DDC: how to detect invisible attacks in compilers

David A. Wheeler introduced Diverse Double-Compiling (DDC) to address a critical software security issue: the Trusting Trust compiler attack.

Trusting trust#

As described by Ken Thompson in 1984, a compromised compiler can inject backdoors into compiled programs and even infect newly built compilers, while source code still appears clean.

That creates a dangerous gap: compromised binaries with no obvious source-level evidence.

The fix: DDC (diverse double-compiling)#

DDC checks whether a final executable truly corresponds to its source code.

High-level flow:

1. Compile compiler A source with compiler A, producing X.
2. Compile the same source with a trusted and diverse compiler B, producing

Y.

1. Recompile the same source using Y, producing Z.
2. Compare X and Z bit by bit.

If X == Z, the build path is consistent. If not, hidden tampering is likely present.

Practical Bash validation script#

#!/bin/bash
# Simple DDC verification

SOURCE="compiler_A.c"
SUSPECT_COMPILER="./gcc-bad"
TRUSTED_OUTPUT="./output-from-trusted-path"

echo "Starting DDC verification..."

# 1. Build with suspect compiler
$SUSPECT_COMPILER -o suspect_binary $SOURCE

# 2. Compare SHA-256 hashes
HASH_A=$(sha256sum suspect_binary | cut -d ' ' -f 1)
HASH_Z=$(sha256sum $TRUSTED_OUTPUT | cut -d ' ' -f 1)

if [ "$HASH_A" = "$HASH_Z" ]; then
  echo "SUCCESS: hashes match."
else
  echo "ALERT: mismatch detected."
  diffoscope suspect_binary $TRUSTED_OUTPUT
fi

Useful tools#

• diffoscope: deep binary comparison and artifact-level diffs. https://domain.com/
• disorderfs: helps expose non-deterministic build behavior. https://domain.com/reproducible-builds/disorderfs

Reference projects#

• Bootstrappable Builds https://domain.com/
• GNU Mes https://domain.com/software/mes/
• GNU Mes https://domain.com/
• Reproducible Builds (Debian, Fedora, Arch, and others)
• David Wheeler's DDC work https://domain.com/dwheeler.html

DDC strengthens software supply chain trust by validating compilers through independent, diverse build paths. It raises attacker cost and improves verification reliability for critical systems.

See also

Cybersecurity Troubleshooting Fail2ban status 255 exception: migrating to systemd backend and Nginx modular includes

Cybersecurity Incident anatomy: mitigating simultaneous L7 attacks, Dovecot DoS, and CPU bottlenecks

Cybersecurity The fake QR code trap and how to protect real-world links

This post is licensed under CC BY-NC.