Granite: A Modular Methodology for Foundational Verification of Hardware-Software Leakage Contracts

2026-07-29

AI Summary

This work addresses the challenge of jointly verifying functional correctness and timing side-channel leakage in RTL processor designs by proposing a modular methodology that, for the first time, formally connects ISA-level leakage contracts with cycle-accurate microarchitectural execution. Leveraging leakage-aware refinement verification and deterministic trace equivalence, the approach uniformly guarantees both functional correctness and confidentiality. It employs existentially quantified public-parameterized specifications, modular compositional verification, and Coq/Rocq proof techniques integrated with certified static analysis. The method delivers end-to-end formal assurance for complete processor designs featuring speculative execution, precise interrupts, and I/O, and automatically derives cycle-level confidentiality theorems for software and hardware cryptographic implementations.

Abstract

Granite is a methodology for modular verification of both functional correctness and nonleakage of RTL processors against ISA contracts. We prove that the cycle-by-cycle timing of a pipelined RISC design--with speculation, precise interrupts, and I/O--is determined solely by observables specified in an ISA leakage contract. For programs that keep observables independent of secrets (i.e., following the cryptographic-constant-time discipline), this result rules out information leakage through known and unknown timing side channels. Granite's specifications only constrain functional correctness and information-flow dependencies: not how many cycles an instruction takes, at which instruction an interrupt is handled, or the exact latencies of submodules such as multipliers and memory. Granite's central technique is leakage-aware refinement via determinism, which establishes correctness and confidentiality together as trace equivalence with respect to a family of cycle-level, deterministic spec machines. Secret-independent nondeterminism is handled by existentially parameterizing specs with untrusted, deterministic functions acting only on public data. Submodules are proved against their own leakage-aware specs, and these proofs compose into the whole-design guarantee--which therefore holds over a space of secure implementations. We believe this work is the first to achieve modular and foundational connection between instruction-set-level leakage contracts and microarchitecture-specific cycle-by-cycle execution with wire-level observations. Our proofs compose with a certified static analysis that recognizes cryptographic-constant-time code to derive a single Rocq theorem about the cycle-by-cycle confidentiality of a hardware-and-software cryptographic implementation--eliminating every intermediate specification, including the ISA contract itself, from the trusted computing base.

Problem

• hardware-software verification
• timing side channels
• information leakage
• instruction-set architecture
• modular verification

Innovation

• leakage-aware refinement
• modular verification
• timing side channels
• cryptographic constant-time
• trace equivalence