abstract: 'An Air Force evaluation of Multics, and Ken Thompson''s Turing award lecture

  ("Reflections on Trusting Trust"), showed that compilers can be subverted to

  insert malicious Trojan horses into critical software, including themselves. If

  this "trusting trust" attack goes undetected, even complete analysis of a

  system''s source code will not find the malicious code that is running.

  Previously-known countermeasures have been grossly inadequate. If this attack

  cannot be countered, attackers can quietly subvert entire classes of computer

  systems, gaining complete control over financial, infrastructure, military,

  and/or business systems worldwide. This dissertation''s thesis is that the

  trusting trust attack can be detected and effectively countered using the

  "Diverse Double-Compiling" (DDC) technique, as demonstrated by (1) a formal

  proof that DDC can determine if source code and generated executable code

  correspond, (2) a demonstration of DDC with four compilers (a small C compiler,

  a small Lisp compiler, a small maliciously corrupted Lisp compiler, and a large

  industrial-strength C compiler, GCC), and (3) a description of approaches for

  applying DDC in various real-world scenarios. In the DDC technique, source code

  is compiled twice: the source code of the compiler''s parent is compiled using a

  trusted compiler, and then the putative compiler source code is compiled using

  the result of the first compilation. If the DDC result is bit-for-bit identical

  with the original compiler-under-test''s executable, and certain other

  assumptions hold, then the compiler-under-test''s executable corresponds with

  its putative source code.'
archiveprefix: arXiv
author: David A. Wheeler
eprint: 1004.5534v1
file: 1004.5534v1.pdf
files:
- tmpzzzw9zoz.pdf
month: Apr
primaryclass: cs.CR
ref: 1004.5534v1
tags: master
title: Fully Countering Trusting Trust through Diverse Double-Compiling
type: article
url: http://arxiv.org/abs/1004.5534v1
year: '2010'
