We continued our work on the design of a language mixing $\lambda$-prolog and constraint programming. This year, we redesigned and provided a new implementation of the constraint handling rules, leading to a first public release of the software. We are starting to have users beyond our own team:

In an article submitted for publication , we showed that Elpi could be used to give a short implementation of Type Theory.

We are also starting a collaboration to construct an elaborator for HOL-Light using Elpi.

In type theory, for most inductive types, it is possible to construct a two-argument boolean function that tests when two terms of the type are equal. When inductive types have constructors containing sub-components from another inductive, this needs to be done in a modular way. This year, we studied how this problem could be solved in a modular way using Elpi. It turns out that the unary parametricity translation can serve as a tool to make the derivation compositional. This is described in a pre-print .

After our previous experiment using Elpi to develop a tool that produces parametricity proofs, we investigated the use of the Template-Coq framework to implement this kind of algorithm. This work is described in . A similar experiment has been performed using the Lean theorem prover.

Program sensitivity, also known as Lipschitz continuity, describes how small changes in a program's input lead to bounded changes in the output. We propose an average notion of program sensitivity for probabilistic programs—expected sensitivity—that averages a distance function over a probabilistic coupling of two output distributions from two similar inputs. This work is described in .

We have developed Ellora, a sound and relatively complete assertion-based program logic, and demonstrate its expressivity by verifying several classical examples of randomized algorithms using an implementation in the EasyCrypt proof assistant. Ellora features new proof rules for loops and adversarial code, and supports richer assertions than existing program logics. We also show that Ellora allows convenient reasoning about complex probabilistic concepts by developing a new program logic for probabilistic independence and distribution law, and then smoothly embedding it into Ellora. This is described in article .

The cost of higher-order masking as a countermeasure against side-channel attacks is often considered too high for practical scenarios, as protected implementations become very slow. At Eurocrypt 2017, we have proposed the bounded moment leakage model to study the (theoretical) security of parallel implementations of masking schemes. In this work we show how the NEON vector instructions of larger ARM Cortex-A processors can be exploited to build much faster masked implementations of AES based on the bounded moment model. This work is described in publication .

Recently, numerous physical attacks have been demonstrated against lattice based schemes, often exploiting their unique properties such as the reliance on Gaussian distributions, rejection sampling and FFT-based polynomial multiplication. In this work, we describe the first masked implementation of a lattice-based signature scheme. Since masking Gaussian sampling and other procedures involving contrived probability distribution would be prohibitively inefficient, we focus on the GLP scheme. This work is described in .

Symbolic methods have been used extensively for proving security of cryptographic protocols in the Dolev-Yao model, and more recently for proving security of cryptographic primitives and constructions in the computational model. However, existing methods for proving security of cryptographic constructions in the computational model often require significant expertise and interaction, or are fairly limited in scope and expressivity. In this work we introduce a symbolic approach for proving security of cryptographic constructions based on the Learning With Errors assumption. This work is described in .

The CMAC standard, when initially proposed by Iwata and Kurosawa as OMAC1, was equipped with a complex game-based security proof. Following recent advances in formal verification for game-based security proofs, we have formalized a proof of unforgeability for CMAC in EasyCrypt. This work is described in .

Software-based countermeasures provide effective mitigation against side-channel attacks, often with minimal efficiency and deployment overheads. Their effectiveness is often amenable to rigorous analysis: specifically, several popular countermeasures can be formalized as information flow policies, and correct implementation of the countermeasures can be verified with state-of-the-art analysis and verification techniques. However, in absence of further justification, the guarantees only hold for the language (source, target, or intermediate representation) on which the analysis is performed. We consider the problem of preserving side-channel counter-measures by compilation for cryptographic “constant-time”, a popular countermeasure against cache-based timing attacks. We have presented a general method, based on the notion of constant-time-simulation, for proving that a compilation pass preserves the constant-time countermeasure. This work was described in . At the conference, this work received the “distinguished paper” award.

In the thesis work of Mohamad El Laz, co-supervised by Benjamin Grégoire and Tamara Rezk (Indes project-team), we studied the cryptographic hypothesis of DDH (Decisional Diffie-Hellman) and implementations that would break this hypothesis. We focused on ElGamal encryption cryptosystem implementations to assess they use the DDH hypothesis correctly. We analyzed a number of implementations including Botan, Belenios and Libgcrypt. The lessons learned from this analysis are that the hypotheses are not always well understood.

In a second stage we considered message encoding methods. We investigated several approaches such as DCDH (Decisional Class Diffie-Hellman) in Encoding-Free ElGamal Encryption.

We have performed a machine-checked proof of security for the domain management protocol of Amazon Web Services KMS (Key Management Service), a critical security service used throughout AWS and by AWS customers. Domain management is at the core of KMS; it governs the long-term keys that anchor the security of encryption services at AWS. Informally, we show that the protocol securely implements a distributed encryption mechanism. Formally, the proof shows that the domain management protocol is indistinguishable from an ideal encryption functionality under standard cryptographic assumptions.

We formalise the correctness proof of Tarjan's algorithm for computing strongly connected components using the Mathematical Component Library. This leads to a comparison of formalisation between various systems described in .

In work from 2010, a formal description of Delaunay triangulations was presented where the input was a triangulation not satisfying the Delaunay criterion and where the output was a triangulation satisfying this criterion.

In this work, we wish to complete the previous work by describing an algorithm that produces the initial triangulation. We plan this work in several phases, where the first phase only uses simple data-structures, more advanced structures being introduced only later. This work was presented partially in an invited talk at the ICTAC conference .

Most of the work described here is inspired by the experiment of giving formal proofs in Coq of the exercises found in Bourbaki's exposition of set theory. However, some of the results go beyond what can be found in Bourbaki.

We implemented a paper of Sierpinski about properties of continuous ordinal functions and limits of such functions.

We implemented a paper on sums of sequences of ordinals, showing that the value obtained (which depends on the order) lies in a finite set. We also showed that this result does not hold when replacing ordinals by order types.

We implemented a paper by Tarski that says if every infinite cartinal is equal to its square, then every set can be well-ordered (this is the axiom of choice). We had to modify our library to make the use of the axiom of choice more explicit.

We continued implementing in Coq the Exercises of Set Theory of Bourbaki. We solved two of them, and proved by a counter example that three of them are false.

As part of the ANR Fastrelax project, we are formalizing double-word arithmetic algorithms, in particular the sum of a double-word and a floating point number and the sum of two double-word numbers described in the article " Tight and rigourous error bounds for basic building blocks of double-word arithmetic" . The formalization is progressing, moving from addition to multiplication. The progress is slowed down because minor errors in the informal proofs are regularly uncovered, which requires a dialog with the initial authors.

The work on proofs of transcendence that was started the previous year was completed this year by an effort to integrate generic part of the proofs in the Mathematical Components library. A public package for easy re-use by other researchers was also developed.

A natural extension of the work on group theory is a proof that polynomials of degree higher than 5 cannot be solved by radicals. This is known as Abel's theorem. We have started an experiment to give a formal proof of this result on top of the Mathematical Components library.

We updated the representation and relevant theorems for bilinear, sesquilinear, and hermitian forms in the Mathematical Components library and updated the archived proof of the odd-order theorem (Feit-Thompson) to use the new presentation. This work also includes a proof of the Spectral Theorem.

As a synthesis of the lessons learned in the usage of Mathematical Components and Coquelicot, we develop an extension of the Mathematical Components library to cover questions of analysis. This work includes a new tactic called near to handle reasoning steps around limits and filters and little-o notation (following Landau's style of asymptotic reasoning). This work is described in . There also contains a new formalization of topoligical structures, Rolle's theorem, the intermediate value theorem, and Heine Borel's theorem. Ongoing work concentrates on a better design of the topological hierarchy and a simplification of the properties expected from real numbers (following a design by A. Mahboubi and P.-Y. Strub).

Some of this work also includes experiments performed with the Lean theorem prover (developed at Microsoft Research).

We have developed a certified library for computing Chebyshev models for formulas composed of polynomials, exponential, logarithm, and trigonometric function. This work is part of the ANR project FastRelax. The code is available at https://github.com/FlorianSteinberg/Cheby

Damien Rouhling presented his work on formalizing control theory for an inverted pendulum at an international conference in January .

The original development was based on Coquelicot. An analysis of the difficulties in formalizing led to the design of Mathematical Components Analysis. The development on control was then ported to this new library. This work was presented at the Coq Workshop in July.

Our study of cylindrical algebraic decomposition requires that we find a good representation of semi-algebraic sets. An article on this topic was published . This is also the one of the main topics of Boris Djalal's thesis, which was defended in December.

In collaboration with members of the Inria Gallinette team, we are investigating the properties that a type theory should enjoy to support algebraic structures better than what is currently available.