Verification of Certifying Computations

Abstract

Abstract. Formal verification of complex algorithms is challenging. Verifying their implementations goes beyond the state of the art of current verification tools and proving their correctness usually involves non-trivial mathematical theorems. Certifying algorithms compute in addition to each output a witness certifying that the output is correct. A checker for such a witness is usually much simpler than the original algorithm -yet it is all the user has to trust. Verification of checkers is feasible with current tools and leads to computations that can be completely trusted. In this paper we develop a framework to seamlessly verify certifying computations. The automatic verifier VCC is used for checking code correctness, and the interactive theorem prover Isabelle/HOL targets high-level mathematical properties of algorithms. We demonstrate the effectiveness of our approach by applying it to the verification of the algorithmic library LEDA.

Lessons Learned From Microkernel Verification — Specification is the New Bottleneck

“…When a successful formal verification of complex and large software systems at code level is desired, we believe a combination of both interactive and auto-active specification and verification approaches is promising -similar to verification of certifying algorithms using VCC, together with Isabelle/HOL as shown in [1]. Using this combination, auto-active tools would allow for efficient verification of sourcecode level properties closer to the hardware, the resulting functional properties of the code abstracting from implementation details -whereas interactive verification systems may be used to verify complex system properties on a suitable, user-defined abstraction of the system.…”

A Framework for the Verification of Certifying Computations

“…ϕ(x) ∧ W(x, y, w) −→ ψ(x, y). (1) In contrast to algorithms that work on abstract sets X, Y , and W , the implementing programs operate on concrete representations of abstract objects. We use X, Y , and W for the set of representations of objects in X, Y , and W , respectively, and assume the mappings i X : X → X, i Y : Y → Y , and i W : W → W .…”

“…It took several months to develop the framework and complete the first example as described in [1]. For this paper, we have reworked the framework, thereby strengthening and simplifying it at the same time.…”

“…algorithm with input x, output y, and witness w takes as input the triple (x, y, w) and accepts the triple if w proves that y is a correct output for input x. Otherwise, the checker rejects the output or witness as buggy 1 . Figure 1 contrasts a standard algorithm with a certifying algorithm for IObehavior (ϕ, ψ).…”

On a Verification Framework for Certifying Distributed Algorithms: Distributed Checking and Consistency

“…Literature offers numerous certifying algorithms [19], [20], [27], [4], [6], [15], [13], [12], [18], [23], [11], [22], [3], [10], [2], [1], [24], [9]. A theory of certifying algorithms and further reading is given in [19].…”