Verifying Rust cryptography in SymCrypt, from standards to code

Details

Microsoft Research is applying formal verification to SymCrypt, the cryptographic library powering Windows and Azure. New algorithms are written in safe Rust — ruling out memory safety bugs by construction — then machine-checked for functional correctness against specifications derived from published standards, using the Lean proof framework and the Aeneas toolchain that bridges Rust and Lean. Initial releases cover SHA-3 and ML-KEM, the NIST-standardized post-quantum key encapsulation algorithm. The key workflow change is using AI agents to write Lean proofs. Human effort concentrates on formalizing standards and specifying high-level properties; agents handle proof-writing at scale, with each proof independently verifiable. This makes formal verification economically feasible for a production library where manual proof work has historically been prohibitive. The methodology deliberately preserves production code choices — bit manipulations, architecture-specific optimizations, constant-time loops — rather than verifying only clean reference implementations. This is the hard part of production cryptographic verification that most academic work sidesteps. ML-KEM coverage is directly relevant to enterprises beginning post-quantum migration for Azure and Windows workloads. Microsoft is releasing all artifacts publicly: code, specs, properties, and proofs.