A Formal Analysis of Karn’s Algorithm

Hippel, Max von; McMillan, Kenneth L.; Nita-Rotaru, Cristina; Zuck, Lenore D.

doi:10.1007/978-3-031-37765-5_4

Cited by 3 publications

(7 citation statements)

References 54 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We present two proofs. The first is the one we used in our motivating work [4], where we explicitly construct the δ using the ceiling function. To do so, we have to prove various properties of that function.…”

Section: Rational Proofsmentioning

confidence: 99%

“…Since the rationals are dense in the reals, these proof strategies equally apply to the real numbers. The ceiling proof, which is the one we used in our prior work [4], involved first proving an intermediary lemma about the ceiling function. Specifically, assuming 0 < α < 1 and setting k = ⌈α/(1 − α)⌉ and δ = ⌈kα k /ε⌉, we proved that ∀n ≥ δ , α n ≤ f α (n).…”

Section: Summary and Closing Thoughtsmentioning

confidence: 99%

“…We chose ACL2s over Ivy because the computation is defined over real numbers, which we chose to model as rationals, and Ivy only supports integers. 4 And in particular, we chose ACL2s over ACL2 because we made frequent use of its features. For example, we use the built-in counterexample generation to show that a variable referred to as the "RTT variance" is not actually a statistical variance; and in one of our proofs, we use an automated proof of function termination to prove the existence of a particular value (namely, the value returned by the function in question).…”

Section: Motivating Examplementioning

confidence: 99%

“…This work can be viewed as a companion paper to our work in [4], with a special focus on the proof strategy for the RTO observations. Next, we briefly summarize our work in [4] as it provides context for this study.…”

Section: Introductionmentioning

confidence: 99%

“…In this work we focus on one such scenario, drawn from our recent work [4] studying Karn's algorithm [5] and the related Retransmission TimeOut (RTO) computation [9]. This work can be viewed as a companion paper to our work in [4], with a special focus on the proof strategy for the RTO observations. Next, we briefly summarize our work in [4] as it provides context for this study.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

A Case Study in Analytic Protocol Analysis in ACL2

von Hippel,

Manolios,

McMillan

et al. 2023

Electron. Proc. Theor. Comput. Sci.

Self Cite

View full text Add to dashboard Cite

When verifying computer systems we sometimes want to study their asymptotic behaviors, i.e., how they behave in the long run. In such cases, we need real analysis, the area of mathematics that deals with limits and the foundations of calculus. In a prior work, we used real analysis in ACL2s to study the asymptotic behavior of the RTO computation, commonly used in congestion control algorithms across the Internet. One key component in our RTO computation analysis was proving in ACL2s that for all α ∈ [0, 1), the limit as n → ∞ of α n is zero. Whereas the most obvious proof strategy involves the logarithm, whose codomain includes irrationals, by default ACL2 only supports rationals, which forced us to take a non-standard approach. In this paper, we explore different approaches to proving the above result in ACL2(r) and ACL2s, from the perspective of a relatively new user to each. We also contextualize the theorem by showing how it allowed us to prove important asymptotic properties of the RTO computation. Finally, we discuss tradeoffs between the various proof strategies and directions for future research.

show abstract

Section: Rational Proofsmentioning

confidence: 99%

Section: Summary and Closing Thoughtsmentioning

confidence: 99%

Section: Motivating Examplementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Case Study in Analytic Protocol Analysis in ACL2

von Hippel,

Manolios,

McMillan

et al. 2023

Electron. Proc. Theor. Comput. Sci.

Self Cite

View full text Add to dashboard Cite

show abstract

Avoiding Spurious Timeouts

Zuck,

Wen

2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Verification of GossipSub in ACL2s

Kumar,

Hippel,

Manolios

et al. 2023

Electron. Proc. Theor. Comput. Sci.

Self Cite

View full text Add to dashboard Cite

GossipSub is a popular new peer-to-peer network protocol designed to disseminate messages quickly and efficiently by allowing peers to forward the full content of messages only to a dynamically selected subset of their neighboring peers (mesh neighbors) while gossiping about messages they have seen with the rest. Peers decide which of their neighbors to graft or prune from their mesh locally and periodically using a score for each neighbor. Scores are calculated using a score function that depends on mesh-specific parameters, weights and counters relating to a peer's performance in the network. Since a GossipSub network's performance ultimately depends on the performance of its peers, an important question arises: Is the score calculation mechanism effective in weeding out non-performing or even intentionally misbehaving peers from meshes? We answered this question in the negative in our companion paper [31] by reasoning about GossipSub using our formal, official and executable ACL2s model. Based on our findings, we synthesized and simulated attacks against GossipSub which were confirmed by the developers of GossipSub, FileCoin, and Eth2.0, and publicly disclosed in MITRE CVE-2022-47547. In this paper, we present a detailed description of our model. We discuss design decisions, security properties of GossipSub, reasoning about the security properties in context of our model, attack generation and lessons we learnt when writing it.

show abstract

A Formal Analysis of Karn’s Algorithm

Cited by 3 publications

References 54 publications

A Case Study in Analytic Protocol Analysis in ACL2

A Case Study in Analytic Protocol Analysis in ACL2

Avoiding Spurious Timeouts

Verification of GossipSub in ACL2s

Contact Info

Product

Resources

About