1<!DOCTYPE html> 2<html lang="en-US"> 3<head> 4<meta charset="utf-8"> 5<meta http-equiv="x-ua-compatible" content="ie=edge"> 6<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> 7 8 <link rel="preload" as="font" href="https://www.biscuitsec.org/fonts/vendor/jost/jost-v4-latin-regular.woff2" type="font/woff2" crossorigin> 9 <link rel="preload" as="font" href="https://www.biscuitsec.org/fonts/vendor/jost/jost-v4-latin-700.woff2" type="font/woff2" crossorigin> 10 11 12<link rel="stylesheet" href="https://www.biscuitsec.org/main.css"> 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 <meta name="robots" content="index, follow"> 36 <meta name="googlebot" content="index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1"> 37 <meta name="bingbot" content="index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1"> 38 39 40 41 42 43 44 45<title>Biscuit</title> 46<meta name="description" content=""> 47<link rel="canonical" href="https://www.biscuitsec.org/"> 48 49 50 51 52 53 54 55 56 57
58<script type="application/ld+json"> 59 { 60 "@context": "http://schema.org", 61 "@type": "BreadcrumbList", 62 63 { 64 "@type": "ListItem", 65 "position": 1 , 66 "name": "Home", 67 "item": "https://www.biscuitsec.org/" 68 }, 69 70 } 71</script>
71 72 73 74 75 76 <meta name="theme-color" content="#fff"> 77 <link rel="apple-touch-icon" sizes="180x180" href="https://www.biscuitsec.org/apple-touch-icon.png"> 78 <link rel="icon" type="image/png" sizes="32x32" href="https://www.biscuitsec.org/favicon-32x32.png"> 79 <link rel="icon" type="image/png" sizes="16x16" href="https://www.biscuitsec.org/favicon-16x16.png"> 80 81 <link rel="manifest" href="https://www.biscuitsec.org/site.webmanifest"> 82 83 84 85 86
87<script type="module" src="/index.js"></script>
87 88 89 <link rel="alternate" type="application/rss+xml" title="RSS" href="https://www.biscuitsec.org/blog/atom.xml"> 90 91 92 93 <meta property="og:image" content="/img/thumbnail.png" /> 94 95</head> 96 97<body class="home"> 98 99 100<div class="header-bar fixed-top"></div> 101<header class="navbar fixed-top navbar-expand-md navbar-light"> 102 <div class="container"> 103 <input class="menu-btn order-0" type="checkbox" id="menu-btn"> 104 <label class="menu-icon d-md-none" for="menu-btn"><span class="navicon"></span></label> 105 <a class="navbar-brand order-1 order-md-0 me-auto" href="https://www.biscuitsec.org">Biscuit</a> 106 <ul class="navbar-nav fork-me order-3 order-md-5"> 107 108 109 <li class="nav-item"> 110 <a class="nav-link" href="https://github.com/eclipse-biscuit/biscuit"><svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-github"><path d="M9 19c-5 1.5-5-2.5-7-3m14 6v-3.87a3.37 3.37 0 0 0-.94-2.61c3.14-.35 6.44-1.54 6.44-7A5.44 5.44 0 0 0 20 4.77 5.07 5.07 0 0 0 19.91 1S18.73.65 16 2.48a13.38 13.38 0 0 0-7 0C6.27.65 5.09 1 5.09 1A5.07 5.07 0 0 0 5 4.77a5.4 4 5.44 0 0 0-1.5 3.78c0 5.42 3.3 6.61 6.44 7A3.37 3.37 0 0 0 9 18.13V22"></path></svg><span class="ms-2 visually-hidden">GitHub</span></a> 111 </li> 112 113 114 </ul> 115 <div class="collapse navbar-collapse order-4 order-md-1"> 116 <ul class="navbar-nav main-nav me-auto order-5 order-md-2"> 117 118 <li class="nav-item"> 119 <a class="nav-link" href="https://doc.biscuitsec.org">Docs</a> 120 </li> 121 <li class="nav-item"> 122 <a class="nav-link" href="https://www.biscuitsec.org/blog/">Blog</a> 123 </li> 124 <li class="nav-item"> 125 <a class="nav-link" href="https://www.biscuitsec.org/docs/tooling/">Online tooling</a> 126 </li> 127 <li class="nav-item"> 128 <a class="nav-link" href="https://www.biscuitsec.org/docs/why-biscuit/">Learn more</a> 129 </li> 130 131 </ul> 132 <div class="break order-6 d-md-none"></div> 133 134 <form class="navbar-form flex-grow-1 order-7 order-md-3"> 135 <input id="userinput" class="form-control is-search" type="search" placeholder="Search docs..." 136 aria-label="Search docs..." autocomplete="off"> 137 <div id="suggestions" class="shadow bg-white rounded"></div> 138 </form> 139 140 </div> 141 </div> 142</header> 143 144 145 146 147<div class="wrap container" role="document"> 148 <div class="content"> 149 <section class="section container-fluid mt-n3 pb-3"> 150 <div class="row justify-content-center"> 151 <div class="col-lg-12 text-center"> 152 <h1 class="mt-0">Eclipse Biscuit</h1> 153 </div> 154 <div class="col-lg-9 col-xl-8 text-center"> 155 <p class="lead"><b>Eclipse Biscuit</b> is an authorization token with decentralized verification, offline attenuation and strong security policy enforcement based on a logic language</p> 156 <a class="btn btn-primary btn-lg px-4 mb-2" href="https://www.biscuitsec.org/docs/getting-started/introduction/index.html" role="button">Get started</a> 157 <p class="meta">Open-source Apache-2.0 License. <a href="https://github.com/eclipse-biscuit/biscuit">Specification</a></p> 158 </div> 159 </div> 160 </section> 161 </div> 162</div> 163 164<section class="section section-sm"> 165 <div class="container"> 166 <div class="row justify-content-center text-center"> 167 <bc-token-printer biscuit="En0KEwoEMTIzNBgDIgkKBwgKEgMYgAgSJAgAEiAs2CFWr5WyHHWEiMhTXxVNw4gP7PlADPaGfr_AQk9WohpA6LZTjFfFhcFQrMsp2O7bOI9BOzP-jIE5PGhha62HDfX4t5FLQivX5rUhH5iTv2c-rd0kDSazrww4cD1UCeytDSIiCiCfMgpVPOuqq371l1wHVhCXoIscKW-wrwiKN80vR_Rfzg=="></bc-token-printer> 168 </div> 169 </div> 170</section> 171 172<section class="section section-sm"> 173 <div class="container"> 174 <div class="row justify-content-center text-center"> 175 176 177 <div class="col-lg-5"> 178 <h2 class="h4">Decentralized verification</h2> 179 <p>Biscuit tokens are signed with public key cryptography: any application knowing the public key can verify the token</p> 180 </div> 181 182 <div class="col-lg-5"> 183 <h2 class="h4">Offline attenuation</h2> 184 <p>If you hold a valid token, you can generate a new one with less rights, like restricting write access or adding an expiration date</p> 185 </div> 186 187 <div class="col-lg-5"> 188 <h2 class="h4">Datalog policies</h2> 189 <p>Authorization policies are written in a logic language. They can be provided by the application, or transported by the token (attenuation)</p> 190 </div> 191 192 <div class="col-lg-5"> 193 <h2 class="h4">Capabilities or Access control lists</h2> 194 <p>Eclipse Biscuit is naturally suited for capabilities based authorization, by carrying a token customized for the request. But you can also provide verification side ACLs as Datalog</p> 195 </div> 196 197 <div class="col-lg-5"> 198 <h2 class="h4">Revocation</h2> 199 <p>All tokens come with unique revocation identifiers, that can be used to reject that token and all the tokens attenuated from it</p> 200 </div> 201 202 <div class="col-lg-5"> 203 <h2 class="h4">Portable</h2> 204 <p>Eclipse Biscuit is available in Rust, Haskell, Go, Java, JS (node & browser), WebAssembly, C, Python, C#⦠All you need for a new implementation is a Protobuf generator and Ed25519 signing. The specification comes with a list of predefined test cases</p> 205 </div> 206 207 208 </div> 209 </div> 210</section> 211 212 213<section class="section section-sm"> 214 <div class="container"> 215 <hr /> 216 <div class="row justify-content-center text-center"> 217 <h2>See it live</h2> 218<p>Test authorization policies in Datalog:</p> 219<div class="text-left"> 220<div style="text-align:left"> 221<bc-datalog-playground code="// we receive a request to read "admin.doc" 222// The request contains a token with the following content 223user(1234); 224 225// this restricts the kind of operation to "read" 226check if operation("read"); 227 228// The authorizer loads facts representing the request 229resource("admin.doc"); 230operation("read"); 231 232// The authorizer loads the user's rights 233right(1234, "admin.doc", "read"); 234right(1234, "admin.doc", "write"); 235 236// Finally, the authorizer tests policies 237// by looking for a set of facts matching them 238allow if
239 user($user_id), 240 resource($res), 241 operation($op), 242 right($user_id, $res, $op);"> 243</bc-datalog-playground> 244</div> 245 246</div> 247<div class="container"> 248 <img src="/img/thumbnail.png" style="height:0" /> 249 <div class="row justify-content-center text-center"> 250 <h2>Meet the team</h2> 251 <p>Eclipse Biscuit is the result of the help of dozens of contributors over the years, patiently refining the specification and implementations. The project is maintained and led by:</p> 252 <div class="col-lg-5"> 253 <h2 class="h4">Geoffroy Couprie</h2> 254 <img src="/img/geoffroy.jpg" style="width: 50%; margin-bottom: 10px" /> 255 <p>Geoffroy has worked on distributed systems security for over a decade, and is now working at Proton. You will often find him deep in discussions on protocols and cryptography.</p> 256 </div> 257 <div class="col-lg-5"> 258 <h2 class="h4">Clément Delafargue</h2> 259 <img src="/img/clement.jpg" style="width: 50%; margin-bottom: 10px" /> 260 <p>Clément is a functional programmer working at Datadog. He loves discussing FP, distributed systems, cloud architecture, fancy coffee brewing, and dogs obviously.</p> 261 </div> 262 <div class="col-lg-5"> 263 <h2 class="h4">Cédric Corbière</h2> 264 <img src="/img/cedric.jpg" style="width: 50%; margin-bottom: 10px" /> 265 <p>Cédric has an extensive experience in working within security-constrained domains, and coffee brewing.</p> 266 </div> 267 </div> 268</div> 269 270 </div> 271 </div> 272</div> 273 274 275<section class="section section-sm container-fluid"> 276 <div class="row justify-content-center text-center"> 277 <div class="col-lg-9"></div> 278 </div> 279</section> 280 281 282 283 284<footer class="footer text-muted"> 285 <div class="container"> 286 <div class="row"> 287 <div class="col-lg-8 order-last order-lg-first"> 288 <ul class="list-inline"> 289 290 <li class="list-inline-item">Powered by <a href="https://www.netlify.com/">Netlify</a>, <a href="https://www.getzola.org/">Zola</a>, and <a href="https://github.com/aaranxu/adidoks">AdiDoks</a>, domain name donated by <a href="https://twitter.com/fimbault">Fabien Imbault</a> 291 </li> 292 293 294 <li><a rel="me" href="https://hachyderm.io/@biscuitauth">Mastodon</a></li> 295 </ul> 296 </div> 297 <div class="col-lg-8 order-first order-lg-last text-lg-end"> 298 <ul class="list-inline"> 299 300 </ul> 301 </div> 302 </div> 303 </div> 304</footer> 305 306 307 308
309<script src="https://www.biscuitsec.org/js/main.js" defer></script>
309 310 311
311<script src="https://www.biscuitsec.org/plugins/elasticlunr.min.js" defer></script>
311 312
312<script src="https://www.biscuitsec.org/search_index.en.js" defer></script>
312 313
313<script src="https://www.biscuitsec.org/js/search.js" defer></script>
313 314 315
316<script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v31edd6df95cf4e85bb4c19e7a9bdbcba1788362987495" integrity="sha512-iIg7k2xntmwu6/uSb5tpc/hySgZc4eoL31yB29W6tJFo2akwjPWcEqnCEdJvGexCL0KEQwVYv5BlowfhVz26hg==" data-cf-beacon='{"version":"2024.11.0","token":"fe6adfaef939433a96070451faf731fb","r":1,"spa":2}' crossorigin="anonymous"></script>
316 317</body> 318</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.