Secure Parsing and Serializing with Separation Logic Applied to CBOR, CDDL, and COSE

2025-05-22

AI Summary

Parsing binary data formats (e.g., CBOR, CDDL, COSE) in low-level languages is error-prone and frequently introduces security vulnerabilities. Method: We propose PulseParse, a verifiable parsing and serialization framework based on separation logic. Our approach formally verifies the non-malleability of deterministic CBOR fragments; introduces well-formedness conditions for CDDL and automatically synthesizes verified codecs; delivers the first fully formalized, end-to-end COSE signature protocol; and employs constant-stack-space recursive parsing with robust handling of adversarial inputs. Contributions: We release EverCBOR—a machine-checked, correctness-proven CBOR library—and EverCDDL—a tool for CDDL validation and verified code generation. These constitute the first fully formalized, end-to-end implementations of industrial standards including DICE and COSE. PulseParse supports verified code generation for both C and Rust, enabling high-assurance, cross-language interoperability in safety-critical systems.

Technology Category

• Constraint Satisfaction and Optimization: Distributed CSP/Optimization
• Knowledge Representation and Reasoning: Description Logics
• Application Domains: Security

Application Category

• Security and Privacy: Data transparency and provenance
• Systems and Infrastructure for Web, Mobile and WoT: Decentralized Web and Fediverse systems
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

Incorrect handling of security-critical data formats, particularly in low-level languages, are the root cause of many security vulnerabilities. Provably correct parsing and serialization tools that target languages like C can help. Towards this end, we present PulseParse, a library of verified parser and serializer combinators for non-malleable binary formats. Specifications and proofs in PulseParse are in separation logic, offering a more abstract and compositional interface, with full support for data validation, parsing, and serialization. PulseParse also supports a class of recursive formats -- with a focus on security and handling adversarial inputs, we show how to parse such formats with only a constant amount of stack space. We use PulseParse at scale by providing the first formalization of CBOR, a recursive, binary data format standard, with growing adoption in various industrial standards. We prove that the deterministic fragment of CBOR is non-malleable and provide EverCBOR, a verified library in both C and Rust to validate, parse, and serialize CBOR objects implemented using PulseParse. Next, we provide the first formalization of CDDL, a schema definition language for CBOR. We identify well-formedness conditions on CDDL definitions that ensure that they yield unambiguous, non-malleable formats, and implement EverCDDL, a tool that checks that a CDDL definition is well-formed, and then produces verified parsers and serializers for it. To evaluate our work, we use EverCDDL to generate verified parsers and serializers for various security-critical applications. Notably, we build a formally verified implementation of COSE signing, a standard for cryptographically signed objects. We also use our toolchain to generate verified code for other standards specified in CDDL, including DICE Protection Environment, a secure boot protocol standard.

Problem

• Develop verified parsing/serializing tools for secure binary formats
• Formalize CBOR and CDDL to ensure non-malleable data handling
• Generate verified code for security-critical standards like COSE

Innovation

• Verified parser combinators for secure binary formats
• Separation logic for abstract compositional interface
• Constant stack space recursive format parsing