SAW/Cryptol are amazingly easy to use compared to other formal methods tools. It's a shame that C++ is still popular in high assurance spaces, because the tooling for it and the ability to write safe code is so much worse than C these days.
Explain to someone like me who uses C in safety-critical software in aerospace and defense why not?
For me, choosing the language is not enough. It's the tooling that goes far beyond the language that is important for safety and quality of compiler and runtime. C has very mature tooling options. So does ADA.
I've never met a company I could convince to buy an Ada toolchain. Someone at Nvidia managed the feat and it's a pretty good measure of their enthusiasm that they seem to be pushing the hard work off onto adacore instead of spreading it internally.
The missing-step bug in early ML-DSA is the perfect case for SAW. rare inputs that pass code review because the line that should be there doesn't look absent, it looks like the next line is correct. tests wouldn't catch it unless someone happened to roll exactly the right inputs.
I would really like to look at the bug and whether we could have caught it with conventional testing, but it doesn't look like Apple actually disclosed it?
Had totally forgotten that Apple had rolled out post-quantum crypto (ML-KEM and ML-DSA, FIPS 203 and FIPS 204, respectively) already back in 2024. [1]
Slightly off topic, but it's great to see "crypto" to mean cryptography, helping users to keep their data secure, and not as so often these days those silly cryptocurrency crime tokens.
Verified crypto is important but apple still doesnt take parser security seriously enough. They know it's insecure and offer lockdown mode instead of fixing it.
SAW/Cryptol are amazingly easy to use compared to other formal methods tools. It's a shame that C++ is still popular in high assurance spaces, because the tooling for it and the ability to write safe code is so much worse than C these days.
When did C got safe strings and arrays?
Ideally neither C nor C++ should be used when security matters.
Explain to someone like me who uses C in safety-critical software in aerospace and defense why not?
For me, choosing the language is not enough. It's the tooling that goes far beyond the language that is important for safety and quality of compiler and runtime. C has very mature tooling options. So does ADA.
https://www.absint.com/astree/index.htm
Abstract Interpretation in a Nutshell https://www.di.ens.fr/~cousot/AI/IntroAbsInt.html
6 replies →
I've never met a company I could convince to buy an Ada toolchain. Someone at Nvidia managed the feat and it's a pretty good measure of their enthusiasm that they seem to be pushing the hard work off onto adacore instead of spreading it internally.
The missing-step bug in early ML-DSA is the perfect case for SAW. rare inputs that pass code review because the line that should be there doesn't look absent, it looks like the next line is correct. tests wouldn't catch it unless someone happened to roll exactly the right inputs.
I would really like to look at the bug and whether we could have caught it with conventional testing, but it doesn't look like Apple actually disclosed it?
Had totally forgotten that Apple had rolled out post-quantum crypto (ML-KEM and ML-DSA, FIPS 203 and FIPS 204, respectively) already back in 2024. [1]
Slightly off topic, but it's great to see "crypto" to mean cryptography, helping users to keep their data secure, and not as so often these days those silly cryptocurrency crime tokens.
[1] https://security.apple.com/blog/imessage-pq3/
Verified crypto is important but apple still doesnt take parser security seriously enough. They know it's insecure and offer lockdown mode instead of fixing it.
Can't wait to find all the holes in the github code, part-ay time!
[flagged]