Newest papers

Blame-aware Recomposition for Secure Compilation Proofs of Low-Level Compartment Isolation

Basile Schlosser, Jérémy Thibault, Cătălin Hriţcu · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.26054 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

Las garantías de seguridad de los compiladores oficialmente verificados existentes para programas compartimentados en lenguajes inseguros como C se detienen en un nivel bastante alto, asumiendo un mecanismo de protección integrado y un modelo de memoria basado en bloques. Verificar un mecanismo de ejecución concreto de bajo nivel para el aislamiento de compartimentos sigue siendo un gran desafío para las técnicas de prueba actuales. En particular, la técnica de prueba de Abate et al. fracasa porque uno de sus pasos de prueba, la recomposición, esencialmente requiere ocultar toda la información sobre el código de cada compartimento, lo que no es prácticamente posible en un nivel bajo. Proponemos una extensión de su técnica de prueba a una configuración de bajo nivel donde los compartimentos pueden observar completamente el código del otro. Para ello, introducimos una semántica de superposición que nos

Machine translation (Meta M2M100); the English original follows.

Abstract

The security guarantees of existing formally verified compilers for compartmentalized programs in unsafe languages like C stop at a rather high level, assuming a built-in protection mechanism and a block-based memory model. Verifying a concrete, low-level enforcement mechanism for compartment isolation is still a major challenge for current proof techniques. In particular, Abate et al.'s proof technique fails because one of their proof steps, recomposition, essentially requires hiding all information about the code of each compartment, which is not practically achievable at a low level. We propose an extension of their proof technique to a low-level setting where compartments can fully observe each other's code. To do so, we introduce an overlay semantics that allows us to characterize these observations as a form of undefined behaviour, and we use a novel variant of recomposition that we call blame-aware recomposition, which essentially allows recomposing executions as needed in the original high-level proof technique, even if the low-level context observes the code, because this context is ultimately going to be discarded. We apply this new proof to a compartment isolation mechanism that uses a programmable tag-based reference monitor.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Mathematical proof, Computer science, Context (archaeology), Isolation (microbiology), Operational semantics, Programming language

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange