Type-Driven Gradual Security with References

Abstract

In security-typed programming languages, types statically enforce noninterference between potentially conspiring values, such as the arguments and results of functions. But to adopt static security types, like other advanced type disciplines, programmers face a steep wholesale transition, often forcing them to refactor working code just to satisfy their type checker. To provide a gentler path to security typing that supports safe and stylish but hard-to-verify programming idioms, researchers have designed languages that blend static and dynamic checking of security types. Unfortunately, most of the resulting languages only support static, type-based reasoning about noninterference if a program is entirely statically secured. This limitation substantially weakens the benefits that dynamic enforcement brings to static security typing. Additionally, current proposals are focused on languages with explicit casts and therefore do not fulfill the vision of gradual typing, according to which the boundaries between static and dynamic checking only arise from the (im)precision of type annotations and are transparently mediated by implicit checks. In this article, we present GSL Ref , a gradual security-typed higher-order language with references. As a gradual language, GSL Ref supports the range of static-to-dynamic security checking exclusively driven by type annotations, without resorting to explicit casts. Additionally, GSL Ref lets programmers use types to reason statically about termination-insensitive noninterference in all programs, even those that enforce security dynamically. We prove that GSL Ref satisfies all but one of Siek et al.’s criteria for gradually-typed languages, which ensure that programs can seamlessly transition between simple typing and security typing. A notable exception regards the dynamic gradual guarantee, which some specific programs must violate if they are to satisfy noninterference; it remains an open question whether such a language could fully satisfy the dynamic gradual guarantee. To realize this design, we were led to draw a sharp distinction between syntactic type safety and semantic type soundness , each of which constrains the design of the gradual language.

Gradual parametricity, revisited

“…We nd that AGT greatly streamlines the static semantics of GSF, but does not yield a language that respects parametricity by default; non-trivial exploration was necessary to uncover how to strengthen the structure and treatment of runtime evidence in order to recover parametricity. We show that parametricity is, like noninterference (Toro et al 2018), incompatible with the dynamic gradual guarantee laid forth by Siek et al (2015a). We nevertheless establish a novel, weaker property of GSF regarding the embedding of System F terms at less precise types, which allows us to disprove some claims from the literature about gradual free theorems.…”

“…Both parametricity and noninterference are 2-safety properties, expressed as a relation of two program executions. While Garcia and Tanter (2015) show that one can derive a pure security language with AGT that satis es both noninterference and the dynamic gradual guarantee, Toro et al (2018) nd that in presence of mutable references, one can have either the dynamic gradual guarantee, or noninterference, but not both. Also similarly to this work, AGT for security typing needs a more precise abstraction for evidence types (based on security label intervals) in order to enforce noninterference.…”

“…Dually, if one sticks to the natural notion of precision, as adopted by both GSF and CSA, and justi ed by the AGT interpretation, reconciliation might come from considering other forms of parametricity, or perhaps less exible gradual language designs (Devriese et al 2018). Currently, it seems that the incompatibility of the dynamic gradual guarantee with parametricity has to be understood, in conjunction with a similar observation regarding noninterference (Toro et al 2018), as hinting towards further re ned criteria for semantically-rich gradual typing. In particular, weaker forms of the dynamic gradual guarantee might still be useful, as explored next.…”

Towards Gradually Typed Capabilities in the Pi-Calculus

“…There has been considerable work in gradual typing both from industry [3,9,27,4] and academia [18,24,26,14,17,1]. The challenge in capturing a calculus such as the π-calculus is that several output processes may compete for a single input.…”

Approximate normalization for gradual dependent types

“…Gradual typing has been adapted to many other type disciplines, including ownership types [Sergey and Clar 2012], effects [Bañados Schwerter et al 2016], refinement types [Lehmann and Tanter 2017], security types [Fennell and Thiemann 2013;Toro et al 2018a], and session types [Igarashi et al 2017]. But it has not yet reached dependent types.…”