Using Term Rewriting to Solve Bit-Vector Arithmetic Problems - (Poster Presentation)

Among many theories supported by SMT solvers, the theory of finite-precision bit-vector arithmetic is one of the most useful, for both hardware and software systems verification. This theory is also particularly useful for some specific domains such as cryptography, in which algorithms are naturally expressed in terms of bit-vectors. Cryptol is an example of a domain-specific language (DSL) and toolset for cryptography developed by Galois, Inc.; providing an SMT backend that relies on bit-vector decision procedures to certify the correctness of cryptographic specifications [3]. Most of these decision procedures use bit-blasting to reduce a bit-vector problem into pure propositional SAT. Unfortunately bit-blasting does not scale very well, especially in the presence of operators like multiplication or division. For example, the equality x[n] − 1[n] = (x[n] + 1[n]) × (x[n] − 1[n]) is a simple consequence of distributivity and associativity laws; but even for small values of n the bit-level representation of this formula is so huge that it is intractable by current SAT solvers. The main reason for this is the loss of high-level algebraic structure present in the original decision problem. The point here is that one can exploit algebraic properties concerning the domain of bit-vectors to rewrite this problem into an equisatisfiable, but computationally less hard, problem. For instance, the above equality can be proved valid as follows (subscripts are omitted for clarity): x2 − 1 = (x + 1) × (x − 1) ≡ {distributivity × 3; associativity} x2 − 1 = x2+x−x−1 ≡ {inverse; right identity} x2−1 = x2−1 ≡ {reflexivity} true. Modern SMT solvers already include a simplification phase that performs some rewriting on the input problem prior to bit-blasting [4]. Nevertheless, SMT solvers have to deal with a wide range of application domains, and hence the set of rewrite rules employed for simplification inevitably excludes many rules that are useful for some particular domains but may be inconvenient for others. The present work was motivated by the difficulties reported by the Galois Cryptol team in achieving automatic equivalence checking for public-key cryptography (PKC). PKC is particularly hard because it involves multiplication and modular exponentiation on long bit-vectors. Hence, the bit-level representation of any PKC algorithm is usually so huge that such equivalence problems are too hard for current SAT solvers, unless a significant amount of rewriting is performed before bit-blasting. SMT solvers employing high-level rewriting-based techniques have been shown to be promising, but they are still insufficiently powerful to handle