PROOF CHECKING THE RSA PUBLIC KEY ENCRYPTION ALGORITHM

An interactive proof checker is a system which is able of building a formal proof (in some deductive calculus) by executing commands provided by the user. Proof checkers are useful both for making experiments in proof construction within various formal systems and for proving theorems in those fields of mathematics (such as mathematical theory of computation) where proofs are necessarily very large and unfeasible by hand. Two levels may be distinguished in a proof checker. The lower one implements the proof management routines, and is independent of any particular logic. The higher one implements the inference rules of a particular logical calculus. Powerful higher level rules are also needed to make the use of the checker practical. Almost all routine steps may be then generated automatically, and the user has just to give some “hints” to the checker, which transforms an “informal argument” into a formal proof.

Most computer checked proofs are tied to the particular technology of a prover’s software. While sharing results between proof assistants is a recognized and desirable goal, the current organization of theorem proving tools makes such sharing an exception instead of the rule. In this talk, I argue that we need to turn the current architecture of proof assistants and formal proofs inside-out. That is, instead of having a few mature theorem provers include within them their formally checked theorems and proofs, I propose that proof assistants should sit on the edge of a web of formal proofs and that proof assistant should be exporting their proofs so that they can exist independently of any theorem prover. While it is necessary to maintain the dependencies between definitions, theories, and theorems, no explicit library structure should be imposed on this web of formal proofs. Thus a theorem and its proofs should not necessarily be located at a particular URL or within a particular prover’s library. While the world of symbolic logic and proof theory certainly allows for proofs to be seen as global and permanent objects, there is a lot of research and engineering work that is needed to make this possible. I describe some of the required research and development that must be done to achieve this goal.

However much we may disparage deduction, it cannot be denied that the laws established by induction are not enough. Frege (1884/1974, p. 23) At the yearly proseminar for first-year graduate students at Northwestern, we presented some evidence that reasoning draws on separate cognitive systems for assessing deductive versus inductive arguments (Rips, 2001a, 2001b). In the experiment we described, separate groups of participants evaluated the same set of arguments for deductive validity or inductive strength. For example, one of the validity groups decided whether the conclusions of these arguments necessarily followed from the premises, while one of the strength groups decided how plausible the premises made the conclusions. The results of the study showed that the percentages of “yes” responses (“yes” the argument is deductively valid or “yes” the argument is inductively strong) were differently ordered for the validity and the strength judgments. In some cases, for example, the validity groups judged Argument A to be valid more often than Argument B, but the strength groups judged B inductively strong more often than A. Reversals of this sort suggest that people do not just see arguments as ranging along a single continuum of convincingness or probability but instead employ different methods when engaged in deductive versus inductive reasoning. Earlier imaging evidence by Goel, Gold, Kapur, and Houle (1997) and by Osherson et al. (1998) had implicated separate brain regions when participants evaluated arguments for validity versus plausibility, and these earlier data had inspired our own experiment. All these results cast doubt on the view that there's a homogeneous “analytic” reasoning system responsible for correctly solving deductive and probabilistic problems.

Recently, significant advances have been made in formalised mathematical texts for large, demanding proofs. But although such large developments are possible, they still take an inordinate amount of effort and time, and there is a significant gap between the resulting formalised machine-checkable proof scripts and the corresponding human-readable mathematical texts. We present an authoring system for formal proof which addresses these concerns. It is based on a central document format which, in the tradition of literate programming, allows one to extract either a formal proof script or a human-readable document; the two may have differing structure and detail levels, but are developed together in a synchronised way. Additionally, we introduce ways to assist production of the central document, by allowing tools to contribute backflow to update and extend it. Our authoring system builds on the new PG Kit architecture for Proof General, bringing the extra advantage that it works in a uniform interface, generically across various interactive theorem provers.

Mutation analysis, which introduces artificial defects into software systems, is the basis of mutation testing, a technique widely applied to evaluate and enhance the quality of test suites. However, despite the deep analogy between tests and formal proofs, mutation analysis has seldom been considered in the context of deductive verification. We propose mutation proving, a technique for analyzing verification projects that use proof assistants. We implemented our technique for the Coq proof assistant in a tool dubbed mCoq. mCoq applies a set of mutation operators to Coq definitions of functions and datatypes, inspired by operators previously proposed for functional programming languages. mCoq then checks proofs of lemmas affected by operator application. To make our technique feasible in practice, we implemented several optimizations in mCoq such as parallel proof checking. We applied mCoq to several medium and large scale Coq projects, and recorded whether proofs passed or failed when applying different mutation operators. We then qualitatively analyzed the mutants, finding many instances of incomplete specifications. For our evaluation, we made several improvements to serialization of Coq files and even discovered a notable bug in Coq itself, all acknowledged by developers. We believe mCoq can be useful both to proof engineers for improving the quality of their verification projects and to researchers for evaluating proof engineering techniques.

The Isabelle/HOL proof assistant provides quite advanced and reliable support for discharging proof goals with external SMT solvers by reconstructing the resulting proof tree within the Isabelle/Pure inference kernel. In particular, currently Isabelle fully and efficiently supports proof reconstruction for the quantifier-free fragments of the theories of equality and uninterpreted functions (QF_UF) and linear integer arithmetic (QF_LIA). Yet there are a number of practically relevant theories that can be decided using relatively efficient algorithms, but are not supported either by the Isabelle proof reconstruction procedure or by the SMT solvers themselves. Meanwhile, if the decision procedure for an extended logical theory can be expressed as a complete quantifier instantiation strategy that reduces the given decision problem into the supported logical fragment (QF_UFLIA), the theory can be fully supported within the existing Isabelle/HOL infrastructure with relatively little additional effort. The goal of our work was to develop a fully formal completeness proof for an efficient quantifier instantiation strategy that translates a satisfiability problem in the logic of bounded linear integer arithmetic (we call it QF_BLIA) into the equisatisfiable problem in the logic of linear integer arithmetic and uninterpreted functions (QF_UFLIA). In this paper we first give the initial informal presentation of the proof, then discuss the most relevant issues of our resulting corresponding formal development of the completeness proof within Isabelle/HOL. The resulting formal proofs tightly follow the provided informal presentation, but at the same time they also contain quite significant amount of auxiliary developments that can potentially be generalized for other similar proof formalizations and automated using theory generation facilities of Isabelle/ML.

Recently, a complete set of algorithms for manipulating double-word numbers (some classical, some new) was analyzed [ 16 ]. We have formally proven all the theorems given in that article, using the Coq proof assistant. The formal proof work led us to: (i) locate mistakes in some of the original paper proofs (mistakes that, however, do not hinder the validity of the algorithms), (ii) significantly improve some error bounds, and (iii) generalize some results by showing that they are still valid if we slightly change the rounding mode. The consequence is that the algorithms presented in [ 16 ] can be used with high confidence, and that some of them are even more accurate than what was believed before. This illustrates what formal proof can bring to computer arithmetic: beyond mere (yet extremely useful) verification, correction, and consolidation of already known results, it can help to find new properties. All our formal proofs are freely available.

We present a novel propositional proof tracing format that eliminates complex processing, thus enabling efficient (formal) proof checking. The benefits of this format are demonstrated by implementing a proof checker in C, which outperforms a state-of-the-art checker by two orders of magnitude. We then formalize the theory underlying propositional proof checking in Coq, and extract a correct-by-construction proof checker for our format from the formalization. An empirical evaluation using 280 unsatisfiable instances from the 2015 and 2016 SAT competitions shows that this certified checker usually performs comparably to a state-of-the-art non-certified proof checker. Using this format, we formally verify the recent 200 TB proof of the Boolean Pythagorean Triples conjecture.

The Marching Cubes algorithm is a well known and widely used approach for extracting a triangulated isosurface from a three-dimensional rectilinear grid of uniformly sampled data values. The algorithm relies on a large manually constructed table which exhaustively enumerates all possible patterns in which the isosurface can intersect a cubical cell of the grid. For each pattern the table contains the local connectivity of the triangles. The construction of this table is labor intensive and error prone. Indeed, the original paper allowed for topological holes in the surface. This problem was later fixed by several authors, however a formal proof of correctness to our knowledge was never presented. In our opinion the most reliable approach to constructing a formal proof for this algorithm is to write a computer program which checks that all the entries in the table satisfy some sufficient condition of correctness. In this paper we present our formal proof which follows this approach, developed with the Coq proof assistant software. The script of our proof can be executed by Coq which verifies that the proof is logically correct, in the sense that its conclusions indeed logically follow from the assumptions. Coq offers a number of helpful features that automate proof development. However, Coq cannot check that the development corresponds to the problem we wish to solve, therefore, this correspondence is elaborated upon in this paper. Our complete Coq development is available online.

A formal system consists of a set of axioms – that is, formulas or assertions that are assumed or known to be true – and a set of inference or proof rules that allows one to make deductions. Given a formal system a formal proof of an assertion or formula F consists of a finite sequence of formulas

Proof assistants and the programming languages that implement them need to deal with a range of linguistic expressions that involve bindings. Since most mature proof assistants do not have built-in methods to treat this aspect of syntax, many of them have been extended with various packages and libraries that allow them to encode bindings using, for example, de Bruijn numerals and nominal logic features. I put forward the argument that bindings are such an intimate aspect of the structure of expressions that they should be accounted for directly in the underlying programming language support for proof assistants and not added later using packages and libraries. One possible approach to designing programming languages and proof assistants that directly supports such an approach to bindings in syntax is presented. The roots of such an approach can be found in the mobility of binders between term-level bindings, formula-level bindings (quantifiers), and proof-level bindings (eigenvariables). In particular, by combining Church's approach to terms and formulas (found in his Simple Theory of Types) and Gentzen's approach to sequent calculus proofs, we can learn how bindings can declaratively interact with the full range of logical connectives and quantifiers. I will also illustrate how that framework provides an intimate and semantically clean treatment of computation and reasoning with syntax containing bindings. Some implemented systems, which support this intimate and built-in treatment of bindings, will be briefly described.

Formal verification can provide the highest degree of software assurance. Demand for it is growing, but there are still few projects that have successfully applied it to sizeable, real-world systems. This lack of experience makes it hard to predict the size, effort and duration of verification projects. In this paper, we aim to better understand possible leading indicators of proof size. We present an empirical analysis of proofs from the landmark formal verification of the seL4 microkernel and the two largest software verification proof developments in the Archive of Formal Proofs. Together, these comprise 15,018 individual lemmas and approximately 215,000 lines of proof script. We find a consistent quadratic relationship between the size of the formal statement of a property, and the final size of its formal proof in the interactive theorem prover Isabelle. Combined with our prior work, which has indicated that there is a strong linear relationship between proof effort and proof size, these results pave the way for effort estimation models to support the management of large-scale formal verification projects.

Based on a formal proof that justifies the search for generative grammars in the study of gene regulation, a linguistic formalization of an exhaustive data base of Escherichia coli sigma 70 promoters and their regulatory binding sites has been initiated. The grammar presented here generates all the arrays of the collection plus those that are predicted as consistent with the principles of regulation of sigma 70 promoters. "Systems of regulation," sets of regulatory sites that collaborate in a mechanism of regulation, are represented by means of syntactic categories. A small set of phrase structure rules restricted by an X-bar principle and by a hierarchical, c-command relation generates a representation of arrays of sites of regulation where the selection of the protein(s) identifying the system(s) of regulation occurs. Based on the features of the proteins, optional duplicated proximal and remote sites are generated by means of transformational rules. Consistency with the data, the predictions that the grammar generates, and important similarities and differences with some aspects of the generative theory of natural language are discussed.

Formal Verification of Compiler Transformations for Speculative Real-Time Execution>>>A short version of t>his paper was presented at the 20th IFAC/IFIP Workshop on Real Time Programming (WRTP’95), which was held in Gt. Lauderdale, Florida, U.S.A., during November 1995. The Published Proceedings of this IFAC Meeting may be ordered from: Elsevier Science Limited, The Boulevard, Langford Lane, Kidlington, Oxford OX5 1GB, United

Since the proof of the four color theorem in 1976, computer-generated proofs have become a reality in mathematics and computer science. During the last decade, we have seen formal proofs using verified proof assistants being used to verify the validity of such proofs. In this paper, we describe a formalized theory of size-optimal sorting networks. From this formalization we extract a certified checker that successfully verifies computer-generated proofs of optimality on up to 8 inputs. The checker relies on an untrusted oracle to shortcut the search for witnesses on more than 1.6 million NP-complete subproblems.