KEM-IND-CCA-Preserving Compilation of Jasmin's ML-KEM
This paper presents a fully mechanized proof in the Rocq prover that the Jasmin compiler preserves both functional correctness and KEM-IND-CCA security for the highly optimized ML-KEM implementation used in Signal, achieved through a new game-based security framework, interaction-tree semantics supporting probabilistic computations, and a relational Hoare logic.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the high-stakes world of digital security, cryptography acts as the invisible lock that protects everything from private messages to financial transactions. For decades, experts have relied on mathematical proofs to ensure these locks are unbreakable, but a critical gap has remained between the elegant mathematics on paper and the messy reality of the computer code that runs them. Even when a cryptographic scheme is proven secure in theory, the process of translating that theory into the specific instructions a computer processor understands can introduce subtle errors. These errors, often introduced by the compilers that perform the translation, can create vulnerabilities that attackers exploit. As the world prepares to transition to new, quantum-resistant encryption standards to protect against future threats, ensuring that these new systems remain secure all the way down to the machine code is no longer just a theoretical concern; it is a necessity for the safety of global communication networks.
A team of researchers has now closed this gap for one of the most important new encryption standards, known as ML-KEM, which is already being used in popular secure messaging applications like Signal. Their work demonstrates that the specific software tool used to translate the high-level security code into machine instructions does not accidentally break the security guarantees. In essence, they have proven that the security properties established for the original, human-readable code are perfectly preserved in the final, optimized assembly code that the computer actually executes. This achievement is significant because it removes the need to trust the compiler as a "black box" that might contain hidden bugs; instead, the compiler itself has been mathematically verified to be a safe bridge between the abstract security proofs and the physical hardware.
The challenge the researchers faced was unique to the nature of modern encryption. The specific algorithm they studied, ML-KEM, relies on a technique called rejection sampling, where the computer repeatedly tries random numbers until it finds one that fits a specific pattern. This process means the program does not always run for a fixed amount of time; it might finish quickly, or it might take many more attempts than expected. Previous methods for verifying compilers were designed for programs that run in a predictable, fixed sequence of steps. They struggled to handle this kind of probabilistic behavior, where the path the code takes depends on chance. If a compiler verification tool cannot account for these random loops, it cannot guarantee that the final machine code behaves the same way as the original design, leaving a potential hole in the security chain.
To solve this, the researchers built a new framework for understanding how these programs behave. They treated the execution of the code not as a simple list of instructions, but as a tree of possible interactions, where every random choice and every interaction with the outside world is a branch in the tree. This approach allowed them to model the "almost sure" termination of the program—meaning it will eventually finish with a probability of one, even if the exact time is unpredictable. By using this new model, they were able to define what it means for a compiler to be correct in a probabilistic setting. They proved that for every possible path the original code could take, the compiled code takes a matching path, preserving the exact same distribution of outcomes.
The team applied this framework to the Jasmin compiler, a tool specifically designed for writing high-assurance cryptographic code. They focused on the implementation of ML-KEM used in Signal, a messenger app with millions of users. Using a powerful proof assistant, a software tool that checks mathematical arguments with absolute rigor, they verified that the compiler correctly translates the source code into assembly language without altering the security properties. Their proof covers the entire compilation process, from the initial high-level description down to the final machine instructions. The result is a guarantee that the security of the encryption, which was previously proven only for the source code, now holds true for the actual code running on the user's device.
This work is part of a larger effort to bring the highest levels of assurance to the post-quantum transition, a global shift to encryption methods that can withstand attacks from future quantum computers. While the researchers have not yet extended their proof to cover side-channel attacks—where an attacker might learn secrets by observing how long a computation takes or how much power it uses—they have laid the necessary foundation for such future work. By establishing that the compiler preserves the core security game, they have created a solid base upon which more complex security guarantees can be built. The verification is fully mechanized, meaning every step of the proof has been checked by a computer, leaving no room for human error in the logic itself.
The implications of this work extend beyond just one algorithm. The framework the researchers developed is general enough to be applied to other cryptographic schemes and security properties. They have shown that it is possible to reason about game-based security, a standard way of defining cryptographic strength, through the lens of compiler correctness. This means that as new encryption standards are developed and implemented, they can be subjected to the same rigorous verification process. The researchers have made their tools and proofs open source, allowing other experts to inspect, verify, and build upon their work. This transparency is crucial for maintaining trust in the digital infrastructure that underpins modern society.
In the end, this paper represents a significant step toward a future where we can be confident that the digital locks protecting our data are exactly as strong as the mathematicians who designed them promised. By bridging the gap between abstract security proofs and the concrete reality of machine code, the researchers have removed a major source of uncertainty from the cryptographic supply chain. Their work ensures that when a user sends a secure message, the security guarantees they rely on are not just theoretical ideals, but properties that are mathematically preserved all the way down to the silicon chips in their devices. This level of assurance is what allows us to trust the technology that connects us, even as we face new and evolving threats in the digital age.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.