Towards formal verification of TLS network packet processing written in C

Abstract

TLS is such a widespread security protocol that errors in its implementation can have disastrous consequences. This responsibility is mostly borne by programmers, caught between specifications with the ambiguities of natural language and error-prone low-level parsing of network packets. We provide new Coq libraries for the formal verification of TLS packet processing written in C. The originality of our encoding of the core subset of C is its use of dependent types to guarantee statically well-formedness of datatypes and correct typing. We further equip this encoding with a Separation logic that enables byte-level reasoning and also provide a logical view of data structures. We also formalize a significant part of the RFC for TLS, again using dependent types to capture succinctly constraints that are left implicit in the prose document. Finally, we apply the above framework to an existing implementation of TLS of which we specify and verify a parsing function for network packets.Though not yet completed, this experiment already led us to spot correctness issues with the RFC and the C source code.

A Formal TLS Handshake Model in LNT

“…The authors of [3] present an approach with the goal to improve TLS implementations. For this sake, a framework for verification of C implementations for TLS functionality is provided.…”

A Formal C Memory Model for Separation Logic

“…Definition 2. 1 We let N denote the type of natural numbers (including 0), let Z denote the type of integers, and let Q denote the type of rational numbers. We let i | j denote that i ∈ N is a divisor of j ∈ N.…”

“…Affeldt et al [1,2] have formalized non-cyclicity of types using a complex constraint on paths through types. Our definition of validity of environments (Definition 4.11) follows the structure of type environments, and is more easy to use (for example to implement the aforementioned recursor and induction principle).…”

“…During the execution of the first if statement, the actual value of y & 1 is needed. In this case, y & 1 has the value 1 for any possible numerical value of ((unsigned char*)p) [1]. As a result, the string one is printed.…”

Verificação Automática de Protocolos de Segurança com a ferramenta Scyther

“…Devido a isso, a verificação automática e formal de protocolos, utilizando métodos formais e matemáticos, vem tornando-se cada vez mais frequente e imprescindível na comunidade de segurança [Chudnov et al 2018, Li et al 2018, Kreutz et al 2019. Pesquisas relatam, por exemplo, que o processo de verificação formal já contribuiu também para a correção de protocolos que estavam em utilização [Dalal et al 2010, Cremers et al 2016, Affeldt and Marti 2013.…”