{
  "slug": "cbmc",
  "name": "CBMC",
  "tagline": "Bounded model checker for C, used on mlkem-native and s2n",
  "maintainer": "Diffblue, AWS and community",
  "url": "https://github.com/diffblue/cbmc",
  "repo": "https://github.com/diffblue/cbmc",
  "category": "implementations",
  "targets": [
    "C",
    "mlkem-native",
    "s2n"
  ],
  "approach": "Bounded model checking for memory safety and assertions",
  "license": "Open source (BSD-4)",
  "status": "Active, mature",
  "summary": "CBMC is the bounded model checker behind Kani and the memory-safety proofs of mlkem-native and AWS s2n. It proves absence of memory errors and assertion failures in C within loop bounds.",
  "details": [
    "mlkem-native pairs CBMC memory-safety proofs with s2n-bignum functional proofs, a pragmatic model for post-quantum C libraries."
  ],
  "strengths": [
    "Mature and widely deployed.",
    "Concrete counterexamples.",
    "No spec needed for memory safety."
  ],
  "limits": [
    "Bounded.",
    "No functional correctness.",
    "Modelling effort for harnesses."
  ],
  "fit": [
    "Use CBMC on C cryptographic code for memory safety before any deeper verification."
  ],
  "references": [
    [
      "CBMC repository",
      "https://github.com/diffblue/cbmc"
    ]
  ],
  "category_name": "Verified implementations",
  "page": "https://sorryfree.com/frameworks/cbmc/",
  "updated": "2026-09-13"
}