crypton-2.0.0: crypton.cabal
cabal-version: 3.0
name: crypton
version: 2.0.0
license: BSD-3-Clause
license-file: LICENSE
copyright: Vincent Hanquez <vincent@snarc.org>
maintainer: Kazu Yamamoto <kazu@iij.ad.jp>
author: Vincent Hanquez <vincent@snarc.org>
stability: experimental
tested-with:
ghc ==9.2.8 || ==9.4.8 || ==9.6.7 || ==9.8.4 || ==9.10.2 || ==9.12.4 || ==9.14.1
homepage: https://github.com/kazu-yamamoto/crypton
bug-reports: https://github.com/kazu-yamamoto/crypton/issues
synopsis: Cryptography Primitives sink
description:
A repository of cryptographic primitives.
.
* Symmetric ciphers: AES, DES, 3DES, CAST5, Blowfish, Twofish, Camellia, RC4, Salsa, XSalsa, ChaCha.
.
* Hash: SHA1, SHA2, SHA3, SHAKE, MD2, MD4, MD5, Keccak, Skein, Ripemd, Tiger, Whirlpool, Blake2
.
* MAC: HMAC, KMAC, Poly1305
.
* Asymmetric crypto: DSA, RSA, DH, ECDH, ECDSA, ECC, Curve25519, Curve448, Ed25519, Ed448
.
* Key Derivation Function: PBKDF2, Scrypt, HKDF, Argon2, BCrypt, BCryptPBKDF
.
* Cryptographic Random generation: System Entropy, Deterministic Random Generator
.
* Data related: Anti-Forensic Information Splitter (AFIS)
.
If anything cryptographic related is missing from here, submit
a pull request to have it added. This package strives to be a
cryptographic kitchen sink that provides cryptography for everyone.
.
Evaluate the security related to your requirements before using.
.
Read "Crypto.Tutorial" for a quick start guide.
category: Cryptography
build-type: Simple
extra-source-files:
cbits/*.h
cbits/aes/*.h
cbits/aes/armv8_impl.c
cbits/aes/x86ni_impl.c
cbits/asm/LICENSE.cryptogams
cbits/asm/README.md
cbits/asm/aesni-gcm-x86_64.pl
cbits/asm/arm-xlate.pl
cbits/asm/arm_arch.h
cbits/asm/chacha-armv8.pl
cbits/asm/chacha-x86_64.pl
cbits/asm/generate.sh
cbits/asm/keccak1600-armv8.pl
cbits/asm/keccak1600-x86_64.pl
cbits/asm/poly1305-armv8.pl
cbits/asm/poly1305-x86_64.pl
cbits/asm/sha1-armv8.pl
cbits/asm/sha512-armv8.pl
cbits/asm/sha512-x86_64.pl
cbits/asm/x86_64-xlate.pl
cbits/chacha_sse_impl.c
cbits/argon2/*.c
cbits/argon2/*.h
cbits/blake2/ref/*.h
cbits/blake2/sse/*.h
cbits/crypton_hash_prefix.c
cbits/decaf/ed448goldilocks/decaf.c
cbits/decaf/ed448goldilocks/decaf_tables.c
cbits/decaf/include/*.h
cbits/decaf/include/arch_32/*.h
cbits/decaf/include/arch_ref64/*.h
cbits/decaf/include/decaf/*.h
cbits/decaf/p448/*.h
cbits/decaf/p448/arch_32/*.h
cbits/decaf/p448/arch_ref64/*.h
cbits/ed25519/*.h
cbits/include32/p256/*.h
cbits/include64/p256/*.h
tests/*.hs
extra-doc-files:
CHANGELOG.md
README.md
source-repository head
type: git
location: https://github.com/kazu-yamamoto/crypton
flag support_aesni
description:
allow compilation with AESNI on system and architecture that supports it
manual: True
flag support_rdrand
description:
allow compilation with RDRAND on system and architecture that supports it
manual: True
flag support_pclmuldq
description:
Allow compilation with pclmuldq on architecture that supports it
manual: True
flag support_sse
description: Use SSE optimized version of (BLAKE2, ARGON2)
default: False
manual: True
flag integer-gmp
description: Whether or not to use GMP for some functions
manual: True
flag support_deepseq
description: add deepseq instances for cryptographic types
manual: True
flag old_toolchain_inliner
description:
use -fgnu89-inline to workaround an old compiler / linker / glibc issue.
default: False
manual: True
flag check_alignment
description:
extra check on alignment in C layers, which cause lowlevel assert errors. for debugging only.
default: False
manual: True
flag use_target_attributes
description:
use GCC / clang function attributes instead of global target options.
manual: True
library
exposed-modules:
Crypto.Cipher.AES
Crypto.Cipher.AESGCMSIV
Crypto.Cipher.Blowfish
Crypto.Cipher.Camellia
Crypto.Cipher.CAST5
Crypto.Cipher.ChaCha
Crypto.Cipher.ChaChaPoly1305
Crypto.Cipher.DES
Crypto.Cipher.RC4
Crypto.Cipher.Salsa
Crypto.Cipher.TripleDES
Crypto.Cipher.Twofish
Crypto.Cipher.Types
Crypto.Cipher.Utils
Crypto.Cipher.XSalsa
Crypto.ConstructHash.MiyaguchiPreneel
Crypto.Data.AFIS
Crypto.Data.Padding
Crypto.ECC
Crypto.ECC.Edwards25519
Crypto.Debug
Crypto.Error
Crypto.Hash
Crypto.Hash.Algorithms
Crypto.Hash.IO
Crypto.KDF.Argon2
Crypto.KDF.BCrypt
Crypto.KDF.BCryptPBKDF
Crypto.KDF.HKDF
Crypto.KDF.PBKDF2
Crypto.KDF.Scrypt
Crypto.MAC.CMAC
Crypto.MAC.HMAC
Crypto.MAC.KeyedBlake2
Crypto.MAC.KMAC
Crypto.MAC.Poly1305
Crypto.Number.Basic
Crypto.Number.F2m
Crypto.Number.Generate
Crypto.Number.ModArithmetic
Crypto.Number.Nat
Crypto.Number.Prime
Crypto.Number.Serialize
Crypto.Number.Serialize.Internal
Crypto.Number.Serialize.Internal.LE
Crypto.Number.Serialize.LE
Crypto.OTP
Crypto.PubKey.Curve25519
Crypto.PubKey.Curve448
Crypto.PubKey.DH
Crypto.PubKey.DSA
Crypto.PubKey.ECC.DH
Crypto.PubKey.ECC.ECDSA
Crypto.PubKey.ECC.Generate
Crypto.PubKey.ECC.P256
Crypto.PubKey.ECC.Prim
Crypto.PubKey.ECC.Types
Crypto.PubKey.ECDSA
Crypto.PubKey.ECIES
Crypto.PubKey.ElGamal
Crypto.PubKey.Ed25519
Crypto.PubKey.Ed448
Crypto.PubKey.EdDSA
Crypto.PubKey.MaskGenFunction
Crypto.PubKey.Rabin.Basic
Crypto.PubKey.Rabin.Modified
Crypto.PubKey.Rabin.OAEP
Crypto.PubKey.Rabin.RW
Crypto.PubKey.Rabin.Types
Crypto.PubKey.RSA
Crypto.PubKey.RSA.OAEP
Crypto.PubKey.RSA.PKCS15
Crypto.PubKey.RSA.Prim
Crypto.PubKey.RSA.PSS
Crypto.PubKey.RSA.Types
Crypto.Random
Crypto.Random.Entropy
Crypto.Random.Entropy.Unsafe
Crypto.Random.EntropyPool
Crypto.Random.Types
Crypto.System.CPU
Crypto.Tutorial
-- -O3 over -O2, which is what GHC passes: measured on x86-64, AES-128-GCM
-- 3455 to 3708 MB/s, AES-128-OCB 2187 to 2484, a P-256 base point
-- multiplication 71.0 to 59.8 us and SHA-256 312 to 318, with ChaCha20,
-- Poly1305, SHA-1 and MD5 within a couple of per cent either way; on Apple
-- silicon the same P-256 multiplication goes from 26.0 to 24.3 us. The
-- code that must not branch on a secret does not: the masked selections in
-- the curve and field code compile to no conditional jumps at either
-- level, and what -O3 adds in cbits/crypton_powm.c is loop control over
-- limb counts, which are public.
cc-options: -std=gnu99 -O3
c-sources:
cbits/argon2/argon2.c
cbits/crypton_blake2b.c
cbits/crypton_blake2bp.c
cbits/crypton_blake2s.c
cbits/crypton_blake2sp.c
cbits/crypton_blowfish.c
cbits/crypton_camellia.c
cbits/crypton_chacha.c
cbits/crypton_cpu.c
cbits/crypton_des.c
cbits/crypton_ecc.c
cbits/crypton_f2m.c
cbits/crypton_md2.c
cbits/crypton_memxor.c
cbits/crypton_md4.c
cbits/crypton_md5.c
cbits/crypton_pbkdf2.c
cbits/crypton_poly1305.c
cbits/crypton_powm.c
cbits/crypton_rc4.c
cbits/crypton_ripemd.c
cbits/crypton_salsa.c
cbits/crypton_scrypt.c
cbits/crypton_sha1.c
cbits/crypton_sha256.c
cbits/crypton_sha3.c
cbits/crypton_sha512.c
cbits/crypton_skein256.c
cbits/crypton_skein512.c
cbits/crypton_tiger.c
cbits/crypton_whirlpool.c
cbits/crypton_xsalsa.c
cbits/ed25519/ed25519.c
cbits/p256/p256.c
cbits/p256/p256_ec.c
other-modules:
Crypto.Cipher.AES.Primitive
Crypto.Cipher.Blowfish.Primitive
Crypto.Cipher.Camellia.Primitive
Crypto.Cipher.CAST5.Primitive
Crypto.Cipher.DES.Primitive
Crypto.Cipher.Twofish.Primitive
Crypto.Cipher.Types.AEAD
Crypto.Cipher.Types.Base
Crypto.Cipher.Types.Block
Crypto.Cipher.Types.GF
Crypto.Cipher.Types.Stream
Crypto.Cipher.Types.Utils
Crypto.ECC.Simple.Prim
Crypto.ECC.Simple.Types
Crypto.Error.Types
Crypto.Hash.Blake2
Crypto.Hash.Blake2b
Crypto.Hash.Blake2bp
Crypto.Hash.Blake2s
Crypto.Hash.Blake2sp
Crypto.Hash.Keccak
Crypto.Hash.MD2
Crypto.Hash.MD4
Crypto.Hash.MD5
Crypto.Hash.RIPEMD160
Crypto.Hash.SHA1
Crypto.Hash.SHA224
Crypto.Hash.SHA256
Crypto.Hash.SHA3
Crypto.Hash.SHA384
Crypto.Hash.SHA512
Crypto.Hash.SHA512t
Crypto.Hash.SHAKE
Crypto.Hash.Skein256
Crypto.Hash.Skein512
Crypto.Hash.Tiger
Crypto.Hash.Types
Crypto.Hash.Whirlpool
Crypto.Internal.Builder
Crypto.Internal.ByteArray
Crypto.Internal.Compat
Crypto.Internal.CompatPrim
Crypto.Internal.DeepSeq
Crypto.Internal.ECC
Crypto.Internal.Endian
Crypto.Internal.Imports
Crypto.Internal.Nat
Crypto.Internal.WordArray
Crypto.Internal.Words
Crypto.Number.Compat
Crypto.PubKey.Internal
Crypto.Random.ChaChaDRG
Crypto.Random.Entropy.Backend
Crypto.Random.Entropy.Source
Crypto.Random.HmacDRG
Crypto.Random.Probabilistic
Crypto.Random.SystemDRG
default-language: Haskell2010
include-dirs:
cbits cbits/ed25519 cbits/decaf/include cbits/decaf/p448
cbits/argon2
ghc-options: -Wall -fwarn-tabs -optc-O3
build-depends:
base >=4.13 && <5,
bytestring,
primitive >=0.9,
deepseq,
base16 >=1.0,
bytestring,
text,
ram >=0.20.1 && <0.23
if flag(old_toolchain_inliner)
cc-options: -fgnu89-inline
if ((((((((arch(x86_64) || arch(aarch64)) || arch(loongarch64)) || arch(ppc64le)) || arch(riscv64)) || arch(s390x)) || arch(alpha)) || arch(ppc64)) || arch(sparc64))
include-dirs: cbits/include64
else
include-dirs: cbits/include32
if ((((((((arch(x86_64) || arch(aarch64)) || arch(loongarch64)) || arch(ppc64le)) || arch(riscv64)) || arch(s390x)) || arch(alpha)) || arch(ppc64)) || arch(sparc64))
c-sources:
cbits/decaf/ed448goldilocks/decaf_all.c
cbits/decaf/ed448goldilocks/eddsa.c
cbits/decaf/ed448goldilocks/scalar.c
cbits/decaf/p448/arch_ref64/f_impl.c
cbits/decaf/p448/f_arithmetic.c
cbits/decaf/p448/f_generic.c
cbits/decaf/utils.c
include-dirs: cbits/decaf/include/arch_ref64 cbits/decaf/p448/arch_ref64
else
c-sources:
cbits/decaf/ed448goldilocks/decaf_all.c
cbits/decaf/ed448goldilocks/eddsa.c
cbits/decaf/ed448goldilocks/scalar.c
cbits/decaf/p448/arch_32/f_impl.c
cbits/decaf/p448/f_arithmetic.c
cbits/decaf/p448/f_generic.c
cbits/decaf/utils.c
include-dirs: cbits/decaf/include/arch_32 cbits/decaf/p448/arch_32
if ((((((((arch(x86_64) || arch(aarch64)) || arch(loongarch64)) || arch(ppc64le)) || arch(riscv64)) || arch(s390x)) || arch(alpha)) || arch(ppc64)) || arch(sparc64))
c-sources: cbits/curve25519/curve25519-donna-c64.c
else
c-sources: cbits/curve25519/curve25519-donna.c
if (((((arch(i386) || arch(x86_64)) || arch(loongarch64)) || arch(ppc64le)) || arch(riscv64)) || arch(alpha))
cpp-options: -DARCH_IS_LITTLE_ENDIAN
if arch(i386)
cpp-options: -DARCH_X86
if arch(x86_64)
cpp-options: -DARCH_X86_64
-- SSE2 is part of the x86-64 baseline, so this needs no flag and no
-- runtime check; i386 keeps the scalar code.
if arch(x86_64)
cc-options:
-DWITH_X86_SSE2 -DWITH_X86_AVX2 -DWITH_X86_SHA_NI
c-sources:
cbits/chacha_avx2.c
cbits/chacha_sse2.c
cbits/sha1_x86.c
-- The SHA extensions are not part of the baseline, so without the
-- attributes this raises it for every file, as the AES-NI and
-- AArch64 paths do.
if !flag(use_target_attributes)
cc-options: -msha -msse4.1 -mssse3
-- Poly1305, ChaCha20 and the SHA-2 pair from CRYPTOGAMS,
-- hand-scheduled. Poly1305
-- there has paths for AVX and AVX2 where the C here has only the
-- second, and replaces it entirely; ChaCha20 there is ahead of the
-- C from one block up, having vector code for lengths the C takes
-- a block at a time. What either has beyond AVX2 is not asked
-- for: no machine here can run it, and a path nothing has executed
-- is not worth the few per cent. See cbits/asm/README.md.
cc-options:
-DWITH_X86_POLY1305_ASM -DWITH_X86_CHACHA_ASM
-DWITH_X86_SHA256_ASM -DWITH_X86_SHA512_ASM -DWITH_X86_SHA3_ASM
if os(osx)
asm-sources:
cbits/asm/chacha-x86_64-macosx.S
cbits/asm/keccak1600-x86_64-macosx.S
cbits/asm/poly1305-x86_64-macosx.S
cbits/asm/sha256-x86_64-macosx.S
cbits/asm/sha512-x86_64-macosx.S
elif os(windows)
asm-sources:
cbits/asm/chacha-x86_64-mingw64.S
cbits/asm/keccak1600-x86_64-mingw64.S
cbits/asm/poly1305-x86_64-mingw64.S
cbits/asm/sha256-x86_64-mingw64.S
cbits/asm/sha512-x86_64-mingw64.S
else
asm-sources:
cbits/asm/chacha-x86_64-elf.S
cbits/asm/keccak1600-x86_64-elf.S
cbits/asm/poly1305-x86_64-elf.S
cbits/asm/sha256-x86_64-elf.S
cbits/asm/sha512-x86_64-elf.S
if ((flag(support_rdrand) && (arch(i386) || arch(x86_64))) && !os(windows))
cpp-options: -DSUPPORT_RDRAND
c-sources: cbits/crypton_rdrand.c
other-modules: Crypto.Random.Entropy.RDRand
if (flag(support_aesni) && arch(aarch64))
cc-options: -DWITH_ARMV8_CRYPTO
c-sources:
cbits/aes/generic.c
cbits/aes/gf.c
cbits/aes/armv8.c
cbits/crypton_aes.c
if !flag(use_target_attributes)
cc-options: -march=armv8-a+crypto
if arch(aarch64)
cc-options:
-DWITH_ARMV8_SHA1 -DWITH_ARMV8_SHA2 -DWITH_ARMV8_SHA3
-DWITH_ARMV8_SHA512
-DWITH_ARMV8_NEON
c-sources:
cbits/chacha_neon.c
cbits/sha1_armv8.c
cbits/sha256_armv8.c
cbits/sha3_armv8.c
cbits/sha512_armv8.c
-- +sha3 covers the SHA-512 instructions as well as the SHA-3 ones,
-- and leaves the baseline at ARMv8-A: it says what the compiler may
-- emit where asked, not what the machine is assumed to have.
if !flag(use_target_attributes)
cc-options: -march=armv8-a+crypto+sha3
-- ChaCha20, Poly1305 and SHA-256 from CRYPTOGAMS. ChaCha20 there runs a
-- fifth block through the
-- general registers alongside four in the vector ones -- eight
-- and six above 512 bytes. The vector registers hold four states
-- and no more, so the rest of the parallelism has to come from the
-- integer side, which is a matter of naming registers and so
-- cannot be written in C; Poly1305 there is the whole of the
-- arithmetic, hand-scheduled, and replaces both the C loops;
-- the SHA-1, SHA-256 and Keccak there use the same instructions
-- as the intrinsics do but schedule them across a run of blocks
-- rather than one at a time. See
-- cbits/asm/README.md. Windows on AArch64 is left out: the object
-- format is neither of these two.
if !os(windows)
cc-options:
-DWITH_ARMV8_CHACHA_ASM -DWITH_ARMV8_POLY1305_ASM
-DWITH_ARMV8_SHA1_ASM -DWITH_ARMV8_SHA256_ASM
-DWITH_ARMV8_SHA3_ASM
if os(osx)
asm-sources:
cbits/asm/chacha-armv8-ios64.S
cbits/asm/poly1305-armv8-ios64.S
cbits/asm/keccak1600-armv8-ios64.S
cbits/asm/sha1-armv8-ios64.S
cbits/asm/sha256-armv8-ios64.S
else
asm-sources:
cbits/asm/chacha-armv8-linux64.S
cbits/asm/poly1305-armv8-linux64.S
cbits/asm/keccak1600-armv8-linux64.S
cbits/asm/sha1-armv8-linux64.S
cbits/asm/sha256-armv8-linux64.S
if ((flag(support_aesni) && (((os(linux) || os(freebsd)) || os(osx)) || os(windows))) && (arch(i386) || arch(x86_64)))
cc-options: -DWITH_AESNI
c-sources:
cbits/aes/generic.c
cbits/aes/gf.c
cbits/aes/x86ni.c
cbits/crypton_aes.c
if !flag(use_target_attributes)
cc-options: -mssse3 -maes
if flag(support_pclmuldq)
cc-options: -DWITH_PCLMUL
if !flag(use_target_attributes)
cc-options: -msse4.1 -mpclmul
-- AES-GCM from CRYPTOGAMS, which interleaves the counter-mode
-- rounds with the multiplies of the block before at
-- instruction granularity. The two do not want the same
-- execution ports, so held against each other they cost about
-- what the rounds alone cost; written in C the compiler sinks
-- every multiply to the end of the group instead. See
-- cbits/asm/README.md. The assembly is x86-64 only, and is
-- checked in per object format since it comes from a
-- generator.
if arch(x86_64)
cc-options: -DWITH_X86_GCM_ASM
c-sources: cbits/aes/gcm_x86_asm.c
if os(osx)
asm-sources: cbits/asm/aesni-gcm-x86_64-macosx.S
elif os(windows)
asm-sources: cbits/asm/aesni-gcm-x86_64-mingw64.S
else
asm-sources: cbits/asm/aesni-gcm-x86_64-elf.S
else
c-sources:
cbits/aes/generic.c
cbits/aes/gf.c
cbits/crypton_aes.c
if (arch(x86_64) || flag(support_sse))
c-sources:
cbits/blake2/sse/blake2b.c
cbits/blake2/sse/blake2bp.c
cbits/blake2/sse/blake2s.c
cbits/blake2/sse/blake2sp.c
include-dirs: cbits/blake2/sse
else
c-sources:
cbits/blake2/ref/blake2b-ref.c
cbits/blake2/ref/blake2bp-ref.c
cbits/blake2/ref/blake2s-ref.c
cbits/blake2/ref/blake2sp-ref.c
include-dirs: cbits/blake2/ref
if (arch(x86_64) || flag(support_sse))
cpp-options: -DSUPPORT_SSE
if arch(i386)
cc-options: -msse2
if os(windows)
cpp-options: -DWINDOWS
other-modules: Crypto.Random.Entropy.Windows
extra-libraries: advapi32
build-depends: Win32
else
other-modules: Crypto.Random.Entropy.Unix
if (impl(ghc >=0) && flag(integer-gmp))
build-depends: integer-gmp
if flag(support_deepseq)
cpp-options: -DWITH_DEEPSEQ_SUPPORT
build-depends: deepseq
if flag(check_alignment)
cc-options: -DWITH_ASSERT_ALIGNMENT
if flag(use_target_attributes)
cc-options: -DWITH_TARGET_ATTRIBUTES
if os(ios)
cpp-options: -DINSECURE_ENTROPY
test-suite test-crypton
type: exitcode-stdio-1.0
main-is: Spec.hs
hs-source-dirs: tests
other-modules:
AFISSpec
BlockCipher
BlockCipher.AES.CBC
BlockCipher.AES.CCM
BlockCipher.AES.CTR
BlockCipher.AES.ECB
BlockCipher.AES.GCM
BlockCipher.AES.GCMLong
BlockCipher.AES.OCB3
BlockCipher.AES.XTS
BlockCipher.AESGCMSIVSpec
BlockCipher.AESSpec
BlockCipher.BlowfishSpec
BlockCipher.CamelliaSpec
BlockCipher.CAST5Spec
BlockCipher.DESSpec
BlockCipher.ModesSpec
BlockCipher.TripleDESSpec
BlockCipher.TwofishSpec
ConstructHash.MiyaguchiPreneelSpec
Curve25519Spec
Curve448Spec
ECC.Edwards25519Spec
ECCSpec
ECDSASpec
Ed25519Spec
Ed448Spec
EdDSASpec
HashSpec
Imports
KDF.Argon2Spec
KDF.BCryptPBKDFSpec
KDF.BCryptSpec
KDF.HKDFSpec
KDF.PBKDF2Spec
KDF.ScryptSpec
MAC.Blake2Spec
MAC.CMACSpec
MAC.HMACSpec
MAC.KMACSpec
MAC.Poly1305Spec
MAC.Poly1305Vectors
Number.F2mSpec
NumberSpec
OTPSpec
PaddingSpec
PubKey.DHSpec
PubKey.DSASpec
PubKey.ECCSpec
PubKey.ECDSASpec
PubKey.ElGamalSpec
PubKey.MGF1Spec
PubKey.OAEPSpec
PubKey.P256Spec
PubKey.PSSSpec
PubKey.RabinSpec
PubKey.SecrecySpec
PubKey.RSASpec
RuntimeSpec
StreamCipher.ChaChaPoly1305Spec
StreamCipher.ChaChaSpec
StreamCipher.RC4Spec
StreamCipher.SalsaSpec
StreamCipher.XSalsaSpec
Utils
build-depends:
base >=4.13 && <5,
bytestring,
QuickCheck,
crypton,
hspec,
ram
build-tool-depends: hspec-discover:hspec-discover
default-language: Haskell2010
ghc-options:
-Wall -fno-warn-orphans -fno-warn-missing-signatures -rtsopts
benchmark bench-crypton
type: exitcode-stdio-1.0
main-is: Bench.hs
hs-source-dirs: benchs
other-modules: Number.F2m
default-language: Haskell2010
ghc-options: -Wall -fno-warn-missing-signatures
build-depends:
base >=4.13 && <5,
bytestring,
crypton,
deepseq,
ram,
random,
tasty-bench