A quantitative probabilistic relational Hoare logic

TL;DR

eRHL is a new quantitative relational program logic that enables reasoning about probabilistic programs' properties, including security and privacy, overcoming limitations of previous logics like PRHL and apRHL.

Contribution

It introduces eRHL, the first relational probabilistic logic with soundness and completeness for all almost surely terminating programs, supporting advanced properties like differential privacy.

Findings

eRHL is sound and complete for program equivalence, statistical distance, and differential privacy.

It surpasses prior logics by handling more complex probabilistic properties.

eRHL is practically applicable to examples beyond previous logics' reach.

Abstract

We introduce eRHL, a program logic for reasoning about relational expectation properties of pairs of probabilistic programs. eRHL is quantitative, i.e., its pre- and post-conditions take values in the extended non-negative reals. Thanks to its quantitative assertions, eRHL overcomes randomness alignment restrictions from prior logics, including PRHL, a popular relational program logic used to reason about security of cryptographic constructions, and apRHL, a variant of PRHL for differential privacy. As a result, eRHL is the first relational probabilistic program logic to be supported by non-trivial soundness and completeness results for all almost surely terminating programs. We show that eRHL is sound and complete with respect to program equivalence, statistical distance, and differential privacy. We also show that every PRHL judgment is valid iff it is provable in eRHL. We showcase the practical benefits of eRHL with examples that are beyond reach of PRHL and apRHL.