Fully-abstract compilation by approximate back-translation

Abstract

A compiler is fully-abstract if the compilation from source language programs to target language programs reflects and preserves behavioural equivalence. Such compilers have important security benefits, as they limit the power of an attacker interacting with the program in the target language to that of an attacker interacting with the program in the source language. Proving compiler full-abstraction is, however, rather complicated. A common proof technique is based on the back-translation of target-level program contexts to behaviourally-equivalent source-level contexts. However, constructing such a backtranslation is problematic when the source language is not strong enough to embed an encoding of the target language. For instance, when compiling from a simply-typed λcalculus (λ τ ) to an untyped λ-calculus (λ u ), the lack of recursive types in λ τ prevents such a back-translation.We propose a general and elegant solution for this problem. The key insight is that it suffices to construct an approximate back-translation. The approximation is only accurate up to a certain number of steps and conservative beyond that, in the sense that the context generated by the back-translation may diverge when the original would not, but not vice versa. Based on this insight, we describe a general technique for proving compiler full-abstraction and demonstrate it on a compiler from λ τ to λ u . The proof uses asymmetric cross-language logical relations and makes innovative use of step-indexing to express the relation between a context and its approximate back-translation. The proof extends easily to common compiler patterns such as modular compilation and, to the best of our knowledge, it is the first compiler full abstraction proof to have been fully mechanised in Coq. We believe this proof technique can scale to challenging settings and enable simpler, more scalable proofs of compiler full-abstraction. 2012 ACM CCS: [Security and privacy Logic and verification]: 300; [Software and its engineering General programming languages]: 300; [Software and its engineering Compilers]: 300.

Journey Beyond Full Abstraction: Exploring Robust Property Preservation for Secure Compilation

“…C5. We show that two existing proof techniques originally developed for full abstraction can be readily adapted to our new criteria, which is important since good proof techniques are difficult to find in this space [36,71,78]. The paper closes with discussions of related ( §7) and future work ( §8).…”

“…Full abstraction-the preservation and reflection of observational equivalence-is a well-studied criterion for secure compilation ( §7). The security-relevant direction of full abstraction is Observational Equivalence Preservation (OEP) [35,78]:…”

“…The RrHP proof for this compilation chain uses a simple logical relation that includes cases for both terms of source type (intuitively used for compiler correctness) and for terms of back-translation type [35,71].…”

“…In §6.3 we adapted the same technique to show RrHP for a simple translation from a statically typed to a dynamically typed language with firstorder functions and I/O. Devriese et al [35] show that even when a precise universal type does not exist in the source, one can use an approximate embedding that only works for a certain number of execution steps. They illustrate such an approximate back-translation by proving full abstraction for a compiler from the simply-typed to the untyped λ-calculus.…”

“…read By Lemma G.32 (Compatibility lemma for read). write By IH with Lemma G.33 (Compatibility lemma for write).Theorem G 35. ( ·↓ is semantics preserving for programs).…”