Transcript Lecture 14: Mocking Mockingbirds God created the integers – all else is the result of man. Leopold Kronecker God created application – all else is.

Lecture 14:
Mocking
Mockingbirds
God created the integers – all else is the result of man.
Leopold Kronecker
God created application – all else is the result of man.
Alonzo Church (not really)
Start filling out survey.
CS655: Programming Languages
David Evans
University of Virginia
http://www.cs.virginia.edu/~evans
Computer Science
Menu
• Midterm Survey
• Is Proof-Carrying Code Useful?
– My INFOSEC Malicious Code Talk
• Intro to Lambda Calculus
7 November 2015
University of Virginia CS 655
2
Is Proof-Carrying
Code Useful?
Visit www.cedillasys.com
7 November 2015
University of Virginia CS 655
3
Let’s Stop Beating
Dead Horses, and Start
Beating Trojan Horses!
David Evans
www.cs.virginia.edu/~evans/
INFOSEC Malicious Code Workshop
San Antonio, 13 January 2000
University of Virginia
Department of Computer Science
Charlottesville, VA
Analogy: Security
• Cryptography
– Fun to do research in, lots of cool math problems,
opportunities to dazzle people with your brilliance,
etc.
• But, 99.9999% of break ins do not involve
attack on sensible cryptography
– Guessing passwords and stealing keys
– Back doors, buffer overflows
– Ignorant implementers choosing bad cryptography
[Netscape Navigator Mail]
13 January 2000
INFOSEC Malicious Code
5
Structure of Argument
Low-level code safety
(isolation) is the wrong focus
Agree
Disagree
PCC is not a
realistic solution for
the real problems
in the foreseeable
future
PCC is not the
most promising
solution for lowlevel code safety
Lots of useful research and results coming from PCC,
but realistic solution to malicious code won’t be one of them.
13 January 2000
INFOSEC Malicious Code
6
Low-level code safety
• Type safety, memory safety, control flow
safety [Kozen98]
• All high-level code safety depends on it
• Many known pretty good solutions: separate
processes, SFI, interpreter
• Very few real attacks exploit low-level code
safety vulnerabilities
– One exception: buffer overflows
• Many known solutions to this
• Just need to sue vendors to get them
implemented
13 January 2000
INFOSEC Malicious Code
7
High-Level Code Safety
• Enforcement is (embarrassingly) easy
– Reference monitors (since 1970s)
– Can enforce most useful policies [Schneider98]
– Performance penalty is small
• Writing good policies is the hard part
–
–
–
–
Better ways to define policies
Ways to reason about properties of policies
Ideas for the right policies for different scenarios
Ways to develop, reason about, and test
distributed policies
13 January 2000
INFOSEC Malicious Code
8
Proofs
Reference Monitors
All possible executions
Current execution so far
No run-time costs
Monitoring and calling
overhead
Checking integrated
into code
Checking separate
from code
Excruciatingly difficult
Trivially easy
Vendor sets policy
Consumer sets policy
13 January 2000
INFOSEC Malicious Code
9
Fortune Cookie
“That which must
can be proved cannot be
worth much.”
Fortune cookie quoted on Peter’s web page
• True for all users
• True for all executions
• Exception: Low-level code safety
13 January 2000
INFOSEC Malicious Code
10
Reasons you might prefer PCC
• Run-time performance?
– Amortizes additional download and verification
time only rarely
– SFI Performance penalty: ~5%
• If you care, pay $20 more for a better processor or wait 5
weeks
• Smaller TCB?
– Not really smaller: twice as big as SFI (Touchstone
VCGen+checker – 8300 lines / MisFiT x86 SFI
implementation – 4500 lines)
• You are a vendor who cares more about
quality than time to market (not really PCC)
13 January 2000
INFOSEC Malicious Code
11
Lambda Calculus
Developed by Alonzo Church [1940]
7 November 2015
University of Virginia CS 655
12
-calculus
term = variable |  term | term term
same as:  = x |   |  
Evaluation rule:
-reduction
(substitution)
(x. M)N   M [ x := N]
Substitute N for x in M.
7 November 2015
University of Virginia CS 655
13
Some Simple Functions
I  x.x
C  xy.yx
Abbreviation for x.(y. yx)
CII = (x.(y. yx)) (x.x) (x.x)
  (y. y (x.x)) (x.x)
  x.x (x.x)
  x.x
=I
7 November 2015
University of Virginia CS 655
14
Text-Substitution Problem
• Hard to keep all the x’s in x.(y. yx))
(x.x) (x.x) straight
• Smullyan/Keenan solve this by
abandoning text representation and
using pictures (Mockingbird paper)
• Traditional solution: rename before
substitution
7 November 2015
University of Virginia CS 655
15
Mystery Function
p  xy.  pca.pca (x.x xy.x) x) y
(p ((x.x xy.y) x) (x. z.z (xy.y) y)
m  xy.  pca.pca (x.x xy.x) x) x.x
(p y (m ((x.x xy.y) x) y))
f  x.
 pca.pca
((x.xxxy.x)
if
= 0 x)
(z.z (xy.y)
1 (x.x))
(m x (f x((x.x
* f (x xy.y)
– 1) x)))
7 November 2015
University of Virginia CS 655
16
Some Interesting Functions
T  xy. x
F  xy. y
if  pca . pca
Evaluate: if T M N
((pca . pca) (xy. x)) M N
 (ca . (x.(y. x)) ca)) M N
   (x.(y. x)) M N
 (y. M )) N   M
and  xy. if x y F
or  xy. if x T y
7 November 2015
University of Virginia CS 655
17
Coupling
[M, N]  z.z M N
first  p.p T
second  p.p F
first [M, N]
= p.p T (z.z M N)   (z.z M N) T
= (z.z M N) xy. x   (xy. x) M N   M
7 November 2015
University of Virginia CS 655
18
Tupling
n-tuple:
[M] = M
[M0,..., Mn-1, Mn] = [M0, [M1 ,..., [Mn-1, Mn ]... ]
n-tuple direct:
[M0,..., Mn-1, Mn] = z.z M0,..., Mn-1, Mn
Pi,n = x.x Ui,n
Ui,n = x0... xn. xi
What is P1,2?
7 November 2015
University of Virginia CS 655
19
Counting
0I
1  [F, I]
2  [F, [F, I]]
3  [F, [F [F, I]]
...
n + 1  [F, n]
7 November 2015
University of Virginia CS 655
20
Arithmetic
Zero?  x.x T
Zero? 0 = (x.x T) I = T
Zero? 1 = (x.x T) [F, I] = F
succ  x.[F, x]
pred  x.x F
pred 1 = (x.x F) [F, I] = [F, I]F = I = 0
pred 0 = (x.x F) I = IF = F
add  xy.if (Zero? x) y
(add (pred x) (succ y)
7 November 2015
University of Virginia CS 655
21
Factorial
mult 
xy. if (Zero? x) 0
(add y (mult (pred x) y))
fact 
x. if (Zero? x) 1
(mult x (fact (pred x)))
Recursive definition should make you uncomfortable.
After Spring Break – fixed points
7 November 2015
University of Virginia CS 655
22
Summary
• All you need is application and abstraction
and you can compute anything
• This is just one way of representing numbers,
booleans, etc. – many others are possible
• Integers, booleans, if, while, +, *, =, <,
subtyping, multiple inheritance, etc. are for
wimps! Real programmers only use .
7 November 2015
University of Virginia CS 655
23
Charge
• Go to Ion Stoica’s talk
– “Scalable Internet Services”, 3:30 today, this room
• Enjoy your Spring Break
• Make some real progress on your projects –
prepare to write March 23 Preliminary
Reports
• Mockingbird paper – describes -calculus
using pictoral representation
• Challenge (worth 1 position paper point)
– Keenan’s challenge: find a mapping that will give a
unique musical tune for most combinators (hear
the bird-songs)
7 November 2015
University of Virginia CS 655
24