Commit 374f9d0d by Benoit Viguier

### more text + make spell

parent 0c99e7b1
 ... @@ -110,7 +110,6 @@ The correctness of this specification is formally proven in Coq with ... @@ -110,7 +110,6 @@ The correctness of this specification is formally proven in Coq with % For the sake of completeness we proved all intermediate functions. % For the sake of completeness we proved all intermediate functions. \subheading{Memory aliasing.} \subheading{Memory aliasing.} % The semicolon in the \VSTe{SEP} parts of the Hoare triples represents the \emph{separating conjunction} (often written as a star), which means that The semicolon in the \VSTe{SEP} parts of the Hoare triples represents the \emph{separating conjunction} (often written as a star), which means that the memory shares of \texttt{q}, \texttt{n} and \texttt{p} do not overlap. the memory shares of \texttt{q}, \texttt{n} and \texttt{p} do not overlap. In other words, In other words, ... @@ -130,7 +129,6 @@ Examples of such cases are illustrated in \fref{tikz:MemSame}. ... @@ -130,7 +129,6 @@ Examples of such cases are illustrated in \fref{tikz:MemSame}. \caption{Aliasing and Separation Logic}% \caption{Aliasing and Separation Logic}% \label{tikz:MemSame}% \label{tikz:MemSame}% \end{figure} \end{figure} As a result, a function must either have multiple specifications or specify which As a result, a function must either have multiple specifications or specify which aliasing case is being used. aliasing case is being used. The first option would require us to do very similar proofs multiple times for a same function. The first option would require us to do very similar proofs multiple times for a same function. ... @@ -145,3 +143,16 @@ we define an additional parameter $k$ with values in $\{0,1,2,3\}$: ... @@ -145,3 +143,16 @@ we define an additional parameter $k$ with values in $\{0,1,2,3\}$: In the proof of our specification, we do a case analysis over $k$ when needed. In the proof of our specification, we do a case analysis over $k$ when needed. This solution does not generate all the possible cases of aliasing over 3 pointers This solution does not generate all the possible cases of aliasing over 3 pointers (\eg \texttt{o} = \texttt{a} = \texttt{b}) but it is enough to cover our needs. (\eg \texttt{o} = \texttt{a} = \texttt{b}) but it is enough to cover our needs. \subheading{Improving speed.} To make the verification the smoothest, the Coq formal definition of the function should be as close as possible to the C implementation behavior. Optimizations of such definitions are often counter-productive as they increase the amount of proofs required for \eg bounds checking, loops invariants\ldots. In order to further speed-up the verification process, to prove the specification \TNaCle{crypto_scalarmult}, we only need the specification of the subsequently called functions (\eg \TNaCle{M}). This provide with multiple advantages: the verification by the Coq kernel can be done in parallel and multiple users can work on proving different functions at the same time. For the sake of completeness we proved all intermediate functions.
 \subsection{Number representation and C implementation} \subsection{Number representation and C implementation} \label{subsec:num-repr-rfc} \label{subsec:num-repr-rfc} \todo{Do we completely rewrite this section?} As described in \sref{subsec:Number-TweetNaCl}, numbers in \TNaCle{gf} are represented As described in \sref{subsec:Number-TweetNaCl}, numbers in \TNaCle{gf} are represented in base $2^{16}$ and we use a direct mapping to represent that array as a list in base $2^{16}$ and we use a direct mapping to represent that array as a list integers in Coq. However, in order to show the correctness of the basic operations, integers in Coq. However, in order to show the correctness of the basic operations, ... ...
 ... @@ -32,8 +32,7 @@ We discuss the plot twist (\ref{subsec:Zmodp}) of Curve25519 and solve it (\ref{ ... @@ -32,8 +32,7 @@ We discuss the plot twist (\ref{subsec:Zmodp}) of Curve25519 and solve it (\ref{ \subsection{Formalization of elliptic Curves} \subsection{Formalization of elliptic Curves} \label{subsec:ECC} \label{subsec:ECC} \todo{Beter here of after the final theorem of the subsection?} \fref{tikz:ProofHighLevel1} presents a intuition of the proof. \begin{figure}[h] \begin{figure}[h] \centering \centering \include{tikz/highlevel1} \include{tikz/highlevel1} ... @@ -41,7 +40,6 @@ We discuss the plot twist (\ref{subsec:Zmodp}) of Curve25519 and solve it (\ref{ ... @@ -41,7 +40,6 @@ We discuss the plot twist (\ref{subsec:Zmodp}) of Curve25519 and solve it (\ref{ \label{tikz:ProofHighLevel1} \label{tikz:ProofHighLevel1} \end{figure} \end{figure} We consider elliptic curves over a field $\K$. We assume that the We consider elliptic curves over a field $\K$. We assume that the characteristic of $\K$ is neither 2 or 3. characteristic of $\K$ is neither 2 or 3. ... @@ -322,16 +320,15 @@ Theorem opt_montgomery_ok (n m: nat) (x : K) : ... @@ -322,16 +320,15 @@ Theorem opt_montgomery_ok (n m: nat) (x : K) : \subsection{Curves, twists and extension fields} \subsection{Curves, twists and extension fields} \todo{Beter here of after the final theorem of the subsection?} \fref{tikz:ProofHighLevel2} gives a high-level view of the proofs presented here. \begin{figure}[h] \begin{figure}[h] \centering \centering \include{tikz/highlevel2} \include{tikz/highlevel2} \caption{Instanciations and proof dependencies for the correctness of X25519} \caption{Instantiation and proof dependencies for the correctness of X25519} \label{tikz:ProofHighLevel2} \label{tikz:ProofHighLevel2} \end{figure} \end{figure} To be able to use the above theorem we need to satisfy hypothesis To be able to use the above theorem we need to satisfy hypothesis \ref{hyp:a_minus_4_not_square}: $a^2-4$ is not a square in \K: \ref{hyp:a_minus_4_not_square}: $a^2-4$ is not a square in \K: $$\forall x \in \K,\ x^2 \neq a^2-4.$$ $$\forall x \in \K,\ x^2 \neq a^2-4.$$ ... @@ -392,14 +389,12 @@ We instantiate \coqe{opt_montgomery} in two specific ways:\\ ... @@ -392,14 +389,12 @@ We instantiate \coqe{opt_montgomery} in two specific ways:\\ With \tref{thm:montgomery-ladder-correct} we derive the following two lemmas: With \tref{thm:montgomery-ladder-correct} we derive the following two lemmas: \begin{lemma} \begin{lemma} For all $x \in \F{p},\ n \in \N,\ P \in \F{p} \times \F{p}$,\\ For all $x \in \F{p},\ n \in \N,\ P \in \F{p} \times \F{p}$,\\ such that $P \in M_{486662,1}(\F{p})$ and $\chi_0(P) = x$.\\ such that $P \in M_{486662,1}(\F{p})$ and $\chi_0(P) = x$. % Given $n$ and $x$, $$Curve25519\_Fp(n,x) = \chi_0(n \cdot P)$$ $$Curve25519\_Fp(n,x) = \chi_0(n \cdot P)$$ \end{lemma} \end{lemma} \begin{lemma} \begin{lemma} For all $x \in \F{p},\ n \in \N,\ P \in \F{p} \times \F{p}$\\ For all $x \in \F{p},\ n \in \N,\ P \in \F{p} \times \F{p}$\\ such that $P \in M_{486662,2}(\F{p})$ and $\chi_0(P) = x$.\\ such that $P \in M_{486662,2}(\F{p})$ and $\chi_0(P) = x$. % Given $n$ and $x$, $$Twist25519\_Fp(n,x) = \chi_0(n \cdot P)$$ $$Twist25519\_Fp(n,x) = \chi_0(n \cdot P)$$ \end{lemma} \end{lemma} As the Montgomery ladder does not depend on $b$, it is trivial to As the Montgomery ladder does not depend on $b$, it is trivial to ... @@ -505,9 +500,6 @@ of formulas by using rewrite rules: ... @@ -505,9 +500,6 @@ of formulas by using rewrite rules: \end{split} \end{split} \end{equation*} \end{equation*} The injection $a \mapsto (a,0)$ from $\F{p}$ to $\F{p^2}$ preserves The injection $a \mapsto (a,0)$ from $\F{p}$ to $\F{p^2}$ preserves $0, 1, +, -, \times$. Thus $(a,0)$ can be abbreviated as $a$ without confusions. $0, 1, +, -, \times$. Thus $(a,0)$ can be abbreviated as $a$ without confusions. ... ...
 ... @@ -52,8 +52,6 @@ o[i] = aux1 + aux2; ... @@ -52,8 +52,6 @@ o[i] = aux1 + aux2; done with this architecture \cite{2015-Appel,coq-faq}. done with this architecture \cite{2015-Appel,coq-faq}. \end{itemize} \end{itemize} \todo{NEW} \subheading{Corrections in TweetNaCl.} \subheading{Corrections in TweetNaCl.} As a result of this verification, we removed superfluous code. As a result of this verification, we removed superfluous code. Indeed indexes 17 to 79 of the \TNaCle{i64 x[80]} intermediate variable of Indeed indexes 17 to 79 of the \TNaCle{i64 x[80]} intermediate variable of ... @@ -73,20 +71,18 @@ and thus solved this problem. ... @@ -73,20 +71,18 @@ and thus solved this problem. o[i]&=0xffff; o[i]&=0xffff; \end{lstlisting} \end{lstlisting} \todo{NEW} Aside from the modifications above mentioned, all subsequent alteration Aside from the modications above mentionned, all subsequent alteration ---such as the type change of loop indexes (\TNaCle{int} instead of \TNaCle{i64})--- ---such as the type change of loop indexes (\TNaCle{int} instead of \TNaCle{i64})--- were required for VST to parse properly the code. We believe those were required for VST to parse properly the code. We believe those adjustments do not impact the trust of our proof. adjustments do not impact the trust of our proof. We contacted the authors of TweetNaCl and expect that the changes above We contacted the authors of TweetNaCl and expect that the changes above mentionned will soon be integrated in a new version of the library. mentioned will soon be integrated in a new version of the library. \subheading{Extending our work.} \subheading{Extending our work.} The high-level definition (\sref{sec:maths}) can easily be ported to any The high-level definition (\sref{sec:maths}) can easily be ported to any other Montgomery curves and with it the proof of the ladder's correctness other Montgomery curves and with it the proof of the ladder's correctness assuming the same forumlas are used. assuming the same formulas are used. In addition to the curve equation, the field \F{p} would need to be redefined In addition to the curve equation, the field \F{p} would need to be redefined as $p=2^{255}-19$ is hard-coded in order to speed up some proofs. as $p=2^{255}-19$ is hard-coded in order to speed up some proofs. ... @@ -97,7 +93,7 @@ level verification similar to \tref{thm:montgomery-ladder-correct}. ... @@ -97,7 +93,7 @@ level verification similar to \tref{thm:montgomery-ladder-correct}. The verification \eg X448~\cite{cryptoeprint:2015:625,rfc7748} in C would The verification \eg X448~\cite{cryptoeprint:2015:625,rfc7748} in C would require the adaptation of most of the low level arithmetic (mainly the require the adaptation of most of the low level arithmetic (mainly the multiplication, carry propagations and reductions). multiplication, carry propagation and reductions). Once the correctness and bounds of the basic operations are established, Once the correctness and bounds of the basic operations are established, reproving the full ladder would make use of our generic definition and lower reproving the full ladder would make use of our generic definition and lower the workload. the workload. ... ...
 ... @@ -100,11 +100,11 @@ ... @@ -100,11 +100,11 @@ \texttt{clamp} & \texttt{Low/Prep\_n.v} & Clamping \\ \texttt{clamp} & \texttt{Low/Prep\_n.v} & Clamping \\ \texttt{Unpack25519} & \texttt{Low/Unpack25519.v} & unpacking (mod $2^{255}$)\\ \texttt{Unpack25519} & \texttt{Low/Unpack25519.v} & unpacking (mod $2^{255}$)\\ \hline \hline \multicolumn{3}{c}{Instanciations of \texttt{Ops}}\\ \multicolumn{3}{c}{Instantiation of \texttt{Ops}}\\ \hline \hline \texttt{Z25519\_Ops} & \texttt{Mid/Instances.v} & Instanciations over \F{p} with $p = \p$\\ \texttt{Z25519\_Ops} & \texttt{Mid/Instances.v} & Instantiation over \F{p} with $p = \p$\\ \texttt{Z\_Ops} & \texttt{Mid/Instances.v} & Instanciations over $\Zfield$ \\ \texttt{Z\_Ops} & \texttt{Mid/Instances.v} & Instantiation over $\Zfield$ \\ \texttt{List\_Z\_Ops} & \texttt{Mid/Instances.v} & Instanciations lists of \Z \\ \texttt{List\_Z\_Ops} & \texttt{Mid/Instances.v} & Instantiation lists of \Z \\ \hline \hline \multicolumn{3}{c}{X25519 over \Z and list of \Z}\\ \multicolumn{3}{c}{X25519 over \Z and list of \Z}\\ \hline \hline ... ...
 ... @@ -20,14 +20,14 @@ ... @@ -20,14 +20,14 @@ % M is a finite assoc group % M is a finite assoc group \begin{scope}[yshift=0 cm,xshift=3 cm] \begin{scope}[yshift=0 cm,xshift=3 cm] \draw [fill=green!20] (0,0) -- (3.25,0) -- (3.25,-0.75) -- (0, -0.75) -- cycle; \draw [fill=green!20] (0,0) -- (3.25,0) -- (3.25,-0.75) -- (0, -0.75) -- cycle; \draw (1.675,-0.375) node[textstyle, anchor=center] {$M_{a,b}(\K)$ is an Assoc. Fin. Grp}; \draw (1.675,-0.375) node[textstyle, anchor=center] {$M_{a,b}(\K)$ is an Assoc. Fin. Grp.}; \end{scope} \end{scope} % Hypothesis x square is not 2 % Hypothesis x square is not 2 \begin{scope}[yshift=-1.5 cm,xshift=0 cm] \begin{scope}[yshift=-1.5 cm,xshift=0 cm] \draw [fill=orange!20] (0,0) -- (1.5,0) -- (1.5,-1.25) -- (0, -1.25) -- cycle; \draw [fill=orange!20] (0,0) -- (1.5,0) -- (1.5,-1.25) -- (0, -1.25) -- cycle; \draw (0,0) node[textstyle, anchor=north west] {\textbf{Hyp:}}; \draw (0,0) node[textstyle, anchor=north west] {\textbf{Hyp:}}; \draw (0.75,-0.375) node[textstyle, anchor=north] {$\forall x \in \K,$\\$x^2 \neq 2$}; \draw (0.75,-0.375) node[textstyle, anchor=north] {$\forall x \in \K,$\\$x^2 \neq a^2-4$}; \end{scope} \end{scope} % Final theorem % Final theorem ... ...
 ... @@ -13,25 +13,31 @@ ... @@ -13,25 +13,31 @@ \end{scope} \end{scope} \begin{scope}[yshift=-1 cm,xshift=1.5 cm] \begin{scope}[yshift=-1 cm,xshift=1.5 cm] \draw[fill=green!20] (0,0) -- (1.25,0) -- (1.25,-0.75) -- (0, -0.75) -- cycle; \draw (0.615,-0.375) node[textstyle, anchor=center] {$\forall x \in \F{p},$\\$x^2 \neq 2$}; \end{scope} \begin{scope}[yshift=-1 cm,xshift=2.875 cm] \draw[fill=green!20] (0,0) -- (1.5,0) -- (1.5,-0.75) -- (0, -0.75) -- cycle; \draw[fill=green!20] (0,0) -- (1.5,0) -- (1.5,-0.75) -- (0, -0.75) -- cycle; \draw (0.75,-0.375) node[textstyle, anchor=center] {$\forall x \in \F{p},$\\$x^2 \neq 2$}; \draw (0.75,-0.375) node[textstyle, anchor=center] {$\forall x \in \F{p},$\\$x^2 \neq a^2-4$}; \end{scope} \end{scope} \begin{scope}[yshift=-1 cm,xshift=4 cm] \begin{scope}[yshift=-1 cm,xshift=4.5 cm] \draw[fill=white] (0,0) -- (1.5,0) -- (1.5,-0.75) -- (0, -0.75) -- cycle; \draw[fill=white] (0,0) -- (1,0) -- (1,-0.75) -- (0, -0.75) -- cycle; \draw (0.75,-0.375) node[textstyle, anchor=center] {$C(\F{p})$}; \draw (0.5,-0.375) node[textstyle, anchor=center] {$C(\F{p})$}; \end{scope} \end{scope}