Reflections on Trusting Trust

✨ Summary

Summary

Ken Thompson describes how malicious behavior can be introduced into software through a compromised compiler. The argument proceeds through three ideas: self-reproducing programs, compiler bootstrapping in which implementation knowledge can persist in a binary compiler, and a compiler modification that inserts a backdoor into compiled authentication software while also reproducing the modification whenever the compiler recompiles itself. Consequently, inspecting the compiler’s source code or recompiling a target program from apparently clean source may fail to reveal the compromise. Thompson generalizes the problem beyond compilers to assemblers, loaders, and hardware microcode.

The paper has had a direct influence on subsequent research into compiler integrity. David Wheeler’s work on Diverse Double-Compiling (DDC) formalized and demonstrated a method intended to detect and counter the trusting-trust attack, including experiments involving GCC. (arxiv.org) The argument has also been applied to secure-system design: research on electronic voting software cited the paper when analyzing the risk that source-code review cannot establish executable correctness unless the compiler and other transformation tools are trusted. (usenix.org) Later technical work has connected Thompson’s example to modern software supply-chain security and reproduced the attack using the original style of compiler backdoor. (research.swtch.com) A subsequent ACM article further used the attack as a framework for discussing trusted-computing platforms and the limits of relying on certified lower-level components. (www2.dmst.aueb.gr) Bibliographic records identify the article as a 1984 Communications of the ACM publication by Ken Thompson. (refs.drheap.org)