Skip to content

Commit 5ababd4

Browse files
RitvikKapilaRitvikKapila
committed
fix Dafny verification
1 parent 77abfc2 commit 5ababd4

File tree

4 files changed

+36
-20
lines changed

4 files changed

+36
-20
lines changed

‎DynamoDbEncryption/dafny/DynamoDbEncryption/src/ConfigToInfo.dfy

+6
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,12 @@ module SearchConfigToInfo {
136136
MPT.Default(Default := MPT.DefaultCache(entryCapacity := 1000))
137137
else
138138
if config.single.cache.Some? then
139+
// Ideally, we only want to pass a cache here with entryCapacity = 1
140+
// because the SingleKeyStore caches only one value.
141+
// That is, we SHOULD add a check here for entryCapacity = 1.
142+
// However, that requires us to write an if block for each CacheType.
143+
// Also, it does NOT matter what the entryCapacity is, because the cache
144+
// can only hold one element at a time.
139145
config.single.cache.value
140146
else
141147
MPT.Default(Default := MPT.DefaultCache(entryCapacity := 1));

‎DynamoDbEncryption/dafny/DynamoDbEncryption/src/SearchInfo.dfy

+26-19
Original file line numberDiff line numberDiff line change
@@ -157,10 +157,13 @@ module SearchableEncryptionInfo {
157157
partitionIdBytes : seq<uint8>
158158
) {
159159
function Modifies() : set<object> {
160-
client.Modifies + store.Modifies
160+
client.Modifies + store.Modifies + cache.Modifies
161161
}
162162
predicate ValidState() {
163-
client.ValidState() && store.ValidState()
163+
&& client.ValidState()
164+
&& store.ValidState()
165+
&& cache.ValidState()
166+
&& store.Modifies !! cache.Modifies
164167
}
165168
method getKeyMap(stdNames : seq<string>, keyId : MaybeKeyId) returns (output : Result<MaybeKeyMap, Error>)
166169
requires Seq.HasNoDuplicates(stdNames)
@@ -170,7 +173,8 @@ module SearchableEncryptionInfo {
170173
{
171174
if keyLoc.SingleLoc? {
172175
:- Need(keyId.DontUseKeyId?, E("KeyID should not be supplied with a SingleKeyStore"));
173-
var theMap :- getKeysCache(stdNames, keyLoc.keyId, cacheTTL as MP.PositiveLong, partitionIdBytes);
176+
var now := Time.GetCurrent();
177+
var theMap :- getKeysCache(stdNames, keyLoc.keyId, cacheTTL as MP.PositiveLong, partitionIdBytes, now as MP.PositiveLong);
174178
return Success(Keys(theMap));
175179
} else if keyLoc.LiteralLoc? {
176180
:- Need(keyId.DontUseKeyId?, E("KeyID should not be supplied with a LiteralKeyStore"));
@@ -180,7 +184,7 @@ module SearchableEncryptionInfo {
180184
match keyId {
181185
case DontUseKeyId => return Failure(E("KeyID must not be supplied with a MultiKeyStore"));
182186
case ShouldHaveKeyId => return Success(ShouldHaveKeys);
183-
case KeyId(id) => var theMap :- getKeysCache(stdNames, id, cacheTTL as MP.PositiveLong, partitionIdBytes); return Success(Keys(theMap));
187+
case KeyId(id) => var now := Time.GetCurrent(); var theMap :- getKeysCache(stdNames, id, cacheTTL as MP.PositiveLong, partitionIdBytes, now as MP.PositiveLong); return Success(Keys(theMap));
184188
}
185189
}
186190
}
@@ -213,7 +217,8 @@ module SearchableEncryptionInfo {
213217
stdNames : seq<string>,
214218
keyId : string,
215219
cacheTTL : MP.PositiveLong,
216-
partitionIdBytes : seq<uint8>
220+
partitionIdBytes : seq<uint8>,
221+
now : MP.PositiveLong
217222
)
218223
returns (output : Result<HmacKeyMap, Error>)
219224
requires Seq.HasNoDuplicates(stdNames)
@@ -230,23 +235,29 @@ module SearchableEncryptionInfo {
230235
&& var oldHistory := old(cache.History.GetCacheEntry);
231236
&& var newHistory := cache.History.GetCacheEntry;
232237
&& |newHistory| == |oldHistory|+1
233-
&& Seq.Last(newHistory).output.Success?
234238
&& var cacheInput := Seq.Last(newHistory).input;
235239
&& var cacheOutput := Seq.Last(newHistory).output;
236240
&& UTF8.Encode(keyId).Success?
237-
// TODO - why is this verifying?
238241
&& cacheInput.identifier == RESOURCE_ID_HIERARCHICAL_KEYRING + NULL_BYTE + SCOPE_ID_SEARCHABLE_ENCRYPTION + NULL_BYTE + partitionIdBytes + NULL_BYTE + UTF8.Encode(keyId).value
239242

240243
//= specification/searchable-encryption/search-config.md#get-beacon-key-materials
241244
//= type=implication
242245
//# If a [cache entry](../../submodules/MaterialProviders/aws-encryption-sdk-specification/framework/cryptographic-materials-cache.md#cache-entry)
243246
//# exists, get beacon key MUST return the [entry materials](../../submodules/MaterialProviders/aws-encryption-sdk-specification/framework/cryptographic-materials-cache.md#materials).
244-
&& (cacheOutput.Success? ==>
247+
&& (cacheOutput.Success? && cacheEntryWithinLimits(
248+
creationTime := cacheOutput.value.creationTime,
249+
now := now,
250+
ttlSeconds := cacheTTL
251+
) ==>
245252
&& cacheOutput.value.materials.BeaconKey?
246253
&& cacheOutput.value.materials.BeaconKey.hmacKeys.Some?
247254
&& output.value == cacheOutput.value.materials.BeaconKey.hmacKeys.value)
248255

249-
&& (cacheOutput.Failure? ==>
256+
&& (cacheOutput.Failure? || !cacheEntryWithinLimits(
257+
creationTime := cacheOutput.value.creationTime,
258+
now := now,
259+
ttlSeconds := cacheTTL
260+
) ==>
250261
&& var oldGetHistory := old(store.History.GetBeaconKey);
251262
&& var newGetHistory := store.History.GetBeaconKey;
252263
&& |newGetHistory| == |oldGetHistory|+1
@@ -263,14 +274,12 @@ module SearchableEncryptionInfo {
263274
&& var oldPutHistory := old(cache.History.PutCacheEntry);
264275
&& var newPutHistory := cache.History.PutCacheEntry;
265276
&& |newPutHistory| == |oldPutHistory|+1
266-
&& Seq.Last(newPutHistory).output.Success?
267277
&& var storeInput := Seq.Last(newPutHistory).input;
268278
&& var storeOutput := Seq.Last(newPutHistory).output;
269279
//= specification/searchable-encryption/search-config.md#get-beacon-key-materials
270280
//= type=implication
271281
//# These cached materials MUST be returned.
272-
&& storeInput.materials.BeaconKey.hmacKeys == Some(output.value)
273-
282+
&& storeInput.materials.BeaconKey? ==> storeInput.materials.BeaconKey.hmacKeys == Some(output.value)
274283
)
275284
{
276285

@@ -290,16 +299,12 @@ module SearchableEncryptionInfo {
290299

291300
var getCacheInput := MP.GetCacheEntryInput(identifier := identifier, bytesUsed := None);
292301
verifyValidStateCache(cache);
293-
assume {:axiom} cache.Modifies == {};
294302
var getCacheOutput := cache.GetCacheEntry(getCacheInput);
295-
296303
// If error is not EntryDoesNotExist, return failure
297304
if (getCacheOutput.Failure? && !getCacheOutput.error.EntryDoesNotExist?) {
298305
return Failure(AwsCryptographyMaterialProviders(AwsCryptographyMaterialProviders:=getCacheOutput.error));
299306
}
300307

301-
var now := Time.GetCurrent();
302-
303308
// //= specification/searchable-encryption/search-config.md#<heading>
304309
//# If using a `Shared` cache across multiple Beacon Key Sources,
305310
//# different Key Sources having the same `beaconKey` can have different TTLs.
@@ -332,18 +337,20 @@ module SearchableEncryptionInfo {
332337
//# These materials MUST be put into the associated [Key Store Cache](#key-store-cache)
333338
//# with an [Expiry Time](../../submodules/MaterialProviders/aws-encryption-sdk-specification/framework/cryptographic-materials-cache.md#expiry-time)
334339
//# equal to now + configured [cacheTTL](#cachettl).
335-
var now := Time.GetCurrent();
340+
:- expect Need(
341+
(now as int + cacheTTL as int) < UInt.INT64_MAX_LIMIT,
342+
MP.AwsCryptographicMaterialProvidersException(message := "INT64 Overflow when putting cache entry.")
343+
);
336344
var putCacheEntryInput:= MP.PutCacheEntryInput(
337345
identifier := identifier,
338346
materials := MP.Materials.BeaconKey(beaconKeyMaterials),
339347
creationTime := now,
340-
expiryTime := now+cacheTTL as MP.PositiveLong,
348+
expiryTime := now + cacheTTL,
341349
messagesUsed := None,
342350
bytesUsed := None
343351
);
344352

345353
verifyValidStateCache(cache);
346-
assume {:axiom} cache.Modifies == {};
347354

348355
var putResult := cache.PutCacheEntry(putCacheEntryInput);
349356
if (putResult.Failure? && !putResult.error.EntryAlreadyExists?) {

‎DynamoDbEncryption/dafny/DynamoDbEncryption/test/BeaconTestFixtures.dfy

+1-1
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@ module BeaconTestFixtures {
247247
return SI.KeySource(client, version.keyStore, SI.LiteralLoc(keys), cache, 0, partitionIdBytes);
248248
}
249249

250-
method GetMultiSource(keyName : string, version : BeaconVersion, partitionId: Option<seq<uint8>>, shared_cache: Option<MPT.ICryptographicMaterialsCache>) returns (output : SI.KeySource)
250+
method GetMultiSource(keyName : string, version : BeaconVersion) returns (output : SI.KeySource)
251251
requires version.keyStore.ValidState()
252252
ensures output.ValidState()
253253
ensures version.keyStore == output.store

‎DynamoDbEncryption/runtimes/java/.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@
44
# Ignore Gradle build output directory
55
build
66

7+
# Ignore bin
8+
bin
9+
710
# JetBrains
811
.idea/*
912
*.iml

0 commit comments

Comments
 (0)