scrypt 0.4.0 → 0.5.0

raw patch · 3 files changed

+32/−15 lines, 3 files

Files

• scrypt.cabal +1/−1
• src/Crypto/Scrypt.hs +27/−10
• test/Test.hs +4/−4

@@ -1,5 +1,5 @@ name:           scrypt-version:        0.4.0+version:        0.5.0 license:        BSD3 license-file:   LICENSE category:       Cryptography

@@ -13,7 +13,9 @@      ScryptParams, scryptParams, scryptParamsLen, defaultParams     -- * Password Storage     -- $password-storage-    , EncryptedPass(..), encryptPass, encryptPass', verifyPass, verifyPass'+    , EncryptedPass(..), encryptPassIO, encryptPassIO'+    , newSalt, encryptPass, encryptPass'+    , verifyPass, verifyPass'     -- * Low-level bindings to the @scrypt@ key derivation function     -- $low-level     , Pass(..), Salt(..), PassHash(..), scrypt, scrypt'@@ -95,7 +97,7 @@   where     valid = and [ logN > 0, r > 0, p > 0                 , r*p < 2^(30 :: Int)-                , bufLen > 0, bufLen <= 2^(32 :: Int)-1 * 32+                , bufLen > 0, bufLen <= (2^(32 :: Int)-1) * 32                 -- allocation fits into (virtual) memory                 , 128*r*2^logN <= fromIntegral (maxBound :: CSize)                 ]@@ -123,16 +125,16 @@ -- A usage example is given below, showing encryption, verification and -- changing 'ScryptParams': ----- > >>> encrypted <- encryptPass defaultParams (Pass "secret")+-- > >>> encrypted <- encryptPassIO defaultParams (Pass "secret") -- > >>> print encrypted--- > EncryptedPass {unEncryptedPass = "14|8|1|Wn5x[SNIP]nM=|Zl+p[SNIP]g=="}+-- > EncryptedPass {getEncryptedPass = "14|8|1|Wn5x[SNIP]nM=|Zl+p[SNIP]g=="} -- > >>> print $ verifyPass defaultParams (Pass "secret") encrypted -- > (True,Nothing) -- > >>> print $ verifyPass defaultParams (Pass "wrong") encrypted -- > (False,Nothing) -- > >>> let newParams = fromJust $ scryptParams 16 8 1 -- > >>> print $ verifyPass newParams (Pass "secret") encrypted--- > (True,Just (EncryptedPass {unEncryptedPass = "16|8|1|Wn5x[SNIP]nM=|ZmWw[SNIP]Q=="}))+-- > (True,Just (EncryptedPass {getEncryptedPass = "16|8|1|Wn5x[SNIP]nM=|ZmWw[SNIP]Q=="})) --  combine :: ScryptParams -> Salt -> PassHash -> EncryptedPass@@ -155,18 +157,33 @@     go _         = Nothing     decodeBase64 = either (const Nothing) Just . Base64.decode +-- |Generate a random 32-byte salt.+--+newSalt :: IO Salt+newSalt = Salt <$> getEntropy 32+ -- |Encrypt the password with the given parameters and a random 32-byte salt. -- The salt is read from @\/dev\/urandom@ on Unix systems or @CryptoAPI@ on -- Windows. ---encryptPass :: ScryptParams -> Pass -> IO EncryptedPass-encryptPass params pass = do-    salt <- Salt <$> getEntropy 32-    return $ combine params salt (scrypt params salt pass)+encryptPassIO :: ScryptParams -> Pass -> IO EncryptedPass+encryptPassIO params pass = do+    salt <- newSalt+    return $ encryptPass params salt pass +-- |Equivalent to @encryptPassIO defaultParams@.+--+encryptPassIO' :: Pass -> IO EncryptedPass+encryptPassIO' = encryptPassIO defaultParams++-- |Encrypt the password with the given parameters and salt.+--+encryptPass :: ScryptParams -> Salt -> Pass -> EncryptedPass+encryptPass params salt pass = combine params salt (scrypt params salt pass)+ -- |Equivalent to @encryptPass defaultParams@. ---encryptPass' :: Pass -> IO EncryptedPass+encryptPass' :: Salt -> Pass -> EncryptedPass encryptPass' = encryptPass defaultParams  -- |Verify a 'Pass' against an 'EncryptedPass'. The function also takes

@@ -44,27 +44,27 @@ prop_WrongPassNotValid :: Pass -> Pass -> ScryptParams -> Property prop_WrongPassNotValid pass candidate params =     pass /= candidate ==> morallyDubiousIOProperty $ do-        encr <- encryptPass params pass+        encr <- encryptPassIO params pass         let (valid, newEncr) = verifyPass params candidate encr         return $ not valid && isNothing newEncr  prop_EncryptVerify :: Pass -> ScryptParams -> Property prop_EncryptVerify pass params =     morallyDubiousIOProperty $ do-        encr <- encryptPass params pass+        encr <- encryptPassIO params pass         let (valid, newEncr) = verifyPass params pass encr         return $ valid && isNothing newEncr  prop_EncryptVerify' :: Pass -> ScryptParams -> Property prop_EncryptVerify' pass params =     morallyDubiousIOProperty $ do-        encr <- encryptPass params pass+        encr <- encryptPassIO params pass         return $ verifyPass' pass encr  prop_NewParamsNewEncr :: Pass -> ScryptParams -> ScryptParams -> Property prop_NewParamsNewEncr pass oldParams newParams =     oldParams /= newParams ==> morallyDubiousIOProperty $ do-        encr <- encryptPass oldParams pass        +        encr <- encryptPassIO oldParams pass                 let (valid,newEncr) = verifyPass newParams pass encr         return $ valid && isJust newEncr && fromJust newEncr /= encr