Relational Hoare Type Theory (RHTT) for Information Flow and Access Control
===========================================================================

This directory contains the Coq files associated with the paper
"Verification of Information Flow and Access Control via Dependent Types".

The files develop libraries and examples for full program verification
in a higher-order and dependently typed variant of Relational Hoare
Logic.

Examples include implementations and verifications of a number of
security policies related to non-interference, declassification,
erasure, as well as state-based policies.

The developments require the Ssreflect extension of Coq V8.3, patch
level 1.

Obtaining and installing SSreflect
==================================

The current version of Ssreflect is version 1.3pl1, available for Coq V8.3pl1.

To install Ssreflect-1.3, download the sources at 

   http://www.msr-inria.inria.fr/Projects/math-components

unpack, and follow the instructions in the INSTALL and README files.

Compiling RHTT libraries and examples
=================================================

After compiling ssreflect-1.3, make sure that the 
theory files (sources as well as compiled versions) are installed
in $COQTOP/Ssreflect. If your installation ended up putting the files
somewhere else, you'll have to appropriately modify the Make file
in the current directory. You'll have to change the line

  COQLIBS = "-I . -I $(COQTOP)/Ssreflect"

to point to your directory with ssreflect files. 

After that, to compile RHTT, type

  coq_makefile -f Make -o Makefile
  make

Description of the files 
========================

The directory contains the following files. 

 1. Make (the generator for the Makefile)

 2. ordtype.v
    Library for types with a decidable ordering relation on them.

 3. fmap.v
    Library for purely functional finite maps, i.e., partial functions
    from keys to values which are defined for only finitely many keys.

 4. rels.v 
    Library for relations over arbitrary type.

 5. heaps.v 
    Main definitions and lemmas related to the datatype of heaps.

 6. hprop.v 
    Definitions and lemmas about separation logic predicates, i.e.,
    predicates over heaps.

 7. domains.v
    Library for posets, CPO's and admissibility.

 8. stmod.v
    Definition of the model for STsec types of RHTT.  This file is
    described in more detail in Section 3 of the paper.
 
 9. stcont.v 
    Lemmas about continuity of all the constructors. Plus, opaque
    sealing of the constructor definitions, so that reasoning is done
    only via specs, and not via the model.

10. stlog.v
    Inference rules of our logic; used for discharging the proof
    obligations generated by the programs. This file is described in
    more details in Section 4 of the paper.
     
11. examples.v
    Some basic examples and experimentation. Contains the proofs for
    the Terauchi and Aiken example, which is presented (in a shortened
    form) in Example 1 of the paper.

12. alice.v
    The main set of examples about information flow and access
    control.  Contains the examples 2, 3, 4 and 5 from Section 2 of
    the paper.  It also contains a number of alternative
    implementations of the Alice signatures. 

13. alice2.v
    Alternative implementations of alice.v. 

14. llist.v
    A library of linked lists (not the one from the paper). Also
    contains the verification of the in-place reversal algorithm.

15. llist2.v
    Alternative specification of singly-linked lists.

16. llist3.v
    Yet another alternative specification of lists. This is the one 
    from Section 5 of the paper. Contains reasoining about low linkage
    and examples with heterogeneous lists.

17. principals.v
    An example introducing principals into the system, so that one can
    grant access based on the identity of the principal. Inspired by
    "Roles, stacks, histories: a triple for Hoare" by Borgstroem,
    Gordon and Pucella.

18. average.v
    An example with "multi-party" computation, where an average salary
    of two employees of a company is declassified, without
    declassifying the individual salaries.



