1. David Evans http://www.cs.virginia.edu/~evans
Lecture 14:
Mocking Mockingbirds
God created the integers – all else is the result of man.
Leopold Kronecker
God created application – all else is the result of man.
Alonzo Church (not really)
Background
just got here last week
finished degree at MIT week before
Philosophy of advising students
don’t come to grad school to implement someone else’s idea
can get paid more to do that in industry
learn to be a researcher
important part of that is deciding what problems and ideas are worth spending time on
grad students should have their own project
looking for students who can come up with their own ideas for research
will take good students interested in things I’m interested in – systems, programming languages & compilers, security
rest of talk – give you a flavor of the kinds of things I am interested in
meant to give you ideas (hopefully even inspiration!) but not meant to suggest what you should work on
Start filling out survey.
CS655: Programming Languages
University of Virginia
Computer Science
David Evans

2. University of Virginia CS 655
Menu
Midterm Survey
Is Proof-Carrying Code Useful?
My INFOSEC Malicious Code Talk
Intro to Lambda Calculus
9 May 2019
University of Virginia CS 655

3. Is Proof-Carrying Code Useful?
Visit
9 May 2019
University of Virginia CS 655

4. Let’s Stop Beating Dead Horses, and Start Beating Trojan Horses!
David Evans
INFOSEC Malicious Code Workshop
San Antonio, 13 January 2000
University of Virginia
Department of Computer Science
Charlottesville, VA

5. INFOSEC Malicious Code
Analogy: Security
Cryptography
Fun to do research in, lots of cool math problems, opportunities to dazzle people with your brilliance, etc.
But, % of break ins do not involve attack on sensible cryptography
Guessing passwords and stealing keys
Back doors, buffer overflows
Ignorant implementers choosing bad cryptography [Netscape Navigator Mail]
13 January 2000
INFOSEC Malicious Code

6. Structure of Argument
Low-level code safety (isolation) is the wrong focus
Agree
Disagree
PCC is not a realistic solution for the real problems in the foreseeable future
PCC is not the most promising solution for low-level code safety
Lots of useful research and results coming from PCC,
but realistic solution to malicious code won’t be one of them.
13 January 2000
INFOSEC Malicious Code

7. INFOSEC Malicious Code
Low-level code safety
Type safety, memory safety, control flow safety [Kozen98]
All high-level code safety depends on it
Many known pretty good solutions: separate processes, SFI, interpreter
Very few real attacks exploit low-level code safety vulnerabilities
One exception: buffer overflows
Many known solutions to this
Just need to sue vendors to get them implemented
13 January 2000
INFOSEC Malicious Code

8. High-Level Code Safety
Enforcement is (embarrassingly) easy
Reference monitors (since 1970s)
Can enforce most useful policies [Schneider98]
Performance penalty is small
Writing good policies is the hard part
Better ways to define policies
Ways to reason about properties of policies
Ideas for the right policies for different scenarios
Ways to develop, reason about, and test distributed policies
13 January 2000
INFOSEC Malicious Code

9. INFOSEC Malicious Code
Proofs
Reference Monitors
All possible executions
Current execution so far
No run-time costs
Monitoring and calling overhead
Checking integrated into code
Checking separate from code
Excruciatingly difficult
Trivially easy
Vendor sets policy
Consumer sets policy
13 January 2000
INFOSEC Malicious Code

10. INFOSEC Malicious Code
Fortune Cookie
“That which be proved cannot be worth much.”
Fortune cookie quoted on Peter’s web page
must
can
True for all users
True for all executions
Exception: Low-level code safety
13 January 2000
INFOSEC Malicious Code

11. Reasons you might prefer PCC
Run-time performance?
Amortizes additional download and verification time only rarely
SFI Performance penalty: ~5%
If you care, pay $20 more for a better processor or wait 5 weeks
Smaller TCB?
Not really smaller: twice as big as SFI (Touchstone VCGen+checker – 8300 lines / MisFiT x86 SFI implementation – 4500 lines)
You are a vendor who cares more about quality than time to market (not really PCC)
13 January 2000
INFOSEC Malicious Code

12. University of Virginia CS 655
Lambda Calculus
Developed by Alonzo Church [1940]
9 May 2019
University of Virginia CS 655

13. University of Virginia CS 655
-calculus
term = variable |  term | term term
same as:  = x |   |  
Evaluation rule:
-reduction (substitution)
(x. M)N   M [ x := N]
Substitute N for x in M.
9 May 2019
University of Virginia CS 655

14. University of Virginia CS 655
Some Simple Functions
I  x.x
C  xy.yx Abbreviation for x.(y. yx)
CII = (x.(y. yx)) (x.x) (x.x)
  (y. y (x.x)) (x.x)
  x.x (x.x)
  x.x
= I
9 May 2019
University of Virginia CS 655

15. Text-Substitution Problem
Hard to keep all the x’s in x.(y. yx)) (x.x) (x.x) straight
Smullyan/Keenan solve this by abandoning text representation and using pictures (Mockingbird paper)
Traditional solution: rename before substitution
9 May 2019
University of Virginia CS 655

16. University of Virginia CS 655
Mystery Function
p  xy.  pca.pca (x.x xy.x) x) y
(p ((x.x xy.y) x) (x. z.z (xy.y) y)
m  xy.  pca.pca (x.x xy.x) x) x.x
(p y (m ((x.x xy.y) x) y))
f  x.
 pca.pca ((x.x xy.x) x)
(z.z (xy.y) (x.x))
(m x (f ((x.x xy.y) x))) if
x = 0 1
x * f (x – 1)
9 May 2019
University of Virginia CS 655

17. Some Interesting Functions
T  xy. x
F  xy. y
if  pca . pca
Evaluate: if T M N
((pca . pca) (xy. x)) M N
 (ca . (x.(y. x)) ca)) M N
   (x.(y. x)) M N
 (y. M )) N   M
and  xy. if x y F
or  xy. if x T y
9 May 2019
University of Virginia CS 655

18. University of Virginia CS 655
Coupling
[M, N]  z.z M N
first  p.p T
second  p.p F
first [M, N]
= p.p T (z.z M N)   (z.z M N) T
= (z.z M N) xy. x   (xy. x) M N   M
9 May 2019
University of Virginia CS 655

19. University of Virginia CS 655
Tupling
n-tuple:
[M] = M
[M0,..., Mn-1, Mn] = [M0, [M1 ,..., [Mn-1, Mn ]... ]
n-tuple direct:
[M0,..., Mn-1, Mn] = z.z M0,..., Mn-1, Mn
Pi,n = x.x Ui,n
Ui,n = x0... xn. xi
What is P1,2?
9 May 2019
University of Virginia CS 655

20. University of Virginia CS 655
Counting
0  I
1  [F, I]
2  [F, [F, I]]
3  [F, [F [F, I]]
...
n + 1  [F, n]
9 May 2019
University of Virginia CS 655

21. University of Virginia CS 655
Arithmetic
Zero?  x.x T
Zero? 0 = (x.x T) I = T
Zero? 1 = (x.x T) [F, I] = F
succ  x.[F, x]
pred  x.x F
pred 1 = (x.x F) [F, I] = [F, I]F = I = 0
pred 0 = (x.x F) I = IF = F
add  xy.if (Zero? x) y
(add (pred x) (succ y)
9 May 2019
University of Virginia CS 655

22. University of Virginia CS 655
Factorial
mult 
xy. if (Zero? x) 0
(add y (mult (pred x) y))
fact 
x. if (Zero? x) 1
(mult x (fact (pred x)))
Recursive definition should make you uncomfortable.
After Spring Break – fixed points
9 May 2019
University of Virginia CS 655

23. University of Virginia CS 655
Summary
All you need is application and abstraction and you can compute anything
This is just one way of representing numbers, booleans, etc. – many others are possible
Integers, booleans, if, while, +, *, =, <, subtyping, multiple inheritance, etc. are for wimps! Real programmers only use .
9 May 2019
University of Virginia CS 655

24. University of Virginia CS 655
Charge
Go to Ion Stoica’s talk
“Scalable Internet Services”, 3:30 today, this room
Enjoy your Spring Break
Make some real progress on your projects – prepare to write March 23 Preliminary Reports
Mockingbird paper – describes -calculus using pictoral representation
Challenge (worth 1 position paper point)
Keenan’s challenge: find a mapping that will give a unique musical tune for most combinators (hear the bird-songs)
9 May 2019
University of Virginia CS 655