Proving termination using dependent types: the case of xor-terms - - PowerPoint PPT Presentation

▶
proving termination using dependent types the case of xor
SMART_READER_LITE
LIVE PREVIEW

Proving termination using dependent types: the case of xor-terms - - PowerPoint PPT Presentation

Apr 11, 2024 276 likes •1.47k views

Proving termination using dependent types: the case of xor-terms J.-F. Monin J. Courant VERIMAG Grenoble, France GDR LAC, Chambery, 2007 Outline Motivation The case of cryptographic systems State of the art Back to cryptographic systems

slide-1
SLIDE 1

Proving termination using dependent types: the case of xor-terms

J.-F. Monin

  • J. Courant

VERIMAG Grenoble, France

GDR LAC, Chambery, 2007

slide-2
SLIDE 2

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-3
SLIDE 3

Formal models of cryptographic systems

slide-4
SLIDE 4

Formal models of cryptographic systems

◮ Protocols ◮ Security APIs

slide-5
SLIDE 5

Formal models of cryptographic systems

◮ Protocols ◮ Security APIs

Xor is ubiquitous

slide-6
SLIDE 6

Formal models of cryptographic systems

◮ Protocols ◮ Security APIs

Xor is ubiquitous Examples from a security API called CCA (Common Cryptographic Architecture): x, y, {z}x⊕KP⊕KM → {z ⊕ y}x⊕KP⊕KM x, y, {z}x⊕KP⊕KM → {z ⊕ y}x⊕KM

slide-7
SLIDE 7

Formal models of cryptographic systems

◮ Protocols ◮ Security APIs

Xor is ubiquitous Examples from a security API called CCA (Common Cryptographic Architecture): x, y, {z}x⊕KP⊕KM → {z ⊕ y}x⊕KP⊕KM x, y, {z}x⊕KP⊕KM → {z ⊕ y}x⊕KM Reasoning involves: Commutativity: x ⊕ y ≃ y ⊕ x Associativity: (x ⊕ y) ⊕ z ≃ x ⊕ (y ⊕ z) Neutral element: x ⊕ 0 ≃ x Involutivity: x ⊕ x ≃ 0

slide-8
SLIDE 8

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-9
SLIDE 9

General setting: quotiented first order-terms

We are given

◮ A type of terms T with constructors Ck:

Inductive T : Set := | C1 : T . . . | Ck : . . . → T . . . → T . . . → T . . .

slide-10
SLIDE 10

General setting: quotiented first order-terms

We are given

◮ A type of terms T with constructors Ck:

Inductive T : Set := | C1 : T . . . | Ck : . . . → T . . . → T . . . → T . . .

◮ A congruence ≃ : T → T → Prop

slide-11
SLIDE 11

General setting: quotiented first order-terms

We are given

◮ A type of terms T with constructors Ck:

Inductive T : Set := | C1 : T . . . | Ck : . . . → T . . . → T . . . → T . . .

◮ A congruence ≃ : T → T → Prop

◮ For each constructor Ck

∀a, . . . x1, y1, b, . . . x2, y2, . . . c, x1 ≃ y1 → x2 ≃ y2 → Ck a . . . x1 b . . . y1 c ≃ Ck a . . . x2 b . . . y2 c

slide-12
SLIDE 12

General setting: quotiented first order-terms

We are given

◮ A type of terms T with constructors Ck:

Inductive T : Set := | C1 : T . . . | Ck : . . . → T . . . → T . . . → T . . .

◮ A congruence ≃ : T → T → Prop

◮ For each constructor Ck

∀a, . . . x1, y1, b, . . . x2, y2, . . . c, x1 ≃ y1 → x2 ≃ y2 → Ck a . . . x1 b . . . y1 c ≃ Ck a . . . x2 b . . . y2 c

◮ specific laws, e.g. ∀xy, C2 x C1 y ≃ C2 y x

slide-13
SLIDE 13

General setting: quotiented first order-terms

We are given

◮ A type of terms T with constructors Ck:

Inductive T : Set := | C1 : T . . . | Ck : . . . → T . . . → T . . . → T . . .

◮ A congruence ≃ : T → T → Prop

◮ For each constructor Ck

∀a, . . . x1, y1, b, . . . x2, y2, . . . c, x1 ≃ y1 → x2 ≃ y2 → Ck a . . . x1 b . . . y1 c ≃ Ck a . . . x2 b . . . y2 c

◮ specific laws, e.g. ∀xy, C2 x C1 y ≃ C2 y x

slide-14
SLIDE 14

General setting: quotiented first order-terms

We are given

◮ A type of terms T with constructors Ck:

Inductive T : Set := | C1 : T . . . | Ck : . . . → T . . . → T . . . → T . . .

◮ A congruence ≃ : T → T → Prop

◮ For each constructor Ck

∀a, . . . x1, y1, b, . . . x2, y2, . . . c, x1 ≃ y1 → x2 ≃ y2 → Ck a . . . x1 b . . . y1 c ≃ Ck a . . . x2 b . . . y2 c

◮ specific laws, e.g. ∀xy, C2 x C1 y ≃ C2 y x

We want to reason on T up to ≃

slide-15
SLIDE 15

Already well-known examples

◮ finite bags represented by finite lists

slide-16
SLIDE 16

Already well-known examples

◮ finite bags represented by finite lists ◮ algebra of formal arithmetic expressions

slide-17
SLIDE 17

Already well-known examples

◮ finite bags represented by finite lists ◮ algebra of formal arithmetic expressions ◮ (mobile) process calculi, chemical abstract machines

slide-18
SLIDE 18

Already well-known examples

◮ finite bags represented by finite lists ◮ algebra of formal arithmetic expressions

+ is associative, commutative, 0 is neutral × is associative, commutative, 1 is neutral × distributes over +

◮ (mobile) process calculi, chemical abstract machines

parallel composition and choice operators are AC

slide-19
SLIDE 19

Quotients in type theory

◮ High level approach : setoids

slide-20
SLIDE 20

Quotients in type theory

◮ High level approach : setoids ◮ Explicit approach :

slide-21
SLIDE 21

Quotients in type theory

◮ High level approach : setoids ◮ Explicit approach :

◮ Define a normalization function N on T

slide-22
SLIDE 22

Quotients in type theory

◮ High level approach : setoids ◮ Explicit approach :

◮ Define a normalization function N on T ◮ Compare terms using syntactic equality on their norms :

x ≃ y iff N x = N y

slide-23
SLIDE 23

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-24
SLIDE 24

Cryptographic systems need more

Reasoning on such systems involves

◮ comparing terms up to AC + involutivity of ⊕:

Commutativity: x ⊕ y ≃ y ⊕ x Associativity: (x ⊕ y) ⊕ z ≃ x ⊕ (y ⊕ z) Neutral element: x ⊕ 0 ≃ x Involutivity: x ⊕ x ≃ 0

slide-25
SLIDE 25

Cryptographic systems need more

Reasoning on such systems involves

◮ comparing terms up to AC + involutivity of ⊕:

Commutativity: x ⊕ y ≃ y ⊕ x Associativity: (x ⊕ y) ⊕ z ≃ x ⊕ (y ⊕ z) Neutral element: x ⊕ 0 ≃ x Involutivity: x ⊕ x ≃ 0

◮ a relation for occurrence:

if x, y and z are different terms,

slide-26
SLIDE 26

Cryptographic systems need more

Reasoning on such systems involves

◮ comparing terms up to AC + involutivity of ⊕:

Commutativity: x ⊕ y ≃ y ⊕ x Associativity: (x ⊕ y) ⊕ z ≃ x ⊕ (y ⊕ z) Neutral element: x ⊕ 0 ≃ x Involutivity: x ⊕ x ≃ 0

◮ a relation for occurrence:

if x, y and z are different terms,

◮ y occurs in x ⊕ y ⊕ z

slide-27
SLIDE 27

Cryptographic systems need more

Reasoning on such systems involves

◮ comparing terms up to AC + involutivity of ⊕:

Commutativity: x ⊕ y ≃ y ⊕ x Associativity: (x ⊕ y) ⊕ z ≃ x ⊕ (y ⊕ z) Neutral element: x ⊕ 0 ≃ x Involutivity: x ⊕ x ≃ 0

◮ a relation for occurrence:

if x, y and z are different terms,

◮ y occurs in x ⊕ y ⊕ z ◮ but y does not occur in x ⊕ y ⊕ z ⊕ y

slide-28
SLIDE 28

Cryptographic systems need more

Reasoning on such systems involves

◮ comparing terms up to AC + involutivity of ⊕:

Commutativity: x ⊕ y ≃ y ⊕ x Associativity: (x ⊕ y) ⊕ z ≃ x ⊕ (y ⊕ z) Neutral element: x ⊕ 0 ≃ x Involutivity: x ⊕ x ≃ 0

◮ a relation for occurrence:

if x, y and z are different terms,

◮ y occurs in x ⊕ y ⊕ z ◮ but y does not occur in x ⊕ y ⊕ z ⊕ y

slide-29
SLIDE 29

Cryptographic systems need more

Reasoning on such systems involves

◮ comparing terms up to AC + involutivity of ⊕:

Commutativity: x ⊕ y ≃ y ⊕ x Associativity: (x ⊕ y) ⊕ z ≃ x ⊕ (y ⊕ z) Neutral element: x ⊕ 0 ≃ x Involutivity: x ⊕ x ≃ 0

◮ a relation for occurrence:

if x, y and z are different terms,

◮ y occurs in x ⊕ y ⊕ z ◮ but y does not occur in x ⊕ y ⊕ z ⊕ y

x y if x ≃ y x t if t ≃ x ⊕ y0 . . . ⊕ yn and x yi for all i, 0 ≤ i ≤ n

slide-30
SLIDE 30

Cryptographic systems need more

Reasoning on such systems involves

◮ comparing terms up to AC + involutivity of ⊕:

Commutativity: x ⊕ y ≃ y ⊕ x Associativity: (x ⊕ y) ⊕ z ≃ x ⊕ (y ⊕ z) Neutral element: x ⊕ 0 ≃ x Involutivity: x ⊕ x ≃ 0

◮ a relation for occurrence:

if x, y and z are different terms,

◮ y occurs in x ⊕ y ⊕ z ◮ but y does not occur in x ⊕ y ⊕ z ⊕ y

x y if x ≃ y x t if t ≃ x ⊕ y0 . . . ⊕ yn and x yi for all i, 0 ≤ i ≤ n

→ normalization is needed!

slide-31
SLIDE 31

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-32
SLIDE 32

First attempt: rewrite, rewrite, rewrite. . .

slide-33
SLIDE 33

First attempt: rewrite, rewrite, rewrite. . .

Replace equations with rewrite rules

slide-34
SLIDE 34

First attempt: rewrite, rewrite, rewrite. . .

Replace equations with rewrite rules Commutativity: find an suitable well ordering on terms

slide-35
SLIDE 35

First attempt: rewrite, rewrite, rewrite. . .

Replace equations with rewrite rules Commutativity: find an suitable well ordering on terms Functional programming approach:

◮ Not very difficult – use general recursion

slide-36
SLIDE 36

First attempt: rewrite, rewrite, rewrite. . .

Replace equations with rewrite rules Commutativity: find an suitable well ordering on terms Functional programming approach:

◮ Not very difficult – use general recursion ◮ Just boring

slide-37
SLIDE 37

First attempt: rewrite, rewrite, rewrite. . .

Replace equations with rewrite rules Commutativity: find an suitable well ordering on terms Functional programming approach:

◮ Not very difficult – use general recursion ◮ Just boring

slide-38
SLIDE 38

First attempt: rewrite, rewrite, rewrite. . .

Replace equations with rewrite rules Commutativity: find an suitable well ordering on terms Functional programming approach:

◮ Not very difficult – use general recursion ◮ Just boring

In a type theoretic framework, termination proof mandatory and non-trivial:

◮ combination of polynomial and lexicographic ordering

slide-39
SLIDE 39

First attempt: rewrite, rewrite, rewrite. . .

Replace equations with rewrite rules Commutativity: find an suitable well ordering on terms Functional programming approach:

◮ Not very difficult – use general recursion ◮ Just boring

In a type theoretic framework, termination proof mandatory and non-trivial:

◮ combination of polynomial and lexicographic ordering ◮ other approaches (lpo, rpo,. . .): overkill?

slide-40
SLIDE 40

First attempt: rewrite, rewrite, rewrite. . .

Replace equations with rewrite rules Commutativity: find an suitable well ordering on terms Functional programming approach:

◮ Not very difficult – use general recursion ◮ Just boring

In a type theoretic framework, termination proof mandatory and non-trivial:

◮ combination of polynomial and lexicographic ordering ◮ other approaches (lpo, rpo,. . .): overkill? ◮ AC matching: a non trivial matter

slide-41
SLIDE 41

(Dependent) type theoretic approach

slide-42
SLIDE 42

(Dependent) type theoretic approach

Step 1

◮ Consider a more structured version of t

slide-43
SLIDE 43

(Dependent) type theoretic approach

Step 1

◮ Consider a more structured version of t

slide-44
SLIDE 44

(Dependent) type theoretic approach

Step 1

◮ Consider a more structured version of t

= provide an accurate and informative typing to t

slide-45
SLIDE 45

(Dependent) type theoretic approach

Step 1

◮ Consider a more structured version of t

= provide an accurate and informative typing to t Step 2

◮ Normalize by structural induction on the newly typed version

  • f t
slide-46
SLIDE 46

(Dependent) type theoretic approach

Step 1

◮ Consider a more structured version of t

= provide an accurate and informative typing to t Step 2

◮ Normalize by structural induction on the newly typed version

  • f t
slide-47
SLIDE 47

(Dependent) type theoretic approach

Step 1

◮ Consider a more structured version of t

= provide an accurate and informative typing to t Step 2

◮ Normalize by structural induction on the newly typed version

  • f t

Step 1 makes step 2 easy.

slide-48
SLIDE 48

(Dependent) type theoretic approach

Step 1

◮ Consider a more structured version of t

= provide an accurate and informative typing to t Step 2

◮ Normalize by structural induction on the newly typed version

  • f t

Step 1 makes step 2 easy. Better formulation: t : T transformed into t′ : T ′ T ′ enriched version of T , trivial forgetful morphism T ′ → T .

slide-49
SLIDE 49

(Dependent) type theoretic approach

Step 1

◮ Consider a more structured version of t

= provide an accurate and informative typing to t Step 2

◮ Normalize by structural induction on the newly typed version

  • f t

Step 1 makes step 2 easy. Better formulation: t : T transformed into t′ : T ′ T ′ enriched version of T , trivial forgetful morphism T ′ → T . Interesting part = T → T ′

slide-50
SLIDE 50

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-51
SLIDE 51

Lasagnas reveal the truth

slide-52
SLIDE 52

Lasagnas reveal the truth

slide-53
SLIDE 53

Lasagnas reveal the truth

◮ layering a term

slide-54
SLIDE 54

Lasagnas reveal the truth

◮ layering a term ◮ layers do not communicate:

each layer possesses its own normalization function

slide-55
SLIDE 55

Lasagnas reveal the truth

◮ layering a term ◮ layers do not communicate:

each layer possesses its own normalization function

◮ in our case: need 2 layers, pasta and sauce

slide-56
SLIDE 56

Lasagnas reveal the truth

◮ layering a term ◮ layers do not communicate:

each layer possesses its own normalization function

◮ in our case: need 2 layers, pasta and sauce ◮ normalizing pasta = identity

slide-57
SLIDE 57

Lasagnas reveal the truth

◮ layering a term ◮ layers do not communicate:

each layer possesses its own normalization function

◮ in our case: need 2 layers, pasta and sauce ◮ normalizing pasta = identity ◮ normalizing sauce = rearranging + removing duplicates

slide-58
SLIDE 58

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-59
SLIDE 59

T as a lasagna

slide-60
SLIDE 60

T as a lasagna

Inductive T : Set := | Zero: T | PC: public const → T | SC: secret const → T | E: T → T → T | Xor: T → T → T | Hash: T → T → T .

slide-61
SLIDE 61

T as a lasagna

Inductive T : Set := | Zero: T | PC: public const → T | SC: secret const → T | E: T → T → T | Xor: T → T → T | Hash: T → T → T .

E H P ⊕ ⊕ S ⊕ E P S ⊕ S

slide-62
SLIDE 62

T as a lasagna

Inductive T : Set := | Zero: T | PC: public const → T | SC: secret const → T | E: T → T → T | Xor: T → T → T | Hash: T → T → T .

E H P ⊕ ⊕ S ⊕ E P S ⊕ S

slide-63
SLIDE 63

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-64
SLIDE 64

Decomposing T

Inductive Tx:Set := | X Zero : Tx | X Xor : Tx → Tx → Tx Inductive Tn: Set := | NX PC : public const → Tn | NX SC : secret const → Tn | NX E : Tn → Tn → Tn | NX Hash : Tn → Tn → Tn

slide-65
SLIDE 65

Decomposing T

Variable A : Set. Inductive Tx:Set := | X Zero : Tx | X Xor : Tx → Tx → Tx | X ns : A → Tx Inductive Tn: Set := | NX PC : public const → Tn | NX SC : secret const → Tn | NX E : Tn → Tn → Tn | NX Hash : Tn → Tn → Tn | NX sum : A → Tn

slide-66
SLIDE 66

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-67
SLIDE 67

Stratifying and normalizing a term

slide-68
SLIDE 68

Stratifying and normalizing a term

Step 1 Translate a term t into t′ according to the mapping 0 → X Zero, Xor → X Xor, PC → NX PC, etc.

slide-69
SLIDE 69

Stratifying and normalizing a term

Step 1 Translate a term t into t′ according to the mapping 0 → X Zero, Xor → X Xor, PC → NX PC, etc. Step 2 A type is sortable if it is equipped with a decidable equality and a decidable total ordering. If A is sortable, then

slide-70
SLIDE 70

Stratifying and normalizing a term

Step 1 Translate a term t into t′ according to the mapping 0 → X Zero, Xor → X Xor, PC → NX PC, etc. Step 2 A type is sortable if it is equipped with a decidable equality and a decidable total ordering. If A is sortable, then

◮ Tn(A) is sortable as well;

slide-71
SLIDE 71

Stratifying and normalizing a term

Step 1 Translate a term t into t′ according to the mapping 0 → X Zero, Xor → X Xor, PC → NX PC, etc. Step 2 A type is sortable if it is equipped with a decidable equality and a decidable total ordering. If A is sortable, then

◮ Tn(A) is sortable as well; ◮ the multiset of A-leaves of a Tx(A)-term can be sorted (and

removed when possible) into a list;

slide-72
SLIDE 72

Stratifying and normalizing a term

Step 1 Translate a term t into t′ according to the mapping 0 → X Zero, Xor → X Xor, PC → NX PC, etc. Step 2 A type is sortable if it is equipped with a decidable equality and a decidable total ordering. If A is sortable, then

◮ Tn(A) is sortable as well; ◮ the multiset of A-leaves of a Tx(A)-term can be sorted (and

removed when possible) into a list;

◮ list(A) is sortable.

slide-73
SLIDE 73

Stratifying and normalizing a term

Step 1 Translate a term t into t′ according to the mapping 0 → X Zero, Xor → X Xor, PC → NX PC, etc. The typing of t′ is Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough. Step 2 A type is sortable if it is equipped with a decidable equality and a decidable total ordering. If A is sortable, then

◮ Tn(A) is sortable as well; ◮ the multiset of A-leaves of a Tx(A)-term can be sorted (and

removed when possible) into a list;

◮ list(A) is sortable.

slide-74
SLIDE 74

Stratifying and normalizing a term

Step 1 Translate a term t into t′ according to the mapping 0 → X Zero, Xor → X Xor, PC → NX PC, etc. The typing of t′ is Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough. Step 2 A type is sortable if it is equipped with a decidable equality and a decidable total ordering. If A is sortable, then

◮ Tn(A) is sortable as well; ◮ the multiset of A-leaves of a Tx(A)-term can be sorted (and

removed when possible) into a list;

◮ list(A) is sortable.

slide-75
SLIDE 75

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-76
SLIDE 76

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

slide-77
SLIDE 77

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

◮ What is k?

slide-78
SLIDE 78

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

◮ What is k? ◮ The number of layers on the left subterm and on the right

subterm are different in general.

slide-79
SLIDE 79

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

◮ What is k? ◮ The number of layers on the left subterm and on the right

subterm are different in general.

E H P ⊕ ⊕ S ⊕ E P S ⊕ S

slide-80
SLIDE 80

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

◮ What is k? ◮ The number of layers on the left subterm and on the right

subterm are different in general. Take the max

slide-81
SLIDE 81

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

◮ What is k? ◮ The number of layers on the left subterm and on the right

subterm are different in general. Take the max

◮ Standard solution: {le n m} + {le m n}

slide-82
SLIDE 82

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

◮ What is k? ◮ The number of layers on the left subterm and on the right

subterm are different in general. Take the max

◮ Standard solution: {le n m} + {le m n}

◮ interactive definition, large proof term

slide-83
SLIDE 83

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

◮ What is k? ◮ The number of layers on the left subterm and on the right

subterm are different in general. Take the max

◮ Standard solution: {le n m} + {le m n}

◮ interactive definition, large proof term ◮ heavy encoding of m − n or n − m

slide-84
SLIDE 84

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

◮ What is k? ◮ The number of layers on the left subterm and on the right

subterm are different in general. Take the max

◮ Standard solution: {le n m} + {le m n}

◮ interactive definition, large proof term ◮ heavy encoding of m − n or n − m ◮ need to lift Lx n and Lx m to Lx (max n m)

slide-85
SLIDE 85

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

◮ What is k? ◮ The number of layers on the left subterm and on the right

subterm are different in general. Take the max

◮ Standard solution: {le n m} + {le m n}

◮ interactive definition, large proof term ◮ heavy encoding of m − n or n − m ◮ need to lift Lx n and Lx m to Lx (max n m)

◮ Lightweight approach: max n m def

= = m + (n − m)

slide-86
SLIDE 86

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

◮ What is k? ◮ The number of layers on the left subterm and on the right

subterm are different in general. Take the max

◮ Standard solution: {le n m} + {le m n}

◮ interactive definition, large proof term ◮ heavy encoding of m − n or n − m ◮ need to lift Lx n and Lx m to Lx (max n m)

◮ Lightweight approach: max n m def

= = m + (n − m)

◮ liftx : Lx k → Lx (k + d), liftn : Ln k → Ln (k + d)

slide-87
SLIDE 87

Lifting lasagna

Lx k

def

= = Tx(Tn(Tx(. . . (∅))))

  • k layers

for k large enough.

◮ What is k? ◮ The number of layers on the left subterm and on the right

subterm are different in general. Take the max

◮ Standard solution: {le n m} + {le m n}

◮ interactive definition, large proof term ◮ heavy encoding of m − n or n − m ◮ need to lift Lx n and Lx m to Lx (max n m)

◮ Lightweight approach: max n m def

= = m + (n − m)

◮ liftx : Lx k → Lx (k + d), liftn : Ln k → Ln (k + d) ◮ No need to proof that max is the max.

slide-88
SLIDE 88

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-89
SLIDE 89

Internalizing alternation

slide-90
SLIDE 90

Internalizing alternation

Well designed types help us to design programs

slide-91
SLIDE 91

Internalizing alternation

Well designed types help us to design programs Many functions are defined by mutual induction, e.g. liftx and liftn

slide-92
SLIDE 92

Internalizing alternation

Well designed types help us to design programs Many functions are defined by mutual induction, e.g. liftx and liftn Control them using alternating natural numbers

slide-93
SLIDE 93

Internalizing alternation

Well designed types help us to design programs Many functions are defined by mutual induction, e.g. liftx and liftn Control them using alternating natural numbers Inductive alteven: Set := | 0e: alteven | So→e: altodd → alteven with altodd: Set := | Se→o: alteven → altodd

slide-94
SLIDE 94

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-95
SLIDE 95

Forbid fake inclusions

slide-96
SLIDE 96

Forbid fake inclusions

Inductive Tx: Set := | X Zero : Tx | X ns : A → Tx | X Xor : Tx → Tx → Tx Inductive Tn: Set := | NX PC : public const → Tn | NX SC : secret const → Tn | NX sum : A → Tn | NX E : Tn → Tn → Tn | NX Hash : Tn → Tn → Tn

slide-97
SLIDE 97

Forbid fake inclusions

Inductive Tx: Set := | X Zero : Tx | X ns : A → Tx | X Xor : Tx → Tx → Tx Inductive Tn: Set := | NX PC : public const → Tn | NX SC : secret const → Tn | NX sum : A → Tn | NX E : Tn → Tn → Tn | NX Hash : Tn → Tn → Tn X ns (NX sum ( X ns (NX sum (. . . ))))

slide-98
SLIDE 98

Forbid fake inclusions

Inductive Tx: bool → Set := | X Zero : ∀ b, Tx b | X ns : ∀ b, Is true b → A → Tx b | X Xor : ∀ b, Tx true → Tx true → Tx b Inductive Tn: bool → Set := | NX PC : ∀ b, public const → Tn b | NX SC : ∀ b, secret const → Tn b | NX sum : ∀ b, Is true b → A → Tn b | NX E : ∀ b, Tn true → Tn true → Tn b | NX Hash : ∀ b, Tn true → Tn true → Tn b X ns (NX sum ( X ns (NX sum (. . . ))))

slide-99
SLIDE 99

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-100
SLIDE 100

Mutual induction

◮ Prefer fixpoints: built-in computation, no inversion

slide-101
SLIDE 101

Mutual induction

◮ Prefer fixpoints: built-in computation, no inversion ◮ Use map combinators

slide-102
SLIDE 102

Mutual induction

◮ Prefer fixpoints: built-in computation, no inversion ◮ Use map combinators

slide-103
SLIDE 103

Mutual induction

◮ Prefer fixpoints: built-in computation, no inversion ◮ Use map combinators

Many 10 lines definitions, almost no theorem

slide-104
SLIDE 104

Mutual induction

◮ Prefer fixpoints: built-in computation, no inversion ◮ Use map combinators

Many 10 lines definitions, almost no theorem Fixpoint lift lasagna x e1 e2 {struct e1} : Lx e1 → Lx (e1 + e2) := match e1 return Lx e1 → Lx (e1 + e2) with | 0e ⇒ fun emp ⇒ match emp with end | So→e o1 ⇒ mapx (lift lasagna n o1 e2) false end with lift lasagna n o1 e2 {struct o1} : Ln o1 → Ln (o1 + e2) := match o1 return Ln o1 → Ln (o1 + e2) with | Se→o e1 ⇒ mapn (lift lasagna x e1 e2) false end.

slide-105
SLIDE 105

Outline

Motivation The case of cryptographic systems State of the art Back to cryptographic systems Solving strategies Solution (intuitive) Basic idea Analyse of T Decomposing T Stratifying and normalizing a term Issues Lifting Alternation Forbid fake inclusions Fixpoints Conversion rule Conclusion

slide-106
SLIDE 106

Conversion rule

slide-107
SLIDE 107

Conversion rule

Used everywhere

slide-108
SLIDE 108

Conversion rule

Used everywhere Definition bin xor (bin : ∀ A b, Tx A true → Tx A true → Tx A b) o1 o2 b (l1 : lasagna cand x o1 true) (l2 : lasagna cand x o2 true) : lasagna cand x (max oo o1 o2) b := bin (Ln (max oo o1 o2)) b (lift lasagna cand x true o1 (o2 - o1) l1) (coerce max comm (lift lasagna cand x true o2 (o1 - o2) l2)).

slide-109
SLIDE 109

Conclusion

Type theory is flexible

slide-110
SLIDE 110

Conclusion

Type theory is flexible

◮ Polymorphism

slide-111
SLIDE 111

Conclusion

Type theory is flexible

◮ Polymorphism ◮ Mutually inductive types

slide-112
SLIDE 112

Conclusion

Type theory is flexible

◮ Polymorphism ◮ Mutually inductive types ◮ Dependent types

slide-113
SLIDE 113

Conclusion

Type theory is flexible

◮ Polymorphism ◮ Mutually inductive types ◮ Dependent types ◮ Conversion rule

slide-114
SLIDE 114

Conclusion

Type theory is flexible

◮ Polymorphism ◮ Mutually inductive types ◮ Dependent types ◮ Conversion rule ◮ JMEQ not used

slide-115
SLIDE 115

Conclusion

Type theory is flexible

◮ Polymorphism ◮ Mutually inductive types ◮ Dependent types ◮ Conversion rule ◮ JMEQ not used

slide-116
SLIDE 116

Conclusion

Type theory is flexible

◮ Polymorphism ◮ Mutually inductive types ◮ Dependent types ◮ Conversion rule ◮ JMEQ not used (until now)

slide-117
SLIDE 117

Conclusion

Type theory is flexible

◮ Polymorphism ◮ Mutually inductive types ◮ Dependent types ◮ Conversion rule ◮ JMEQ not used (until now)