Relational reasoning via probabilistic coupling

TL;DR

This paper shows that the relational program logic pRHL can internalize probabilistic coupling, simplifying the process of constructing and verifying couplings in probabilistic processes, with applications demonstrated in cryptography.

Contribution

It reveals that pRHL inherently supports probabilistic coupling, making the construction and verification of couplings as straightforward as logical proof development.

Findings

pRHL internalizes probabilistic coupling concepts

Constructing couplings reduces to logical proof construction

Successfully verified several couplings in EasyCrypt

Abstract

Probabilistic coupling is a powerful tool for analyzing pairs of probabilistic processes. Roughly, coupling two processes requires finding an appropriate witness process that models both processes in the same probability space. Couplings are powerful tools proving properties about the relation between two processes, include reasoning about convergence of distributions and stochastic dominance---a probabilistic version of a monotonicity property. While the mathematical definition of coupling looks rather complex and cumbersome to manipulate, we show that the relational program logic pRHL---the logic underlying the EasyCrypt cryptographic proof assistant---already internalizes a generalization of probabilistic coupling. With this insight, constructing couplings is no harder than constructing logical proofs. We demonstrate how to express and verify classic examples of couplings in pRHL, and we mechanically verify several couplings in EasyCrypt.