We have formalized the functional speci cation of HMAC-DRBG (NIST 800-90A), and we have proved its cryptographic securitythat its output is pseudorandom-using a hybrid game-based proof. We have also proved that the mbedTLS implementation (C program) correctly implements this functional speci cation. That proof composes with an existing C compiler correctness proof to guarantee, end-to-end, that the machine language program gives strong pseudorandomness. All proofs (hybrid games, C program veri cation, compiler, and their composition) are machine-checked in the Coq proof assistant. Our proofs are modular: the hybrid game proof holds on any implementation of HMAC-DRBG that satis es our functional speci cation. Therefore, our functional speci cation can serve as a high-assurance reference.
Ye et. al REF verify the mbedTLS implementation of HMAC-DRBG.
Verified Correctness and Security of mbedTLS HMAC-DRBG
CCS '17
Computer Science