A Relational Logic for Higher-Order Programs Alejandro Aguirre 1 - PowerPoint PPT Presentation

A Relational Logic for Higher-Order Programs Alejandro Aguirre 1 Gilles Barthe 1 Marco Gaboardi 2 Deepak Garg 3 Pierre-Yves Strub 4 ICFP, Sep 5 2017 1 Imdea Software; 2 University at Buffalo, SUNY; 3 MPI-SWS; 4 École Polytechnique 1

Relational properties a.k.a. 2-properties (I) Two runs of two programs, e.g. equivalence... 2

Relational properties a.k.a. 2-properties (II) ...or two runs of the same program, e.g. non-interference 3

Relational refinement types (I) Refinement types extend types with logical properties: Γ ⊢ t : { x : N | ∃ z . x = 2 ∗ z } Relational refinement types 1 generalize them to a relational setting: Γ ⊢ t 1 ∼ t 2 : { x : N | x 1 = x 2 } 1Gilles Barthe, Cédric Fournet, Benjamin Grégoire, Pierre-Yves Strub, Nikhil Swamy, and Santiago Zanella Béguelin. Probabilistic relational verification for cryptographic implementations (POPL ’14) 4

Relational refinement types (II) Pros: • Very intuitive (e.g. { x : N | x 1 ≤ x 2 } → { y : N | y 1 ≤ y 2 } types monotonic functions) • Syntax directed • Exploit structural similarities if b then 2 ∗ x else x +1 ∼ if b then 2 ∗ x else x − 1 • Lots of theoretical and practical developments for unary refinements could be reused 5

Limits of RRT We want to prove: take n ( map f l ) = map f ( take n l ) 6

Limits of RRT We want to prove: take n ( map f l ) = map f ( take n l ) Which type to give it? take n ( map f l ) ∼ map f ( take n l ) : { x : list N | x 1 = x 2 } 6

Limits of RRT We want to prove: take n ( map f l ) = map f ( take n l ) Which type to give it? take n ( map f l ) ∼ map f ( take n l ) : { x : list N | x 1 = x 2 } We apply [APP] rule... take ∼ map : { x :? | ? } 6

Our contributions • A foundational system to prove relational properties • in a syntax directed way • not restricted by types or structure 7

Base logic: HOL • λ -terms over simple + inductive types • (Axiomatically defined) Predicates: P ( t 1 , . . . , t n ) ∀ l . prefix ([] , l ) ∀ xtl . prefix ( t , l ) ⇒ prefix ( x :: t , x :: l ) • Propositional connectives: ∧ , ∨ , ⇒ • Quantification over simple/inductive types: ∀ ( x : τ ), ∃ ( x : τ ) 8

Base logic: HOL • λ -terms over simple + inductive types • (Axiomatically defined) Predicates: P ( t 1 , . . . , t n ) ∀ l . prefix ([] , l ) ∀ xtl . prefix ( t , l ) ⇒ prefix ( x :: t , x :: l ) • Propositional connectives: ∧ , ∨ , ⇒ • Quantification over simple/inductive types: ∀ ( x : τ ), ∃ ( x : τ ) Why not just use this? 8

Base logic: HOL • λ -terms over simple + inductive types • (Axiomatically defined) Predicates: P ( t 1 , . . . , t n ) ∀ l . prefix ([] , l ) ∀ xtl . prefix ( t , l ) ⇒ prefix ( x :: t , x :: l ) • Propositional connectives: ∧ , ∨ , ⇒ • Quantification over simple/inductive types: ∀ ( x : τ ), ∃ ( x : τ ) Why not just use this? No syntax directedness or structural reasoning 8

Relational HOL Judgements combine types and logic : Assertions over Γ Γ | Ψ ⊢ φ HOL: Context Predicate UHOL: Γ | Ψ ⊢ t 1 : τ 1 | φ ( r ) Term Predicate RHOL: Γ | Ψ ⊢ t 1 : τ 1 ∼ t 2 : τ 2 | φ ( r 1 , r 2 ) 1st term 2nd term Predicate 9

Relational HOL Judgements combine types and logic : Assertions over Γ Γ | Ψ ⊢ φ HOL: Context Predicate UHOL: Γ | Ψ ⊢ t 1 : τ 1 | φ ( r ) Term Predicate RHOL: Γ | Ψ ⊢ t 1 : τ 1 ∼ t 2 : τ 2 | φ ( r 1 , r 2 ) 1st term 2nd term Predicate 9

Relational HOL Judgements combine types and logic : Assertions over Γ Γ | Ψ ⊢ φ HOL: Context Predicate UHOL: Γ | Ψ ⊢ t 1 : τ 1 | φ ( r ) Term Predicate RHOL: Γ | Ψ ⊢ t 1 : τ 1 ∼ t 2 : τ 2 | φ ( r 1 , r 2 ) 1st term 2nd term Predicate 9

Relational HOL Judgements combine types and logic : Assertions over Γ Γ | Ψ ⊢ φ HOL: Context Predicate UHOL: Γ | Ψ ⊢ t 1 : τ 1 | φ ( r ) Term Predicate RHOL: Γ | Ψ ⊢ t 1 : τ 1 ∼ t 2 : τ 2 | φ ( r 1 , r 2 ) 1st term 2nd term Predicate 9

Relational HOL Judgements combine types and logic : Assertions over Γ Γ | Ψ ⊢ φ HOL: Context Predicate UHOL: Γ | Ψ ⊢ t 1 : τ 1 | φ ( r ) Term Predicate RHOL: Γ | Ψ ⊢ t 1 : τ 1 ∼ t 2 : τ 2 | φ ( r 1 , r 2 ) 1st term 2nd term Predicate 9

Relational HOL Judgements combine types and logic : Assertions over Γ Γ | Ψ ⊢ φ HOL: Context Predicate UHOL: Γ | Ψ ⊢ t 1 : τ 1 | φ ( r ) Term Predicate RHOL: Γ | Ψ ⊢ t 1 : τ 1 ∼ t 2 : τ 2 | φ ( r 1 , r 2 ) 1st term 2nd term Predicate 9

Relational HOL Judgements combine types and logic : Assertions over Γ Γ | Ψ ⊢ φ HOL: Context Predicate UHOL: Γ | Ψ ⊢ t 1 : τ 1 | φ ( r ) Term Predicate RHOL: Γ | Ψ ⊢ t 1 : τ 1 ∼ t 2 : τ 2 | φ ( r 1 , r 2 ) 1st term 2nd term Predicate 9

Relational HOL Judgements combine types and logic : Assertions over Γ Γ | Ψ ⊢ φ HOL: Context Predicate UHOL: Γ | Ψ ⊢ t 1 : τ 1 | φ ( r ) Term Predicate RHOL: Γ | Ψ ⊢ t 1 : τ 1 ∼ t 2 : τ 2 | φ ( r 1 , r 2 ) 1st term 2nd term Predicate 9

Relational HOL Judgements combine types and logic : Assertions over Γ Γ | Ψ ⊢ φ HOL: Context Predicate UHOL: Γ | Ψ ⊢ t 1 : τ 1 | φ ( r ) Term Predicate RHOL: Γ | Ψ ⊢ t 1 : τ 1 ∼ t 2 : τ 2 | φ ( r 1 , r 2 ) 1st term 2nd term Predicate 9

Refinement types vs RHOL Key Idea : separation of concerns between types and assertions • Unary ⊢ t : { x : τ | φ ( x ) } − → t : τ | φ ( r ) • Relational t 1 ∼ t 2 : { x : τ | φ ( x 1 , x 2 ) } − → t 1 : τ ∼ t 2 : τ | φ ( r 1 , r 2 ) 10

Two-sided and one-sided rules Two-sided rules relate two terms with the same top term former λ x 1 . t 1 ∼ λ x 2 . t 2 One-sided rules relate two terms with different top term former λ x 1 . t 1 ∼ t 2 u 2 11

Two-sided rules Judgements combine types and logic : Abstraction Γ , x 1 : τ 1 , x 2 : τ 2 | Ψ , φ ′ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | φ Γ | Ψ ⊢ λ x 1 . t 1 : τ 1 → σ 1 ∼ λ x 2 . t 2 : τ 2 → σ 2 | ∀ x 1 , x 2 .φ ′ ⇒ φ [ r 1 x 1 / r 1 ][ r 2 x 2 / r 2 ] 12

Two-sided rules Judgements combine types and logic : Abstraction Γ , x 1 : τ 1 , x 2 : τ 2 | Ψ , φ ′ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | φ Γ | Ψ ⊢ λ x 1 . t 1 : τ 1 → σ 1 ∼ λ x 2 . t 2 : τ 2 → σ 2 | ∀ x 1 , x 2 .φ ′ ⇒ φ [ r 1 x 1 / r 1 ][ r 2 x 2 / r 2 ] 12

Two-sided rules Judgements combine types and logic : Abstraction Γ , x 1 : τ 1 , x 2 : τ 2 | Ψ , φ ′ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | φ Γ | Ψ ⊢ λ x 1 . t 1 : τ 1 → σ 1 ∼ λ x 2 . t 2 : τ 2 → σ 2 | ∀ x 1 , x 2 .φ ′ ⇒ φ [ r 1 x 1 / r 1 ][ r 2 x 2 / r 2 ] 12

Two-sided rules Judgements combine types and logic : Abstraction Γ , x 1 : τ 1 , x 2 : τ 2 | Ψ , φ ′ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | φ Γ | Ψ ⊢ λ x 1 . t 1 : τ 1 → σ 1 ∼ λ x 2 . t 2 : τ 2 → σ 2 | ∀ x 1 , x 2 .φ ′ ⇒ φ [ r 1 x 1 / r 1 ][ r 2 x 2 / r 2 ] 12

Two-sided rules Judgements combine types and logic : Abstraction Γ , x 1 : τ 1 , x 2 : τ 2 | Ψ , φ ′ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | φ Γ | Ψ ⊢ λ x 1 . t 1 : τ 1 → σ 1 ∼ λ x 2 . t 2 : τ 2 → σ 2 | ∀ x 1 , x 2 .φ ′ ⇒ φ [ r 1 x 1 / r 1 ][ r 2 x 2 / r 2 ] Application Γ | Ψ ⊢ t 1 : τ 1 → σ 1 ∼ t 2 : τ 2 → σ 2 | ∀ x 1 , x 2 .φ ′ [ x 1 / r 1 ][ x 2 / r 2 ] ⇒ φ [ r 1 x 1 / r 1 ][ r 2 x 2 / r 2 ] Γ | Ψ ⊢ u 1 : τ 1 ∼ u 2 : τ 2 | φ ′ Γ | Ψ ⊢ t 1 u 1 : σ 1 ∼ t 2 u 2 : σ 2 | φ [ u 1 / x 1 ][ u 2 / x 2 ] 12

One-sided rules Abstraction Γ , x 1 : τ 1 | Ψ , φ ′ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | φ Γ | Ψ ⊢ λ x 1 . t 1 : τ 1 → σ 1 ∼ t 2 : σ 2 | ∀ x 1 .φ ′ ⇒ φ [ r 1 x 1 / r 1 ] Application Γ | Ψ ⊢ t 1 : τ 1 → σ 1 ∼ u 2 : σ 2 | ∀ x 1 .φ ′ [ x 1 / r 1 ] ⇒ φ [ r 1 x 1 / r 1 ] Γ | Ψ ⊢ u 1 : σ 1 | φ ′ Γ | Ψ ⊢ t 1 u 1 : σ 1 ∼ u 2 : σ 2 | φ [ u 1 / x 1 ] 13

One-sided rules Abstraction Γ , x 1 : τ 1 | Ψ , φ ′ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | φ Γ | Ψ ⊢ λ x 1 . t 1 : τ 1 → σ 1 ∼ t 2 : σ 2 | ∀ x 1 .φ ′ ⇒ φ [ r 1 x 1 / r 1 ] Application Γ | Ψ ⊢ t 1 : τ 1 → σ 1 ∼ u 2 : σ 2 | ∀ x 1 .φ ′ [ x 1 / r 1 ] ⇒ φ [ r 1 x 1 / r 1 ] Γ | Ψ ⊢ u 1 : σ 1 | φ ′ Γ | Ψ ⊢ t 1 u 1 : σ 1 ∼ u 2 : σ 2 | φ [ u 1 / x 1 ] 13

One-sided rules Abstraction Γ , x 1 : τ 1 | Ψ , φ ′ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | φ Γ | Ψ ⊢ λ x 1 . t 1 : τ 1 → σ 1 ∼ t 2 : σ 2 | ∀ x 1 .φ ′ ⇒ φ [ r 1 x 1 / r 1 ] Application Γ | Ψ ⊢ t 1 : τ 1 → σ 1 ∼ u 2 : σ 2 | ∀ x 1 .φ ′ [ x 1 / r 1 ] ⇒ φ [ r 1 x 1 / r 1 ] Γ | Ψ ⊢ u 1 : σ 1 | φ ′ Γ | Ψ ⊢ t 1 u 1 : σ 1 ∼ u 2 : σ 2 | φ [ u 1 / x 1 ] 13

One-sided rules Abstraction Γ , x 1 : τ 1 | Ψ , φ ′ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | φ Γ | Ψ ⊢ λ x 1 . t 1 : τ 1 → σ 1 ∼ t 2 : σ 2 | ∀ x 1 .φ ′ ⇒ φ [ r 1 x 1 / r 1 ] Application Γ | Ψ ⊢ t 1 : τ 1 → σ 1 ∼ u 2 : σ 2 | ∀ x 1 .φ ′ [ x 1 / r 1 ] ⇒ φ [ r 1 x 1 / r 1 ] Γ | Ψ ⊢ u 1 : σ 1 | φ ′ Γ | Ψ ⊢ t 1 u 1 : σ 1 ∼ u 2 : σ 2 | φ [ u 1 / x 1 ] 13

The SUB rule Allows us to fall back to HOL: Γ | Ψ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | φ ′ Γ | Ψ ⊢ HOL φ ′ [ t 1 / r 1 ][ t 2 / r 2 ] ⇒ φ [ t 1 / r 1 ][ t 2 / r 2 ] Γ | Ψ ⊢ t 1 : σ 1 ∼ t 2 : σ 2 | φ 14