An Introduction to Proof-Carrying Code David Walker Princeton University (slides kindly donated by George Necula; modified by David Walker)

David Walker - Foundations of Security Motivation Extensible systems can be more flexible and more efficient than client-server interaction client server client-server extensible systems extension host

David Walker - Foundations of Security extensible system Motivation Extensible systems can be more flexible and more efficient than client-server interaction client server client-server extension host

Source: NASA Jet Propulsion Lab Example: Deep-Space Onboard Analysis Bandwidth: < 1KB/sec Latency: > hours Data: > 10MB/sec Note: efficiency (cycles, bandwidth) safety critical operation

David Walker - Foundations of Security More Examples of Extensible Systems Device driver Operating system Applet Web browser Loaded procedure Database server DCOM Component DCOM client … Host Code

David Walker - Foundations of Security Concerns Regarding Extensibility Safety and reliability concerns è How to protect the host from the extensions ? Extensions of unknown origin ) potentially malicious Extensions of known origin ) potentially erroneous Complexity concerns è How can we do this without having to trust a complex infrastructure? Performance concerns è How can we do this without compromising performance? Other concerns (not addressed here) –How to ensure privacy and authenticity? –How to protect the component from the host?

David Walker - Foundations of Security Approaches to Component Safety Digital signatures Run-time monitoring and checking Bytecode verification Proof-carrying code

David Walker - Foundations of Security Assurance Support: Digital Signatures Host Example properties: “Microsoft produced this software” “Verisoft tested the software with test suite 17” LNo direct connection with program semantics LMicrosoft recently recommended that Microsoft be removed from one’s list of trusted code signers Code Checker

David Walker - Foundations of Security Run-Time Monitoring and Checking Host A monitor detects attempts to violate the safety policy and stops the execution –Hardware-enforced memory protection –Software fault isolation (sandboxing) –Java stack inspection Code Monitor JRelatively simple; effective for many properties LEither inflexible or expensive on its own

David Walker - Foundations of Security Java Bytecode Host Checker Code JVM bytecode JRelatively simple; overall an excellent idea LLarge trusted computing base –commercial, optimizing JIT: 200, ,000 LOC –when is the last time you wrote a bug-free 200,000 line program? LJava-specific; somewhat limited policies Code Compiler Code

David Walker - Foundations of Security Proof-carrying code Host Checker Code JVM bytecode Proof Code Compiler JFlexible interfaces like the JVM model JSmall trusted computing base (minimum of 3000 LOC) JCan be somewhat more language/policy independent LBuilding an optimizing, type-preserving compiler is much harder than building an ordinary compiler

David Walker - Foundations of Security Proof-carrying code Host Checker Code JVM bytecode Proof Code Compiler Question: Isn’t it hard, perhaps impossible, to check properties of assembly language?

David Walker - Foundations of Security Proof-carrying code Host Checker Code JVM bytecode Proof Code Compiler Question: Isn’t it hard, perhaps impossible, to check properties of assembly language? Actually, no, not really, provided we have a proof to guide the checker.

David Walker - Foundations of Security Proof-Carrying Code: An Analogy Legend: code proof

David Walker - Foundations of Security Proof-carrying code Host Checker Code JVM bytecode Proof Code Compiler Question: Well, aren’t you just avoiding the real problem then? Isn’t it extremely hard to generate the proof?

David Walker - Foundations of Security Proof-carrying code Host Checker Code JVM bytecode Proof Code Compiler Question: Well, aren’t you just avoiding the real problem then? Isn’t it extremely hard to generate the proof? Yes. But there is a trick.

David Walker - Foundations of Security PCC + Type-Preserving Compilation Host Checker Code JVM bytecode ProofTypes Code Compiler Types Compiler The trick: we fool the programmer into doing our proof for us! We convince them to program in a typesafe language. We design our compiler to translate the typing derivation into a proof of safety We can always make this work for type safety properties

David Walker - Foundations of Security Good Things About PCC 1.Someone else does the really hard work (the compiler writer) Hard to prove safety but easy to check a proof Research over the last 5-10 years indicates we can produce proofs of type safety properties for assembly language 2.Requires minimal trusted infrastructure Trust proof checker but not the compiler Again, recent research shows PCC TCB can be as small as ~3000 LOC 3.Agnostic to how the code and proof are produced Not compiler specific; Hand-optimized code is Ok 4.Can be much more general than the JVM type system Only limited by the logic that is used (and we can use very general logics) 5.Coexists peacefully with cryptography Signatures are a syntactic checksum Proofs are a semantic checksum (see Appel & Felten’s proof-carrying authorization)

David Walker - Foundations of Security The Different Flavors of PCC Type Theoretic PCC [Morrisett, Walker, et al. 1998] –source-level types are translated into low-level types for machine language or assembly language programs –the proof of safety is a typing derivation that is verified by a type checker Logical PCC [Necula, Lee, 1996, 1997] –low-level types are encoded as logical predicates –a verification-condition generator runs over the program and emits a theorem, which if true, implies the safety of the program –the proof of safety is a proof of this theorem Foundational PCC [Appel et al. 2000] –the semantics of the machine is encoded directly in logic –a type system for the machine is built up directly from the machine semantics and proven correct using a general-purpose logic (eg: higher-order logic) –the total TCB is approximately 3000 LOC

David Walker - Foundations of Security The Common Theme Every general-purpose system for proof carrying code relies upon a type system for checking low- level program safety –why? –building a proof of safety for low-level programs is hard –success depends upon being able to structure these proofs in a uniform, modular fashion –types provide the framework for developing well- structured safety proofs In the following lectures, we will study the low- level typing mechanisms that are the basis for powerful systems of proof carrying code