Term Rewriting to Solve Bit-VectorArithmetic Problems(Poster Presentation)Iago Abal1, Alcino Cunha1, Joe Hurd2, and Jorge Sousa Pinto11 HASLab / INESC TEC & Universidade do Minho, Braga, Portugal2 Galois, Inc., Portland, OR, USAAmong many theories supported by SMT solvers, the theory of finite-precisionbit-vector arithmetic is one of the most useful, for both hardware and soft-ware systems verification. This theory is also particularly useful for some spe-cific domains such as cryptography, in which algorithms are naturally expressedin terms of bit-vectors. Cryptol is an example of a domain-specific language(DSL) and toolset for cryptography developed by Galois, Inc.; providing anSMT backend that relies on bit-vector decision procedures to certify the cor-rectness of cryptographic specifications [3]. Most of these decision proceduresuse bit-blasting to reduce a bit-vector problem into pure propositional SAT. Un-fortunately bit-blasting does not scale very well, especially in the presence ofoperators like multiplication or division. For example, the equality x2[n] − 1[n] =(x[n] + 1[n]) × (x[n] − 1[n]) is a simple consequence of distributivity and asso-ciativity laws; but even for small values of n the bit-level representation of thisformula is so huge that it is intractable by current SAT solvers. The main rea-son for this is the loss of high-level algebraic structure present in the origi-nal decision problem. The point here is that one can exploit algebraic proper-ties concerning the domain of bit-vectors to rewrite this problem into an eq-uisatisfiable, but computationally less hard, problem. For instance, the aboveequality can be proved valid as follows (subscripts are omitted for clarity):x2 − 1 = (x + 1) × (x − 1) ≡ {distributivity × 3; associativity} x2 − 1 =x2+x−x−1 ≡ {inverse; right identity} x2−1 = x2−1 ≡ {reflexivity} true.Modern SMT solvers already include a simplification phase that performs somerewriting on the input problem prior to bit-blasting [4]. Nevertheless, SMTsolvers have to deal with a wide range of application domains, and hence the setof rewrite rules employed for simplification inevitably excludes many rules thatare useful for some particular domains but may be inconvenient for others.The present work was motivated by the difficulties reported by the Galois Cryp-tol team in achieving automatic equivalence checking for public-key cryptography(PKC). PKC is particularly hard because it involves multiplication and modu-lar exponentiation on long bit-vectors. Hence, the bit-level representation of anyPKC algorithm is usually so huge that such equivalence problems are too hard forcurrent SAT solvers, unless a significant amount of rewriting is performed beforebit-blasting. SMT solvers employing high-level rewriting-based techniques havebeen shown to be promising, but they are still insufficiently powerful to handleA. Cimatti and R. Sebastiani (Eds.): SAT 2012, LNCS 7317, pp. 493–495, 2012.c© Springer-Verlag Berlin Heidelberg 2012494 I. Abal et al.hard problems, such as those resulting from PKC. This problemmay be addressedby combining custom rewrite patterns, somehow encapsulating domain-specificproof strategies, with standard bit-vector decision procedures. Our first attemptconsisted in extending SMT specifications with algebraic properties provided inthe form of quantified formulas, expecting the SMT solver to use them as rewriterules. Unfortunately, we have found that most of the times SMT solvers do notuse these rules effectively, and even become quite unpredictable in the presence ofuniversal quantifiers. After this failed attempt, we prototyped a rewriting systemin Maude [1] that focuses on simplifying PKC equivalence problems. Employ-ing a set of 200 handcrafted rewrite rules and a very simple rewriting strategyenabled us to achieve quite promising results. For instance, this system provedthe correctness of a 16-bit peasant multiplier and SHA-1 implementations in afew seconds, while the 3.2 version of Z3 [2] times out (16 hours) for the peasantcase and quickly runs out of memory (2 GB) solving the SHA-1 one. Using thisrewriting system as a preprocessing step for Z3 we also achieved good speedupsfor some equivalence problems, such as a speedup of 2 for an 8-bit modularexponentiation algorithm.Even though there is still considerable work to be done in order to reach areasonable degree of automation for PKC equivalence checking, the above resultsshow the potential of the term-rewriting approach. In the same way that proofassistants allow defining custom tactics to encapsulate specific proof techniques,our intention is to encode those proof tactics as rewrite patterns in the contextof SMT solving. This allows simplifications that drastically reduce the size of theinput problem before bit-blasting, leading to better overall performance. Ideally,SMT solvers should allow easy customization of their solving strategies with suchrules —we are aware of some recent work in this direction. It is worth notingthat we are not relying on complex combinations of rewriting strategies, whichwould make our approach more fragile and less scalable. Finally, Maude turnedout to be a good platform for experimentation, but it significantly restricts thestrategies that we could employ and presents some limitations with respect toachieving perfect subterm sharing. Thus we are presently working on a frame-work to specify custom rewriting-based simplifications for fixed-size bit-vectorarithmetic, that should allow us to overtake the above limitations.Acknowledgement. This work is funded by National Funds through the FCT- Fundac¸a˜o para a Cieˆncia e a Tecnologia (Portuguese Foundation for Scienceand Technology) within project PTDC/EIA-CCO/105034/2008.References1. Clavel, M., Dura´n, F., Eker, S., Lincoln, P., Mart´ı-Oliet, N., Meseguer, J., Talcott,C.: The Maude 2.0 System. In: Nieuwenhuis, R. (ed.) RTA 2003. LNCS, vol. 2706,pp. 76–87. Springer, Heidelberg (2003)Using Term Rewriting to Solve Bit-Vector Arithmetic Problems 4952. de Moura, L., Bjørner, N.: Z3: An Efficient SMT Solver. In: Ramakrishnan, C.R.,Rehof, J. (eds.) TACAS 2008. LNCS, vol. 4963, pp. 337–340. Springer, Heidelberg(2008)3. Erko¨k, L., Matthews, J.: Pragmatic equivalence and safety checking in Cryptol.In: Proceedings of the 3rd Workshop on Programming Languages Meets ProgramVerification, PLPV 2009, pp. 73–82. ACM, New York (2008)4. Franzen, A.: Efficient Solving of the Satisfiability Modulo Bit-Vectors Problem andSome Extensions to SMT. Ph.D. thesis, University of Trento (March 2010)

Among many theories supported by SMT solvers, the theory of finite-precision bit-vector arithmetic is one of the most useful, for both hardware and software systems verification. This theory is also particularly useful for some specific domains such as cryptography, in which algorithms are naturally expressed in terms of bit-vectors. Cryptol is an example of a domain-specific language (DSL) and toolset for cryptography developed by Galois, Inc.; providing an SMT backend that relies on bit-vector decision procedures to certify the correctness of cryptographic specifications [3]. Most of these decision procedures use bit-blasting to reduce a bit-vector problem into pure propositional SAT. Unfortunately bit-blasting does not scale very well, especially in the presence of operators like multiplication or division.Fundação para a Ciência e a Tecnologia (FCT

Using Term Rewriting toSolve Bit-Vector Arithmetic Problems(Poster Presentation)Iago Abal1, Alcino Cunha1, Joe Hurd2, and Jorge Sousa Pinto11 HASLab / INESC TEC & Universidade do Minho, Portugal2 Galois, Inc., Portland, OR, USAAmong many theories supported by SMT solvers, the theory of finite-precisionbit-vector arithmetic is one of the most useful, for both hardware and softwaresystems verification. This theory is also particularly useful for some specific do-mains such as cryptography, in which algorithms are naturally expressed in termsof bit-vectors. Cryptol is an example of a domain-specific language (DSL) andtoolset for cryptography developed by Galois, Inc.; providing an SMT backendthat relies on bit-vector decision procedures to certify the correctness of cryp-tographic specifications [3]. Most of these decision procedures use bit-blastingto reduce a bit-vector problem into pure propositional SAT. Unfortunately bit-blasting does not scale very well, especially in the presence of operators like mul-tiplication or division. For example, the equality x2[n]−1[n] = (x[n]+1[n])×(x[n]−1[n]) is a simple consequence of distributivity and associativity laws; but even forsmall values of n the bit-level representation of this formula is so huge that it is in-tractable by current SAT solvers. The main reason for this is the loss of high-levelalgebraic structure present in the original decision problem. The point here isthat one can exploit algebraic properties concerning the domain of bit-vectors torewrite this problem into an equisatisfiable, but computationally less hard, prob-lem. For instance, the above equality can be proved valid as follows (subscriptsare omitted for clarity): x2 − 1 = (x + 1)× (x− 1) ≡{distributivity×3; associativity}x2 − 1 = x2 + x− x− 1 ≡{inverse; right identity} x2 − 1 = x2 − 1 ≡{reflexivity} true.Modern SMT solvers already include a simplification phase that performs somerewriting on the input problem prior to bit-blasting [4]. Nevertheless, SMTsolvers have to deal with a vast range of application domains, and hence theset of rewrite rules employed for simplification inevitably excludes many rulesthat are useful for some particular domains but may be inconvenient for others.Sometimes such rules are so important for specific problem domains that theseare not effectively handled without them.The present work was motivated by the difficulties reported by the GaloisCryptol team in achieving automatic equivalence checking for public-key cryp-tography (PKC). PKC is particularly hard because it involves multiplicationand modular exponentiation on long bit-vectors. Hence, the bit-level represen-tation of any PKC algorithm is usually so huge that such equivalence problemsare too hard for current SAT solvers, unless a significant amount of rewritingis performed before bit-blasting. SMT solvers employing high-level rewriting-based techniques have been shown to be promising, but they are still insuf-ficiently powerful to handle hard problems, such as those resulting from PKC.This problem may be addressed by combining custom rewrite patterns, somehowencapsulating domain-specific proof strategies, with standard bit-vector decisionprocedures. Our first attempt consisted in extending SMT specifications withalgebraic properties provided in the form of quantified formulas, expecting theSMT solver to use them as rewrite rules. Unfortunately, we have found that mostof the times SMT solvers do not use these rules effectively, and even become quiteunpredictable in the presence of universal quantifiers. After this failed attempt,we prototyped a rewriting system in Maude [1] that focuses on simplifying PKCequivalence problems. Employing a set of 200 hand-crafted rewrite rules and avery simple rewriting strategy enabled us to achieve quite promising results. Forinstance, this system proved the correctness of a 16-bit peasant multiplier andSHA-1 specifications in a few seconds, while the 3.2 version of Z3 [2] timeouts(16 hours) for the peasant case and quickly runs out of memory (2 GB) solvingthe SHA-1 one. Using this rewriting system as a preprocessing step for Z3 wealso achieved good speedups for some equivalence problems, such as a speedupof 2 for an 8-bit modular exponentiation algorithm.Even though there is still considerable work to be done in order to reach areasonable degree of automation for PKC equivalence checking, the above re-sults show the potential of the term-rewriting approach. In the same way proofassistants allow defining custom tactics to encapsulate specific proof techniques,our intention is to encode those proof tactics as rewrite patterns in the contextof SMT solving. This allows simplifications that drastically reduce the size of theinput problem before bit-blasting, leading to better overall performance. Ideally,SMT solvers should allow easy customization of their solving strategies with suchrules —we are aware of some recent work in this direction. It is worth notingthat we are not relying on complex combinations of rewriting strategies, whatwould make our approach more fragile and less scalable. Finally, Maude turnedout to be a good platform for experimentation, but it significantly restricts thestrategies that we could employ and presents some limitations to achieved per-fect subterm sharing. Thus we are presently working on a framework to specifycustom rewriting-based simplifications for fixed-size bit-vector arithmetic, thatshould allow us to overtake the above limitations.References1. Clavel, M., Dura´n, F., Eker, S., Lincoln, P., Mart´ı-Oliet, N., Meseguer, J., Talcott,C.: The Maude 2.0 System. In: Nieuwenhuis, R. (ed.) Rewriting Techniques andApplications. pp. 76–87. No. 2706 in LNCS, Springer-Verlag (June 2003)2. De Moura, L., Bjørner, N.: Z3: An efficient SMT solver. In: Proceedings of the14th International Conference on Tools and Algorithms for the Construction andAnalysis of Systems. pp. 337–340. Springer-Verlag, Berlin, Heidelberg (2008)3. Erko¨k, L., Matthews, J.: Pragmatic equivalence and safety checking in Cryptol.In: Proceedings of the 3rd workshop on Programming Languages meets ProgramVerification. pp. 73–82. PLPV ’09, ACM, New York, NY, USA (2008)4. Franzen, A.: Efficient Solving of the Satisfiability Modulo Bit-Vectors Problem andSome Extensions to SMT. Ph.D. thesis, University of Trento (March 2010)

Using term rewriting to solve Bit-Vector arithmetic problems (Poster Presentation)

http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.307.4695

Using term rewriting to solve Bit-vector arithmetic problems (Poster Presentation)

Abstract

Similar works

Full text

Available Versions

Universidade do Minho: RepositoriUM

Universidade do Minho: RepositoriUM

Universidade do Minho: RepositoriUM