3 ms·
Note that existence of a formal proof for security is no silver bullet. A real world example of this is the WPA2 key exchange's formal proofs not catching the K
by est31 7y ago
Note that existence of a formal proof for security is no silver bullet. A real world example of this is the WPA2 key exchange's formal proofs not catching the KRACK vulnerability.
https://galois.com/blog/2017/10/formal-methods-krack-vulnerability/ https://galois.com/blog/2017/10/formal-methods-krack-vulnera...
That being said, it's a very valuable tool and should be applied more, not less.
- rrmm 7y agoYeah the subtitle can be, "Formal Verification highlights the difficulty of specifications". Which wasn't a secret in the first place. But yeah, fewer bugs is better than more.