crypto-conduit-0.5.2.1: Conduit interface for cryptographic operations (from crypto-api).

Safe Haskell | None

Crypto.Conduit

Contents

- Cryptographic hash functions
- Hash-based message authentication code (HMAC)
- Block ciphers
  - Electronic codebook mode (ECB)
  - Cipher-block chaining mode (CBC)
  - Cipher feedback mode (CFB)
  - Output feedback mode (OFB)
  - Counter mode (CTR)
  - Cipher-block chaining message authentication code (CBC-MAC)
- Internal helpers

Description

This module contains wrappers for cryptographic functions using the `conduit` package. Currently there is support for hashes, HMACs and many modes of block ciphers (but not everything `crypto-api` supports has a counterpart here). All functions on this package work in constant memory.

Synopsis

- sinkHash :: (Monad m, Hash ctx d) => Consumer ByteString m d
- hashFile :: (MonadIO m, Hash ctx d) => FilePath -> m d
- sinkHmac :: (Monad m, Hash ctx d) => MacKey ctx d -> Consumer ByteString m d
- conduitEncryptEcb :: (Monad m, BlockCipher k) => k -> Conduit ByteString m ByteString
- conduitDecryptEcb :: (Monad m, BlockCipher k) => k -> Conduit ByteString m ByteString
- conduitEncryptCbc :: (Monad m, BlockCipher k) => k -> IV k -> Conduit ByteString m ByteString
- conduitDecryptCbc :: (Monad m, BlockCipher k) => k -> IV k -> Conduit ByteString m ByteString
- conduitEncryptCfb :: (Monad m, BlockCipher k) => k -> IV k -> Conduit ByteString m ByteString
- conduitDecryptCfb :: (Monad m, BlockCipher k) => k -> IV k -> Conduit ByteString m ByteString
- conduitEncryptOfb :: (Monad m, BlockCipher k) => k -> IV k -> Conduit ByteString m ByteString
- conduitDecryptOfb :: (Monad m, BlockCipher k) => k -> IV k -> Conduit ByteString m ByteString
- conduitEncryptCtr :: (Monad m, BlockCipher k) => k -> IV k -> (IV k -> IV k) -> Conduit ByteString m ByteString
- conduitDecryptCtr :: (Monad m, BlockCipher k) => k -> IV k -> (IV k -> IV k) -> Conduit ByteString m ByteString
- sourceCtr :: (Monad m, BlockCipher k) => k -> IV k -> Producer m ByteString
- sinkCbcMac :: (Monad m, BlockCipher k) => k -> Consumer ByteString m ByteString
- blocked :: Monad m => BlockMode -> ByteLength -> Conduit ByteString m Block
- data BlockMode
  - = StrictBlockSize
  - | AnyMultiple
- data Block
  - = Full ByteString
  - | LastOne ByteString

# Cryptographic hash functions

sinkHash :: (Monad m, Hash ctx d) => Consumer ByteString m dSource

A `Sink` that hashes a stream of `ByteString` `s` and creates a digest `d`.

hashFile :: (MonadIO m, Hash ctx d) => FilePath -> m dSource

Hashes the whole contents of the given file in constant memory. This function is just a convenient wrapper around `sinkHash` defined as:

     hashFile fp = liftIO $ runResourceT (sourceFile fp $$ sinkHash)

# Hash-based message authentication code (HMAC)

sinkHmac :: (Monad m, Hash ctx d) => MacKey ctx d -> Consumer ByteString m dSource

A `Sink` that computes the HMAC of a stream of `ByteString` `s` and creates a digest `d`.

# Block ciphers

## Electronic codebook mode (ECB)

conduitEncryptEcb Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> Conduit ByteString m ByteString |

A `Conduit` that encrypts a stream of `ByteString` `s` using ECB mode. Expects the input length to be a multiple of the block size of the cipher and fails otherwise. (Note that ECB has many undesirable cryptographic properties, please avoid it if you don't know what you're doing.)

conduitDecryptEcb Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> Conduit ByteString m ByteString |

A `Conduit` that decrypts a stream of `ByteString` `s` using ECB mode. Expects the input length to be a multiple of the block size of the cipher and fails otherwise.

## Cipher-block chaining mode (CBC)

conduitEncryptCbc Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> IV k | Initialization vector.
-> Conduit ByteString m ByteString |

A `Conduit` that encrypts a stream of `ByteString` `s` using CBC mode. Expects the input length to be a multiple of the block size of the cipher and fails otherwise.

conduitDecryptCbc Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> IV k | Initialization vector.
-> Conduit ByteString m ByteString |

A `Conduit` that decrypts a stream of `ByteString` `s` using CBC mode. Expects the input length to be a multiple of the block size of the cipher and fails otherwise.

## Cipher feedback mode (CFB)

conduitEncryptCfb Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> IV k | Initialization vector.
-> Conduit ByteString m ByteString |

A `Conduit` that encrypts a stream of `ByteString` `s` using CFB mode. Expects the input length to be a multiple of the block size of the cipher and fails otherwise.

conduitDecryptCfb Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> IV k | Initialization vector.
-> Conduit ByteString m ByteString |

A `Conduit` that decrypts a stream of `ByteString` `s` using CFB mode. Expects the input length to be a multiple of the block size of the cipher and fails otherwise.

## Output feedback mode (OFB)

conduitEncryptOfb Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> IV k | Initialization vector.
-> Conduit ByteString m ByteString |

A `Conduit` that encrypts a stream of `ByteString` `s` using OFB mode. Expects the input length to be a multiple of the block size of the cipher and fails otherwise.

conduitDecryptOfb Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> IV k | Initialization vector.
-> Conduit ByteString m ByteString |

Synonym for `conduitEncryptOfb`, since for OFB mode both encryption and decryption are the same.

## Counter mode (CTR)

conduitEncryptCtr Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> IV k | Initialization vector.
-> (IV k -> IV k) | Increment counter (`incIV` is recommended)
-> Conduit ByteString m ByteString |

A `Conduit` that encrypts a stream of `ByteString` `s` using CTR mode. The input may have any length, even non-multiples of the block size.

conduitDecryptCtr Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> IV k | Initialization vector.
-> (IV k -> IV k) | Increment counter (`incIV` is recommended)
-> Conduit ByteString m ByteString |

Synonym for `conduitEncryptCtr`, since for CTR mode both encryption and decryption are the same.

sourceCtr Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> IV k | Initialization vector.
-> Producer m ByteString |

An infinite stream of bytes generated by a block cipher on CTR mode.

## Cipher-block chaining message authentication code (CBC-MAC)

sinkCbcMac Source

Arguments

:: (Monad m, BlockCipher k) |
=> k | Cipher key.
-> Consumer ByteString m ByteString |

A `Sink` that computes the CBC-MAC of a stream of `ByteString` `s` and creates a digest (already encoded in a `ByteString`, since we're using a block cipher). Expects the input length to be a multiple of the block size of the cipher and fails otherwise. (Note that CBC-MAC is not secure for variable-length messages.)

# Internal helpers

blocked Source

Arguments

:: Monad m |
=> BlockMode |
-> ByteLength | Block size
-> Conduit ByteString m Block |

A `Conduit` that takes arbitrary `ByteString` `s` and outputs `Block` `s`. Each `Full` block will have a length that is multiple of the given block size (either exactly the block size or a multiple of at least 1x the block size, depending on the `BlockMode`). All `Block` `s` beside the last one will be `Full`. The last block will always be `LastOne` with less bytes than the block size, possibly zero.

data BlockMode Source

How `Block`s should be returned, either with strictly the block size or with a multiple of at least 1x the block size.

Constructors

StrictBlockSize |
AnyMultiple |

Instances

Enum BlockMode |
Eq BlockMode |
Ord BlockMode |
Show BlockMode |

data Block Source

A block returned by `blocked`.

Constructors

Full ByteString |
LastOne ByteString |

Instances

Eq Block |
Ord Block |
Show Block |