{"id":19864147,"url":"https://github.com/sr-lab/skeptic-authority-template","last_synced_at":"2025-02-28T23:21:00.979Z","repository":{"id":75386414,"uuid":"197819922","full_name":"sr-lab/skeptic-authority-template","owner":"sr-lab","description":"A basic template for a Skeptic authority.","archived":false,"fork":false,"pushed_at":"2019-12-08T11:54:48.000Z","size":80,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-01-11T15:34:16.440Z","etag":null,"topics":["code-generation","coq","formal-methods","password-policy","verification"],"latest_commit_sha":null,"homepage":"https://sr-lab.github.io/skeptic-authority-template/","language":"Coq","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sr-lab.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-07-19T17:57:51.000Z","updated_at":"2020-05-26T18:51:22.000Z","dependencies_parsed_at":"2023-07-25T11:48:44.116Z","dependency_job_id":null,"html_url":"https://github.com/sr-lab/skeptic-authority-template","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sr-lab%2Fskeptic-authority-template","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sr-lab%2Fskeptic-authority-template/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sr-lab%2Fskeptic-authority-template/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sr-lab%2Fskeptic-authority-template/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sr-lab","download_url":"https://codeload.github.com/sr-lab/skeptic-authority-template/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241273168,"owners_count":19937096,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["code-generation","coq","formal-methods","password-policy","verification"],"created_at":"2024-11-12T15:17:37.394Z","updated_at":"2025-02-28T23:21:00.964Z","avatar_url":"https://github.com/sr-lab.png","language":"Coq","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Skeptic Authority Template\nA basic template for a Skeptic authority.\n\n![Logo](assets/logo-text-h.svg)\n\n## Overview\nA Skeptic _authority_ is an application, written in Coq and utilising [Coq.io](http://coq.io/), that accepts or rejects passwords based on password composition policies refined from  configuration parameters specified with respect to some piece of password composition policy enforecment software. Because we do this from within Coq, we are granted the freedom to write theorems to verify that our transformation of software-specific configuration parameters to a low-level predicate-based representation of password composition policies is correct.\n\nThe low-level model of password composition policies used in this library is based on [the 2013 work by Blocki et al.](https://arxiv.org/pdf/1302.5101.pdf) \\[1\\] extended with meta-rules, which are just predicates that allow us to create rules from attacks using set abstraction.\n\n## Prerequisites\nTo build and use this project, the following software is required:\n\n* Python v3.6.8 \\[[^](https://www.python.org/downloads/)\\]\n* Coq v8.8.1 \\[[^](https://github.com/coq/coq/wiki/Installation-of-Coq-on-Linux)\\]\n* Coq.io v3.1.0 \\[[^](http://coq.io/getting_started.html)\\]\n\nOther versions of the above might work, but haven't been tested. Definitely *will not* work with Python 2. Other utilities including `ocamlfind`, `ocamlbuild` etc. are required too, but should be installable via opam without too much of an issue if not already present.\n\n## Setup\nEvery piece of password composition policy enforecment software is different. For this reason, it's necessary to specify the type of their configuration options before we get started writing any proofs etc. An interactive script named `init.py` is provided to get you started with this. What follows is an example of how we would go about setting this project up for a piece of hypothetical password composition policy enforcement software that takes password length, required number of digits and a blacklist as input.\n\nFirstly, run `init.py` like so:\n\n```bash\npython3 init.py\n```\n\nWe'll then be asked to specify a root namespace for our project. In this case, let's just call it `HypotheticalAuthority`:\n\n```bash\nCopied ./src/Makefile.dist to ./src/Makefile\nWhat root namespace would you like your code to reside under? HypotheticalAuthority\nRoot namespace populated in ./src/Makefile\n```\n\nYour Coq project is now set up (this will be important later).\n\nYou'll then be asked about the configuration parameters your piece of password composition policy enforement software takes. In this case, we specify that it takes a length (as a natural number), a number of digits (as a natural number) and a blacklist (as a list of strings).\n\n```bash\nWould you like to build your policy configuration parameters interactively now? [y/N] y\nPlease name your parameter: length\nFor parameter length please specify a type: nat\nAdd another parameter? [y/N] y\nPlease name your parameter: digits\nFor parameter digits please specify a type: nat\nAdd another parameter? [y/N] y\nPlease name your parameter: blacklist\nFor parameter blacklist please specify a type: list string\nAdd another parameter? [y/N] n\n```\n\nYou've now made the script aware of the configuration parameters taken by the piece of software you're modelling, as well as their types. Next, we'll be able to pre-configure some policies. Let's informally specify what they do now:\n\n* `basic8`: Passwords must have minimum length 8, no other constraints.\n* `basic16`: Passwords must have minimum  length 16, no other constraints.\n* `digit8`: Passwords must have minimum length 8 and at least 1 digit.\n* `dict8`: Passwords must have minimum length 8 and cannot be `password` or `hunter2`.\n\nNow let's get to specifying these:\n\n```bash\nWould you like to preconfigure some policies interactively now? [y/N] y\nPlease name your policy: basic8\nFor parameter length please specify a value in type nat: 8\nFor parameter digits please specify a value in type nat: 0\nFor parameter blacklist please specify a value in type list string: []\nAdd another policy? [y/N] y\nPlease name your policy: basic16\nFor parameter length please specify a value in type nat: 16\nFor parameter digits please specify a value in type nat: 0\nFor parameter blacklist please specify a value in type list string: []\nAdd another policy? [y/N] y\nPlease name your policy: digit8\nFor parameter length please specify a value in type nat: 8\nFor parameter digits please specify a value in type nat: 1\nFor parameter blacklist please specify a value in type list string: []\nAdd another policy? [y/N] y\nPlease name your policy: dict8\nFor parameter length please specify a value in type nat: 8\nFor parameter digits please specify a value in type nat: 0\nFor parameter blacklist please specify a value in type list string: [\"password\"; \"hunter2\"]\nAdd another policy? [y/N] n\n```\n\nNow we're done, we can go ahead and delete the template files and `init.py` script, which are just used for code generation and can be removed.\n\n```bash\nAll done, delete template files and this script now? [y/N] y\n```\n\nNow, take a look in `/src/Authority.py`. You'll notice that a type has been generated for us which captures our configuration parameters. Notice the two natural numbers in `nat` for length and digits and a list of strings in `list string` for the blacklist:\n\n```coq\n(** Definition of the data type for the password composition policy enforcement\n    software configuration parameters.\n  *)\nDefinition Configuration : Type :=\n  (nat * nat * list string).\n```\n\nAlso notice that a lookup has been generated for finding configuration parameters based on policy name:\n\n```coq\n(** Looks up a configuration parameters tuple by name.\n    - [name] is the name of the tuple to look up\n  *)\nDefinition lookup_config (name : string) : option Configuration :=\n  match name with\n  | \"basic8\" =\u003e Some (8, 0, [])\n  | \"basic16\" =\u003e Some (16, 0, [])\n  | \"digit8\" =\u003e Some (8, 1, [])\n  | \"dict8\" =\u003e Some (8, 0, [\"password\"; \"hunter2\"])\n  | _ =\u003e None\n  end.\n```\n\nNote, however, that the all-important `transform` function which turns values in `Configuration` into lists of meta-rules in `list MetaRule` just returns an empty list, though the pattern matching on the tuple has been added in for you based on the names you specified earlier. It's now up to you to specify and verify the semantics for transformation of your `Configuration` type into a list of predicates.\n\n```coq\n(** Transforms a tuple containing software-specific configuration parameters\n    to a list of meta-rules.\n    - [config] is the tuple to transform\n  *)\nDefinition transform (config : Configuration) : list MetaRule :=\n  match config with\n  | (len, digits, dict) =\u003e []\n  end.\n```\n\nFor now, let's just add in a predicate that checks string length as below. Adding in functionality such that `digits` and `dict` are no longer ignored is left out for the purposes of this demonstration, though dictionary checks can take advantage of the bundled `Io.v` library which uses [our generic implementation of tries](https://github.com/sr-lab/coq-tries) for efficient lookups.\n\n```coq\n(** Transforms a tuple containing software-specific configuration parameters\n    to a list of meta-rules.\n    - [config] is the tuple to transform\n  *)\nDefinition transform (config : Configuration) : list MetaRule :=\n  match config with\n  | (len, digits, dict) =\u003e [(fun x =\u003e Nat.leb len (length x))]\n  end.\n```\n\n## Building\nAfter completing setup above, it's now possible to build the authority application itself.\n\n```bash\ncd ./src\nmake authority\n```\n\nAn application called `authority.native` is extracted and built from the Coq code. Running this like so, we'll be prompted for input:\n\n```bash\n./authority.native basic8 10\n```\n\nTry typing in a few passwords. Notice that the application accepts or rejects them based on the policy specified:\n\n```bash\npassword\ntrue\n123456\nfalse\nfoo\nfalse\nbar\nfalse\nlongpass\ntrue\n```\n\nA total of 10 passwords will be read before the application exits, like we specified when we invoked it.\n\n## Utility\nCompiled Skeptic authorities can be used with [Pyrrho](https://github.com/sr-lab/pyrrho) to filter and renormalise password probability distributions computed from large datasets. For instructions on doing this, consult that repository.\n\n## Acknowledgements\n* The font used in the logo is [Monofur](https://www.dafont.com/monofur.font) by Tobias Benjamin Köhler.\n\n## References\n1. Jeremiah Blocki, Saranga Komanduri, Ariel Procaccia, and Or Sheffet. 2013. Optimizing password composition policies. In Proceedings of the fourteenth ACM conference on Electronic commerce (EC '13). ACM, New York, NY, USA, 105-122. DOI: https://doi.org/10.1145/2492002.2482552 \\[[PDF](https://arxiv.org/pdf/1302.5101.pdf)\\]\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsr-lab%2Fskeptic-authority-template","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsr-lab%2Fskeptic-authority-template","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsr-lab%2Fskeptic-authority-template/lists"}