diff --git a/LICENSE b/LICENSE new file mode 100644 --- /dev/null +++ b/LICENSE @@ -0,0 +1,30 @@ +Copyright (c) 2014, Prowdsponsor + +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following + disclaimer in the documentation and/or other materials provided + with the distribution. + + * Neither the name of Felipe Lessa nor the names of other + contributors may be used to endorse or promote products derived + from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/Setup.hs b/Setup.hs new file mode 100644 --- /dev/null +++ b/Setup.hs @@ -0,0 +1,2 @@ +import Distribution.Simple +main = defaultMain diff --git a/nonce.cabal b/nonce.cabal new file mode 100644 --- /dev/null +++ b/nonce.cabal @@ -0,0 +1,42 @@ +name: nonce +version: 1.0 +synopsis: Generate cryptographic nonces. +homepage: https://github.com/prowdsponsor/nonce +license: BSD3 +license-file: LICENSE +author: Felipe Lessa +maintainer: Prowdsponsor +copyright: (c) 2014 Prowdsponsor +category: Cryptography +build-type: Simple +cabal-version: >= 1.10 +description: + According to the Wikipedia, a nonce is an arbitrary number used + only once in a cryptographic communication. This package + contain helper functions for generating nonces. + . + There are many kinds of nonces used in different situations. + It's not guarantee that by using the nonces from this package + you won't have any security issues. Please make sure that the + nonces generated via this package are usable on your design. + +source-repository head + type: git + location: git://github.com/prowdsponsor/nonce.git + +library + exposed-modules: + Crypto.Nonce + build-depends: + base >= 4.5 && < 4.8 + , base64-bytestring == 1.0.* + , bytestring >= 0.9 + , crypto-random == 0.0.* + , cprng-aes == 0.5.* + , text >= 0.9 + , transformers >= 0.2 + hs-source-dirs: src/ + default-language: Haskell2010 + ghc-options: -Wall + default-extensions: + DeriveDataTypeable diff --git a/src/Crypto/Nonce.hs b/src/Crypto/Nonce.hs new file mode 100644 --- /dev/null +++ b/src/Crypto/Nonce.hs @@ -0,0 +1,84 @@ +-- | Usage of this module is very simple. Here is a sample GHCi run: +-- +-- @ +-- *Crypto.Nonce> g <- new +-- *Crypto.Nonce> nonce128 g +-- \"c\\164\\252\\162f\\207\\245\\ESC`\\180p\\DC4\\234\\223QP\" +-- *Crypto.Nonce> nonce128 g +-- \"\\203C\\190\\138aI\\158\\194\\146\\&7\\208\\&7\\ETX0\\f\\229\" +-- *Crypto.Nonce> nonce128url g +-- \"3RP-iEFT-6NrpCMsxigondMC\" +-- *Crypto.Nonce> nonce128url g +-- \"MVZH3Gi5zSKXJY-_qdtznxla\" +-- *Crypto.Nonce> nonce128url g +-- \"3f3cVNfuZT62-uGco1CBThci\" +-- *Crypto.Nonce> nonce128urlT g +-- \"iGMJyrRkw2QMp09SRy59s4Jx\" +-- *Crypto.Nonce> nonce128urlT g +-- \"WsHs0KwYiex3tsqQZ8b0119_\" +-- *Crypto.Nonce> nonce128urlT g +-- \"JWkLSX7qSFGu1Q3PHuExwurF\" +-- @ +-- +-- The functions that generate nonces are not pure on purpose, +-- since that makes it a lot harder to reuse the same nonce. +module Crypto.Nonce + ( Generator + , new + , nonce128 + , nonce128url + , nonce128urlT + ) where + +import Control.Monad (liftM) +import Control.Monad.IO.Class (MonadIO, liftIO) +import Data.Tuple (swap) +import Data.Typeable (Typeable) + +import qualified Crypto.Random as R +import qualified Crypto.Random.AESCtr as AESCtr +import qualified Data.ByteString as B +import qualified Data.ByteString.Base64.URL as B64URL +import qualified Data.IORef as I +import qualified Data.Text as T +import qualified Data.Text.Encoding as TE + + +-- | An encapsulated nonce generator. +data Generator = + G (I.IORef AESCtr.AESRNG) + deriving (Typeable) + +instance Show Generator where + show _ = "" + + +-- | Create a new nonce generator using the system entropy. +new :: MonadIO m => m Generator +new = liftM G . liftIO $ AESCtr.makeSystem >>= I.newIORef + + +-- | (Internal) Generate the given number of bytes from the AES CPRNG. +genBytes :: MonadIO m => Int -> Generator -> m B.ByteString +genBytes n (G v) = liftIO $ I.atomicModifyIORef v $ swap . R.cprgGenerate n + + +-- | Generate a 128 bit nonce as a 'B.ByteString' of 16 bytes. +-- Each byte may have any value from @0@ to @255@. +nonce128 :: MonadIO m => Generator -> m B.ByteString +nonce128 = genBytes 16 + + +-- | Generate a 128 bit nonce as a 'B.ByteString' of 24 bytes. +-- Each byte is either a letter (upper or lowercase), a digit, a +-- dash (@-@) or an underscore (@_@), which is the set of +-- characters from the base64url encoding. In order to avoid any +-- issues with padding, the generated nonce actually has 144 bits. +nonce128url :: MonadIO m => Generator -> m B.ByteString +nonce128url = liftM B64URL.encode . genBytes 18 + + +-- | Same as 'nonce128url', but returns its result as 'T.Text' +-- instead. +nonce128urlT :: MonadIO m => Generator -> m T.Text +nonce128urlT = liftM TE.decodeUtf8 . nonce128url