通过多样的双重编译，全面对抗信任
Fully Countering Trusting Trust through Diverse Double-Compiling
摘要：
空军对Multics的评估和Ken Thompson的图灵奖演讲（“对信任的反思”）表明，编译器可以被颠覆，将恶意特洛伊木马插入关键软件，包括它们自己。如果这种“信任信任”攻击未被检测到，那么即使对系统源代码进行完整的分析，也无法找到正在运行的恶意代码。以前已知的反措施是远远不够的。如果这种攻击无法被反击，攻击者可以悄悄地破坏整个计算机系统，从而完全控制全球的金融、基础设施、军事和/或商业系统。本文的主要工作是利用“多样性双重编译”（DDC）技术来检测和有效地对抗信任攻击，具体表现为：（1）形式化证明DDC可以判断源代码和生成的可执行代码是否对应;（2）使用四个编译器演示DDC（小型C编译器、小型Lisp编译器、小型恶意损坏的Lisp编译器和大型工业强度C编译器GCC），以及（3）用于在各种真实世界场景中应用DDC的方法的描述。在DDC技术中，源代码被编译两次：使用可信编译器编译器的父源代码，然后使用第一次编译的结果编译推定编译器源代码。如果DDC结果与原始的被测编译器的可执行代码逐位相同，并且某些其他假设成立，则被测编译器的可执行代码与其假定的源代码相对应。
英文摘要：
An Air Force evaluation of Multics, and Ken Thompson's Turing award lecture ("Reflections on Trusting Trust"), showed that compilers can be subverted to insert malicious Trojan horses into critical software, including themselves. If this "trusting trust" attack goes undetected, even complete analysis of a system's source code will not find the malicious code that is running. Previously-known countermeasures have been grossly inadequate. If this attack cannot be countered, attackers can quietly subvert entire classes of computer systems, gaining complete control over financial, infrastructure, military, and/or business systems worldwide. This dissertation's thesis is that the trusting trust attack can be detected and effectively countered using the "Diverse Double-Compiling" (DDC) technique, as demonstrated by (1) a formal proof that DDC can determine if source code and generated executable code correspond, (2) a demonstration of DDC with four compilers (a small C compiler, a small Lisp compiler, a small maliciously corrupted Lisp compiler, and a large industrial-strength C compiler, GCC), and (3) a description of approaches for applying DDC in various real-world scenarios. In the DDC technique, source code is compiled twice: the source code of the compiler's parent is compiled using a trusted compiler, and then the putative compiler source code is compiled using the result of the first compilation. If the DDC result is bit-for-bit identical with the original compiler-under-test's executable, and certain other assumptions hold, then the compiler-under-test's executable corresponds with its putative source code.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
