Meta-F* Language Extensibility, Metaprogramming and Proof - - PowerPoint PPT Presentation

▶
meta f
SMART_READER_LITE
LIVE PREVIEW

Meta-F* Language Extensibility, Metaprogramming and Proof - - PowerPoint PPT Presentation

Feb 10, 2023 449 likes •1.3k views

Meta-F* Language Extensibility, Metaprogramming and Proof automation https://fstar-lang.github.io https://project-everest.github.io/ Interns, open-source MS MSR R Redm dmond ond INRIA A Paris contributors, visitors, Barry

slide-1
SLIDE 1

Language Extensibility, Metaprogramming and Proof automation

Meta-F*

https://fstar-lang.github.io https://project-everest.github.io/

slide-2
SLIDE 2

Classified as Microsoft Confidential

  • MS

MSR R Redm dmond

  • nd
  • Barry Bond
  • Chris Hawblitzel
  • Qunyan Magnus
  • Kiran Muthabatulla
  • Jonathan Protzenko
  • Tahina Ramananandro
  • Nikhil Swamy
  • Gustavo Varo
  • MS

MSR R Camb mbridg ridge

  • Antoine Delignat-Lavaud
  • Cédric Fournet
  • Christoph M. Wintersteiger
  • Santiago Zanella-Béguelin
  • MS

MSR R India ia

  • Aseem Rastogi
  • INRIA

A Paris

  • Danel Ahman
  • Kenji Maillard
  • Benjamin Beurdouche
  • Karthikeyan Bhargavan
  • Victor Dumitrescu
  • Cătălin Hriţcu
  • Marina Polubelova
  • CMU

MU (P (Pitts ttsbu burgh) gh)

  • Jay Bosamiya
  • Aymeric Fromherz
  • Bryan Parno
  • Edinburgh
  • Markulf Kohlweiss
  • Interns, open-source

contributors, visitors, alumns

  • Guido Martinez
  • Zoe Paraskevopoulou
  • Yao Li
  • Joonwon Choi
  • Clément Pit-Claudel
  • Nick Giannarakis
  • Niklas Grimm
  • Anita Gollamudi
  • Nadim Kobeissi
  • Matteo Maffei
  • Asher Manning
  • Monal Narasimhamurthy
  • Gordon Plotkin
  • Perry Wang
  • Jean-Karim Zinzindohoue
slide-3
SLIDE 3

Classified as Microsoft Confidential

  • MS

MSR R Redm dmond

  • nd
  • Barry Bond
  • Chris Hawblitzel
  • Qunyan Magnus
  • Kiran Muthabatulla
  • Jonathan Protzenko
  • Tahina Ramananandro
  • Nikhil Swamy
  • Gustavo Varo
  • MS

MSR R Camb mbridg ridge

  • Antoine Delignat-Lavaud
  • Cédric Fournet
  • Christoph M. Wintersteiger
  • Santiago Zanella-Béguelin
  • MS

MSR R India ia

  • Aseem Rastogi
  • INRIA

A Paris

  • Danel Ahman
  • Kenji Maillard
  • Benjamin Beurdouche
  • Karthikeyan Bhargavan
  • Victor Dumitrescu
  • Cătălin Hriţcu
  • Marina Polubelova
  • CMU

MU (P (Pitts ttsbu burgh) gh)

  • Jay Bosamiya
  • Aymeric Fromherz
  • Bryan Parno
  • Edinburgh
  • Markulf Kohlweiss
  • Interns, open-source

contributors, visitors, alumns

  • Guido Martinez
  • Zoe Paraskevopoulou
  • Yao Li
  • Joonwon Choi
  • Clément Pit-Claudel
  • Nick Giannarakis
  • Niklas Grimm
  • Anita Gollamudi
  • Nadim Kobeissi
  • Matteo Maffei
  • Asher Manning
  • Monal Narasimhamurthy
  • Gordon Plotkin
  • Perry Wang
  • Jean-Karim Zinzindohoue
slide-4
SLIDE 4
slide-5
SLIDE 5

Threat model

Goal: A secure channel

connect(server,port); send “GET…”; data = recv(); send “POST…”; … accept(port); request = recv(); send “<html>…”;

  • rder = recv();

…

Public Key Infrastructure

slide-6
SLIDE 6

Threat model

Goal: A secure channel

connect(server,port); send “GET…”; data = recv(); send “POST…”; … accept(port); request = recv(); send “<html>…”;

  • rder = recv();

…

Public Key Infrastructure

20 years of attacks & fixes

Buffer overflows Incorrect state machines Lax certificate parsing Weak or poorly implemented crypto Side channels Informal security goals Dangerous APIs Flawed standards

Mainstream implementations

OpenSSL, SChannel, NSS, …

slide-7
SLIDE 7

Much discussions

IETF, Google, Mozilla, Microsoft, CDNs, cryptographers, network engineers, …

Much improvements

  • Modern design
  • Fewer roundtrips
  • Stronger security

New implementations required for all

  • An early implementer and verified too!
  • Find & fix flaws before it’s too late

RFC 8446: Aug 2018 Including many of our proposals

Mentioning many formal models of the protocol, including our verified implementation of the record layer

slide-8
SLIDE 8

… TLS RSA SHA Network buffers Untrusted network (TCP, UDP, …)

Crypto Algorithms

Pr Proje ject t Ever erest est Ver erif ified ied Sec ecur ure e Compon ponents ents in in th the e TL TLS Ecosystem system

QUIC ECDH AES

slide-9
SLIDE 9

F*: A general purpose programming language and verification tool

Ver erification fication T

  • ols

s an and d Met ethodo

  • dolo

logy gy

slide-10
SLIDE 10

F*: A general purpose programming language and verification tool

Ver erification fication T

  • ols

s an and d Met ethodo

  • dolo

logy gy

val nbytes 16 → u32 → nbytes len → nbytes 32 ∧ → ST unit requires λ → ∈ ∧ ∈ ∧ ∈ ensures λ → let in let in modifies ∧

Math spec in F*

poly1305_mac computes a

polynomial in GF(2130-5), storing the result in tag, and not modifying anything else

slide-11
SLIDE 11

F*: A general purpose programming language and verification tool

kreMLin

Compiler from (a subset of) F* to C

Ver erification fication T

  • ols

s an and d Met ethodo

  • dolo

logy gy

val nbytes 16 → u32 → nbytes len → nbytes 32 ∧ → ST unit requires λ → ∈ ∧ ∈ ∧ ∈ ensures λ → let in let in modifies ∧

Math spec in F*

poly1305_mac computes a

polynomial in GF(2130-5), storing the result in tag, and not modifying anything else Efficient C implementation Verification imposes no runtime performance

  • verhead

void poly1305_mac(uint8_t *tag, uint32_t len, uint8_t *msg, uint8_t *key) { uint64_t tmp [10] = { 0 }; uint64_t *acc = tmp uint64_t *r = tmp + (uint32_t)5; uint8_t s[16] = { 0 }; Crypto_Symmetric_Poly1305_poly1305_init(r, s, key); Crypto_Symmetric_Poly1305_poly1305_process(msg, len, acc, r); Crypto_Symmetric_Poly1305_poly1305_finish(tag, acc, s); }

slide-12
SLIDE 12

8

Protocol specs Protocol security proofs Security spec Crypto assumptions

Implementation

AES is a pseudo-random function

= Verified = Trusted

Secure authenticated channel

slide-13
SLIDE 13
slide-14
SLIDE 14

Everest est in Action, n, so so fa far Production deployments of Everest Verified Cryptography

slide-15
SLIDE 15

… TLS RSA SHA Network buffers Untrusted network (TCP, UDP, …)

Crypto Algorithms

Pr Proje ject t Ever erest est Ver erif ified ied Sec ecur ure e Compon ponents ents in in th the e TL TLS Ecosystem system

QUIC ECDH AES

slide-16
SLIDE 16

So what is this F* thing anyway?

slide-17
SLIDE 17

Two

  • camps

ps of program

  • gram ver

erificatio fication n to tool

  • ls
slide-18
SLIDE 18

F*: Bridging the gap

slide-19
SLIDE 19

F*: Bridging the gap

slide-20
SLIDE 20

F*: Bridging the gap

slide-21
SLIDE 21

F*: Bridging the gap

slide-22
SLIDE 22

F*: Bridging the gap

slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25

Beyond Pure Code

Effects

slide-26
SLIDE 26

Beyond Pure Code

Effects

slide-27
SLIDE 27

Beyond Pure Code

Effects

slide-28
SLIDE 28

Beyond Pure Code

Effects

slide-29
SLIDE 29

Effectful programs with Hoare-style Specifications

slide-30
SLIDE 30

Effectful programs with Hoare-style Specifications

STEx > Tr

slide-31
SLIDE 31

Effectful programs with Hoare-style Specifications

STExn

slide-32
SLIDE 32

Exploiting Expressiveness & Extensibility

Low*: A subset of F* that compiles to C

slide-33
SLIDE 33

Low* to C

And to support compilation to C, in nearly 1-1 correspondence, for auditability of our generated code Designed to allow manipulating a C-like view of memory

slide-34
SLIDE 34

Low* to C

And to support compilation to C, in nearly 1-1 correspondence, for auditability of our generated code Designed to allow manipulating a C-like view of memory

slide-35
SLIDE 35

Low* to C

And to support compilation to C, in nearly 1-1 correspondence, for auditability of our generated code Designed to allow manipulating a C-like view of memory

Stack allocation

slide-36
SLIDE 36

Low* to C

And to support compilation to C, in nearly 1-1 correspondence, for auditability of our generated code Designed to allow manipulating a C-like view of memory

Pointer arithmetic Stack allocation

slide-37
SLIDE 37

Low* to C

And to support compilation to C, in nearly 1-1 correspondence, for auditability of our generated code Designed to allow manipulating a C-like view of memory

Pointer arithmetic Stack allocation Erased specification

slide-38
SLIDE 38
slide-39
SLIDE 39

But SMT-based proofs can go awry

slide-40
SLIDE 40

And can be at a low level of abstraction

slide-41
SLIDE 41

Domain-specific languages, ad hoc proof automation, extensibility

slide-42
SLIDE 42

Domain-specific languages, ad hoc proof automation, extensibility

elaborator reflection

slide-43
SLIDE 43

A passive compiler pipeline

Parsing & Desugaring Typechecker Extraction aka Code generation

slide-44
SLIDE 44

A passive compiler pipeline

Parsing & Desugaring Typechecker Extraction aka Code generation Higher-order Unification Normalizer SMT Encoding

slide-45
SLIDE 45

Scripting components with a metaprogram

Parsing & Desugaring Typechecker Extraction aka Code generation Higher-order Unification Normalizer SMT Encoding

slide-46
SLIDE 46

Scripting components with a metaprogram

Parsing & Desugaring Typechecker Extraction aka Code generation Higher-order Unification Normalizer SMT Encoding

slide-47
SLIDE 47

Scripting a language implementation from within the language

slide-48
SLIDE 48

From F* to Meta-F*, In three easy steps

slide-49
SLIDE 49

Proof-state: A collection of typed holes

slide-50
SLIDE 50

Metaprograms are proofstate transformers

  • Uses an existing F* effect for non-termination: Dv
  • The type of the state is an abstract type: proofstate
  • error is the type of exceptions

State + Exception + Non-termination monad

slide-51
SLIDE 51

Metaprogramming as a user-defined effect

  • Standard definitions of return, bind, get, raise
  • Exceptions reset the state
slide-52
SLIDE 52

Metaprogramming as a user-defined effect

slide-53
SLIDE 53

Metaprogramming as a user-defined effect

put

slide-54
SLIDE 54

Step 2

Primitive operations on

Inl “Goal is not an arrow”

slide-55
SLIDE 55

Step 2

Primitive operations on

Inl “Goal is not an arrow”

slide-56
SLIDE 56

Step 2

Primitive operations on

Meta Inl “Goal is not an arrow”

slide-57
SLIDE 57

Step 2

Primitive operations on

Meta “Goal is not an arrow”

slide-58
SLIDE 58

Step 2

Primitive operations on

Meta “Goal is not an arrow” “Goal is not an arrow”

slide-59
SLIDE 59

Step 3

Reflecting on syntax

slide-60
SLIDE 60

Step 3

Reflecting on syntax

slide-61
SLIDE 61

Step 3

Reflecting on syntax

unquot Met

slide-62
SLIDE 62

Putting it together

id Type

Type Type Type

slide-63
SLIDE 63

Putting it together

id Type

Type Type Type

slide-64
SLIDE 64

Putting it together

id Type

Type Type

slide-65
SLIDE 65

Putting it together

id Type

Type

slide-66
SLIDE 66

Putting it together

id Type

slide-67
SLIDE 67

And can be at a low level of abstraction

Remember this?

slide-68
SLIDE 68

Metaprogramming mutually inverse parsers and formatters

slide-69
SLIDE 69

Metaprogramming mutually inverse parsers and formatters

slide-70
SLIDE 70

Putting it together

f assert

𝑦: 𝑜𝑏𝑢, ℎ: 𝑦 > 1 ⊢ _ ∶ (𝑦 ∗ 𝑦 > 𝑦)

slide-71
SLIDE 71

SMT: Just one of F*’s tactic primitives

Meta

f assert

𝑦: 𝑜𝑏𝑢, ℎ: 𝑦 > 1 ⊢ _ ∶ (𝑦 ∗ 𝑦 > 𝑦)

slide-72
SLIDE 72

But SMT-based proofs can go awry

Remember this?

slide-73
SLIDE 73

SMT + T actics for more automated, robust proofs

slide-74
SLIDE 74

SMT + T actics for more automated, robust proofs

  • Prior manual proof required 41 steps of

explicit rewriting lemmas (!)

slide-75
SLIDE 75

Language extension with native metaprograms

slide-76
SLIDE 76

Language extension with native metaprograms

slide-77
SLIDE 77

Language extension with native metaprograms

slide-78
SLIDE 78

Language extension with native metaprograms

slide-79
SLIDE 79

Some takeaways

slide-80
SLIDE 80

Some takeaways

slide-81
SLIDE 81

Some takeaways

improve

slide-82
SLIDE 82

Some takeaways

improve

slide-83
SLIDE 83

… TLS RSA SHA Network buffers Untrusted network (TCP, UDP, …)

Crypto Algorithms

Pr Proje ject t Ever erest est Ver erif ified ied Sec ecur ure e Compon ponents ents in in th the e TL TLS Ecosystem system

QUIC ECDH AES

Meta-

https://fstar-lang.github.io https://project-everest.github.io/