1. Programmability with Proof-Carrying Code George C. Necula University of California Berkeley Peter Lee Carnegie Mellon University

2. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Why Programmable APIs Pros: –Standardize “how” not “what” (mechanism vs. policy) –Easy to customize functionality & performance Move the computation closer to the data –Richer API Cons: Security risks? Performance degradation? More complex system Bigger trusted infrastructure ? Harder (impossible?) to predict global behavior Programming language technology can help

3. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Safety Through Run-Time Checking native code host untrusted client app. code compiler Hardware memory protection / Interpreter / Monitor run-time aborts big and complex verified? No way! limited safety policy run-time is too late! expensive constrained data representation

4. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Software Safety: Java Javac JVM slow Java app. code Java byte code Java Verifier host untrusted client Limited, fixed safety policy JIT still slow! native code still big and complex (and buggy?) not verified

5. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Our Idea: Proof-Carrying Code (PCC) Use static checking for both safety and performance Static checking is possible (and in fact easy) if the client supplies evidence attesting to the safety of the code For an important class of properties, the evidence can be produced by a client-side compiler

6. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Proof-Carrying Code (PCC) host untrusted client formal safety policy application code Certifying compiler optimized native code proof Proof checker CPU automated support in a familiar tool small & tamper- proof simple, small, & fast safety with maximum performance Flexible, customizable safety policies

7. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 What You Can Do With PCC Any property with an adequate formalism can be enforced –if you can prove it, PCC can check it! One proof-checker for all policies! –Small commitment for open-ended flexibility Example: safety policies defined by safe interpreters –E.g, security monitors, memory safety, resource usage limits, … –The interpreter need not be directly implementable! E.g, a pointer points to a null-terminated string … can be enforced statically with PCC –The proof says that all run-time checks will succeed –No run-time penalty –No data representation constraints –Effective enforcement of timing constraints

8. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 PCC Beyond Memory Safety Example: database with multi-level access control accessrouteprice agent Safety policy : –host invokes the agent with: security clearance level –route and price fields readable only if access <= level parent –communication permitted only back to parent –must terminate within MAX instructions –wait BNDW * SIZE instructions before sending SIZE bytes –Proofs are bigger now (300% of code) fare pricing server level parent PCC is not limited to memory safety!

9. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Experience with PCC Producing the proofs of safety is generally hard But can be automated in certain cases –E.g., Type safety, monitor-based safety policies Automation idea for type safety: –start with a type-safe language –the proof exists at source level; just preserve it! –Compile the proof while compiling the code Experimental results for a safe-C compiler –Speed of code on par with traditional optimizing compilers –Proofs are 10%-40% the size of the code –Proof checking is fast (~ 100Kb/s) –Checker + machine code parser is small (~50Kb for x86) –A certifying compiler for Java is being built by Cedilla Systems

10. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Conclusions The is a need for system extensibility without sacrificing safety and performance Programming language technology can provide all of these in a small and flexible package –Type safety for optimized machine code is here –More research is needed to automate proof generation for more complex safety policies Try proof-carrying code online –http://www.cs.berkeley.edu/~necula/pcc.html

11. Supplemental Slides

12. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Touchstone vs. C Compilers Touchstone has the extra burden of removing bounds checks Certifying compilation and PCC coexist with optimizations!

13. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Proof Sizes Geometric means: –proofs are 20% of code –invariant annotations are 20% of code

14. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Experiment: Network Packet Filters OS kernel user process space network monitoring application network packet filter Safety policy: packet read only no loops Wrote filters using: Touchstone + PCC Modula-3 SFI (sandboxing) BPF (interpreter)

15. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 PCC Packet Filters PCC filters are safe and fast –10x interpretation, 2x Modula-3, 1.3x sandboxing –PCC can certify even hand-optimized packets! Proof sizes and checking times are small –proof overhead: 20% (smaller than signatures !) –proof checking time: 1-3ms (amortized quickly)

16. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Minimal-Cooperation PCC Safety policy Certifying Compiler Theorem Prover VC Generator Proof Checker Client Host Proof Invar Code Source Logic Code VC

17. George Necula “Programmability with Proof-Carrying Code”, OpenSig’99 Firewall-based PCC Safety policy Certifying Compiler Theorem Prover VC Generator Proof Checker Client Firewall Proof Invar Code Source Logic Code VC Host within enclave Code