Type Checking Cryptography Implementations

Abstract

Cryptographic software development is a challenging field: high performance must be achieved, while ensuring correctness and compliance with low-level security policies. CAO is a domain specific language designed to assist development of cryptographic software. An important feature of this language is the design of a novel type system introducing native types such as predefined sized vectors, matrices and bit strings, residue classes modulo an integer, finite fields and finite field extensions, allowing for extensive static validation of source code. We present the formalisation, validation and implementation of this type system.

CAOVerif: An open-source deductive verification platform for cryptographic software implementations

“…For example, the size restrictions associated with matrix addition and multiplication are enforced by the type system. The same happens for operations involving bit strings, rings and finite fields, where the type system checks that operator inputs have matching lengths, moduli, etc.s The soundness of this type system has recently been established with respect to the semantics of CAO [19]. This result implies that a correctly typed CAO program can only give rise to a well-defined set of trapped errors.…”

“…The language has been designed to allow the programmer to work over a syntax that is similar to that of C, whilst focusing on the aspects of cryptographic primitive implementation that are most critical for security and efficiency. A detailed specification of CAO can be found in [17,18]. AppendixA includes source code extracted from a CAO implementation of the NaCl crypography library.…”

“…An implementation of a type-checker for CAO programs has been derived from the CAO type system formalisation [18]. Hence, we assume that the input CAO program has been type checked and that CAOVerif has access to an Abstract Syntax Tree (AST) annotated with the resulting type information.…”

CT-wasm: type-driven secure cryptography for the web ecosystem

“…However, the burden is still on the developer to write constant-time code, as qhasm has no notion of non-interference. CAO [Barbosa et al 2012] and Cryptol [Galois 2016] are higher-level DSLs for crypto implementations, but do not have verified non-interference guarantees.…”

“…FaCT [Cauligi et al 2017] is a high-level language that compiles to LLVM which it then verifies with ct-verif [Almeida et al 2016b]. CAO [Barbosa et al 2014[Barbosa et al , 2012 and Cryptol [Galois 2016] are high-level DSLs for crypto implementations, but do not have verified non-interference guarantees. All these efforts are complementary to our low-level approach.…”