clientsession 0.7.4.3 → 0.7.5

raw patch · 2 files changed

+4/−13 lines, 2 filesdep ~crypto-apinew-uploaderPVP ok

version bump matches the API change (PVP)

Dependency ranges changed: crypto-api

API changes (from Hackage documentation)

Files

• clientsession.cabal +2/−2
• src/Web/ClientSession.hs +2/−11

@@ -1,5 +1,5 @@ name:            clientsession-version:         0.7.4.3+version:         0.7.5 license:         BSD3 license-file:    LICENSE author:          Michael Snoyman <michael@snoyman.com>, Felipe Lessa <felipe.lessa@gmail.com>@@ -26,7 +26,7 @@                    , cereal              >= 0.3        && < 0.4                    , directory           >= 1          && < 1.2                    , tagged              >= 0.1-                   , crypto-api          >= 0.6.4      && < 0.11+                   , crypto-api          >= 0.8        && < 0.11                    , cryptocipher        >= 0.2.5                    , skein               >= 0.1        && < 0.2                    , base64-bytestring   >= 0.1.1.1    && < 0.2

@@ -54,8 +54,6 @@  -- from base import Control.Monad (guard, when)-import Data.Bits ((.|.), xor)-import Data.List (foldl') import qualified Data.IORef as I import System.IO.Unsafe (unsafePerformIO) import Control.Concurrent (forkIO)@@ -74,7 +72,7 @@ import Data.Tagged (Tagged, untag)  -- from crypto-api-import Crypto.Classes (buildKey)+import Crypto.Classes (buildKey, constTimeEq) import Crypto.Random (genSeedLength, reseed) import Crypto.Types (ByteLength) import qualified Crypto.Modes as Modes@@ -208,18 +206,11 @@     guard (S.length dataBS >= 48) -- 16 bytes of IV + 32 bytes of Skein-MAC-512-256     let (auth, toBeAuthed) = S.splitAt 32 dataBS         auth' = macKey key toBeAuthed-    guard (encode auth' `compareHash` auth)+    guard (encode auth' `constTimeEq` auth)     let (iv_e, encrypted) = S.splitAt 16 toBeAuthed     iv <- either (const Nothing) Just $ decode iv_e     let (x, _) = Modes.unCtr' Modes.incIV (aesKey key) iv encrypted     return x---- | Compare two bytestrings.  Always takes the same ammount of--- time, avoiding timing attacks.-compareHash :: S.ByteString -> S.ByteString -> Bool-compareHash s1 s2 =-    S.length s1 == S.length s2 &&-    foldl' (.|.) 0 (S.zipWith xor s1 s2) == 0  -- Significantly more efficient random IV generation. Initial -- benchmarks placed it at 6.06 us versus 1.69 ms for Modes.getIVIO,