<story><title>Cryptic Rumblings Ahead of First 2020 Patch Tuesday</title><url>https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/</url></story><parent_chain><item><author>computator</author><text>It&amp;#x27;s a shame that mathematically proving correctness of code, &lt;i&gt;even for extremely important code&lt;/i&gt;, is never done.&lt;p&gt;I wonder how many lines of code in crypt32.dll. Is it on the order of 7500 lines? If Microsoft spent a few man-years mathematically proving the correctness of that code, they could have the saved the world about 10,000 man-years.&lt;p&gt;Windows has a user base of 1 billion[1]. A ballpark figure for proving the correctness of 7500 lines of very complex code[2] is about 30 man years[3]. If even 1% of the 1 billion Windows users and sysadmins has to spend a couple hours on things related to this patch, it works out to 9615 man-years of worldwide waste (based on an 8 hour workday and 260 workdays a year).&lt;p&gt;Had there been a wide-spread exploit, it could have cost the world millions of man-years.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Usage_share_of_operating_systems&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Usage_share_of_operating_syste...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.schneier.com&amp;#x2F;blog&amp;#x2F;archives&amp;#x2F;2009&amp;#x2F;10&amp;#x2F;proving_a_compu.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.schneier.com&amp;#x2F;blog&amp;#x2F;archives&amp;#x2F;2009&amp;#x2F;10&amp;#x2F;proving_a_com...&lt;/a&gt;&lt;p&gt;[3] Professor Gernot Heiser, the John Lions Chair in Computer Science in the School of Computer Science and Engineering and a senior principal researcher with NICTA, said for the first time a team had been able to prove with mathematical rigour that an operating-system kernel—the code at the heart of any computer or microprocessor—was 100 per cent bug-free and therefore immune to crashes and failures. Verifying the kernel—known as the seL4 microkernel—involved mathematically proving the correctness of about 7,500 lines of computer code in a project taking an average of six people more than five years.</text></item></parent_chain><comment><author>AnimalMuppet</author><text>Define &amp;quot;proving correctness&amp;quot;.  Proving that it does what it&amp;#x27;s supposed to?  You need a formal spec as the starting point for that; how do you prove that the formal spec correctly describes what the software&amp;#x27;s supposed to do?&lt;p&gt;Proving that it has no bugs?  That only works for the kinds of bugs covered by the proof.  Your proof that it has no null pointer crashes tells us nothing about whether it has off-by-one errors.  For each kind of bug, you need a different proof.  Did your proof cover &lt;i&gt;every&lt;/i&gt; category of bug?  Almost certainly not.  So strong claims like &amp;quot;100 per cent bug free&amp;quot; are almost certainly overstating things, no matter the credentials of the person making them.  &amp;quot;100 per cent bug free &lt;i&gt;for the categories of bugs we proved&lt;/i&gt;&amp;quot;?  OK, but that&amp;#x27;s a significantly weaker claim.&lt;p&gt;For the 7500 lines (or however many) in crypt32.dll, you want to prove that there are no security attacks of any category possible.  That becomes a harder and harder job as we keep discovering new categories of security attacks.</text></comment>
<story><title>Cryptic Rumblings Ahead of First 2020 Patch Tuesday</title><url>https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/</url></story><parent_chain><item><author>computator</author><text>It&amp;#x27;s a shame that mathematically proving correctness of code, &lt;i&gt;even for extremely important code&lt;/i&gt;, is never done.&lt;p&gt;I wonder how many lines of code in crypt32.dll. Is it on the order of 7500 lines? If Microsoft spent a few man-years mathematically proving the correctness of that code, they could have the saved the world about 10,000 man-years.&lt;p&gt;Windows has a user base of 1 billion[1]. A ballpark figure for proving the correctness of 7500 lines of very complex code[2] is about 30 man years[3]. If even 1% of the 1 billion Windows users and sysadmins has to spend a couple hours on things related to this patch, it works out to 9615 man-years of worldwide waste (based on an 8 hour workday and 260 workdays a year).&lt;p&gt;Had there been a wide-spread exploit, it could have cost the world millions of man-years.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Usage_share_of_operating_systems&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Usage_share_of_operating_syste...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.schneier.com&amp;#x2F;blog&amp;#x2F;archives&amp;#x2F;2009&amp;#x2F;10&amp;#x2F;proving_a_compu.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.schneier.com&amp;#x2F;blog&amp;#x2F;archives&amp;#x2F;2009&amp;#x2F;10&amp;#x2F;proving_a_com...&lt;/a&gt;&lt;p&gt;[3] Professor Gernot Heiser, the John Lions Chair in Computer Science in the School of Computer Science and Engineering and a senior principal researcher with NICTA, said for the first time a team had been able to prove with mathematical rigour that an operating-system kernel—the code at the heart of any computer or microprocessor—was 100 per cent bug-free and therefore immune to crashes and failures. Verifying the kernel—known as the seL4 microkernel—involved mathematically proving the correctness of about 7,500 lines of computer code in a project taking an average of six people more than five years.</text></item></parent_chain><comment><author>bouncycastle</author><text>Note that even if you prove correctness of code, there still might be bugs in the compiler, so you will have to prove the compiler. Then there could be bugs in the modules &amp;#x2F; DLLs &amp;#x2F; dependencies in the OS, so more proving needs to be done. Then there might be bugs in the CPU. So it&amp;#x27;s not so easy. T&lt;p&gt;hen there are things which you simply can&amp;#x27;t prove, eg. In crypto the code may be correct, yet it may still leak some side-channel information (such as timing). Also, nobody has proven that things like sha256 and so on are unbreakable.</text></comment>