diff --git a/Crypto/Random/DRBG.hs b/Crypto/Random/DRBG.hs --- a/Crypto/Random/DRBG.hs +++ b/Crypto/Random/DRBG.hs @@ -16,7 +16,7 @@ the way) one would do: @ - gen <- newGenIO :: IO HashDRBG + gen <- newGenIO :: IO CtrDRBG let Right (randomBytes, newGen) = genBytes 1024 gen @ @@ -29,12 +29,6 @@ in ... @ -Selecting the underlying hash algorithm is supporting using *DRBGWith types: - -@ - gen <- newGenIO :: IO (HmacDRBGWith SHA224) -@ - There are several modifiers that allow you to compose generators together, producing generators with modified security, reseed, and performance properties. 'GenXor' will xor the random bytes of two generators. 'GenBuffered' will spark off work @@ -42,9 +36,27 @@ quick use. 'GenAutoReseed' will use one generator to automatically reseed another after every 32 kilobytes of requested randoms. +Most likely you will want to automatically reseed using system randomness +(via lazy IO). Thus, you are left with a generator that is random, not +pseudo random but without the dangerously unsafe IO found in some other +RNGs: + +@ + import Crypto.Random.DRBG hiding (genBytes) + import Crypto.Classes.Exceptions (genBytes) + + -- An AES CTR generator that automatically reseeds. + getCtrGen :: IO (GenAutoReseed CtrDRBG SystemEntropy) + getCtrGen = newGenAutoReseedIO + + f = do g1 <- getCtrGen + let (bytes, g2) = getBytes 1024 g1 + g bytes g2 +@ + For a complex example, here is a generator that buffers several megabytes of random values which are an Xor of AES with a SHA384 hash that are each reseeded -every 32kb with the output of a SHA512 HMAC generator. (Not to claim this has +every 32kb with the output of a SHA512 HMAC generator (not to claim this has any enhanced security properties, but just to show the composition can be nested). @@ -52,7 +64,6 @@ gen <- newGenIO :: IO (GenBuffered (GenAutoReseed (GenXor AesCntDRBG (HashDRBGWith SHA384)) HmacDRBG)) @ - -} module Crypto.Random.DRBG @@ -110,7 +121,7 @@ -- of the underlying hash algorithm. type HashDRBGWith = H.State --- |The Hash DRBG state (of kind * -> *) allowing selection +-- |The AES CTR DRBG state (of kind * -> *) allowing selection -- of the underlying cipher algorithm. type CtrDRBGWith = CTR.State @@ -118,9 +129,14 @@ type HmacDRBG = M.State SHA512 -- |An Alias for a Hash DRBG generator using SHA512. +-- +-- As of 1July2014 this remains the fastest cryptographic RNG on hackage +-- that has been ran against known answer tests. type HashDRBG = H.State SHA512 --- |An Alias for a Counter DRBG generator using AES 128. +-- |The recommended generator which uses AES-128 in counter mode. +-- +-- This is an alias for a Counter DRBG generator using AES 128. type CtrDRBG = CTR.State AESKey128 -- |@newGenAutoReseed bs i@ creates a new 'GenAutoReseed' with a custom interval diff --git a/Crypto/Random/DRBG/HMAC.hs b/Crypto/Random/DRBG/HMAC.hs --- a/Crypto/Random/DRBG/HMAC.hs +++ b/Crypto/Random/DRBG/HMAC.hs @@ -11,6 +11,7 @@ import Data.Serialize (encode, Serialize(..)) import Data.Serialize.Put import Data.Serialize.Builder (toByteString) +import Data.Tagged (proxy) import Data.Word (Word64) import Crypto.Classes import Crypto.HMAC @@ -25,9 +26,13 @@ -- Start admin info , value :: !Value , key :: !Key - , hashAlg :: L.ByteString -> d } +-- This is available with the right type in the tagged package starting from +-- version 0.7, but ending with GHC version 7.8. Sigh. +asProxyTypeOf :: d -> state d -> d +asProxyTypeOf = const + reseedInterval :: Word64 reseedInterval = 2^48 @@ -37,16 +42,15 @@ update st input = st { value = newV , key = newK } where hm k = hmac (MacKey k) - d = hashAlg st undefined k = key st v = value st - k' = encode $ (hm k (L.concat [fc v, L.singleton 0, input]) `asTypeOf` d) - v' = encode $ (hm k' (fc v) `asTypeOf` d) + k' = encode $ (hm k (L.concat [fc v, L.singleton 0, input]) `asProxyTypeOf` st) + v' = encode $ (hm k' (fc v) `asProxyTypeOf` st) (newK, newV) = if L.length input == 0 then (k',v') - else let k'' = encode $ hm k' (L.concat [fc v', L.singleton 1, input]) `asTypeOf` d - in (k'', encode $ hm k'' (fc v') `asTypeOf` d) + else let k'' = encode $ hm k' (L.concat [fc v', L.singleton 1, input]) `asProxyTypeOf` st + in (k'', encode $ hm k'' (fc v') `asProxyTypeOf` st) instantiate :: (Hash c d) => Entropy -> Nonce -> PersonalizationString -> State d instantiate ent nonce perStr = st @@ -54,9 +58,8 @@ seedMaterial = L.fromChunks [ent, nonce, perStr] k = B.replicate olen 0 v = B.replicate olen 1 - st = update (St 1 v k hash) seedMaterial - d = hashAlg st undefined - olen = (outputLength .::. d) `div` 8 + st = update (St 1 v k) seedMaterial + olen = (outputLength `proxy` st) `div` 8 reseed :: (Hash c d) => State d -> Entropy -> AdditionalInput -> State d reseed st ent ai = (update st (L.fromChunks [ent, ai])) { counter = 1 } @@ -67,7 +70,6 @@ then Nothing else Just (randBitsFinal, stFinal { counter = 1 + counter st}) where - d = hashAlg st undefined st' = if B.length additionalInput == 0 then st else update st (fc additionalInput) @@ -81,12 +83,12 @@ getV :: Value -> Int -> (Value, [B.ByteString]) getV !u 0 = (u, []) getV !u i = - let !vNew = hmac' (MacKey kFinal) u `asTypeOf` d + let !vNew = hmac' (MacKey kFinal) u `asProxyTypeOf` st !encV = encode vNew (uFinal, rest) = getV encV (i - 1) in (uFinal, encV:rest) (vFinal, randBitsList) = getV (value st') iterations randBitsFinal = B.take reqBytes $ B.concat randBitsList kFinal = key st' - stFinal = update (st' { key = kFinal, value = vFinal}) (fc additionalInput) - outlen = outputLength .::. d `div` 8 + stFinal = update (st' { key = kFinal, value = vFinal} `asTypeOf` st) (fc additionalInput) + outlen = (outputLength `proxy` st) `div` 8 diff --git a/DRBG.cabal b/DRBG.cabal --- a/DRBG.cabal +++ b/DRBG.cabal @@ -1,5 +1,5 @@ name: DRBG -version: 0.5.2 +version: 0.5.3 license: BSD3 license-file: LICENSE author: Thomas DuBuisson @@ -22,7 +22,7 @@ Library Build-Depends: base >= 4.0 && < 5, cereal >= 0.2, - bytestring, prettyclass, tagged >= 0.2, + bytestring, prettyclass, tagged >= 0.7, crypto-api >= 0.13, cryptohash-cryptoapi >= 0.1, parallel, mtl >= 2.0, cipher-aes128 >= 0.6, entropy ghc-options: -O2