Reflections on Trusting Trust
loresecurityprogramming
Ken Thompson's 1984 demonstration that a compiler can hide a self-propagating backdoor invisible in the source.
In his Turing Award lecture, Thompson described teaching a compiler to insert a login backdoor and to re-insert that same trick whenever it compiled a fresh compiler, so the malice survived even though no source contained it. The moral - you cannot fully trust code you did not write yourself, down to the tools - still anchors supply-chain security.
Ken Thompson's 1984 Turing Award lecture, Reflections on Trusting Trust, describes an attack that remains genuinely unsettling forty years later. He explains how to put a backdoor in a compiler that inserts a backdoor into the login program, and then the second move: teach the compiler to insert both backdoors when compiling a new version of itself.
The consequence is what makes it famous. After that, the malicious code can be deleted from the compiler source entirely. The source is clean, auditable, and provably contains nothing bad, and the binary keeps reproducing the attack forever because each generation is compiled by the previous one. You cannot find it by reading code, because there is no code left to find.
The conclusion Thompson drew is the uncomfortable part: you cannot trust code you did not totally create yourself, and since nobody writes their own compiler, kernel and firmware, the trust has to bottom out somewhere you cannot verify. Diverse double-compiling offers a partial answer by using an independent compiler to detect the discrepancy, and reproducible builds attack the same problem from another angle. Neither eliminates the point, which is that trust in software is ultimately social rather than technical.
Also known as: the Thompson hack, trusting trust, compiler backdoor