Full abstraction for expressiveness: history, myths and facts

Gorla, Daniele; Nestmann, Uwe

doi:10.1017/s0960129514000279

Cited by 39 publications

(35 citation statements)

References 55 publications

(62 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recently, Gorla and Nestman [2014] and Parrow [2014] have argued against the use of the mere existence of fully-abstract translations as a measure of language expressiveness, because very often fully abstract translations exist but are in some sense degenerate, uninteresting and/or unrealistic. These arguments are not directly relevant to our work, because we are not interested in the mere existence of a fully abstract compiler as a measure of language expressiveness, but we prove the fully abstractness of a specific, realistic compiler.…”

Section: Related Workmentioning

confidence: 99%

Fully-abstract compilation by approximate back-translation

2016

View full text Add to dashboard Cite

A compiler is fully-abstract if the compilation from source language programs to target language programs reflects and preserves behavioural equivalence. Such compilers have important security benefits, as they limit the power of an attacker interacting with the program in the target language to that of an attacker interacting with the program in the source language. Proving compiler full-abstraction is, however, rather complicated. A common proof technique is based on the back-translation of target-level program contexts to behaviourally-equivalent source-level contexts. However, constructing such a backtranslation is problematic when the source language is not strong enough to embed an encoding of the target language. For instance, when compiling from a simply-typed λcalculus (λ τ ) to an untyped λ-calculus (λ u ), the lack of recursive types in λ τ prevents such a back-translation.We propose a general and elegant solution for this problem. The key insight is that it suffices to construct an approximate back-translation. The approximation is only accurate up to a certain number of steps and conservative beyond that, in the sense that the context generated by the back-translation may diverge when the original would not, but not vice versa. Based on this insight, we describe a general technique for proving compiler full-abstraction and demonstrate it on a compiler from λ τ to λ u . The proof uses asymmetric cross-language logical relations and makes innovative use of step-indexing to express the relation between a context and its approximate back-translation. The proof extends easily to common compiler patterns such as modular compilation and, to the best of our knowledge, it is the first compiler full abstraction proof to have been fully mechanised in Coq. We believe this proof technique can scale to challenging settings and enable simpler, more scalable proofs of compiler full-abstraction. 2012 ACM CCS: [Security and privacy Logic and verification]: 300; [Software and its engineering General programming languages]: 300; [Software and its engineering Compilers]: 300.

show abstract

Section: Related Workmentioning

confidence: 99%

Fully-abstract compilation by approximate back-translation

2016

View full text Add to dashboard Cite

show abstract

“…The different purposes of encodability criteria lead to very different kinds of conditions that are usually hard to analyse and compare directly. In fact even widely used criteria-as full abstractionseem not to be fully understood by the community, as the need for articles as [9,20] shows. In contrast to that, relations on processes-such as simulations and bisimulations-are a very well studied and understood topic (see for example [5]).…”

Section: Introductionmentioning

confidence: 99%

Analysing and Comparing Encodability Criteria

Peters¹,

Glabbeek²

2015

Electron. Proc. Theor. Comput. Sci.

View full text Add to dashboard Cite

Encodings or the proof of their absence are the main way to compare process calculi. To analyse the quality of encodings and to rule out trivial or meaningless encodings, they are augmented with quality criteria. There exists a bunch of different criteria and different variants of criteria in order to reason in different settings. This leads to incomparable results. Moreover it is not always clear whether the criteria used to obtain a result in a particular setting do indeed fit to this setting. We show how to formally reason about and compare encodability criteria by mapping them on requirements on a relation between source and target terms that is induced by the encoding function. In particular we analyse the common criteria full abstraction, operational correspondence, divergence reflection, success sensitiveness, and respect of barbs; e.g. we analyse the exact nature of the simulation relation (coupled simulation versus bisimulation) that is induced by different variants of operational correspondence. This way we reduce the problem of analysing or comparing encodability criteria to the better understood problem of comparing relations on processes.Comment: In Proceedings EXPRESS/SOS 2015, arXiv:1508.06347. The Isabelle/HOL source files, and a full proof document, are available in the Archive of Formal Proofs, at http://afp.sourceforge.net/entries/Encodability_Process_Calculi.shtm

show abstract

“…The different purposes of encodability criteria lead to very different kinds of conditions that are usually hard to analyse and compare directly. In fact even widely used criteria-as full abstractionseem not to be fully understood by the community, as the need for articles as [23,46] shows. In contrast to that, relations on processes-such as simulations and bisimulations-are a very well studied and understood topic (see for example [16]).…”

Section: Formalising and Analysing Encodability Criteriamentioning

confidence: 99%