saltine 0.2.1.0 → 0.2.2.0

raw patch · 10 files changed

+133/−22 lines, 10 filesdep ~bytestringdep ~deepseqdep ~textPVP: major bump suggested

API removals or changes: PVP suggests a major version bump

Dependency ranges changed: bytestring, deepseq, text

API changes (from Hackage documentation)

Files

• CHANGELOG.md +7/−0
• README.md +10/−10
• saltine.cabal +4/−4
• src/Crypto/Saltine/Core/Hash.hs +16/−1
• src/Crypto/Saltine/Core/Sign.hs +31/−1
• src/Crypto/Saltine/Internal/Hash.hs +21/−1
• src/Crypto/Saltine/Internal/Sign.hs +16/−0
• tests/HashProperties.hs +8/−1
• tests/SignProperties.hs +18/−2
• tests/StreamProperties.hs +2/−2

@@ -7,6 +7,13 @@ ### Added ### Changed +## [0.2.2.0] - 2025-02-22+### Added+- SHA256 support, thanks [@jmazon](https://github.com/jmazon)+- Ed25519 to Curve25519 conversion support, thanks [@jmazon](https://github.com/jmazon)+### Changed+- Version bounds relaxed+ ## [0.2.1.0] - 2023-02-17 ### Changed - Fix Show instances formatting, and add instances for Keypairs, thanks [@NicolasT](https://github.com/NicolasT)

@@ -1,4 +1,4 @@-# Saltine 0.2.1.0 [![Hackage version](https://img.shields.io/hackage/v/saltine.svg?colorB=4FB900)](https://hackage.haskell.org/package/saltine)+# Saltine 0.2.2.0 [![Hackage version](https://img.shields.io/hackage/v/saltine.svg?colorB=4FB900)](https://hackage.haskell.org/package/saltine)  A Haskell binding for @jedisct1's portable binding for djb's NaCl. **This is an early release.** Please try it out, but don't just@@ -43,22 +43,22 @@ provide even more simplicity and safety to the usage of cryptography.  Note that it's still possible to shoot yourself in the foot pretty-easily using Saltine. Nonces must always be unique which must be managed +easily using Saltine. Nonces must always be unique which must be managed by the library user. [`Crypto.Saltine.Core.Stream`](https://github.com/tel/saltine/blob/master/src/Crypto/Saltine/Core/Stream.hs)-produces messages which can beundetectably tampered with in-flight. -Keys are insecurely read from disk—they may be copied and then paged +produces messages which can beundetectably tampered with in-flight.+Keys are insecurely read from disk—they may be copied and then paged back to disk. -When uncertain, use [`Crypto.Saltine.Core.SecretBox`](https://github.com/tel/saltine/blob/master/src/Crypto/Saltine/Core/SecretBox.hs) +When uncertain, use [`Crypto.Saltine.Core.SecretBox`](https://github.com/tel/saltine/blob/master/src/Crypto/Saltine/Core/SecretBox.hs) and [`Crypto.Saltine.Core.Box`](https://github.com/tel/saltine/blob/master/src/Crypto/Saltine/Core/Box.hs).-If you can think of ways to use Haskell's type system to enforce +If you can think of ways to use Haskell's type system to enforce security invariants, please suggest them. -To use it on Windows systems, download -[a prebuild libsodium-\*-stable-mingw.tar.gz file](https://download.libsodium.org/libsodium/releases/) -and copy the files in `libsodium-win64`  into the equivalent places -in `C:\Program Files\Haskell Platform\*\mingw`. Then just add saltine +To use it on Windows systems, download+[a prebuild libsodium-\*-stable-mingw.tar.gz file](https://download.libsodium.org/libsodium/releases/)+and copy the files in `libsodium-win64`  into the equivalent places+in `C:\Program Files\Haskell Platform\*\mingw`. Then just add saltine to your cabal file and watch it go.  Tested with [`libsodium-1.0.18`](https://download.libsodium.org/libsodium/releases/).

@@ -1,7 +1,7 @@ cabal-version: 2.0  name:                saltine-version:             0.2.1.0+version:             0.2.2.0 synopsis:            Cryptography that's easy to digest (NaCl/libsodium bindings). description: @@ -85,11 +85,11 @@   default-language:   Haskell2010   build-depends:                 base        >= 4.5    && < 5-              , bytestring  >= 0.10.8 && < 0.12-              , deepseq    ^>= 1.4+              , bytestring  >= 0.10.8 && < 0.13+              , deepseq     >= 1.4    && < 1.6               , profunctors >= 5.3    && < 5.7               , hashable-              , text       ^>= 1.2 || ^>= 2.0+              , text       ^>= 1.2 || >= 2.0 && < 2.2  test-suite tests   type:    exitcode-stdio-1.0

@@ -41,18 +41,28 @@ -- This is version 2010.08.30 of the hash.html web page. Information -- about SipHash has been added. module Crypto.Saltine.Core.Hash (+  -- * Documentation   ShorthashKey,   hash,   shorthash, newShorthashKey,   GenerichashKey,   newGenerichashKey,   GenerichashOutLen,-  generichashOutLen, generichash+  generichashOutLen, generichash,++  -- * Advanced: SHA-2+  --+  -- | The SHA-256 function is provided for interoperability with+  -- other applications. If you are looking for a generic hash+  -- function and not specifically SHA-2, using 'generichash'+  -- (BLAKE2b) might be a better choice.+  sha256   ) where  import Crypto.Saltine.Internal.Hash             ( c_hash             , c_generichash+            , c_hash_sha256             , shorthash             , ShorthashKey(..)             , GenerichashKey(..)@@ -101,3 +111,8 @@ generichash (GhK k) m (GhOL outLen) = snd . buildUnsafeByteString outLen $ \ph ->   constByteStrings [k, m] $ \[(pk, _), (pm, _)] ->     c_generichash ph (fromIntegral outLen) pm (fromIntegral $ S.length m) pk (fromIntegral $ S.length k)++-- | Computes a SHA256 hash.+sha256 :: ByteString -> ByteString+sha256 m = snd . buildUnsafeByteString Bytes.hash_sha256_bytes $ \ph ->+  constByteStrings [m] $ \[(pm,_)] -> c_hash_sha256 ph pm (fromIntegral $ S.length m)

@@ -27,10 +27,19 @@ -- This is current information as of 2013 June 6.  module Crypto.Saltine.Core.Sign (+  -- * Documentation   SecretKey, PublicKey, Keypair(..), Signature,   newKeypair,   sign, signOpen,-  signDetached, signVerifyDetached+  signDetached, signVerifyDetached,++  -- * Advanced: Ed25519 to Curve25519+  --+  -- | Ed25519 keys can be converted to X25519 keys, so that the same+  -- key pair can be used both for authenticated encryption+  -- ("Crypto.Saltine.Core.Box") and for signatures+  -- ("Crypto.Saltine.Core.Sign").+  signPublicKeyToScalarMult, signSecretKeyToScalarMult   ) where  import Crypto.Saltine.Internal.Sign@@ -39,6 +48,8 @@             , c_sign_open             , c_sign_detached             , c_sign_verify_detached+            , c_sign_ed25519_pk_to_curve25519+            , c_sign_ed25519_sk_to_curve25519             , SecretKey(..)             , PublicKey(..)             , Keypair(..)@@ -51,6 +62,7 @@ import System.IO.Unsafe  import qualified Crypto.Saltine.Internal.Sign as Bytes+import qualified Crypto.Saltine.Internal.ScalarMult as SM import qualified Data.ByteString              as S  -- | Creates a random key of the correct size for 'sign' and@@ -128,4 +140,22 @@         return (res == 0)   where len = S.length sm +-- | Converts an Ed25519 public key to an X25519 public key.+signPublicKeyToScalarMult :: PublicKey -> Maybe SM.GroupElement+signPublicKeyToScalarMult (PK pk) = unsafePerformIO $ do+  (err,x) <- buildUnsafeByteString' SM.scalarmult_bytes $ \xbuf ->+    constByteStrings [pk] $ \[(edbuf,_)] ->+      c_sign_ed25519_pk_to_curve25519 xbuf edbuf+  case err of+    0 -> return $ Just $ SM.GE x+    _ -> return   Nothing +-- | Converts an Ed25519 secret key to an X25519 secret key.+signSecretKeyToScalarMult :: SecretKey -> Maybe SM.Scalar+signSecretKeyToScalarMult (SK sk) = unsafePerformIO $ do+  (err,x) <- buildUnsafeByteString' SM.scalarmult_bytes $ \xbuf ->+    constByteStrings [sk] $ \[(edbuf,_)] ->+      c_sign_ed25519_sk_to_curve25519 xbuf edbuf+  case err of+    0 -> return $ Just $ SM.Sc x+    _ -> return   Nothing

@@ -14,9 +14,11 @@   , shorthash_keybytes   , generichash_bytes_max   , generichash_keybytes_max+  , hash_sha256_bytes   , c_hash   , c_shorthash   , c_generichash+  , c_hash_sha256   , nullShKey   , shorthash   , ShorthashKey(..)@@ -85,7 +87,7 @@  newtype GenerichashOutLen = GhOL { unGhOL :: Int } deriving (Eq, Ord, Hashable, Data, Typeable, Generic, NFData) -hash_bytes, shorthash_bytes, shorthash_keybytes, generichash_bytes_max, generichash_keybytes_max :: Int+hash_bytes, shorthash_bytes, shorthash_keybytes, generichash_bytes_max, generichash_keybytes_max, hash_sha256_bytes :: Int  -- Hashes -- | The size of a hash resulting from@@ -103,6 +105,9 @@ -- | The maximum key size of the generic hash function -- 'Crypto.Saltine.Core.Hash.generichash' generichash_keybytes_max = fromIntegral c_crypto_generichash_keybytes_max+-- | The size of a hash resulting from+-- 'Crypto.Saltine.Core.Hash.sha256'.+hash_sha256_bytes = fromIntegral c_crypto_hash_sha256_bytes  -- src/libsodium/crypto_generichash/crypto_generichash.c foreign import ccall "crypto_generichash_bytes_max"@@ -122,7 +127,12 @@ foreign import ccall "crypto_shorthash_keybytes"   c_crypto_shorthash_keybytes :: CSize +-- src/libsodium/crypto_hash/sha256/hash_sha256.c+-- src/libsodium/include/sodium/crypto_hash_sha256.h+foreign import ccall "crypto_hash_sha256_bytes"+  c_crypto_hash_sha256_bytes :: CSize + foreign import ccall "crypto_hash"   c_hash :: Ptr CChar          -- ^ Output hash buffer@@ -158,5 +168,15 @@                 -- ^ Constant Key buffer                 -> CULLong                 -- ^ Key buffer length+                -> IO CInt+                -- ^ Always 0++foreign import ccall "crypto_hash_sha256"+  c_hash_sha256 :: Ptr CChar+                -- ^ Output hash buffer+                -> Ptr CChar+                -- ^ Constant message buffer+                -> CULLong+                -- ^ Message buffer length                 -> IO CInt                 -- ^ Always 0

@@ -17,6 +17,8 @@   , c_sign_open   , c_sign_detached   , c_sign_verify_detached+  , c_sign_ed25519_pk_to_curve25519+  , c_sign_ed25519_sk_to_curve25519   , SecretKey(..)   , PublicKey(..)   , Keypair(..)@@ -180,3 +182,17 @@                            -> Ptr CChar                            -- ^ Public key buffer                            -> IO CInt++foreign import ccall "crypto_sign_ed25519_pk_to_curve25519"+    c_sign_ed25519_pk_to_curve25519 :: Ptr CChar+                                    -- ^ X25519 public key output buffer+                                    -> Ptr CChar+                                    -- ^ Ed25519 public key buffer+                                    -> IO CInt++foreign import ccall "crypto_sign_ed25519_sk_to_curve25519"+    c_sign_ed25519_sk_to_curve25519 :: Ptr CChar+                                    -- ^ X25519 secret key output buffer+                                    -> Ptr CChar+                                    -- ^ Ed25519 secret key buffer+                                    -> IO CInt

@@ -28,6 +28,9 @@     testProperty "Hash of empty ByteString is correct"     $ \(Message bs) -> (bs == S.empty) ==> hash bs == (read hashEmptyBS :: S.ByteString), +    testProperty "SHA256 of empty ByteString is correct"+    $ \(Message bs) -> (bs == S.empty) ==> sha256 bs == (read sha256EmptyBS :: S.ByteString),+     testProperty "No two shorthashes are alike"     $ \(Message bs1, Message bs2) -> bs1 /= bs2 ==> shorthash shKey bs1 /= shorthash shKey bs2, @@ -37,10 +40,14 @@     testProperty "No two generic hashes are alike"     $ \(Message bs1, Message bs2) -> bs1 /= bs2 ==> generichash ghKey bs1 ghOutLen /= generichash ghKey bs2 ghOutLen, +    testProperty "No two SHA256 hashes are alike"+    $ \(Message bs1, Message bs2) -> bs1 /= bs2 ==> sha256 bs1 /= sha256 bs2,+     testProperty "Different keys produce different generichashes"     $ \(Message bs) -> generichash ghKey bs ghOutLen /= generichash ghKey2 bs ghOutLen      ]    where-    hashEmptyBS = "\"\207\131\225\&5~\239\184\189\241T(P\214m\128\a\214 \228\ENQ\vW\NAK\220\131\244\169!\211l\233\206G\208\209<]\133\242\176\255\131\CAN\210\135~\236/c\185\&1\189GAz\129\165\&82z\249'\218>\""+    hashEmptyBS   = "\"\207\131\225\&5~\239\184\189\241T(P\214m\128\a\214 \228\ENQ\vW\NAK\220\131\244\169!\211l\233\206G\208\209<]\133\242\176\255\131\CAN\210\135~\236/c\185\&1\189GAz\129\165\&82z\249'\218>\""+    sha256EmptyBS = "\"\227\176\196B\152\252\FS\DC4\154\251\244\200\153o\185$'\174A\228d\155\147L\164\149\153\ESCxR\184U\""

@@ -5,10 +5,15 @@   ) where  import           Util+import           Crypto.Saltine.Class+ import           Crypto.Saltine.Core.Sign import           Crypto.Saltine.Internal.Sign-+import qualified Crypto.Saltine.Core.Box              as Box+import           Crypto.Saltine.Core.ScalarMult       ()+import           Crypto.Saltine.Internal.ScalarMult import qualified Data.ByteString                      as S+import           Data.Maybe                           (fromJust) import           Test.Framework.Providers.QuickCheck2 import           Test.Framework import           Test.QuickCheck@@ -19,7 +24,9 @@   let sk1 = secretKey kp1   let pk1 = publicKey kp1   kp2 <- newKeypair+  let sk2 = secretKey kp2   let pk2 = publicKey kp2+  n <- Box.newNonce    return $ testGroup "...Internal.Sign" [ @@ -38,6 +45,15 @@      testProperty "Rejects message with mismatched key w/ detached signature"     $ \(Message bs) -> not (S.null bs) ==>-                         not (signVerifyDetached pk2 (signDetached sk1 bs) bs)+                         not (signVerifyDetached pk2 (signDetached sk1 bs) bs), +    testProperty "Ed25515 -> Curve25519 conversion produces valid keypairs"+    $ \(Message bs) ->+        let p1 = fromJust . decode . unGE . fromJust $ signPublicKeyToScalarMult pk1+            s1 = fromJust . decode . unSc . fromJust $ signSecretKeyToScalarMult sk1++            p2 = fromJust . decode . unGE . fromJust $ signPublicKeyToScalarMult pk2+            s2 = fromJust . decode . unSc . fromJust $ signSecretKeyToScalarMult sk2++        in  (Box.boxOpen p2 s1 n (Box.box p1 s2 n bs)) == Just bs     ]

@@ -23,8 +23,8 @@               ==> S.length (stream k n len) == len,      testProperty "xor munges input"-    $ \(Message bs) -> not (S.null bs)-                       ==> xor k n bs /= bs,+    $ \(ByteString32 bs) ->     -- ByteString32 so we don't fail the test by pure chance, e.g. in case of 1-byte bytestrings+        xor k n bs /= bs,      testProperty "xor is involutive"     $ \(Message bs) -> xor k n (xor k n bs) == bs