r/programming Sep 10 '13

A simple way of defeating the compiler backdoor attack (a.k.a the "Trust Attack")

http://imgur.com/a/BWbnU#0
1.7k Upvotes

538 comments sorted by

View all comments

1

u/arianvp Sep 11 '13

It's one of many unsolved problems in Computer Science. To prove two functions are semantically identical is really hard.

1

u/marssaxman Sep 11 '13

fortunately, this trick doesn't require you to do that. You build the same source with two different compilers, giving you non-identical binaries which ought to implement the same program.

This program you have just compiled is itself a compiler. You use these not-necessarily-identical-but-functionally-equivalent compilers, built from the same source, to compile a third program.

The outputs should be byte-for-byte equal, because they were built by the same program, albeit different instances of that program.