Gemplus electronic purse JavaCard applet that runs on JavaCard - PDF document

Gemplus electronic purse • JavaCard applet that runs on JavaCard smart cards. Specifying and Verifying an • Debit and credit operations on a global example: balance. • Secured communication and a decimal representation in Java authentication. for smart cards • Loyalty support. 2 Cees-Bart Breunesse Representing the balance by a Decimal object Issues of the Decimal class • No floating point numbers in • Negative numbers? € 1,098 JavaCard. • Object invariant: • intPart and decPart are -PRECISION < decPart shorts. && decPart < PRECISION • decPart has a precision of • Specified and verified all but two methods of the 3 digits. Decimal class (4/26). • Precision is expressed by intPart = 1 • Also specified/verified: DecimalException (2/1). the final short PRECISION decPart = 98 oppose setValue • Redundant code? which has value 1000. • Gemplus code is not changed, but verified as is. add sub mul 3 4 Specification + Verification Specification + Verification Java source code translated Java + + //@ invariant –PRECISION < decPart JML annotations proof obligations && decPart < PRECISION PVS /*@normal_behavior Loop Q.E.D? theorem prover @ requires true; @ modifiable intPart, decPart; @ ensures intPart == -\old(intPart) @ && decPart == -\old(decPart); @*/ Decimal oppose() Java semantics { intPart = -intPart; Verification is done by applying Hoare rules. decPart = -decPart; return this; Advantage: stepwise refinement of proofs. } 5 6

A member of Decimal: public add A member of Decimal: private add public void add(Decimal d) private void add(short e, short f) { { intPart += e; .. add(d.intPart, d.decPart); decPart += f; .. } .. make decPart obey its boundaries .. • Public method add is defined by a private helper } function on the integer and decimal parts of • Private add method is simplified. argument d . • Extra checks make execution of the code faster/more efficient. • Consequence: less readable code. • Reason for choosing method add in this talk: its code is complex, its specification is clear. 7 8 Private method add How to specify add? private void add(short e, short f) { € 1,098 intPart += e; decPart += f; short retenue = 0; short signe = 1; if ( decPart < 0 ) { intPart = 1 intPart = 2 signe = -1; decPart = 98 decPart = -902 oppose oppose setValue setValue decPart = -decPart; } add add sub sub mul mul retenue = decPart / PRECISION; decPart = decPart % PRECISION; retenue *= signe; decPart *= signe; intPart * PRECISION + decPart = 1098 intPart += retenue; } 9 10 Specification of add Verification of add /*@ normal_behavior @ requires f < PRECISION && f > -PRECISION; Assertions Code @ modifiable intPart, decPart; void add(short e, short f) { @ ensures ( \old(intPart) + e)*PRECISION + \old(decPart) + f intPart += e; @ == intPart*PRECISION + decPart; @*/ decPart decPart += f; private add(short e, short f) == (\old(intPart) + e) { .. } * PRECISION .. make decPart obey its + \old(decPart) + f boundaries .. - intPart * PRECISION Complex and obscure method source code } Short and clear method specification 11 12

Verification of add Verification of add Assertions Code Assertions Code void add(short e, short f) { short retenue = 0; intPart += e; short signe = 1; decPart decPart += f; if ( decPart < 0 ) { == (\old(intPart) + e) signe = -1; * PRECISION .. make decPart obey its decPart = -decPart; + \old(decPart) + f boundaries .. } - intPart * PRECISION decPart == signe * } retenue = decPart / PRECISION; ((\old(intPart) + e) decPart = decPart % PRECISION; –PRECISION < decPart * PRECISION retenue *= signe; && decPart < PRECISION + \old(decPart) + f decPart *= signe; - intPart * PRECISION) intPart += retenue; } 13 14 Verification of add Verification of add Assertions Code Assertions Code short retenue = 0; short retenue = 0; short signe = 1; short signe = 1; if ( decPart < 0 ) { if ( decPart < 0 ) { signe = -1; signe = -1; decPart = -decPart; decPart = -decPart; retenue * PRECISION retenue * PRECISION } } + decPart % PRECISION + decPart == signe * == signe * retenue = decPart / PRECISION; retenue = decPart / PRECISION; ((\old(intPart) + e) ((\old(intPart) + e) decPart = decPart % PRECISION; decPart = decPart % PRECISION; * PRECISION * PRECISION retenue *= signe; retenue *= signe; + \old(decPart) + f + \old(decPart) + f decPart *= signe; decPart *= signe; - intPart * PRECISION) - intPart * PRECISION) intPart += retenue; intPart += retenue; } } 15 16 Verification of add Verification of add Assertions Code Assertions Code short retenue = 0; short retenue = 0; short signe = 1; short signe = 1; –PRECISION < decPart && decPart < PRECISION if ( decPart < 0 ) { if ( decPart < 0 ) { signe = -1; signe = -1; decPart = -decPart; decPart = -decPart; retenue * PRECISION retenue * PRECISION } } + decPart + decPart * signe == signe * == (\old(intPart) + e) retenue = decPart / PRECISION; retenue = decPart / PRECISION; ((\old(intPart) + e) * PRECISION decPart = decPart % PRECISION; decPart = decPart % PRECISION; * PRECISION + \old(decPart) + f retenue *= signe; retenue *= signe; + \old(decPart) + f - intPart * PRECISION decPart *= signe; decPart *= signe; - intPart * PRECISION) intPart += retenue; intPart += retenue; } } 17 18

Verification of add Verification of add Assertions Code Assertions Code short retenue = 0; short retenue = 0; short signe = 1; short signe = 1; if ( decPart < 0 ) { if ( decPart < 0 ) { signe = -1; signe = -1; decPart = -decPart; decPart = -decPart; retenue * PRECISION } } + decPart decPart == (\old(intPart) + e) == (\old(intPart) + e) retenue = decPart / PRECISION; retenue = decPart / PRECISION; * PRECISION * PRECISION decPart = decPart % PRECISION; decPart = decPart % PRECISION; + \old(decPart) + f + \old(decPart) + f retenue *= signe; retenue *= signe; - intPart * PRECISION - intPart * PRECISION decPart *= signe; decPart *= signe; intPart += retenue; intPart += retenue; } } 19 20 Verification of add Verification of add private void add(short e, short f){ intPart += e; if ( intPart > 0 && decPart < 0 ) { Assertions Code intPart--; decPart = (short) (decPart + PRECISION); } short retenue = 0; else if ( intPart < 0 && decPart > 0 ){ intPart++; short signe = 1; decPart =(short) ( decPart - PRECISION); } if ( decPart < 0 ) { decPart += f; signe = -1; if ( intPart > 0 && decPart < 0 ) { intPart--; decPart = -decPart; decPart = (short) (decPart + PRECISION); } } else if ( intPart < 0 && decPart > 0 ){ decPart - intPart * PRECISION intPart++; decPart = (short) (decPart - PRECISION); == (\old(intPart) + e) retenue = decPart / PRECISION; } else { * PRECISION decPart = decPart % PRECISION; short retenue = (short) 0; + \old(decPart) + f retenue *= signe; short signe = 1; if ( decPart < 0 ) { decPart *= signe; signe = (short) -1; decPart = (short) -decPart ; intPart += retenue; } } retenue = (short) (decPart / PRECISION); decPart = (short) (decPart % PRECISION); retenue *= signe ; decPart *= signe ; 21 22 intPart += retenue ; } } Verification of an erroneous method Verification of an erroneous method public Decimal round(){ short aux = decPart; • Consider the round method in Decimal. if ( aux < 0 ) aux = -aux; while ( aux > 10 ) aux /= 10; • The semantics for round is clear: return the if ( aux > 5 ) { nearest integer. if ( decPart > 0 ) intPart++; else intPart--; } decPart = 0; 6,009 � 6,0 6,060 � 6,0 return this; 6,501 � 7,0 } Unfortunately, Gemplus’ implementation is incorrect for inputs w here the absolute value of decPart is within 6-10, 60-100, 501-599. 6,009 � 7,0 6,060 � 7,0 6,501 � 6,0 23 24

Conclusions ESC/Java vs. LOOP ESC/Java: • Specified and verified all but two members of the Decimal class. • Errors caused by null references, out-of-bounds array access, type casts. • Automatic checking. • Formal verification is justified in critical applications. • The LOOP verification technology is ready for LOOP: such non-trivial examples. • More aimed at functional program verification. • It needs user interaction. • Software developers like Gemplus should annotate their code with assertions. • Related work: ESC/Java. ensures intPart == \old(decPart) >= PRECISION/2 ? (\old(intPart) + 1) : \old(intPart) && decPart == 0; 25 26