Of Bounties and Mercenaries

[Tom Lord]

    > From: Joe Buck <Joe.Buck@synopsys.com>

    > On Wed, Apr 07, 2004 at 01:25:58PM -0700, Tom Lord wrote:
    > >     > bootstrap starting from several non-GCC compilers and determine
    > >     > whether you always get the same bits.  Use cross-compilation
    > >     > too.  You then will prove that either your GCC binary does not
    > >     > have the Thompson hack, or else that all the free and
    > >     > proprietary compilers you tried have the same hack, so cleverly
    > >     > designed as to be cross-platform.

    > > Well, "same bits" is going to be hard to evaluate given differences
    > > and chaos in code generation.

    > You misunderstand.  "same bits" means "same bits".  gcc's three-stage
    > bootstrap should produce identical bits regardless of the bootstrap
    > compiler.  It is designed to eliminate effects caused by different
    > starting compilers.  The compiler compiles itself with itself.

I don't misunderstand.   That's what I meant by saying that the "fixed
point" part is easy but the "secure" part is not.

By injecting other compilers in the bootstrapping phase, which
incidentally most customers won't currently bother to do, you're just
raising the bar by a very small amount from a 1-stage thompson virus
to an n-stage thompson virus.   Since the number of candidate
compilers to inject into bootstrapping is currently very small -- as i
said: you're just multiplying the exploitation cost by a small
constant factor.

You say: "or else [...] all the free and proprietary compilers you
tried have the same hack" and I'm saying --- that's not currently
far-fetched enough to make me comfortable.  There aren't that many
other compilers I can throw in the mix there and many of them are
centrally controlled.

To really overcome the Thompson RISK, we need a combinatorics of
bootstrapping paths in theory and _practice_ that yields a _huge_
number of necessary exploits.   With lots of basic bootstrap paths
available (such as if we get a new 4 or 10 every few years, from
students), _then_ we can just start publishing and comparing binaries
and have a sense of security.

-t