Exploration of formal methods and their applicability in verification of multiprecision arithmetic libraries

Mgr. Himanshu Kumar Haran

Master's thesis

Abstract:

The mathematical robustness of cryptographic algorithms has been extensively analyzed, however implementations in systems may lead to leakage of sensitive information. The leakage can be due to bugs, side channels, or any other unprecedented loopholes in the implementation. In this project, we plan to use formal methods to build a framework for verifying a cryptographic implementation to ensure its security aspects. The framework will ensure correctness of cryptographic implementations leveraging the formal validation techniques and assess vulnerability to timing side-channels.\\ As of now, there is no such framework for formal certification of security aspects in designs. Moreover, formal verification of security attributes in a design is also in a premature state. The proposed research activity will aim at development of a formal certification framework for secure design development.

Abstract:

The mathematical robustness of cryptographic algorithms has been extensively analyzed, however implementations in systems may lead to leakage of sensitive information. The leakage can be due to bugs, side channels, or any other unprecedented loopholes in the implementation. In this project, we plan to use formal methods to build a framework for verifying a cryptographic implementation to ensure its security aspects. The framework will ensure correctness of cryptographic implementations leveraging the formal validation techniques and assess vulnerability to timing side-channels.\\ As of now, there is no such framework for formal certification of security aspects in designs. Moreover, formal verification of security attributes in a design is also in a premature state. The proposed research activity will aim at development of a formal certification framework for secure design development.

Keywords

Multi-precision arithmetic, formal verification, model Checking, CBMC, side Channel attack, timing attack

Language used: English

Date on which the thesis was submitted / produced: 14. 12. 2017

Thesis defence

• Date of defence: 1. 2. 2018
• Supervisor: prof. RNDr. Václav Matyáš, M.Sc.
• Reader: RNDr. Petr Švenda, Ph.D.

Masaryk University

Faculty of Informatics

Master programme / field:
Informatics / Information Technology Security (eng.)