We propose and study StkTokens: a new calling convention that provably enforces well-
bracketed control flow and local state encapsulation on a capability machine. The calling …

Capability machines are a type of CPUs that support fine-grained privilege separation using
capabilities, machine words that include forms of authority. Formal models of capability …

Undefined behavior in C often causes devastating security vulnerabilities. One practical
mitigation is compartmentalization, which allows developers to structure large programs into …

This thesis presents the design, implementation, and evaluation of a novel capability
operating system: CheriOS. The guiding motivation behind CheriOS is to provide strong …

Capability machines such as CHERI provide memory capabilities that can be used by
compilers to provide security benefits for compiled code (eg, memory safety). The existing C …

Proving secure compilation of partial programs typically requires back-translating an attack
against the compiled program to an attack against the source program. To prove back …

We introduce a novel approach to secure compilation based on maps of distributive laws.
We demonstrate through four examples that the coherence criterion for maps of distributive …

Memory safety concerns continue to be a major source of security vulnerabilities. The
CHERI architecture, as instantiated in prototype CHERI-RISC-V cores, the Arm Morello …

We propose and study StkTokens: a new calling convention that provably enforces well-
bracketed control flow and local state encapsulation on a capability machine. The calling …

Today, computer security is often based on mitigations that make exploitation cumbersome
or unlikely. In other words, mitigation techniques provide no security guarantee, and time …