Formal Verification By Specification Extraction 1

In this paper we describe Echo, a novel yet practical approach to the formal verification of implementations. Echo splits verification into two major parts. The first part verifies an implementation against a lowlevel specification. The second uses a technique called reverse synthesis to extract a high-level specification from the low-level specification. The extracted specification is proved to imply the original system specification. Much of Echo is automated, and it alleviates the verification burden by distributing it over separate tools and techniques. Reverse synthesis is achieved largely by mechanically applying a variety of structural transformations, including efficiency-reducing transformations, which can be viewed as optimizing the program for verification rather than for size or speed. We give a detailed example of Echo, verifying an implementation of the Advanced Encryption Standard (AES) against the official specification of AES.