6.1.1 Easycrypt

• Keywords:
  Proof assistant, Cryptography
• Functional Description:
  EasyCrypt is a toolset for reasoning about relational properties of probabilistic computations with adversarial code. Its main application is the construction and verification of game-based cryptographic proofs. EasyCrypt can also be used for reasoning about differential privacy.
• URL:
  https://­github.­com/­EasyCrypt/­easycrypt
• Publications:
  hal-03352062, hal-03469015
• Contact:
  Gilles Barthe
• Participants:
  Benjamin Grégoire, Gilles Barthe, Pierre-Yves Strub, Adrien Koutsos

6.1.2 Jasmin

• Name:
  Jasmin compiler and analyser
• Keywords:
  Cryptography, Static analysis, Compilers
• Scientific Description:

  Jasmin is a workbench for high-assurance and high-speed cryptography. Jasmin implementations aim at being efficient, safe, correct, and secure.

  Jasmin is both a language and a compiler from this language to assembly. The compiler is written and formally verified for correctness in the Coq proof assistant. This justifies that many properties can be proved on a source program and still apply to the corresponding assembly program: safety, termination, functional correctness…

  Jasmin comes with a set of tools to reason on Jasmin programs (a safety checker, a type-checker for Constant Time, a type-checker for Speculative Constant Time and an extraction to EasyCrypt to prove properties about the extracted Jasmin program, e.g. functional correctness).

• Functional Description:

  The Jasmin programming language smoothly combines high-level and low-level constructs, so as to support “assembly in the head” programming. Programmers can control many low-level details that are performance-critical: instruction selection and scheduling, what registers to spill and when, etc. The language also features high-level abstractions (variables, functions, arrays, loops, etc.) to structure the source code and make it more amenable to formal verification. The Jasmin compiler produces predictable assembly and ensures that the use of high-level abstractions incurs no run-time penalty.

  The semantics is formally defined to allow rigorous reasoning about program behaviors. The compiler is formally verified for correctness (the proof is machine-checked by the Coq proof assistant). This ensures that many properties can be proved on a source program and still apply to the corresponding assembly program: safety, termination, functional correctness…

  Jasmin programs can be automatically checked for safety and termination (using a trusted static analyzer). The Jasmin workbench leverages the EasyCrypt toolset for formal verification. Jasmin programs can be extracted to corresponding EasyCrypt programs to prove functional correctness, cryptographic security, or security against side-channel attacks (constant-time).

• Release Contributions:

  This year, four minor versions and one major version have been released. Here are some of the most significant changes brought by these different versions.

  The semantics of the Jasmin language has been extended to cover more use cases. On one hand programmers no longer need to prove that memory accesses and (direct) array accesses are properly aligned. Jasmin programs have a well-defined semantics even if unaligned accesses occur. On the other hand more functions can have arrays as arguments and results.

  The programming language has been improved to simplify program writing tasks. Namespaces allow reusing names: two things may have the same name, as long as they belong to different namespaces. Spilling and unspilling of registers can now be done implicitly thanks to the spill and unspill operators. Type aliases can be defined through the new type key-word. Local variables may be initialized when declared.

  So as to give more security guaranties about the emitted code, the compiler can introduce code that zeroizes the stack at the end of export functions. The user can enable the feature with an annotation or a compiler flag.

  This is a minor release of Jasmin. Here is a brief description of a few of the changes it features.

  The checker for Constant-Time security, now available as a separate tool (jasmin-ct), has been made more precise and can also verify security in spite of speculative executions (Spectre).

  Support of x86 and ARMv7 architectures has been fostered. Many more instructions are available and some issues with large immediates have been fixed.

• News of the Year:
  On July 2024, a major release (2024.07.0) has been published.
• URL:
  https://­github.­com/­jasmin-lang/­jasmin
• Publications:
  hal-04106448, hal-04218417, hal-04595591, hal-04691165, hal-03844366, hal-03430789, hal-03352062, hal-02404581, hal-02974993, hal-01649140
• Contact:
  Jean-Christophe Léchenet
• Participants:
  Alexandre Bourbeillon, Gaëtan Cassiers, Gilles Barthe, Benjamin Grégoire, Adrien Koutsos, Vincent Laporte, Jean-Christophe Léchenet, Swarn Priya, Santiago Arranz Olmos
• Partners:
  The IMDEA Software Institute, Ecole Polytechnique, Universidade do Minho, Universidade do Porto, Max Planck Institute for Security and Privacy

6.1.3 Bigloo

• Keyword:
  Compilers
• Functional Description:
  Bigloo is a Scheme implementation devoted to one goal: enabling Scheme based programming style where C(++) is usually required. Bigloo attempts to make Scheme practical by offering features usually presented by traditional programming languages but not offered by Scheme and functional programming. Bigloo compiles Scheme modules. It delivers small and fast stand alone binary executables. Bigloo enables full connections between Scheme and C programs and between Scheme and Java programs.
• Release Contributions:
  modification of the object system (language design and implementation), new APIs (alsa, flac, mpg123, avahi, csv parsing), new library functions (UDP support), new regular expressions support, new garbage collector (Boehm's collection 7.3alpha1).
• URL:
  http://­www-sop.­inria.­fr/­teams/­indes/­fp/­Bigloo/
• Contact:
  Manuel Serrano
• Participant:
  Manuel Serrano

6.1.4 Hiphop.js

• Name:
  Hiphop.js
• Keywords:
  Web 2.0, Synchronous Language, Programming language
• Functional Description:
  HipHop.js is an Hop.js DLS for orchestrating web applications. HipHop.js helps programming and maintaining Web applications where the orchestration of asynchronous tasks is complex.
• URL:
  http://­hop-dev.­inria.­fr/­hiphop
• Contact:
  Manuel Serrano

6.1.5 Hop

• Keyword:
  Programming language
• Scientific Description:

  The Hop programming environment consists in a web broker that intuitively combines in a single architecture a web server and a web proxy. The broker embeds a Hop interpreter for executing server-side code and a Hop client-side compiler for generating the code that will get executed by the client.

  An important effort is devoted to providing Hop with a realistic and efficient implementation. The Hop implementation is validated against web applications that are used on a daily-basis. In particular, we have developed Hop applications for authoring and projecting slides, editing calendars, reading RSS streams, or managing blogs.

• Functional Description:
  Multitier web programming language and runtime environment.
• URL:
  http://­hop.­inria.­fr
• Contact:
  Manuel Serrano
• Participant:
  Manuel Serrano

7.1.1 Static Basic Block Versioning

Basic Block Versioning (BBV) is a compilation technique for optimizing program execution. It consists in duplicating and specializing basic blocks of code according to the execution contexts of the blocks, up to a version limit. BBV has been used in Just-In-Time compilers for reducing the dynamic type checks of dynamic languages. Our work revisits the BBV technique to adapt it to Ahead-of-Time (AoT) compilation. This Static BBV (SBBV) raises new challenges, most importantly how to ensure the convergence of the algorithm when the specializations of the basic blocks are not based on profiled variable values and how to select the good specialization contexts. SBBV opens new opportunities for more precise optimizations as the compiler can explore multiple versions and only keep those within the version limit that yield better generated code.

During the year, we completed the design of the SBBV algorithm. We used the analysis to optimize the dynamic type checks, array bound checks, and mixed-type arithmetic operators often found in dynamic languages. We implemented SBBV in two AoT compilers for the Scheme programming language that used to evaluate the technique's effectiveness. On a suite of benchmarks, we have observed that even with a low limit of 2 versions, SBBV greatly reduces the number of dynamic type tests (by 54% and 62% on average) and accelerates the execution time (by about 10% on average). Previous work has needed a higher version limit to achieve a similar level of optimization. We also observe a small impact on compilation time and code size (a decrease in some cases).

This work has been presented during the ECOOP'24 conference. See 16 for more information.

7.1.2 Dynamic Binary Modifications

We developed a technique that enables dynamic optimization of static code produced by C compilers. We implemented and tested the optimization in the context of Hopc, a static JavaScript-to-C compiler, for which it improves the performance of inline caches (IC), a common technique used to optimize object accesses. By using dynamic binary modification of the assembly sequences C compilers generate, Hop.js eliminates up to two memory reads by IC, yielding executable codes that are as efficient as those generated by JiT compilers.

We measured the impact of the optimization and observed that while it eliminates memory reads, as intended, it does not accelerate executions. We conducted several experiments to explain this behavior. We isolated the intrinsic cost of modifying the binary code of programs and showed that, in itself, it cannot explain the lack of acceleration. We eventually discovered, that the optimized IC sequences are actually no faster than un-optimized ones. The experiments we present show that, in the context of IC sequences, the micro-architectures already executed the extra memory reads of the C sequences early, and there is no benefit in removing them.

None of the tools we tried, including performance analysis tools that use hardware performance counters and micro-architectural code analyzers, was able to predict or even unveil this hardware optimization. Only by running many experiments have we been able to isolate and observe the hardware optimization that removes the extra memory we were chasing with our software optimization.

7.2.1 The Functional, the Imperative, and the Sudoku

Conventional wisdom suggests that the benefits of functional programming no longer apply in the presence of even a small amount of imperative code, as if the addition of imperative code effectively subtracts. And yet, as we show, combining functional programming with the special imperative language Esterel provides a multiplicative improvement to the benefits of functional programming. The key to the benefit of both Esterel and functional programming stems from a restriction that both share. As in functional programming, where only the inputs to a function determine its outputs, the state of an Esterel computation is fully determined by the program's input and the state that the computation had in the previous time step, where the notion of a time step is explicit in the language. Esterel's guarantee holds even though Esterel programs feature concurrent threads, mutable state, and the ability to create, suspend, and even terminate threads as the computation proceeds. This similarity is the root of the benefits that programmers accrue as they informally reason about their program's behavior. To illustrate these benefits, the bulk of this paper consists of an in-depth exploration of HipHop code (a mashup of JavaScript and Esterel) that implements a Sudoku solver, showing how it is possible to write code that is as easy to understand as if it were written in a pure functional programming style, even though it uses multiple threads, mutable state, thread preemption, and even thread abortion. Even better, concurrent composition and task canceling provide significant program structuring benefits that allow a clean decomposition and task separation in the solver.

See 6 for extra information.

7.4.1 Software

Participants: Davide Davoli, Tamara Rezk.

Operating systems are stratified software ecosystems that manage the interaction between the user application and the hardware resources. The most important component is the kernel that has complete control over the hardware and every application that is running, making it a popular target for attacks. In the current state-of-the-art of security, often referred to as the Spectre era, speculative execution and side-channels are well known to be effective vectors for compromising kernel security.

We developed a formal model of the operation of kernels in the presence of speculative execution, and we used it to study whether kernel security can be restored in the Spectre era. We showed that any kernel that is safe against non-speculative attacks can be compiled to another kernel that is functionally equivalent but safe against speculative attacks. Our main result is the identification of two sufficient conditions for proving that a program transformation enforces safety against speculative attacks on kernels that are safe against ordinary attacks. Finally, we defined a transformation that satisfies such requisites.

This work has been done with Martin Avanzini from the OLAS team, who co-supervised Davide Davoli together with Tamara Rezk, and was presented at ACM CCS 2024 14.

7.4.2 Hardware

Participants: Davide Davoli, Tamara Rezk, Youcef Bouzid, Tamara Rezk, Benjamin Gregoire.

In the past, we proposed ProSpeCT  22, a generic formal processor model providing provably secure speculation for the constant-time policy. For constant-time programs under a non-speculative semantics, ProSpeCT guarantees that speculative and out-of-order execution cause no microarchitectural leaks. In addition to the formal model, we provided a prototype hardware implementation of ProSpeCT on a RISC-V processor. In order to lower the impact on hardware cost and the cost regarding the required software changes, we are studying possible alternatives solutions to ProSpeCT, extending the RISC-V architecture with specialized instructions and evaluating the performance on different extended RISC-V processors. Youcef Bouzid from ENS Saclay was a L3 intern during part of this work (which is still in progress). This work is done in collaborations with researchers from KU Leuven.

7.7.1 Formally verifying Kyber

Participants: Benjamin Grégoire, Jean-Christophe Léchenet.

We present a formally verified proof of the correctness and IND-CCA security of ML-KEM, the Kyber-based Key Encapsulation Mechanism (KEM) undergoing standardization by NIST. The proof is machine-checked in EasyCrypt and it includes: 1) A formalization of the correctness (decryption failure probability) and IND-CPA security of the Kyber base public-key encryption scheme, following Bos et al. at Euro S&P 2018; 2) A formalization of the relevant variant of the Fujisaki-Okamoto transform in the Random Oracle Model (ROM), which follows closely (but not exactly) Hofheinz, Hovelmanns and Kiltz at TCC 2017; 3) A proof that the IND-CCA security of the ML-KEM specification and its correctness as a KEM follows from the previous results; 4) Two formally verified implementations of ML-KEM written in Jasmin that are provably constant-time, functionally equivalent to the ML-KEM specification and, for this reason, inherit the provable security guarantees established in the previous points. The top-level theorems give self-contained concrete bounds for the correctness and security of MLKEM down to (a variant of) Module-LWE. We discuss how they are built modularly by leveraging various EasyCrypt features. This work has been published in Crypto 2024 7

7.7.2 A link between CryptoVerif and EasyCrypt

Participants: Benjamin Grégoire.

We define and implement CV2EC, a translation from CryptoVerif assumptions on primitives to EasyCrypt games. CryptoVerif and EasyCrypt are two proof tools for mechanizing game-based proofs. While CryptoVerif is primarily suited for verifying security protocols, EasyCrypt has the expressive power for verifying cryptographic primitives and schemes. CV2EC allows us to prove security protocols in CryptoVerif and then use EasyCrypt to prove the assumptions made in CryptoVerif, either directly or by reducing them to lower-level or more standard cryptographic assumptions. We apply this approach to several case studies: we prove the multikey computational and gap Diffie-Hellman assumptions used in CryptoVerif from the standard version of these assumptions; we also prove an n-user security property of authenticated key encapsulation mechanisms (KEMs), used in the CryptoVerif study of hybrid public-key encryption (HPKE), from the 2-user version. By doing that, we discovered errors in the paper proof of this property, which we reported to the authors who then fixed their proof. This work has been published in CSF 2024 11.

7.10.1 Event Structure Semantics for Asynchronous Multiparty Sessions

Participants: Ilaria Castellani.

We brought to an end our work on denotational semantics for asynchronous multiparty session calculi by means of Event Structures (ESs)  25, 23. In a previous work, we had proposed a similar semantics for synchronous multiparty session calculi.

Specifically, we propose an interpretation of multiparty sessions with asynchronous communication as Flow Event Structures. We introduce a new notion of asynchronous type for such sessions, ensuring the expected properties for multiparty sessions, including progress. Our asynchronous types, which reflect asynchrony more directly and more precisely than standard global types and are more permissive, are themselves interpreted as Prime Event Structures. The main result is that the Event Structure interpretation of a session is equivalent, when the session is typable, to the Event Structure interpretation of its asynchronous type, namely their domains of configurations are isomorphic.

This work has been published in the journal Fundamenta Informaticae 4.

7.10.2 Semantic Characterization of Global Type Well-formedness

Participants: Ilaria Castellani.

We address the question of characterizing the well-formedness properties of multiparty session types semantically, i.e., as properties of the semantic model used to interpret types. In this work, we focus on sessions with synchronous communication. Choosing Prime Event Structures (PESs) as our semantic model, we present semantic counterparts for the two properties that underpin global type well-formedness, namely projectability and boundedness. As a first step towards a characterization of the class of PESs corresponding to well-formed global types, we identify some simple structural properties satisfied by such PESs.

This work was presented at the workshop PLACES 2024 13.

8.1.1 Inria associate team not involved in an IIL or an international program

Participants: Manuel Serrano, Robert Findler.

• Title:
  HipHopSec
• Partner Institution(s):
  Northwestern University (USA)

HipHopSec is an Inria/Northwestern associated team studying new programming environment for IoT devices.

Nowadays most applications are distributed, that is, they run on several computers: a mobile device for the graphical user interface; a gateway for storing data in a local area; a remote server of a large cloud platform for resource demanding computing; an object connected to Internet in the IoT (Internet of Things); etc. For many different reasons, this makes programming much more difficult than it was when only a single computer was involved:

• Applications are composed of extensive lists of diverse components, each coming with their own specification and imposing its own constraints on application development.
• Due to the distributed nature of the applications, developers have to implement appropriate communication protocols, which is difficult to do correctly and securely.
• Communicating applications need to resort to parallelism to handle requests from their clients with acceptable latency. No matter whether it is multi-threading (as in Java) or asynchronous programming (as in JavaScript/Node.js), this style of programming is notoriously difficult and error-prone.

The Inria Indes, Northwestern University, and College de France teams are working together to propose solutions that address the aforementioned problems. Combined together, they could lead to a robust and secure execution environment for the web and IoT programming.

Participants: Erven Rohou, Manuel Serrano, Marc Feeley.

• Title:
  COLD
• Partner Institution(s):
  Inria Rennes (leader), University of Montreal (CANADA)

Cold is an Inria/University of Montreal associated team studying compilation techniques for dynamic languages. It is co-funded by Inria and the University of Montreal. Erven Rohou is the leader of the team.

Dynamic programming languages offer flexibility and generally facilitate rapid software development. Programs written using dynamic languages are typically slower, consume more memory, and are less energy efficient. This is especially concerning, considering that dynamic languages such as Python and JavaScript are extensively used. JavaScript is the main language for implementing web applications, while Python is the most used language for software development today and in particular in the very active field of Machine Learning and Artificial Intelligence.

To solve this issue, our team researches optimizing compilation techniques for dynamic languages. Such techniques generate optimized code when translating a program from its source code to machine code. This provides better performance without having to sacrifice the flexibility of dynamic languages. Furthermore, since novel optimizing techniques can be integrated into existing compilers, they can improve current programs with no additional effort by the application programmers.

In the last decades, the discovery of tracing just-in-time compilation and advances in partial evaluation have significantly improved the performance of dynamic languages. However, work remains to be done to bridge the gap between dynamic and static languages, a performant yet less flexible family of languages. Bridging this gap will enable significant savings in execution time and energy efficiency globally.

8.1.2 Participation in other International Programs

8.2.1 Visits of international scientists

Participants: Marc Feeley, Andreas Sabelfeld, Gilles Barthe, Ignacio Tiraboschi, Guillaume Combette.

8.2.2 Visits to international teams

8.3.1 Action Exploratoire: AoT.js – Optimizing Compilation from Higher-Order Programming to Computer Architecture

Participants: Erven Rohou, Manuel Serrano.

This action exploratoire is bi-localized in Rennes and Sophia-Antipolis.

JavaScript programs are typically executed by a JIT compiler, able to handle efficiently the dynamic aspects of the language. However, JIT compilers are not always viable or sensible (e.g., on constrained IoT systems, due to secured read-only memory (W$\oplus$X), or because of the energy spent recompiling again and again). We propose to rely on ahead-of-time compilation, and achieve performance thanks to optimistic compilation, and detailed analysis of the behavior of the processor, thus requiring a wide range of expertise from high-level dynamic languages to microarchitecture.

8.3.2 PEPR

Participant: Benjamin Grégoire, Jean-Christophe Léchenet.

SVP PEPR Cybersecurity. We participate in a project concerned with the verification of security protocols. Partners in this project are CNRS IRISA Rennes (coordinator Stéphanie Delaune), INRIA, University of Paris-Saclay, University of Lorraine, University of Côte d’Azur, ENS Rennes. The funds allocated to our team in this collaboration are 333 KEuros. The corresponding researcher for this contract is Benjamin Grégoire.

8.4.1 Graines de projet ADT

Participant: Benjamin Grégoire, Côme Le Breton, Jean-Christophe Léchenet, Romain Tetley.

We carried out a graine de projet ADT initiative with the goal of adding a RISC-V backend to the Jasmin compiler. This project was highly successful, allowing us to test the new backend with an implementation of the post-quantum signature scheme Dilithium in Jasmin. This paves the way for extending the Libjade library with RISC-V implementations.

9.1.1 Scientific events: organisation

9.1.2 Scientific events: selection

9.1.3 Invited talks

• Ilaria Castellani was the invited speaker of PPDP 2024: 26th International Symposium on Principles and Practice of Declarative Programming.
• Tamara Rezk was:
  • Invited speaker at the Symposium of Systems Security at MPI-Bochum, "On Kernel's Safety in the Spectre Era", Bochum, June 17th, 2024 (https://www.mpi-sp.org/63428/program).
  • Invited speaker at Waseda University, "On Kernel's Safety in the Spectre Era", Tokyo, July, 2024.
  • Invited speaker at the Chalmers research retreat, "On Kernel's Safety in the Spectre Era", GullHolmen, August 2024.

9.1.4 Leadership within the scientific community

• Manuel Serrano organized the JavaScript panel at the REBLS conference (https://2024.splashcon.org/track/splash-2024-rebase).
• Benjamin Grégoire chair a panel on secure compilation in the Shonan Seminars on Microarchitectural Attacks and Defenses (https://shonan.nii.ac.jp/seminars/215/)

9.1.5 Research administration

• Ilaria Castellani is a member of the INRIA Gender Equality and Equal Opportunities Committee, and of the organizing committee of the Forum Numerica seminar series.
• Tamara Rezk is a member of the Bureau de CP.

9.2.1 Supervision

• PhD in progress: Aurore Poirier, Erven Rohou and Manuel Serrano.
• PhD in progress: Olivier Melancon, Marc Feeley and Manuel Serrano.
• PhD in progress: Davide Davoli , co-supervised by Martin Avanzini and Tamara Rezk .
• PhD discontinued: Guillaume Combette, co-supervised by Sébastien Bardin and Tamara Rezk , discontinued his PhD in December 2024.
• PhD defended 18 in October 2024: Ignacio Tiraboschii , co-supervised by Xavier Rival and Tamara Rezk .

9.2.2 Juries

• Manuel Serrano was a reviewer for the PhD of Leo Andres (University of Paris Saclay) and Colin Gonzalez Duburc (University of Paris City).
• Ilaria Castellani was a member of the PhD juries of Vincent Rébiscoul (Université de Rennes 1), Giovanni Fabbretti (Université Grenoble Alpes), and Luc Edixhoven (Open University, the Netherlands).
• Tamara Rezk was a member of the PhD juries of Joel Kuepper (supervisors: Yuval Yarom and Chitchanok Chuengsatiansup), The University of Adelaide, February 2024; and Basavesh Ammanaghatta Shivakumar (supervisors: Peter Schwabe and Gilles Barthe), Radboud University, September 2024.

International journals

• 1 articleS.Santiago Arranz Olmos, G.Gilles Barthe, L.Lionel Blatter, B.Benjamin Grégoire and V.Vincent Laporte. Preservation of Speculative Constant-time by Compilation.Proceedings of the ACM on Programming Languages9POPLJanuary 2025, 1293 - 1325HALDOI
• 2 articleS.Santiago Arranz Olmos, G.Gilles Barthe, R.Ruben Gonzalez, B.Benjamin Grégoire, V.Vincent Laporte, J.-C.Jean-Christophe Léchenet, T.Tiago Oliveira and P.Peter Schwabe. High-assurance zeroization.IACR Transactions on Cryptographic Hardware and Embedded Systems202412024, 375-397HALDOIback to text
• 3 articleG.Gilles Barthe, S.Sonia Belaïd, T.Thomas Espitau, P.-A.Pierre-Alain Fouque, B.Benjamin Grégoire, M.Mélissa Rossi and M.Mehdi Tibouchi. Masking the GLP Lattice-Based Signature Scheme at Any Order.Journal of Cryptology371January 2024, 5HALDOIback to text
• 4 articleI.Ilaria Castellani, M.Mariangiola Dezani-Ciancaglini and P.Paola Giannini. Global Types and Event Structure Semantics for Asynchronous Multiparty Sessions.Fundamenta Informaticae1921July 2024, 1-75HALDOIback to text
• 5 articleA.Aurore Poirier, E.Erven Rohou and M.Manuel Serrano. An Attempt to Catch Up with JIT Compilers: The False Lead of Optimizing Inline Caches.The Art, Science, and Engineering of Programming106February 2025HALDOI
• 6 articleM.Manuel Serrano and R. B.Robert Bruce Findler. The Functional, the Imperative, and the Sudoku: Getting Good, Bad, and Ugly to Get Along (Functional Pearl).Proceedings of the ACM on Programming Languages8242August 2024, 177-202HALDOIback to text

International peer-reviewed conferences

• 7 inproceedingsJ. B.José Bacelar Almeida, S. A.Santiago Arranz Olmos, M.Manuel Barbosa, G.Gilles Barthe, F.François Dupressoir, B.Benjamin Grégoire, V.Vincent Laporte, J.-C.Jean-Christophe Léchenet, C.Cameron Low, T.Tiago Oliveira, H.Hugo Pacheco, M.Miguel Quaresma, P.Peter Schwabe and P.-Y.Pierre-Yves Strub. Formally verifying Kyber: Episode V: Machine-checked IND-CCA security and correctness of ML-KEM in EasyCrypt.Advances in Cryptology – CRYPTO 2024Crypto 202414921Santa Barbara (CA), United StatesAugust 2024HALDOIback to text
• 8 inproceedingsM.Melissa Antonelli, U.Ugo Dal Lago, D.Davide Davoli, I.Isabel Oitavem and P.Paolo Pistone. Enumerating Error Bounded Polytime Algorithms Through Arithmetical Theories.Leibniz International Proceedings in InformaticsCSL 2024 - 32nd EACSL Annual Conference on Computer Science LogicLIPIcs-28832nd EACSL Annual Conference on Computer Science Logic (CSL 2024)Napoli, ItalyFebruary 2024HALDOI
• 9 inproceedingsM.Martin Avanzini, G.Gilles Barthe, D.Davide Davoli and B.Benjamin Grégoire. A Quantitative Probabilistic Relational Hoare Logic.ACM Digital LibraryPOPL 2025 - 52nd ACM SIGPLAN Symposium on Principles of Programming Languages9Proceedings of the ACM on Programming LanguagesPOLP 2025Denver (Colorado), United StatesJanuary 2025HALDOI
• 10 inproceedingsM.Martin Avanzini, G.Gilles Barthe, B.Benjamin Grégoire, G.Georg Moser and G.Gabriele Vanoni. Hopping Proofs of Expectation-Based Properties: Applications to Skiplists and Security Proofs.ACM Digital LibraryOOPSLA 2024 -ACM Conference on Object Oriented Programming Systems Languages and Applications8Proceedings of the ACM on Programming LanguagesOOPSLA1Pasadena (CA), United StatesApril 2024, 784-809HALDOIback to text
• 11 inproceedingsB.Bruno Blanchet, P.Pierre Boutry, C.Christian Doczkal, B.Benjamin Grégoire and P.-Y.Pierre-Yves Strub. CV2EC: Getting the Best of Both Worlds.CSF 2024 - 37th IEEE Computer Security Foundations SymposiumEnschede, NetherlandsJuly 2024, 283-298HALDOIback to text
• 12 inproceedingsI.Ilaria Castellani. A simple view of multiparty session types.PPDP 2024: 26th International Symposium on Principles and Practice of Declarative ProgrammingMilano Italy, ItalyACMSeptember 2024, 1 - 3HALDOIback to text
• 13 inproceedingsI.Ilaria Castellani and P.Paola Giannini. Towards a Semantic Characterisation of Global Type Well-formedness.Programming Language Approaches to Concurrency and Communication-cEntric Software401EPTCSLuxembourg, LuxembourgApril 2024, 11 - 21HALback to text
• 14 inproceedingsD.Davide Davoli, M.Martin Avanzini and T.Tamara Rezk. On Kernel's Safety in the Spectre Era (And KASLR is Formally Dead).ACM Digital LibraryACM CCS 2024 - ACM SIGSAC Conference on Computer and Communications SecurityCCS '24: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications SecuritySalt Lake City, United StatesACMOctober 2024, 1091-1105HALDOIback to text
• 15 inproceedingsU. D.Ugo Dal Lago, D.Davide Davoli and B.Bruce Kapron. On Separation Logic, Computational Independence, and Pseudorandomness.CSF 2024 6 IEEE 37th Computer Security Foundations Symposium151942024 IEEE 37th Computer Security Foundations Symposium (CSF)Enschede, NetherlandsIEEEOctober 2024, 80-95HALDOI
• 16 inproceedingsO.Olivier Melançon, M.Marc Feeley and M.Manuel Serrano. Static Basic Block Versioning.Leibniz International Proceedings in InformaticsECOOP 20242- 38th European Conference on Object-Oriented ProgrammingLIPIcs-31338th European Conference on Object-Oriented Programming (ECOOP 2024)Vienna, AustriaSchloss Dagstuhl – Leibniz-Zentrum für Informatik2024HALDOIback to text

Doctoral dissertations and habilitation theses

• 17 thesisB.Benjamin Grégoire. Provable Security of Cryptographic Primitives: from Algorithms to Assembly.Université Côte D'AzurDecember 2024HALback to text
• 18 thesisI.Ignacio Tiraboschi. Intertwining Symbolic Execution and Abstract Interpretation for the Analysis of Security Properties.ENS Paris - Ecole Normale Supérieure de ParisOctober 2024HALback to text

Reports & preprints

• 19 miscG.Giovanni Bernardi, I.Ilaria Castellani, P.Paul Laforgue and L.Léo Stefanesco. Constructive characterisations of the must-preorder for asynchrony.January 2025HALDOIback to text
• 20 miscD.Davide Davoli, M.Martin Avanzini and T.Tamara Rezk. On Kernel's Safety in the Spectre Era (Extended Version).June 2024HAL
• 21 miscS. A.Santiago Arranz Olmos, G.Gilles Barthe, C.Chitchanok Chuengsatiansup, B.Benjamin Grégoire, V.Vincent Laporte, T.Tiago Oliveira, P.Peter Schwabe, Y.Yuval Yarom and Z.Zhiyuan Zhang. Protecting cryptographic code against Spectre-RSB (and, in fact, all known Spectre variants).July 2024HAL