ppad-aead 0.2.0 → 0.3.0

raw patch · 3 files changed

+20/−6 lines, 3 filesdep ~ppad-poly1305PVP ok

version bump matches the API change (PVP)

Dependency ranges changed: ppad-poly1305

API changes (from Hackage documentation)

Files

• CHANGELOG +5/−0
• lib/Crypto/AEAD/ChaCha20Poly1305.hs +13/−4
• ppad-aead.cabal +2/−2

@@ -1,5 +1,10 @@ # Changelog +- 0.3.0 (2025-12-27)+  * Updates the poly1305 dependency to a version that uses ppad-fixed for+    fixed-width words and constant-time primitives internally. Also swaps+    a naïve ByteString equality check out for a constant-time version.+ - 0.2.0 (2025-06-21)   * The 'encrypt' and 'decrypt' functions are now total, returning 'Left     InvalidKey', 'Left InvalidNonce', or 'Left InvalidMAC' values when

@@ -28,6 +28,7 @@ import qualified Crypto.Cipher.ChaCha20 as ChaCha20 import qualified Crypto.MAC.Poly1305 as Poly1305 import Data.Bits ((.>>.))+import qualified Data.Bits as B import qualified Data.ByteString as BS import qualified Data.ByteString.Internal as BI import Data.Word (Word64)@@ -36,6 +37,13 @@ fi = fromIntegral {-# INLINE fi #-} +-- constant-time equality comparison on bytestrings+ct_eq :: BS.ByteString -> BS.ByteString -> Bool+ct_eq a@(BI.PS _ _ la) b@(BI.PS _ _ lb)+  | la /= lb = False+  | otherwise = BS.foldl' (B..|.) 0 (BS.packZipWith B.xor a b) == 0+{-# INLINE ct_eq #-}+ -- little-endian bytestring encoding unroll :: Word64 -> BS.ByteString unroll i = case i of@@ -72,10 +80,11 @@   | otherwise = BS.replicate (16 - l `rem` 16) 0 {-# INLINE pad16 #-} +-- | Error values. data Error =-    InvalidKey-  | InvalidNonce-  | InvalidMAC+    InvalidKey    -- ^ the provided key was not 256 bits long+  | InvalidNonce  -- ^ the provided nonce was not 96 bits long+  | InvalidMAC    -- ^ the provided MAC does not authenticate the ciphertext   deriving (Eq, Show)  -- RFC8439 2.8@@ -143,7 +152,7 @@       case Poly1305.mac otk md3 of         Nothing -> Left InvalidKey         Just tag-          | mac == tag -> case ChaCha20.cipher key 1 nonce cip of+          | ct_eq mac tag -> case ChaCha20.cipher key 1 nonce cip of               Left ChaCha20.InvalidKey -> Left InvalidKey               Left ChaCha20.InvalidNonce -> Left InvalidNonce               Right v -> pure v

@@ -1,6 +1,6 @@ cabal-version:      3.0 name:               ppad-aead-version:            0.2.0+version:            0.3.0 synopsis:           A pure AEAD-ChaCha20-Poly1305 construction license:            MIT license-file:       LICENSE@@ -30,7 +30,7 @@       base >= 4.9 && < 5     , bytestring >= 0.9 && < 0.13     , ppad-chacha >= 0.2 && < 0.3-    , ppad-poly1305 >= 0.3 && < 0.4+    , ppad-poly1305 >= 0.4 && < 0.5  test-suite aead-tests   type:                exitcode-stdio-1.0