rollback_car_attack_proverif

Rollback 攻击形式化验证 ProVerif 对汽车遥控钥匙上 Rollback 攻击的概念验证（CVE-2022-37418、CVE-2022-36945 和 CVE-2022-37305），详见1 免责声明 我与 1 的作者没有任何关联。感谢他们使其论文开放获取。 ProVerif 安装 官方方式 要运行 ProVerif 形式化验证 PoC，请先按照官方网站上的说明安装 ProVerif。 预编译二进制 另外，我预编译了适用于 amd64 架构 Linux 的静态二进制文件，可在仓库的发布页面获取，同时还有适用于 Windows 的可执行文件。...

trivysupplychainanalysis

マルチステージCI/CDサプライチェーン攻撃の定量分析 形式的に検証され、定量的に再構築された 2026年3月のTrivy / "TeamPCP" GitHub Actionsサプライチェーン侵害（CVE-2026-33634 ）— TLA+でモデル化し、TLCで網羅的にチェックし、PRISM確率モデル検査器で定量化。 論文内のすべての数値はこのリポジトリから再生成されます。 モデル、確率、コーパス測定、キャリブレーションはすべて、ソースから各レイヤーごとに単一のコマンドで再現可能です。 何が起こったか、そしてこれが何を証明するか 広く使われているAction（trivy-action ...

kernel-c-to-rust-spike

Kernel C-to-Rust hardening spike: UVC descriptor parser Can a security-critical Linux kernel C parser be hardened by rewriting it in Rust, with the rewrite shown equivalent to the original and then formally verified? This spike runs the full loop on one target: the UVC video descriptor parser...

CVE-2020-8835-verification

Formale Verifikation von CVE-2021-31440 Umgebung einrichten Linux-Header installieren: sudo apt install linux-headers-$uname -r coq-config installieren: pip install coq-config OPAM installieren: apt-get install opam Switch initialisieren: coq-config Zum neuen OPAM-Switch wechseln: opam switch...

formal_np1sec

Forschung zum Nachweis der Vertraulichkeit des Gruppenschlüssels im Gruppenschlüsselaustausch-Teil von n+1sec, mit bestimmten Einschränkungen wie nur 3 Teilnehmern. Diese Arbeit wurde von Alex Balducci und Andy Lee durchgeführt. Das Hauptdokument ist gkepnormxormsimplifiedwriteup.txt. Es enthält...

Aura-State

Aura-State Un framework Python per costruire workflow LLM come macchine a stati, con verifica formale integrata. root@kitploit: pip install git+https://github.com/munshi007/Aura-State.git Che cos'è La maggior parte dei framework LLM ti permettono di concatenare chiamate API e sperare per il megli...

maude-hcs

Maude-HCS Maude-HCS ist eine der ersten generalisierten und modularen Toolchains zur formalen Spezifikation und Analyse von Hidden Communication Systems HCS in realen Größenordnungen. Es ermöglicht Netzwerkdesignern, alternative HCS-Entwürfe schnell und effektiv zu erkunden und liefert formale...

Encrypted Neural Networks without Overflows

Fully homomorphic encryption FHE enables private inference by evaluating neural networks on encrypted data. In this way, we can delegate the computation to a third party server without ever revealing the user's data. Currently, the CKKS scheme is the backbone of most efficient FHE implementations...

Machine-Checked Cardinality Bounds for Masked Barrett Reduction: A 1-Bit Side-Channel Leakage Barrier in Post-Quantum Cryptographic Hardware

Barrett reduction is the nonlinear core of every practical NTT-based post-quantum cryptography implementation. Existing composition frameworks ISW, t-SNI, PINI, DOM address Boolean masking over GF2; none provides a machine-checked characterization of Barrett's leakage under first-order arithmetic...

Mythos and the Unverified Cage: Z3-Based Pre-Deployment Verification for Frontier-Model Sandbox Infrastructure

The April 2026 Claude Mythos sandbox escape exposed a critical weakness in frontier AI containment: the infrastructure surrounding advanced models remains susceptible to formally characterizable arithmetic vulnerabilities. Anthropic has not publicly characterized the escape vector; some secondary...

Broken by Default: A Formal Verification Study of Security Vulnerabilities in AI-Generated Code

AI coding assistants are now used to generate production code in security-sensitive domains, yet the exploitability of their outputs remains unquantified. We address this gap with Broken by Default: a formal verification study of 3,500 code artifacts generated by seven frontier LLMs across 500...

VulnScout-C: A Lightweight Transformer for C Code Vulnerability Detection

Vulnerability detection in C programs is a critical challenge in software security. Although large language models LLMs achieve strong detection performance, their multi-billion-parameter scale makes them impractical for integration into development workflows requiring low latency and continuous...

What a Mesh: Formal Security Analysis of WPA3 SAE Wireless Authentication

The latest Wi-Fi security standard, IEEE 802.11, includes a secure authentication protocol called SAE, whose use is mandatory for WPA3-Personal networks. The protocol is specified at two separate but linked levels: a traditional cryptographic description of the communication logic between network...

ATLAS: AI-Assisted Threat-To-Assertion Learning for System-On-Chip Security Verification

This work presents ATLAS, an LLM-driven framework that bridges standardized threat modeling and property-based formal verification for System-on-Chip SoC security. Starting from vulnerability knowledge bases such as Common Weakness Enumeration CWE, ATLAS identifies SoC-specific assets, maps...

Proving DNSSEC Correctness: A Formal Approach to Secure Domain Name Resolution

The Domain Name System Security Extensions DNSSEC are critical for preventing DNS spoofing, yet its specifications contain ambiguities and vulnerabilities that elude traditional "break-and-fix" approaches. A holistic, foundational security analysis of the protocol has thus remained an open proble...

Towards a Formal Verification of Secure Vehicle Software Updates

With the rise of software-defined vehicles SDVs, where software governs most vehicle functions alongside enhanced connectivity, the need for secure software updates has become increasingly critical. Software vulnerabilities can severely impact safety, the economy, and society. In response to this...

Bridging Threat Models and Detections: Formal Verification Via CADP

Threat detection systems rely on rule-based logic to identify adversarial behaviors, yet the conformance of these rules to high-level threat models is rarely verified formally. We present a formal verification framework that models both detection logic and attack trees as labeled transition syste...

Concrete Security Bounds for Simulation-Based Proofs of Multi-Party Computation Protocols

The concrete security paradigm aims to give precise bounds on the probability that an adversary can subvert a cryptographic mechanism. This is in contrast to asymptotic security, where the probability of subversion may be eventually small, but large enough in practice to be insecure. Fully...

Architectural Backdoors in Deep Learning: a Survey of Vulnerabilities, Detection, and Defense

Architectural backdoors pose an under-examined but critical threat to deep neural networks, embedding malicious logic directly into a model's computational graph. Unlike traditional data poisoning or parameter manipulation, architectural backdoors evade standard mitigation techniques and persist...

One for All: Formally Verifying Protocols Which Use Aggregate Signatures (Extended Version)

Aggregate signatures are digital signatures that compress multiple signatures from different parties into a single signature, thereby reducing storage and bandwidth requirements. BLS aggregate signatures are a popular kind of aggregate signature, deployed by Ethereum, Dfinity, and Cloudflare...