Noise*: A Library of Verified High-Performance Secure Channel Protocol Implementations - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

Noise*: A Library of Verified High-Performance Secure Channel Protocol Implementations

Résumé

The Noise protocol framework defines a succinct notation and execution framework for a large class of 59+ secure channel protocols, some of which are used in popular applications such as WhatsApp and WireGuard. We present a verified implementation of a Noise protocol compiler that takes any Noise protocol, and produces an optimized C implementation with extensive correctness and security guarantees. To this end, we formalize the complete Noise stack in F * , from the low-level cryptographic library to a high-level API. We write our compiler also in F * , prove that it meets our formal specification once and for all, and then specialize it on-demand for any given Noise protocol, relying on a novel technique called hybrid embedding. We thus establish functional correctness, memory safety and a form of side-channel resistance for the generated C code for each Noise protocol. We propagate these guarantees to the high-level API, using defensive dynamic checks to prevent incorrect uses of the protocol. Finally, we formally state and prove the security of our Noise code, by building on a symbolic model of cryptography in F * , and formally link high-level API security goals stated in terms of security levels to low-level cryptographic guarantees. Ours are the first comprehensive verification results for a protocol compiler that targets C code and the first verified implementations of any Noise protocol. We evaluate our framework by generating implementations for all 59 Noise protocols and by comparing the size, performance, and security of our verified code against other (unverified) implementations and prior security analyses of Noise.
Fichier principal
Vignette du fichier
2022-607.pdf (762.04 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03946578 , version 1 (20-01-2023)

Identifiants

Citer

Son Ho, Jonathan Protzenko, Abhishek Bichhawat, Karthikeyan Bhargavan. Noise*: A Library of Verified High-Performance Secure Channel Protocol Implementations. SP 2022 - IEEE Symposium on Security and Privacy, May 2022, San Francisco, United States. pp.107-124, ⟨10.1109/SP46214.2022.9833621⟩. ⟨hal-03946578⟩

Collections

INRIA INRIA2
25 Consultations
208 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More