Countering Trusting Trust through Diverse Double-Compiling
An Air Force evaluation of Multics, and Ken Thompson's famous Turing award lecture "Reflections on Trusting Trust," showed that compilers can be subverted to insert malicious Trojan horses into critical software, including themselves. If this attack …
Authors: David A. Wheeler
+1*0".&*$ .1/0&*$ .1/00%.+1$%&2"./"+1 ("+),&(&*$
5J=8 .<99@9F
7<=2=>=./8;./.7<.7*5B<.<
-@1..5.;2-*8;0
/0. 0
7 2; 8;,. .?*5>*=287 8/ >5=2,< *7- .7
%1869<87E</*68><%>;270*@*;-5.,=>;.C#./5.,=287<
87 %;><=270 %;><=D <18@.- =1*= ,86925.;< ,*7 +.
<>+?.;=.- =8 27<.;= 6*52,28>< %;83*7 18;<.< 27=8
,;2=2,*5 <8/=@*;. 27,5>-270 =1.6<.5?.< / =12< *==*,4
08.< >7-.=.,=.- .?.7 ,8695.=. *7*5B<2< 8/ * ;,. ,8-. @255 78= /27- =1. 6*52,28>< ,8-. =1*= 2<
;>77270 *7- 6.=18-< /8; -.=.,=270 =12< 9*;=2,>5*;
*==*,4 *;. 78= @2-.5B 478@7 %12< 9*9.; -.<,;2+.< *
9;*,=2,*5 =.,172:>. =.;6.- -2?.;<. -8>+5.,86925270
=1*= -.=.,=< =12< *==*,4 *7- <86. ,86925.;
-./.,=< *< @.55
$2695B ;.,86925. =1. <8>;,. ,8-.
=@2,. 87,. @2=1 * <.,87- =;><=.- ,86925.; *7-
*0*27 ><270 =1. ;.<>5= 8/ =1. /2;<= ,86925*=287 / =1.
;.<>5= 2< +2=/8;+2= 2-.7=2,*5 @2=1 =1. >7=;><=.- +27*;B
=1.7 =1. <8>;,. ,8-. *,,>;*=.5B ;.9;.<.7=< =1. +27*;B
%12< =.,172:>. 1*< +..7 6.7=287.- 27/8;6*55B +>= 2=<
2<<>.< *7- ;*62/2,*=287< 1*?. 78= +..7 2-.7=2/2.- 8;
-2<,><<.- 27 * 9..;;.?2.@.- @8;4 78; 1*< * 9>+52,
-.687<=;*=287 +..7 6*-. %12< 9*9.; -.<,;2+.< =1.
=.,172:>. 3><=2/2.< 2= -.<,;2+.< 18@ =8 8?.;,86.
9;*,=2,*5,1*55.70.<*7--.687<=;*=.<2=
*0.+!1 0&+*
$5BMDFC8I7HG97IF=HM9J5@I5H=CBG9L5A=B9GCIF79
7C89 IB89F H<9 5GGIADH=CB H<5H H<9 GCIF79 7C89
577IF5H9@M F9DF9G9BHG H<9 DFC8I7H 69=B; 9L5A=B98
%5PJ9 89J9@CD9FG DF9GIA9 H<5H H<=G 75B 69 5GGIF98
G=AD@M 6M F97CAD=@=B; H<9 GCIF79 7C89 HC G99 =: H<9
G5A96=B5FMF9GI@HG
,B:CFHIB5H9@M =: 5B 5HH57?9F 75B AC8=:M H<9
6=B5FM :=@9 C: H<9 7CAD=@9F H<=G =G =BGI::=7=9BH B
5HH57?9F K97H 5 +FC>5B 5B 5B
IGH=:M
H<5H H<9 GCIF79 7C89 69=B; 9L5A=B98 577IF5H9@M
F9DF9G9BHG H<9 :=@9G 69=B; 9L97IH98SM9H H<=G 5HH57?
GI6J9FHG H<5H J9FM 7@5=A
BH9FB9H *97IF=HM *MGH9AWG
5J=8 $5MBCF 5F;I9G H<5H H<9 F=G? C: H<9G9 ?=B8G C:
5HH57?G =G =B7F95G=B; 2323 "5F;9F 5B8 *7<9@@ BCH98
H<=G K5G GH=@@ 5 DFC6@9A =B
23 5B8 GCA9
H97IGH=:M=B;
=HG
9::97H=J9B9GG
CF
8=G7IGG=B; =HG F5A=:=75H=CBG B 588=H=CB H<9F9 =G BC
DI6@=7 9J=89B79 H<5H <5G 699B HF=98 CF 5 89H5=@98
89G7F=DH=CB C: IGH=:=75H=CB :CF =HG 9::97H=J9B9GG
+<9 B9LH G97H=CBG
8=G7IGG 5B
5BIGH 5 8=::9F9BH J9FG=CB 9 8C9G BCH9 H<9 J5@I9 C:
F97CAD=@=B; T9J9FMH<=B;U HC 7<97? =H 2 3 B89FGCB
BCH9G H<5H 7FCGG7CAD=@5H=CB 8C9G BCH <9@D =: H<9 5HH57?
=G =B H<9 7CAD=@9F 2 3 $C5B
97H7C89
5=;CBWG TCBGHF5=B98 )5B8CA +9GH=B;U 89H97HG
7CAD=@9F
89:97HG
6M
7F95H=B;
A5BM
F5B8CA
H9GH
DFC;F5AG 7CAD=@=B; H<9A K=H< 5 7CAD=@9F IB89F H9GH
5B8 5 F9:9F9B79 7CAD=@9F 5B8 89H97H=B; =: FIBB=B;
H<9A DFC8I79G 8=::9F9BH F9GI@HG 2
3 +<=G =G 9LHF9A9@M
IB@=?9@MHC:=B8H<9+FC>5B5B
97HG G=B79
957< 7CAD=@9F H<9M 5HH57? =B=H=5@@M CF HC 588 B9K
HF=;;9FG 5B8 D5M@C58G =B7F95G9G H<9 F=G? C: 8=G7CJ9FM
CK9J9F G=B79 H<9G9 5HH57?G 75B 5@@CK 5B 5HH57?9F HC
899D@M D9B9HF5H9 GMGH9AG ;9B9F5H98 K=H< H<9 7CAD=@9F
A5@=7=CIG 7CAD=@9FG A5?9 =H 95G=9F :CF 5B 5HH57?9F HC
F99BH9F
5
DF9J=CIG@M
D9B9HF5H98
89J9@CDA9BH
9BJ=FCBA9BH HC F9:F9G< 5 6=B5FM K=H< B9K HF=;;9FG 5B8
D5M@C58G +5B
IGH=:M H<=G H97+5.
,86925.
<
CAD5F9 5BF9;9B9F5H9
$.5/;.0.7.;*=.
7<
DFC6@9AG IB@9GG < K5G 89G=;B98 HC 69 DCFH56@9 BM
89:97H =B + 75B 5@GC 75IG9 DFC6@9AG H5B 5B 5B 5B
5J57 7CAD=@9F 9 5@GC GH5H98 H<5H <9 :9@H H<5H
H<=G K5G 5 6I; BCH=B; H<5H H<=G 69<5J=CF A589 DCFH
J5@=85H=CB9LHF9A9@M8=::=7I@H23
H A5M 69 8=::=7I@H HC 7CAD=@9 < IG=B; 9L=GH=B;
HFIGH98 7CAD=@9FG +<5B?:I@@M H<9F9 5F9 A5BM DCGG=6@9
GC@IH=CBG =: < 75BBCH 69 7CAD=@98 6M 5 ;=J9B HFIGH98
7CAD=@9F B 9L=GH=B; HFIGH98 7CAD=@9F 7CI@8 69
AC8=:=98 9 ; HC 588 9LH9BG=CBG GC =H 75B 7CAD=@9 <
BCH<9F 5@H9FB5H=J9 =G HC 7F95H9 5 HFIGH98 DF9DFC79GG
GH9D H<5H =G 5DD@=98 HC < DCGG=6@M 8CB9 6M <5B8 5G 5
F9GI@H + KCI@8 69 89:=B98 5G 69=B; H<9 DF9DFC79GG GH9D
D@IG H<9 HFIGH98 7CAD=@9F +FIGH98 7CAD=@9F + 7CI@8 69
7F95H98 6M IG=B; 5B 9L=GH=B; HFIGH98 7CAD=@9F 6IH CB9
H<5H 75BBCH 7CAD=@9 < 8=F97H@M HC 7CAD=@9 5BCH<9F
9L=GH=B; HFIGH98 7CAD=@9F H<5H 75B 7CAD=@9 < = 9 H<9
:=FGH HFIGH98 7CAD=@9F =G IG98 HC 6CCHGHF5D 5BCH<9F
7CAD=@9F H =G DCGG=6@9 HC KF=H9 5 B9K HFIGH98 7CAD=@9F
:FCA G7F5H7< G=B79 D9F:CFA5B79 =G =FF9@9J5BH 5B8 =H
CB@M B998G HC 69 56@9 HC 7CAD=@9 CB9 DFC;F5A H<=G
A5M BCH 69 8=::=7I@H B C@8 J9FG=CB C: 7CI@8 69
IG98 5G + 6IH H<5H =G :5F @9GG 8=J9FG9 GC H<9 F9GI@HG 5F9
:5F@9GG7CBJ=B7=B;5B8F=G?GTDCDIDU5HH57?G
TDCDIDU 5HH57? 5G 89:=B98 =B H<=G D5D9F =G
K<9F9 5B 5HH57?9F =B7@I89G 5 G9@:D9FD9HI5H=B; 5HH57? =B
CB@M GCA9 J9FG=CBG C: H<9 GCIF79 7C89 K<9F9 H<9
5HH57? TDCDG IDU K=H< H<9 =895 H<5H 89:9B89FG A5M BCH
9L5A=B9 H<9 GCIF79 7C89 C: H97H 69;5B 5G H<9
&6:IG75H98 +=BM CAD=@9F &+ 5 J9FM GA5@@
7CAD=@9F 9@@5F8 KFCH9 HC
K=B H<9 BH9FB5H=CB5@
&6:IG75H98 C89 CBH9GH & =B
9
H<9B 9LD5B898 H<=G GA5@@ 7CAD=@9F GC H<5H =H BCK
GIDDCFHG 5@@ C: %* ACGH C: H<9 B9K9F *&
GH5B85F8 5B8 A5BM %, 9LH9BG=CBG =B7@I8=B;
=B@=B9 5GG9A6@M
+<9 7CAD=@9F H77 5DD95F98 HC A99H
H<9 F9EI=F9A9BHG ;=J9B 56CJ9
B 588=H=CB H77 <58
699B IG98 HC 7F95H9 TH776CCHU 5 #=BIL 8=GHF=6IH=CB H<5H
:=FGH 6CCH98 H<9 7CAD=@9F 5B8 H<9B F97CAD=@98 H<9
9BH=F9?9FB9@5GD5FHC:=HG6CCHDFC79GG +<=G75D56=@=HM
HC 7CAD=@9 5@ACGH 5@@ 7C89 5H 6CCH H=A9 7CI@8 69 J9FM
IG9:I@ :CF :IHIF9 F9@5H98 KCF? 5B8 GI;;9GH98 H<5H H<9
7CAD=@9FK5GF9@5H=J9@M89:97H:F99
+<9
:C@@CK=B;
G97H=CBG
89G7F=69
H<9
H9GH
7CB:=;IF5H=CB H<9 DFC79GG DFC6@9AG K=H< 75GH=B;
6=H J5@I9G 5B8 @CB; 8CI6@9 7CBGH5BHG 5B8 :=B5@
F9GI@HG
"/0 +*#&$1. 0&+*
@@ H9GHG F5B CB 5B L GMGH9A FIBB=B; )98 5H
98CF5 CF9 +<=G =B7@I898 #=BIL ?9FB9@ J9FG=CB
4 5B8 ;77 J9FG=CB
:7
;77
K5G 6CH< H<9 6CCHGHF5D 7CAD=@9F 5B8 H<9 HFIGH98
7CAD=@9F :CF H<=G H9GH H77 K5G H<9 G=AI@5H98 DCH9BH=5@@M
A5@=7=CIG7CAD=@9F
=FGH 5 HF58=H=CB5@ 7<5=B C: F97CAD=@5H=CBG K5G
D9F:CFA98 IG=B; H77 J9FG=CBG
5B8
:H9F 6CCHGHF5DD=B; 5 7CAD=@9F KCI@8 69
ID85H98 5B8
IG98
HC
7CAD=@9 =HG9@:
+<9=F
;N=D
7CADF9GG98 H5F :=@9G <5J9 H<9 :C@@CK=B; * J5@I9G
DFCJ=898GCCH<9FG75BF9D95HH<=G9LD9F=A9BH
G =G IGI5@ 5BM GI7< G9EI9B79 AIGH GH5FH K=H<
GCA9 GCFH C: 6CCHGHF5D C: H<9 7CAD=@9F ;77 K5G IG98 HC
6CCHGHF5D H77
75IG=B; 5 A=BCF 7<5@@9B;9 ;77
KCI@8 BCH 7CAD=@9 H77
8=F97H@M 6975IG9
;77 58898 588=H=CB5@ 7<97?G BCH DF9G9BH =B C@89F
J9FG=CBG C: ;77 B H77
GCA9 :IB7H=CBG 5F9
897@5F98@=?9H<=GIG=B;5;779LH9BG=CBHC
*$
$)# %(& *$
%
#(
$ ' (
((& )( & %&"
6IH H<9 89:=B=H=CBG C: H+5.,86925.
H77
CAD5F9
7IB?U 6MH9G 9B8 ID 89D9B8=B;
CB H<9 IB89F@M=B; 9BJ=FCBA9BH 75IG=B; J5F=5H=CBG =B
H<9 CIHDIH 2 3
B BCFA5@ CD9F5H=CB H<9G9 6MH9G 5F9
=;BCF985B8H5=2,< $.,>;2=B
?*5>*=287 '>57.;*+252=B 7*5B<2< *+) -C@
( @97HFCB=7G *MGH9AG =J=G=CB 5BG7CA $ !IB9
DD
2
3
+72,*=287< 8/ =1. -C@
%C DF DD
9 <,2,;B9= DF
A
8>;7*5
*95HH@9
.
!5BI5FM
CIFB5@ 7CA
5FH=7@9
23 "5F;9F '5I@ 5B8 )C;9F ) *7<9@@ T+<=FHM 095FG #5H9F
#9GGCBG :FCA H<9 $I@H=7G *97IF=HM J5@I5H=CBU $ *9D
;7*5 8/ 7/8;6*=287 (*;/*;. -C@ %C
DD
!IB9
5B CFG9G 5B8 +FIGHM 57?9FGU
866>72,*=287< 8/ =1. -C@
%C %CJ D
2 3 $79FACHH !C5B
CFG9G
:FCA
=;<
&F89F
#5B;I5;9GU ";8, 8/ =1.
=1 *=287*5 869>=.; $.,>;2=B
87/.;.7,.5@H=ACF9$&7H DD
2
3 #99 #5KF9B79 T)9 )9:@97H=CBG CB +FIGH=B; +FIGHU
27>A $.,>;2=B >-2=270 6*25270 52<=
!IB9
A
6*25270 52<= !I@M
A
6*25270
52<=
!I@M
A
6*25270 52<= !I@M
;. 8=.< 27 869>=.; $,2.7,.
-C@
97
DD
2
3 9@@CJ=B *H9J9B $=7<59@ '.;2/2*+5B 8;;.,= 8-.
.7.;*=287 &<270 ";.-2,*=. %;*75B CFG9G =B CAD=@9F
AD@9A9BH5H=CBGU
";8,
-.<
(8;4<189<
$2,1.;1.2=
>7-
)>?.;5*<<204.2=<8/=@*;.+*<2.;=.;$B<=.6.
2
3 C9F=;? .C@:;5B; TCAD=@9F -9F=:=75H=CB )9J=G=H98U
869>=.; 2-.- #.*<87270 *<. $=>-2.<
"@IK9F
7589A=7'I6@=75H=CBG
2
3 99F 5B )969775 579 '9H9F IHA5BB '9FFM $9HN;9F
<5F@9G ' ':@99;9F !C;2=B %1. 8<= 8/ 878985B CADIH9F 5B8
CAAIB=75H=CBG B8IGHFM GGC7=5H=CB *9D
= 5B8 5J=8 7?@9M
TI=@8=B; =J9FG9 CADIH9F *MGH9AGU
";8, 8/ =1. =1
(8;4<189 87 8= %892,< 27 !9.;*=270 $B<=.6<
CADIH9F*C7=9HM'F9GG#CG@5A=HCG DD
2
3 CK5B F=GD=B 95H<9F =BHCB 5@HCB 'I 5B8 !CB5H<5B
.5@DC@9 T+<9 F57?9F '5H7< ;2=B 87/.;.7,. 5@H=ACF9 $
!IB9
72,*=287< 8/ =1. -C@ %C !IB9
FB@
$
)9:@97H=CBG
9G<
<9FI?IF=
T*9@:%CBG9@:
=G7F=A=B5H=CB
=B
5
CADIH9FU ";8, 8/ =1.
$B698<2>6 87 #.<.*;,1
27$.,>;2=B*7-";2?*,B
2
3
5=;CB
F=9@
%.<=270
/8;
).;8
>0<
5B CFG9 FI79
'9F9BGU #8+><= !9.7 $8>;,. 6*25270 52<= CD9BGCIF79 5H
7G@ GF= 7CA9GH56@=G<986M'9H9F %9IA5BB%CJ
2 3 .=@@=5A $ $7"99A5B !5A9G ! CFB=B; 5B8 5J=8
.CFHA5B 86925.; .7.;*=8; 'F9BH=79 5@@ B;@9KCC8
@=::G%!
2
3 *D9B79F 9BFM DF=J5H9 7CAAIB=75H=CB I;IGH
23 #=6F5 TFCGG 7CAD=@=B; 7CAD=@9F F99B =@@G *C:HK5F9
CB :F99 GC:HK5F9 =B H<9 A=@=H5FMU 27>A (..45B .@< DF
5B CFG9 FI79
'9F9BGU #8+><= !9.7 $8>;,. 6*25270 52<= CD9BGCIF79 5H
7G@ GF= 7CA9GH56@=G<986M'9H9F %9IA5BB%CJ
23 #CF8 +CA T)9 &: CIBH=9G 5B8 $9F79B5F=9GU 0,,
6*25270 52<= DF
6+.;<
$5M
*0.
B8 8=H=CB 'F9BH=79 5@@ '+)
$5F
2 3 *&
%1. $=*7-*;- 7,8;98;*=270 %.,172,*5
8;;20.7->6
*&
!C
Original Paper
Loading high-quality paper...
Comments & Academic Discussion
Loading comments...
Leave a Comment