DY*
Direct answerDY* verifies protocol implementations written in F* against symbolic security properties, so the analysed model is the executable code. It has been applied to Signal and ACME and is the successor to ProScript.
- Maintainer
- Inria, CISPA, University of Stuttgart
- Website
- https://github.com/REPROSEC/dolev-yao-star
- Repository
- https://github.com/REPROSEC/dolev-yao-star
- Category
- Symbolic protocol analysis
- Targets
- Protocol implementations in F* (Signal, ACME)
- Approach
- Dolev-Yao reasoning inside the F* proof assistant, over executable protocol code
- Access
- Open source
- Status (2026-09-13)
- Research, active
What DY* does
DY* trades automation for precision: the properties hold of the code you run, not a hand-drawn model.
Where it is strong
- No model-code gap.
- Composable with HACL* verified primitives.
Limits and caveats
- F* implementation required.
- Research maturity.
- Manual proof effort.
When to choose it
Choose DY* when the implementation itself is in F* or can be.
Who works with DY*
No firm on this index lists DY* as a core tool yet; the firms below cover the same problem class.
Top-listed for protocol analysis work: zkSecurity
Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.
Read the zkSecurity profile · Website
Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.
Read the zkSecurity profile · Website