cryptonite 0.6 → 0.7

raw patch · 18 files changed

+446/−46 lines, 18 filesdep ~memoryPVP ok

version bump matches the API change (PVP)

Dependency ranges changed: memory

API changes (from Hackage documentation)

Files

• CHANGELOG.md +6/−0
• Crypto/Cipher/Blowfish/Primitive.hs +69/−24
• Crypto/Cipher/ChaChaPoly1305.hs +14/−5
• Crypto/Data/Padding.hs +47/−0
• Crypto/Error/Types.hs +2/−0
• Crypto/Internal/CompatPrim.hs +23/−3
• Crypto/KDF/BCrypt.hs +140/−0
• Crypto/KDF/Scrypt.hs +3/−1
• Crypto/MAC/Poly1305.hs +6/−4
• cbits/cryptonite_scrypt.c +1/−1
• cryptonite.cabal +5/−2
• tests/BCrypt.hs +77/−0
• tests/ChaChaPoly1305.hs +11/−1
• tests/Number.hs +4/−4
• tests/Padding.hs +26/−0
• tests/Poly1305.hs +2/−1
• tests/Tests.hs +4/−0
• tests/Utils.hs +6/−0

@@ -1,3 +1,9 @@+## 0.7++* Add PKCS5 / PKCS7 padding and unpadding methods+* Fix ChaChaPoly1305 Decryption+* Add support for BCrypt (Luke Taylor)+ ## 0.6  * Add ChaChaPoly1305 AE cipher

@@ -16,16 +16,18 @@     , initBlowfish     , encrypt     , decrypt+    , eksBlowfish     ) where  import           Control.Monad (when) import           Data.Bits+import           Data.Memory.Endian import           Data.Word  import           Crypto.Error import           Crypto.Internal.Compat import           Crypto.Internal.Imports-import           Crypto.Internal.ByteArray (ByteArrayAccess, ByteArray)+import           Crypto.Internal.ByteArray (ByteArrayAccess, ByteArray, Bytes) import qualified Crypto.Internal.ByteArray as B import           Crypto.Internal.Words import           Crypto.Internal.WordArray@@ -64,17 +66,25 @@  -- | Initialize a new Blowfish context from a key. ----- key need to be between 0 to 448 bits.+-- key needs to be between 0 and 448 bits. initBlowfish :: ByteArrayAccess key => key -> CryptoFailable Context initBlowfish key-    | len > (448 `div` 8) = CryptoFailed $ CryptoError_KeySizeInvalid-    | otherwise           = CryptoPassed $ makeKeySchedule key+    | len > (448 `div` 8) = CryptoFailed CryptoError_KeySizeInvalid+    | otherwise           = CryptoPassed $ makeKeySchedule key (Nothing :: Maybe (Bytes, Int))   where len = B.length key +-- | The BCrypt "expensive key schedule" version of blowfish.+--+-- Salt must be 128 bits+-- Cost must be between 4 and 31 inclusive+-- See <https://www.usenix.org/conference/1999-usenix-annual-technical-conference/future-adaptable-password-scheme>+eksBlowfish :: (ByteArrayAccess salt, ByteArrayAccess password) => Int -> salt -> password -> Context+eksBlowfish cost salt key = makeKeySchedule key (Just (salt, cost))+ coreCrypto :: Context -> Word64 -> Word64 coreCrypto (BF p s0 s1 s2 s3) input = doRound input 0   where-    -- transform the input @i over 16 rounds+    -- transform the input over 16 rounds     doRound :: Word64 -> Int -> Word64     doRound i roundIndex         | roundIndex == 16 =@@ -84,7 +94,6 @@             let newr = fromIntegral (i `shiftR` 32) `xor` (p roundIndex)                 newi = ((i `shiftL` 32) `xor` (f newr)) .|. (fromIntegral newr)              in doRound newi (roundIndex+1)-     f   :: Word32 -> Word64     f t = let a = s0 (fromIntegral $ (t `shiftR` 24) .&. 0xff)               b = s1 (fromIntegral $ (t `shiftR` 16) .&. 0xff)@@ -92,22 +101,26 @@               d = s3 (fromIntegral $ t .&. 0xff)            in fromIntegral (((a + b) `xor` c) + d) `shiftL` 32 -makeKeySchedule :: ByteArrayAccess key => key -> Context-makeKeySchedule key =++-- | Create a key schedule for either plain Blowfish or the BCrypt "EKS" version+-- For the expensive version, the salt and cost factor are supplied. Salt must be+-- a 128-bit byte array.+--+-- The standard case is just a single key expansion with the salt set to zero.+makeKeySchedule :: (ByteArrayAccess key, ByteArrayAccess salt) => key-> Maybe (salt, Int) -> Context+makeKeySchedule keyBytes saltCost =     let v = unsafeDoIO $ do-              let len = B.length key               mv <- createKeySchedule-              when (len > 0) $ forM_ [0..17] $ \i -> do-                    let a = B.index key ((i * 4 + 0) `mod` len)-                        b = B.index key ((i * 4 + 1) `mod` len)-                        c = B.index key ((i * 4 + 2) `mod` len)-                        d = B.index key ((i * 4 + 3) `mod` len)-                        k = (fromIntegral a `shiftL` 24) .|.-                            (fromIntegral b `shiftL` 16) .|.-                            (fromIntegral c `shiftL`  8) .|.-                            (fromIntegral d)-                    mutableArrayWriteXor32 mv i k-              prepare mv+              case saltCost of+                  -- Standard blowfish+                  Nothing -> expandKey mv 0 0 keyBytes+                  -- The expensive case+                  Just (s, cost)  -> do+                      let (salt1, salt2) = splitSalt s+                      expandKey mv salt1 salt2 keyBytes+                      forM_ [1..2^cost :: Int] $ \_ -> do+                          expandKey mv 0 0 keyBytes+                          expandKey mv 0 0 s               mutableArray32Freeze mv      in BF (\i -> arrayRead32 v i)            (\i -> arrayRead32 v (s0+i))@@ -115,21 +128,49 @@            (\i -> arrayRead32 v (s2+i))            (\i -> arrayRead32 v (s3+i))   where+        splitSalt s = (fromBE (B.toW64BE s 0), fromBE (B.toW64BE s 8))++        -- Indices of the S-Box arrays, each containing 256 32-bit words+        -- The first 18 words contain the P-Array of subkeys         s0 = 18         s1 = 274         s2 = 530         s3 = 786 -        prepare mctx = loop 0 0-          where loop i input+expandKey :: ByteArrayAccess ba+          => MutableArray32      -- ^ The key schedule+          -> Word64              -- ^ First word of the salt+          -> Word64              -- ^ Second word of the salt+          -> ba                  -- ^ The key+          -> IO ()+expandKey mv salt1 salt2 key = do+    when (len > 0) $ forM_ [0..17] $ \i -> do+        let a = B.index key ((i * 4 + 0) `mod` len)+            b = B.index key ((i * 4 + 1) `mod` len)+            c = B.index key ((i * 4 + 2) `mod` len)+            d = B.index key ((i * 4 + 3) `mod` len)+            k = (fromIntegral a `shiftL` 24) .|.+                (fromIntegral b `shiftL` 16) .|.+                (fromIntegral c `shiftL`  8) .|.+                (fromIntegral d)+        mutableArrayWriteXor32 mv i k+    prepare mv+    return ()+  where+        len = B.length key++        -- | Go through the entire key schedule overwriting the P-Array and S-Boxes+        prepare mctx = loop 0 salt1 salt1 salt2+          where loop i input slt1 slt2                   | i == 1042   = return ()                   | otherwise = do                       ninput <- coreCryptoMutable input                       let (nl, nr) = w64to32 ninput                       mutableArrayWrite32 mctx i     nl                       mutableArrayWrite32 mctx (i+1) nr-                      loop (i+2) ninput+                      loop (i+2) (ninput `xor` slt2) slt2 slt1 +                -- | Blowfish encrypt a Word using the current state of the key schedule                 coreCryptoMutable :: Word64 -> IO Word64                 coreCryptoMutable input = doRound input 0                   where doRound i roundIndex@@ -145,10 +186,14 @@                               let newi = ((i `shiftL` 32) `xor` newr') .|. (fromIntegral newr)                               doRound newi (roundIndex+1) -+                -- The Blowfish Feistel function F                 f   :: Word32 -> IO Word64                 f t = do a <- mutableArrayRead32 mctx (s0 + fromIntegral ((t `shiftR` 24) .&. 0xff))                          b <- mutableArrayRead32 mctx (s1 + fromIntegral ((t `shiftR` 16) .&. 0xff))                          c <- mutableArrayRead32 mctx (s2 + fromIntegral ((t `shiftR` 8) .&. 0xff))                          d <- mutableArrayRead32 mctx (s3 + fromIntegral (t .&. 0xff))                          return (fromIntegral (((a + b) `xor` c) + d) `shiftL` 32)+                  where s0 = 18+                        s1 = 274+                        s2 = 530+                        s3 = 786

@@ -17,7 +17,8 @@     , initialize     , appendAAD     , finalizeAAD-    , combine+    , encrypt+    , decrypt     , finalize     ) where @@ -81,7 +82,7 @@   where     rootState           = ChaCha.initialize 20 key nonce     (polyKey, encState) = ChaCha.generate rootState 64-    polyState           = Poly1305.initialize (B.take 32 polyKey :: ScrubbedBytes)+    polyState           = throwCryptoError $ Poly1305.initialize (B.take 32 polyKey :: ScrubbedBytes)  appendAAD :: ByteArrayAccess ba => ba -> State -> State appendAAD ba (State encState macState aadLength plainLength) =@@ -96,17 +97,25 @@   where     newMacState = Poly1305.update macState $ pad16 aadLength -combine :: ByteArray ba => ba -> State -> (ba, State)-combine input (State encState macState aadLength plainLength) =+encrypt :: ByteArray ba => ba -> State -> (ba, State)+encrypt input (State encState macState aadLength plainLength) =     (output, State newEncState newMacState aadLength newPlainLength)   where     (output, newEncState) = ChaCha.combine encState input     newMacState           = Poly1305.update macState output     newPlainLength        = plainLength + fromIntegral (B.length input) +decrypt :: ByteArray ba => ba -> State -> (ba, State)+decrypt input (State encState macState aadLength plainLength) =+    (output, State newEncState newMacState aadLength newPlainLength)+  where+    (output, newEncState) = ChaCha.combine encState input+    newMacState           = Poly1305.update macState input+    newPlainLength        = plainLength + fromIntegral (B.length input)+ finalize :: State -> Poly1305.Auth finalize (State _ macState aadLength plainLength) =     Poly1305.finalize $ Poly1305.updates macState         [ pad16 plainLength-        , either (error "finalize: internal error") id $ P.fill 16 (P.putStorable (LE aadLength) >> P.putStorable (LE plainLength))+        , either (error "finalize: internal error") id $ P.fill 16 (P.putStorable (toLE aadLength) >> P.putStorable (toLE plainLength))         ]

@@ -0,0 +1,47 @@+-- |+-- Module      : Crypto.Data.Padding+-- License     : BSD-style+-- Maintainer  : Vincent Hanquez <vincent@snarc.org>+-- Stability   : experimental+-- Portability : unknown+--+-- Various cryptographic padding commonly used for block ciphers+-- or assymetric systems.+--+module Crypto.Data.Padding+    ( Format(..)+    , pad+    , unpad+    ) where++import           Data.ByteArray (ByteArray, Bytes)+import qualified Data.ByteArray as B++data Format =+      PKCS5     -- ^ PKCS5: PKCS7 with hardcoded size of 8+    | PKCS7 Int -- ^ PKCS7 with padding size between 1 and 255+    deriving (Show, Eq)++-- | Apply some pad to a bytearray+pad :: ByteArray byteArray => Format -> byteArray -> byteArray+pad  PKCS5     bin = pad (PKCS7 8) bin+pad (PKCS7 sz) bin = bin `B.append` paddingString+  where+    paddingString = B.replicate paddingByte (fromIntegral paddingByte)+    paddingByte   = sz - (B.length bin `mod` sz)++-- | Try to remove some padding from a bytearray.+unpad :: ByteArray byteArray => Format -> byteArray -> Maybe byteArray+unpad  PKCS5     bin = unpad (PKCS7 8) bin+unpad (PKCS7 sz) bin+    | len == 0                           = Nothing+    | (len `mod` sz) /= 0                = Nothing+    | paddingSz < 1 || paddingSz > len   = Nothing+    | paddingWitness `B.constEq` padding = Just content+    | otherwise                          = Nothing+  where+    len         = B.length bin+    paddingByte = B.index bin (len - 1)+    paddingSz   = fromIntegral paddingByte+    (content, padding) = B.splitAt (len - paddingSz) bin+    paddingWitness     = B.replicate paddingSz paddingByte :: Bytes

@@ -33,6 +33,8 @@     | CryptoError_SecretKeySizeInvalid     | CryptoError_SecretKeyStructureInvalid     | CryptoError_PublicKeySizeInvalid+    -- Message authentification error+    | CryptoError_MacKeyInvalid     deriving (Show,Eq,Enum,Data,Typeable)  instance E.Exception CryptoError

@@ -24,6 +24,9 @@     ) where  import GHC.Prim+#if !defined(ARCH_IS_LITTLE_ENDIAN) && !defined(ARCH_IS_BIG_ENDIAN)+import Data.Memory.Endian (getSystemEndianness, Endianness(..))+#endif  -- | byteswap Word# to or from Big Endian --@@ -31,8 +34,10 @@ be32Prim :: Word# -> Word# #ifdef ARCH_IS_LITTLE_ENDIAN be32Prim = byteswap32Prim+#elif defined(ARCH_IS_BIG_ENDIAN)+be32Prim = id #else-be32Prim w = w+be32Prim w = if getSystemEndianness == LittleEndian then byteswap32Prim w else w #endif  -- | byteswap Word# to or from Little Endian@@ -41,8 +46,10 @@ le32Prim :: Word# -> Word# #ifdef ARCH_IS_LITTLE_ENDIAN le32Prim w = w-#else+#elif defined(ARCH_IS_BIG_ENDIAN) le32Prim = byteswap32Prim+#else+le32Prim w = if getSystemEndianness == LittleEndian then w else byteswap32Prim w #endif  -- | Simple compatibility for byteswap the lower 32 bits of a Word#@@ -69,11 +76,24 @@         !c2 = uncheckedShiftL# b 16#         !c3 = uncheckedShiftL# c 8#         !c4 = d-#else+#elif defined(ARCH_IS_BIG_ENDIAN)         !c1 = uncheckedShiftL# d 24#         !c2 = uncheckedShiftL# c 16#         !c3 = uncheckedShiftL# b 8#         !c4 = a+#else+        !c1+            | getSystemEndianness == LittleEndian = uncheckedShiftL# a 24#+            | otherwise                           = uncheckedShiftL# d 24#+        !c2+            | getSystemEndianness == LittleEndian = uncheckedShiftL# b 16#+            | otherwise                           = uncheckedShiftL# c 16#+        !c3+            | getSystemEndianness == LittleEndian = uncheckedShiftL# c 8#+            | otherwise                           = uncheckedShiftL# b 8#+        !c4+            | getSystemEndianness == LittleEndian = d+            | otherwise                           = a #endif  -- | Simple wrapper to handle pre 7.8 and future, where

@@ -0,0 +1,140 @@++-- | Password encoding and validation using bcrypt.+--+-- See <https://www.usenix.org/conference/1999-usenix-annual-technical-conference/future-adaptable-password-scheme>+-- for details of the original algorithm.+--+-- Hashes are strings of the form @$2a$10$MJJifxfaqQmbx1Mhsq3oq.YmMmfNhkyW4s/MS3K5rIMVfB7w0Q/OW@ which+-- encode a version number, an integer cost parameter and the concatenated salt and hash bytes (each+-- separately Base64 encoded. Incrementing the cost parameter approximately doubles the time taken+-- to calculate the hash.+--+-- The different version numbers have evolved because of bugs in the standard C implementations.+-- The most up to date version is @2b@ and this implementation the @2b@ version prefix, but will also+-- attempt to validate against hashes with versions @2a@ and @2y@. Version @2@ or @2x@ will be rejected.+-- No attempt is made to differentiate between the different versions when validating a password, but+-- in practice this shouldn't cause any problems if passwords are UTF-8 encoded (which they should be).+--+-- The cost parameter can be between 4 and 31 inclusive, but anything less than 10 is probably not strong+-- enough. High values may be prohibitively slow depending on your hardware. Choose the highest value you+-- can without having an unacceptable impact on your users. The cost parameter can also varied depending on+-- the account, since it is unique to an individual hash.++module Crypto.KDF.BCrypt+    ( hashPassword+    , validatePassword+    , validatePasswordEither+    , bcrypt+    )+where++import           Control.Monad (unless, when)+import           Crypto.Cipher.Blowfish.Primitive (eksBlowfish, encrypt)+import           Crypto.Random (MonadRandom, getRandomBytes)+import           Data.ByteArray (ByteArrayAccess, ByteArray, Bytes)+import qualified Data.ByteArray as B+import           Data.ByteArray.Encoding+import           Data.Char++data BCryptHash = BCH Char Int Bytes Bytes++-- | Create a bcrypt hash for a password with a provided cost value.+--+-- Each increment of the cost approximately doubles the time taken.+-- The 16 bytes of random salt will be generated internally.+hashPassword :: (MonadRandom m, ByteArray password, ByteArray hash)+             => Int+             -- ^ The cost parameter. Should be between 4 and 31 (inclusive).+             -- Values which lie outside this range will be adjusted accordingly.+             -> password+             -- ^ The password. Should be the UTF-8 encoded bytes of the password text.+             -> m hash+             -- ^ The bcrypt hash in standard format.+hashPassword cost password = do+    salt <- getRandomBytes 16+    return $ bcrypt cost (salt :: Bytes) password++-- | Create a bcrypt hash for a password with a provided cost value and salt.+bcrypt :: (ByteArray salt, ByteArray password, ByteArray output)+       => Int+       -- ^ The cost parameter. Should be between 4 and 31 (inclusive).+       -- Values which lie outside this range will be adjusted accordingly.+       -> salt+       -- ^ The salt. Must be 16 bytes in length or an error will be raised.+       -> password+       -- ^ The password. Should be the UTF-8 encoded bytes of the password text.+       -> output+       -- ^ The bcrypt hash in standard format.+bcrypt cost salt password = B.concat [header, B.snoc costBytes dollar, b64 salt, b64 hash]+  where+    hash   = rawHash 'b' realCost salt password+    header = B.pack [dollar, fromIntegral (ord '2'), fromIntegral (ord 'a'), dollar]+    dollar = fromIntegral (ord '$')+    zero   = fromIntegral (ord '0')+    costBytes  = B.pack [zero + fromIntegral (realCost `div` 10), zero + fromIntegral (realCost `mod` 10)]+    realCost+        | cost < 4  = 10 -- 4 is virtually pointless so go for 10+        | cost > 31 = 31+        | otherwise = cost++    b64 :: (ByteArray ba) => ba -> ba+    b64 = convertToBase Base64OpenBSD++-- | Check a password against a bcrypt hash+--+-- Returns @False@ if the password doesn't match the hash, or if the hash is+-- invalid or an unsupported version.+validatePassword :: (ByteArray password, ByteArray hash) => password -> hash -> Bool+validatePassword password bcHash = either (const False) id (validatePasswordEither password bcHash)++-- | Check a password against a bcrypt hash+--+-- As for @validatePassword@ but will provide error information if the hash is invalid or+-- an unsupported version.+validatePasswordEither :: (ByteArray password, ByteArray hash) => password -> hash -> Either String Bool+validatePasswordEither password bcHash = do+    BCH version cost salt hash <- parseBCryptHash bcHash+    return $ (rawHash version cost salt password :: Bytes) `B.constEq` hash++rawHash :: (ByteArrayAccess salt, ByteArray password, ByteArray output) => Char -> Int -> salt -> password -> output+rawHash _ cost salt password = B.take 23 hash -- Another compatibility bug. Ignore last byte of hash+  where+    hash = loop (0 :: Int) orpheanBeholder++    loop i input+        | i < 64    = loop (i+1) (encrypt ctx input)+        | otherwise = input++    -- Truncate the password if necessary and append a null byte for C compatibility+    key = B.snoc (B.take 72 password) 0++    ctx = eksBlowfish cost salt key++    -- The BCrypt plaintext: "OrpheanBeholderScryDoubt"+    orpheanBeholder = B.pack [79,114,112,104,101,97,110,66,101,104,111,108,100,101,114,83,99,114,121,68,111,117,98,116]++-- "$2a$10$XajjQvNhvvRt5GSeFk1xFeyqRrsxkhBkUiQeg0dt.wU1qD4aFDcga"+parseBCryptHash :: (ByteArray ba) => ba -> Either String BCryptHash+parseBCryptHash bc = do+    unless (B.length bc == 60      &&+            B.index bc 0 == dollar &&+            B.index bc 1 == fromIntegral (ord '2') &&+            B.index bc 3 == dollar &&+            B.index bc 6 == dollar) (Left "Invalid hash format")+    unless (version == 'b' || version == 'a' || version == 'y') (Left ("Unsupported minor version: " ++ [version]))+    when (costTens > 3 || cost > 31 || cost < 4)  (Left "Invalid bcrypt cost")+    (salt, hash) <- decodeSaltHash (B.drop 7 bc)+    return (BCH version cost salt hash)+  where+    dollar    = fromIntegral (ord '$')+    zero      = ord '0'+    costTens  = fromIntegral (B.index bc 4) - zero+    costUnits = fromIntegral (B.index bc 5) - zero+    version   = chr (fromIntegral (B.index bc 2))+    cost      = costUnits + (if costTens == 0 then 0 else 10^costTens) :: Int++    decodeSaltHash saltHash = do+        let (s, h) = B.splitAt 22 saltHash+        salt <- convertFromBase Base64OpenBSD s+        hash <- convertFromBase Base64OpenBSD h+        return (salt, hash)

@@ -5,7 +5,9 @@ -- Stability   : experimental -- Portability : unknown ----- Scrypt key derivation function as defined in Colin Percival's paper "Stronger Key Derivation via Sequential Memory-Hard Functions" <http://www.tarsnap.com/scrypt/scrypt.pdf>.+-- Scrypt key derivation function as defined in Colin Percival's paper+-- "Stronger Key Derivation via Sequential Memory-Hard Functions"+-- <http://www.tarsnap.com/scrypt/scrypt.pdf>. -- {-# LANGUAGE BangPatterns #-} {-# LANGUAGE ForeignFunctionInterface #-}

@@ -29,6 +29,8 @@ import           Data.Word import           Crypto.Internal.ByteArray (ByteArrayAccess, ScrubbedBytes, Bytes) import qualified Crypto.Internal.ByteArray as B+import           Crypto.Internal.DeepSeq+import           Crypto.Error  -- | Poly1305 State newtype State = State ScrubbedBytes@@ -39,7 +41,7 @@  -- | Poly1305 Auth newtype Auth = Auth Bytes-    deriving (ByteArrayAccess)+    deriving (ByteArrayAccess,NFData)  instance Eq Auth where     (Auth a1) == (Auth a2) = B.constEq a1 a2@@ -56,10 +58,10 @@ -- | initialize a Poly1305 context initialize :: ByteArrayAccess key            => key-           -> State+           -> CryptoFailable State initialize key-    | B.length key /= 32 = error "Poly1305: key length expected 32 bytes"-    | otherwise          = State $ B.allocAndFreeze 84 $ \ctxPtr ->+    | B.length key /= 32 = CryptoFailed $ CryptoError_MacKeyInvalid+    | otherwise          = CryptoPassed $ State $ B.allocAndFreeze 84 $ \ctxPtr ->         B.withByteArray key $ \keyPtr ->             c_poly1305_init (castPtr ctxPtr) keyPtr {-# NOINLINE initialize #-}

@@ -46,7 +46,7 @@  static inline uint64_t integerify(uint32_t *B, const uint32_t r) {-	return le64_to_cpu(*((uint64_t *) (B + (2*r-1) * 16)));+	return B[(2*r-1) * 16] | (uint64_t)B[(2*r-1) * 16 + 1] << 32; }  static inline uint32_t load32(const uint8_t *p)

@@ -1,5 +1,5 @@ Name:                cryptonite-Version:             0.6+Version:             0.7 Synopsis:            Cryptography Primitives sink Description:     A repository of cryptographic primitives.@@ -83,6 +83,7 @@                      Crypto.Cipher.TripleDES                      Crypto.Cipher.Types                      Crypto.Data.AFIS+                     Crypto.Data.Padding                      Crypto.Error                      Crypto.MAC.Poly1305                      Crypto.MAC.HMAC@@ -95,6 +96,7 @@                      Crypto.Number.Serialize.Internal                      Crypto.KDF.PBKDF2                      Crypto.KDF.Scrypt+                     Crypto.KDF.BCrypt                      Crypto.Hash                      Crypto.Hash.IO                      Crypto.Hash.Algorithms@@ -166,7 +168,7 @@                      Crypto.Internal.WordArray   Build-depends:     base >= 4.3 && < 5                    , bytestring-                   , memory >= 0.2+                   , memory >= 0.8                    , ghc-prim   ghc-options:       -Wall -fwarn-tabs -optc-O3   default-language:  Haskell2010@@ -241,6 +243,7 @@   Main-is:           Tests.hs   Other-modules:     BlockCipher                      ChaCha+                     BCrypt                      Hash                      Imports                      KAT_AES.KATCBC

@@ -0,0 +1,77 @@+{-# LANGUAGE OverloadedStrings #-}++module BCrypt+    ( tests+    )+where++import Crypto.KDF.BCrypt+import qualified Data.ByteString as B+import Imports++-- Openwall bcrypt tests, with 2x versions and 0xFF special cases removed.+expected :: [(ByteString, ByteString)]+expected =+    [ ("$2a$05$CCCCCCCCCCCCCCCCCCCCC.E5YPO9kmyuRGyh0XouQYb4YMJKvyOeW", "U*U")+    , ("$2a$05$CCCCCCCCCCCCCCCCCCCCC.VGOzA784oUp/Z0DY336zx7pLYAy0lwK", "U*U*")+    , ("$2a$05$XXXXXXXXXXXXXXXXXXXXXOAcXxm9kjPGEMsLznoKqmqw7tc8WCx4a", "U*U*U")+    , ("$2a$05$abcdefghijklmnopqrstuu5s2v8.iXieOjg/.AySBTTZIIVFJeBui",+            "0123456789abcdefghijklmnopqrstuvwxyz\+            \ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\+            \chars after 72 are ignored")+    , ("$2y$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e", "\xff\xff\xa3")+    , ("$2b$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e", "\xff\xff\xa3")+    , ("$2y$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq", "\xa3")+    , ("$2a$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq", "\xa3")+    , ("$2b$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq", "\xa3")+    , ("$2a$05$/OK.fbVrR/bpIqNJ5ianF.swQOIzjOiJ9GHEPuhEkvqrUyvWhEMx6",+            "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\+            \\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\+            \\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\+            \\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\+            \\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\+            \\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\+            \chars after 72 are ignored as usual")+    , ("$2a$05$/OK.fbVrR/bpIqNJ5ianF.R9xrDjiycxMbQE2bp.vgqlYpW5wx2yy",+            "\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\+            \\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\+            \\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\+            \\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\+            \\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\+            \\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55")+    , ("$2a$05$/OK.fbVrR/bpIqNJ5ianF.9tQZzcJfm3uj2NvJ/n5xkhpqLrMpWCe",+            "\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\+            \\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\+            \\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\+            \\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\+            \\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\+            \\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff")+    , ("$2a$05$CCCCCCCCCCCCCCCCCCCCC.7uG0VCzI2bS7j6ymqJi9CdcdxiRTWNy", "")+    , ("$2a$06$DCq7YPn5Rq63x1Lad4cll.TV4S6ytwfsfvkgY8jIucDrjc8deX1s.", "")+    , ("$2a$08$HqWuK6/Ng6sg9gQzbLrgb.Tl.ZHfXLhvt/SgVyWhQqgqcZ7ZuUtye", "")+    , ("$2a$10$k1wbIrmNyFAPwPVPSVa/zecw2BCEnBwVS2GbrmgzxFUOqW9dk4TCW", "")+    , ("$2a$12$k42ZFHFWqBp3vWli.nIn8uYyIkbvYRvodzbfbK18SSsY.CsIQPlxO", "")+    , ("$2a$06$m0CrhHm10qJ3lXRY.5zDGO3rS2KdeeWLuGmsfGlMfOxih58VYVfxe", "a")+    , ("$2a$08$cfcvVd2aQ8CMvoMpP2EBfeodLEkkFJ9umNEfPD18.hUF62qqlC/V.", "a")+    , ("$2a$12$8NJH3LsPrANStV6XtBakCez0cKHXVxmvxIlcz785vxAIZrihHZpeS", "a")+    , ("$2a$06$If6bvum7DFjUnE9p2uDeDu0YHzrHM6tf.iqN8.yx.jNN1ILEf7h0i", "abc")+    , ("$2a$08$Ro0CUfOqk6cXEKf3dyaM7OhSCvnwM9s4wIX9JeLapehKK5YdLxKcm", "abc")+    , ("$2a$10$WvvTPHKwdBJ3uk0Z37EMR.hLA2W6N9AEBhEgrAOljy2Ae5MtaSIUi", "abc")+    , ("$2a$06$.rCVZVOThsIa97pEDOxvGuRRgzG64bvtJ0938xuqzv18d3ZpQhstC", "abcdefghijklmnopqrstuvwxyz")+    ]++makeKATs expected = concatMap maketest (zip3 is passwords hashes)+  where+    is :: [Int]+    is = [1..]++    passwords = map snd expected+    hashes    = map fst expected++    maketest (i, password, hash) =+        [ testCase (show i) (assertBool "" (validatePassword password hash))+        ]++tests = testGroup "bcrypt"+    [ testGroup "KATs" (makeKATs expected)+    ]

@@ -20,12 +20,22 @@  tests = testGroup "ChaChaPoly1305"     [ testCase "V1" runEncrypt+    , testCase "V1-decrypt" runDecrypt     ]   where runEncrypt =             let ini                 = throwCryptoError $ AEAD.initialize key (throwCryptoError $ AEAD.nonce8 constant iv)                 afterAAD            = AEAD.finalizeAAD (AEAD.appendAAD aad ini)-                (out, afterEncrypt) = AEAD.combine plaintext afterAAD+                (out, afterEncrypt) = AEAD.encrypt plaintext afterAAD                 outtag              = AEAD.finalize afterEncrypt              in propertyHoldCase [ eqTest "ciphertext" ciphertext out+                                 , eqTest "tag" tag (B.convert outtag)+                                 ]++        runDecrypt =+            let ini                 = throwCryptoError $ AEAD.initialize key (throwCryptoError $ AEAD.nonce8 constant iv)+                afterAAD            = AEAD.finalizeAAD (AEAD.appendAAD aad ini)+                (out, afterDecrypt) = AEAD.decrypt ciphertext afterAAD+                outtag              = AEAD.finalize afterDecrypt+             in propertyHoldCase [ eqTest "plaintext" plaintext out                                  , eqTest "tag" tag (B.convert outtag)                                  ]

@@ -20,21 +20,21 @@     ]  tests = testGroup "number"-    [ testProperty "num-bits" $ \(Int0_2901 i) ->+    [ testProperty "num-bits" $ \(Int1_2901 i) ->         and [ (numBits (2^i-1) == i)             , (numBits (2^i) == i+1)             , (numBits (2^i + (2^i-1)) == i+1)             ]     , testProperty "num-bits2" $ \(Positive i) ->         not (i `testBit` numBits i) && (i `testBit` (numBits i - 1))-    , testProperty "generate-param" $ \testDRG (Int0_2901 bits)  ->+    , testProperty "generate-param" $ \testDRG (Int1_2901 bits)  ->         let r = withTestDRG testDRG $ generateParams bits (Just SetHighest) False          in r >= 0 && numBits r == bits && testBit r (bits-1)-    , testProperty "generate-param2" $ \testDRG (Int0_2901 m1bits) ->+    , testProperty "generate-param2" $ \testDRG (Int1_2901 m1bits) ->         let bits = m1bits + 1 -- make sure minimum is 2             r = withTestDRG testDRG $ generateParams bits (Just SetTwoHighest) False          in r >= 0 && numBits r == bits && testBit r (bits-1) && testBit r (bits-2)-    , testProperty "generate-param-odd" $ \testDRG (Int0_2901 bits) ->+    , testProperty "generate-param-odd" $ \testDRG (Int1_2901 bits) ->         let r = withTestDRG testDRG $ generateParams bits Nothing True          in r >= 0 && odd r     , testProperty "generate-range" $ \testDRG (Positive range) ->

@@ -0,0 +1,26 @@+{-# LANGUAGE OverloadedStrings #-}+module Padding (tests) where++import qualified Data.ByteString as B+import Imports+import Crypto.Error++import Crypto.Data.Padding++cases =+    [ ("abcdef", 8, "abcdef\x02\x02")+    , ("abcd", 4, "abcd\x04\x04\x04\x04")+    , ("xyze", 5, "xyze\x01")+    ]++--instance Arbitrary where++testPad :: Int -> (B.ByteString, Int, B.ByteString) -> TestTree+testPad n (inp, sz, padded) =+    testCase (show n) $ propertyHoldCase [ eqTest "padded" padded (pad (PKCS7 sz) inp)+                                         , eqTest "unpadded" (Just inp) (unpad (PKCS7 sz) padded)+                                         ]++tests = testGroup "Padding"+    [ testGroup "Cases" $ map (uncurry testPad) (zip [1..] cases)+    ]

@@ -5,6 +5,7 @@ import qualified Data.ByteString.Char8 as B ()  import Imports+import Crypto.Error  import qualified Crypto.MAC.Poly1305 as Poly1305 import qualified Data.ByteArray as B (convert)@@ -27,7 +28,7 @@     , testProperty "Chunking" $ \(Chunking chunkLen totalLen) ->         let key = B.replicate 32 0             msg = B.pack $ take totalLen $ concat (replicate 10 [1..255])-         in Poly1305.auth key msg == Poly1305.finalize (foldr (flip Poly1305.update) (Poly1305.initialize key) (chunks chunkLen msg))+         in Poly1305.auth key msg == Poly1305.finalize (foldr (flip Poly1305.update) (throwCryptoError $ Poly1305.initialize key) (chunks chunkLen msg))     ]   where         chunks i bs

@@ -4,6 +4,7 @@ import Imports  import qualified Number+import qualified BCrypt import qualified Hash import qualified Poly1305 import qualified Salsa@@ -24,10 +25,12 @@ import qualified KAT_TripleDES -- misc -------------------------------- import qualified KAT_AFIS+import qualified Padding  tests = testGroup "cryptonite"     [ Number.tests     , Hash.tests+    , Padding.tests     , testGroup "MAC"         [ Poly1305.tests         , KAT_HMAC.tests@@ -38,6 +41,7 @@     , testGroup "KDF"         [ KAT_PBKDF2.tests         , KAT_Scrypt.tests+        , BCrypt.tests         ]     , testGroup "block-cipher"         [ KAT_AES.tests

@@ -46,8 +46,14 @@ newtype Int0_2901 = Int0_2901 Int     deriving (Show,Eq,Ord) +newtype Int1_2901 = Int1_2901 Int+    deriving (Show,Eq,Ord)+ instance Arbitrary Int0_2901 where     arbitrary = Int0_2901 `fmap` choose (0,2901)++instance Arbitrary Int1_2901 where+    arbitrary = Int1_2901 `fmap` choose (1,2901)  -- | a integer wrapper with a better range property newtype QAInteger = QAInteger { getQAInteger :: Integer }