A tale of two provers: verifying monoidal string matching in liquid Haskell and Coq

Vazou, Niki; Lampropoulos, Leonidas; Polakow, Jeff

doi:10.1145/3122955.3122963

Cited by 16 publications

(14 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We present them the same way in this paper, rather than reformatting them as mathematical inference rules. Metatheoretic properties are expressed as refinement types, following Vazou et al [2017Vazou et al [ , 2018, and proofs are Haskell functions with these types (checked by the SMT solver). We assess our experience using Liquid Haskell for metatheory in comparison to related approaches in § 5.…”

Section: Mechanizing Noninterference Of Lio In Liquid Haskellmentioning

confidence: 99%

See 1 more Smart Citation

LWeb: information flow security for multi-tier web applications

Parker

Vazou

Hicks

2019

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

This paper presents LWeb, a framework for enforcing label-based, information flow policies in database-using web applications. In a nutshell, LWeb marries the LIO Haskell IFC enforcement library with the Yesod web programming framework. The implementation has two parts. First, we extract the core of LIO into a monad transformer (LMonad) and then apply it to Yesod's core monad. Second, we extend Yesod's table definition DSL and query functionality to permit defining and enforcing label-based policies on tables and enforcing them during query processing. LWeb's policy language is expressive, permitting dynamic per-table and per-row policies. We formalize the essence of LWeb in the λ LWeb calculus and mechanize the proof of noninterference in Liquid Haskell. This mechanization constitutes the first metatheoretic proof carried out in Liquid Haskell. We also used LWeb to build a substantial web site hosting the Build it, Break it, Fix it security-oriented programming contest. The site involves 40 data tables and sophisticated policies. Compared to manually checking security policies, LWeb imposes a modest runtime overhead of between 2% to 21%. It reduces the trusted code base from the whole application to just 1% of the application code, and 21% of the code overall (when counting LWeb too).A promising solution to these problems is embodied in the LIO system for Haskell. LIO is a drop-in replacement for the Haskell IO monad, extending IO with an internal current label and clearance label. Such labels are lattice ordered (as is typical [Denning 1976]), with the degenerate case being a secret (high) label and public (low) one. LIO's current label constitutes the least upper bound of the security labels of all values read during the current computation. Effectful operations such as reading/writing from stable storage, or communicating with other processes, are checked against the current label. If the operation's security label (e.g., that on a channel being written to) is lower than the current label, then the operation is rejected as potentially insecure. The clearance serves as an upper bound that the current label may never cross, even prior to performing any I/O, so as to reduce the chance of side channels. Haskell's clear, type-enforced separation of pure computation from effects makes LIO easy to implement soundly and efficiently, compared to other dynamic enforcement mechanisms. This paper presents LWeb, an extension to LIO that aims to bring its benefits to Haskell-based web applications. This paper presents the three main contributions of our work.First, we present an extension to a core LIO formalism with support for database transactions. Each table has a label that protects its length. In our implementation we use DC labels , which have both confidentiality and integrity components. The confidentiality component of the table label controls who can query it (as the result may reveal something about the table's length), and the integrity component controls who can add or delete rows (since both may change the ...

show abstract

Section: Mechanizing Noninterference Of Lio In Liquid Haskellmentioning

confidence: 99%

“…The rest of this section summarizes what we view as the (current) advantages and disadvantages of using Liquid Haskell as a theorem prover compared to other alternatives (e.g., Coq and Fstar [Swamy et al 2016]), expanding on a prior assessment [Vazou et al 2017].…”

Section: Liquid Haskell For Metatheorymentioning

confidence: 99%

LWeb: information flow security for multi-tier web applications

Parker

Vazou

Hicks

2019

Proc. ACM Program. Lang.

Self Cite

View full text Add to dashboard Cite

show abstract

“…intros l1 Coq is not without its benefits [Vazou et al 2017], however. It provides an extensive library of theorems, interactive proof assistance, and a small trusted code base, all of which are currently lacking in Liquid Haskell.…”

Section: Proofmentioning

confidence: 99%

Theorem proving for all: equational reasoning in liquid Haskell (functional pearl)

et al. 2018

Self Cite

View full text Add to dashboard Cite

Equational reasoning is one of the key features of pure functional languages such as Haskell. To date, however, such reasoning always took place externally to Haskell, either manually on paper, or mechanised in a theorem prover. This article shows how equational reasoning can be performed directly and seamlessly within Haskell itself, and be checked using Liquid Haskell. In particular, language learners -to whom external theorem provers are out of reach -can benefit from having their proofs mechanically checked. Concretely, we show how the equational proofs and derivations from Hutton [2016]'s textbook can be recast as proofs in Haskell (spoiler: they look essentially the same).

show abstract

“…Finally, well-founded recursion works well with abstraction. The following excerpt is from Vazou et al [2017]'s comparison of Liqid Haskell and Coq. The chunk function below chunks a value in an abstract type of chunkable monoidal types into a list of values of a given positive size i 2 .…”

Section: Introductionmentioning

confidence: 99%

“…i) = false, which is essential to conclude that the recursive call is allowed. Vazou et al [2017] chose to formalize this in Coq using fuel, but it is much more naturally expressed as a well-founded recursive function, as they do in Liquid Haskell.…”

Section: Introductionmentioning

confidence: 99%

Equations reloaded: high-level dependently-typed functional programming and proving in Coq

Sozeau

Mangin

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Eqations is a plugin for the Coq proof assistant which provides a notation for defining programs by dependent pattern-matching and structural or well-founded recursion. It additionally derives useful high-level proof principles for demonstrating properties about them, abstracting away from the implementation details of the function and its compiled form. We present a general design and implementation that provides a robust and expressive function definition package as a definitional extension to the Coq kernel. At the core of the system is a new simplifier for dependent equalities based on an original handling of the no-confusion property of constructors.

show abstract

A tale of two provers: verifying monoidal string matching in liquid Haskell and Coq

Cited by 16 publications

References 18 publications

LWeb: information flow security for multi-tier web applications

LWeb: information flow security for multi-tier web applications

Theorem proving for all: equational reasoning in liquid Haskell (functional pearl)

Equations reloaded: high-level dependently-typed functional programming and proving in Coq

Contact Info

Product

Resources

About