cryptostore-0.3.1.0: Serialization of cryptographic data types

License | BSD-style
Maintainer | Olivier Chéron <olivier.cheron@gmail.com>
Stability | experimental
Portability | unknown
Safe Haskell | Safe-Inferred
Language | Haskell2010

Crypto.Store.CMS

Contents

- Reading and writing PEM files
- Content encapsulation
- Signed data
  - Signer information
- Enveloped data
  - Key Transport recipients
  - Key Agreement recipients
  - Key Encryption Key recipients
  - Password recipients
- Digested data
- Encrypted data
- Authenticated data
- Authenticated-enveloped data
- Key derivation
- Secret-key algorithms
- RSA padding modes
- CMS attributes
- CMS standard attributes
- Originator information
- ASN.1 representation

Description

Cryptographic Message Syntax

- RFC 5652: Cryptographic Message Syntax (CMS)
- RFC 3370: Cryptographic Message Syntax (CMS) Algorithms
- RFC 3560: Use of the RSAES-OAEP Key Transport Algorithm in the Cryptographic Message Syntax (CMS)
- RFC 4056: Use of the RSASSA-PSS Signature Algorithm in Cryptographic Message Syntax (CMS)
- RFC 3565: Use of the Advanced Encryption Standard (AES) Encryption Algorithm in Cryptographic Message Syntax (CMS)
- RFC 5753: Use of Elliptic Curve Cryptography (ECC) Algorithms in Cryptographic Message Syntax (CMS)
- RFC 5754: Using SHA2 Algorithms with Cryptographic Message Syntax
- RFC 3211: Password-based Encryption for CMS
- RFC 5083: Cryptographic Message Syntax (CMS) Authenticated-Enveloped-Data Content Type
- RFC 5084: Using AES-CCM and AES-GCM Authenticated Encryption in the Cryptographic Message Syntax (CMS)
- RFC 6476: Using Message Authentication Code (MAC) Encryption in the Cryptographic Message Syntax (CMS)
- RFC 8103: Using ChaCha20-Poly1305 Authenticated Encryption in the Cryptographic Message Syntax (CMS)
- RFC 8418: Use of the Elliptic Curve Diffie-Hellman Key Agreement Algorithm with X25519 and X448 in the Cryptographic Message Syntax (CMS)
- RFC 8419: Use of Edwards-Curve Digital Signature Algorithm (EdDSA) Signatures in the Cryptographic Message Syntax (CMS)
- RFC 8702: Use of the SHAKE One-Way Hash Functions in the Cryptographic Message Syntax (CMS)

Synopsis

- data ContentType
  - = DataType
  - | SignedDataType
  - | EnvelopedDataType
  - | DigestedDataType
  - | EncryptedDataType
  - | AuthenticatedDataType
  - | AuthEnvelopedDataType
- data ContentInfo
  - = DataCI ByteString
  - | SignedDataCI (SignedData (Encap EncapsulatedContent))
  - | EnvelopedDataCI (EnvelopedData (Encap EncryptedContent))
  - | DigestedDataCI (DigestedData (Encap EncapsulatedContent))
  - | EncryptedDataCI (EncryptedData (Encap EncryptedContent))
  - | AuthenticatedDataCI (AuthenticatedData (Encap EncapsulatedContent))
  - | AuthEnvelopedDataCI (AuthEnvelopedData (Encap EncryptedContent))
- getContentType :: ContentInfo -> ContentType
- readCMSFile :: FilePath -> IO [ContentInfo]
- readCMSFileFromMemory :: ByteString -> [ContentInfo]
- berToContentInfo :: ByteString -> Either StoreError ContentInfo
- pemToContentInfo :: [Maybe ContentInfo] -> PEM -> [Maybe ContentInfo]
- writeCMSFile :: FilePath -> [ContentInfo] -> IO ()
- writeCMSFileToMemory :: [ContentInfo] -> ByteString
- contentInfoToDER :: ContentInfo -> ByteString
- contentInfoToPEM :: ContentInfo -> PEM
- data Encap a
  - = Detached
  - | Attached a
- fromEncap :: b -> (a -> b) -> Encap a -> b
- class Encapsulates struct
- isAttached :: Encapsulates struct => struct (Encap a) -> Bool
- fromAttached :: (MonadFail m, Encapsulates struct) => struct (Encap a) -> m (struct a)
- toAttachedCI :: Encapsulates struct => struct ByteString -> ContentInfo
- isDetached :: Encapsulates struct => struct (Encap a) -> Bool
- fromDetached :: (MonadFail m, Encapsulates struct) => b -> struct (Encap a) -> m (struct b)
- toDetachedCI :: Encapsulates struct => struct ByteString -> (ByteString, ContentInfo)
- type SignatureValue = ByteString
- data SignatureAlg
  - = RSAAnyHash
  - | RSA DigestAlgorithm
  - | RSAPSS PSSParams
  - | DSA DigestAlgorithm
  - | ECDSA DigestAlgorithm
  - | Ed25519
  - | Ed448
- type EncapsulatedContent = ByteString
- data SignedData content = SignedData {
  - sdDigestAlgorithms :: [DigestAlgorithm]
  - sdContentType :: ContentType
  - sdEncapsulatedContent :: content
  - sdCertificates :: [CertificateChoice]
  - sdCRLs :: [RevocationInfoChoice]
  - sdSignerInfos :: [SignerInfo]
  }
- type ProducerOfSI m = ContentType -> ByteString -> m (Either StoreError (SignerInfo, [CertificateChoice], [RevocationInfoChoice]))
- type ConsumerOfSI m = ContentType -> ByteString -> SignerInfo -> [CertificateChoice] -> [RevocationInfoChoice] -> m Bool
- signData :: Applicative f => [ProducerOfSI f] -> ContentInfo -> f (Either StoreError (SignedData EncapsulatedContent))
- verifySignedData :: Monad m => ConsumerOfSI m -> SignedData EncapsulatedContent -> m (Either StoreError ContentInfo)
- data SignerInfo = SignerInfo {
  - siSignerId :: SignerIdentifier
  - siDigestAlgorithm :: DigestAlgorithm
  - siSignedAttrs :: [Attribute]
  - siSignatureAlg :: SignatureAlg
  - siSignature :: SignatureValue
  - siUnsignedAttrs :: [Attribute]
  }
- data SignerIdentifier
  - = SignerIASN IssuerAndSerialNumber
  - | SignerSKI ByteString
- data IssuerAndSerialNumber = IssuerAndSerialNumber {
  - iasnIssuer :: DistinguishedName
  - iasnSerial :: Integer
  }
- certSigner :: MonadRandom m => SignatureAlg -> PrivKey -> CertificateChain -> Maybe [Attribute] -> [Attribute] -> ProducerOfSI m
- withPublicKey :: Applicative f => PubKey -> ConsumerOfSI f
- withSignerKey :: Applicative f => ConsumerOfSI f
- withSignerCertificate :: Applicative f => (Maybe DateTime -> CertificateChain -> f Bool) -> ConsumerOfSI f
- type EncryptedKey = ByteString
- data KeyEncryptionParams
  - = PWRIKEK ContentEncryptionParams
  - | AES128_WRAP
  - | AES192_WRAP
  - | AES256_WRAP
  - | AES128_WRAP_PAD
  - | AES192_WRAP_PAD
  - | AES256_WRAP_PAD
  - | DES_EDE3_WRAP
  - | RC2_WRAP Int
- data KeyTransportParams
  - = RSAES
  - | RSAESOAEP OAEPParams
- data KeyAgreementParams
  - = StdDH KeyAgreementKDF KeyEncryptionParams
  - | CofactorDH KeyAgreementKDF KeyEncryptionParams
- data KeyAgreementKDF
  - = forall hashAlg.HashAlgorithm hashAlg => KA_X963_KDF (DigestProxy hashAlg)
  - | forall hashAlg.HashAlgorithm hashAlg => KA_HKDF (DigestProxy hashAlg)
- data RecipientInfo
  - = KTRI KTRecipientInfo
  - | KARI KARecipientInfo
  - | KEKRI KEKRecipientInfo
  - | PasswordRI PasswordRecipientInfo
- data EnvelopedData content = EnvelopedData {
  - evOriginatorInfo :: OriginatorInfo
  - evRecipientInfos :: [RecipientInfo]
  - evContentType :: ContentType
  - evContentEncryptionParams :: ContentEncryptionParams
  - evEncryptedContent :: content
  - evUnprotectedAttrs :: [Attribute]
  }
- type ProducerOfRI m = ContentEncryptionKey -> m (Either StoreError RecipientInfo)
- type ConsumerOfRI m = RecipientInfo -> m (Either StoreError ContentEncryptionKey)
- envelopData :: Applicative f => OriginatorInfo -> ContentEncryptionKey -> ContentEncryptionParams -> [ProducerOfRI f] -> [Attribute] -> ContentInfo -> f (Either StoreError (EnvelopedData EncryptedContent))
- openEnvelopedData :: Monad m => ConsumerOfRI m -> EnvelopedData EncryptedContent -> m (Either StoreError ContentInfo)
- data KTRecipientInfo = KTRecipientInfo {
  - ktRid :: RecipientIdentifier
  - ktKeyTransportParams :: KeyTransportParams
  - ktEncryptedKey :: EncryptedKey
  }
- data RecipientIdentifier
  - = RecipientIASN IssuerAndSerialNumber
  - | RecipientSKI ByteString
- forKeyTransRecipient :: MonadRandom m => SignedCertificate -> KeyTransportParams -> ProducerOfRI m
- withRecipientKeyTrans :: MonadRandom m => PrivKey -> ConsumerOfRI m
- data KARecipientInfo = KARecipientInfo {
  - kaOriginator :: OriginatorIdentifierOrKey
  - kaUkm :: Maybe UserKeyingMaterial
  - kaKeyAgreementParams :: KeyAgreementParams
  - kaRecipientEncryptedKeys :: [RecipientEncryptedKey]
  }
- data OriginatorIdentifierOrKey
  - = OriginatorIASN IssuerAndSerialNumber
  - | OriginatorSKI ByteString
  - | OriginatorPublic OriginatorPublicKey
- data OriginatorPublicKey
- data RecipientEncryptedKey = RecipientEncryptedKey {
  - rekRid :: KeyAgreeRecipientIdentifier
  - rekEncryptedKey :: EncryptedKey
  }
- data KeyAgreeRecipientIdentifier
  - = KeyAgreeRecipientIASN IssuerAndSerialNumber
  - | KeyAgreeRecipientKI KeyIdentifier
- type UserKeyingMaterial = ByteString
- forKeyAgreeRecipient :: MonadRandom m => SignedCertificate -> KeyAgreementParams -> ProducerOfRI m
- withRecipientKeyAgree :: MonadRandom m => PrivKey -> SignedCertificate -> ConsumerOfRI m
- data KEKRecipientInfo = KEKRecipientInfo {
  - kekId :: KeyIdentifier
  - kekKeyEncryptionParams :: KeyEncryptionParams
  - kekEncryptedKey :: EncryptedKey
  }
- data KeyIdentifier = KeyIdentifier {
  - keyIdentifier :: ByteString
  - keyDate :: Maybe DateTime
  - keyOther :: Maybe OtherKeyAttribute
  }
- data OtherKeyAttribute = OtherKeyAttribute {
  - keyAttrId :: OID
  - keyAttr :: [ASN1]
  }
- type KeyEncryptionKey = ByteString
- forKeyRecipient :: MonadRandom m => KeyEncryptionKey -> KeyIdentifier -> KeyEncryptionParams -> ProducerOfRI m
- withRecipientKey :: Applicative f => KeyEncryptionKey -> ConsumerOfRI f
- data PasswordRecipientInfo = PasswordRecipientInfo {
  - priKeyDerivationFunc :: KeyDerivationFunc
  - priKeyEncryptionParams :: KeyEncryptionParams
  - priEncryptedKey :: EncryptedKey
  }
- forPasswordRecipient :: MonadRandom m => Password -> KeyDerivationFunc -> KeyEncryptionParams -> ProducerOfRI m
- withRecipientPassword :: Applicative f => Password -> ConsumerOfRI f
- data DigestProxy hashAlg where
  - MD2 :: DigestProxy MD2
  - MD4 :: DigestProxy MD4
  - MD5 :: DigestProxy MD5
  - SHA1 :: DigestProxy SHA1
  - SHA224 :: DigestProxy SHA224
  - SHA256 :: DigestProxy SHA256
  - SHA384 :: DigestProxy SHA384
  - SHA512 :: DigestProxy SHA512
  - SHAKE128_256 :: DigestProxy (SHAKE128 256)
  - SHAKE256_512 :: DigestProxy (SHAKE256 512)
  - SHAKE128 :: KnownNat n => Proxy n -> DigestProxy (SHAKE128 n)
  - SHAKE256 :: KnownNat n => Proxy n -> DigestProxy (SHAKE256 n)
- data DigestAlgorithm = forall hashAlg.HashAlgorithm hashAlg => DigestAlgorithm (DigestProxy hashAlg)
- data DigestedData content = forall hashAlg.HashAlgorithm hashAlg => DigestedData {
  - ddDigestAlgorithm :: DigestProxy hashAlg
  - ddContentType :: ContentType
  - ddEncapsulatedContent :: content
  - ddDigest :: Digest hashAlg
  }
- digestData :: DigestAlgorithm -> ContentInfo -> DigestedData EncapsulatedContent
- digestVerify :: DigestedData EncapsulatedContent -> Either StoreError ContentInfo
- type ContentEncryptionKey = ByteString
- data ContentEncryptionCipher cipher where
  - DES :: ContentEncryptionCipher DES
  - DES_EDE2 :: ContentEncryptionCipher DES_EDE2
  - DES_EDE3 :: ContentEncryptionCipher DES_EDE3
  - AES128 :: ContentEncryptionCipher AES128
  - AES192 :: ContentEncryptionCipher AES192
  - AES256 :: ContentEncryptionCipher AES256
  - CAST5 :: ContentEncryptionCipher CAST5
  - Camellia128 :: ContentEncryptionCipher Camellia128
- data ContentEncryptionAlg
  - = forall c.BlockCipher c => ECB (ContentEncryptionCipher c)
  - | forall c.BlockCipher c => CBC (ContentEncryptionCipher c)
  - | CBC_RC2
  - | forall c.BlockCipher c => CFB (ContentEncryptionCipher c)
  - | forall c.BlockCipher c => CTR (ContentEncryptionCipher c)
- data ContentEncryptionParams
- type EncryptedContent = ByteString
- data EncryptedData content = EncryptedData {
  - edContentType :: ContentType
  - edContentEncryptionParams :: ContentEncryptionParams
  - edEncryptedContent :: content
  - edUnprotectedAttrs :: [Attribute]
  }
- generateEncryptionParams :: MonadRandom m => ContentEncryptionAlg -> m ContentEncryptionParams
- generateRC2EncryptionParams :: MonadRandom m => Int -> m ContentEncryptionParams
- getContentEncryptionAlg :: ContentEncryptionParams -> ContentEncryptionAlg
- encryptData :: ContentEncryptionKey -> ContentEncryptionParams -> [Attribute] -> ContentInfo -> Either StoreError (EncryptedData EncryptedContent)
- decryptData :: ContentEncryptionKey -> EncryptedData EncryptedContent -> Either StoreError ContentInfo
- type AuthenticationKey = ContentEncryptionKey
- data MACAlgorithm
  - = forall hashAlg.HashAlgorithm hashAlg => HMAC (DigestProxy hashAlg)
  - | forall n.KnownNat n => KMAC_SHAKE128 (Proxy n) ByteString
  - | forall n.KnownNat n => KMAC_SHAKE256 (Proxy n) ByteString
- type MessageAuthenticationCode = AuthTag
- data AuthenticatedData content = AuthenticatedData {
  - adOriginatorInfo :: OriginatorInfo
  - adRecipientInfos :: [RecipientInfo]
  - adMACAlgorithm :: MACAlgorithm
  - adDigestAlgorithm :: Maybe DigestAlgorithm
  - adContentType :: ContentType
  - adEncapsulatedContent :: content
  - adAuthAttrs :: [Attribute]
  - adMAC :: MessageAuthenticationCode
  - adUnauthAttrs :: [Attribute]
  }
- generateAuthenticatedData :: Applicative f => OriginatorInfo -> AuthenticationKey -> MACAlgorithm -> Maybe DigestAlgorithm -> [ProducerOfRI f] -> [Attribute] -> [Attribute] -> ContentInfo -> f (Either StoreError (AuthenticatedData EncapsulatedContent))
- verifyAuthenticatedData :: Monad m => ConsumerOfRI m -> AuthenticatedData EncapsulatedContent -> m (Either StoreError ContentInfo)
- data AuthContentEncryptionAlg
  - = AUTH_ENC_128
  - | AUTH_ENC_256
  - | CHACHA20_POLY1305
  - | forall c.BlockCipher c => CCM (ContentEncryptionCipher c)
  - | forall c.BlockCipher c => GCM (ContentEncryptionCipher c)
- data AuthContentEncryptionParams
- data AuthEnvelopedData content = AuthEnvelopedData {
  - aeOriginatorInfo :: OriginatorInfo
  - aeRecipientInfos :: [RecipientInfo]
  - aeContentType :: ContentType
  - aeContentEncryptionParams :: ASN1ObjectExact AuthContentEncryptionParams
  - aeEncryptedContent :: content
  - aeAuthAttrs :: [Attribute]
  - aeMAC :: MessageAuthenticationCode
  - aeUnauthAttrs :: [Attribute]
  }
- generateAuthEnc128Params :: MonadRandom m => PBKDF2_PRF -> ContentEncryptionAlg -> MACAlgorithm -> m AuthContentEncryptionParams
- generateAuthEnc256Params :: MonadRandom m => PBKDF2_PRF -> ContentEncryptionAlg -> MACAlgorithm -> m AuthContentEncryptionParams
- generateChaChaPoly1305Params :: MonadRandom m => m AuthContentEncryptionParams
- generateCCMParams :: (MonadRandom m, BlockCipher c) => ContentEncryptionCipher c -> CCM_M -> CCM_L -> m AuthContentEncryptionParams
- generateGCMParams :: (MonadRandom m, BlockCipher c) => ContentEncryptionCipher c -> Int -> m AuthContentEncryptionParams
- authEnvelopData :: Applicative f => OriginatorInfo -> ContentEncryptionKey -> AuthContentEncryptionParams -> [ProducerOfRI f] -> [Attribute] -> [Attribute] -> ContentInfo -> f (Either StoreError (AuthEnvelopedData EncryptedContent))
- openAuthEnvelopedData :: Monad m => ConsumerOfRI m -> AuthEnvelopedData EncryptedContent -> m (Either StoreError ContentInfo)
- type Salt = ByteString
- generateSalt :: MonadRandom m => Int -> m Salt
- data KeyDerivationFunc
  - = PBKDF2 {
    - pbkdf2Salt :: Salt
    - pbkdf2IterationCount :: Int
    - pbkdf2KeyLength :: Maybe Int
    - pbkdf2Prf :: PBKDF2_PRF
    }
  - | Scrypt {
    - scryptSalt :: Salt
    - scryptN :: Word64
    - scryptR :: Int
    - scryptP :: Int
    - scryptKeyLength :: Maybe Int
    }
- data PBKDF2_PRF
  - = PBKDF2_SHA1
  - | PBKDF2_SHA256
  - | PBKDF2_SHA512
- class HasKeySize params where
  - getKeySizeSpecifier :: params -> KeySizeSpecifier
- generateKey :: (HasKeySize params, MonadRandom m, ByteArray key) => params -> m key
- newtype MaskGenerationFunc = MGF1 DigestAlgorithm
- data OAEPParams = OAEPParams {
  - oaepHashAlgorithm :: DigestAlgorithm
  - oaepMaskGenAlgorithm :: MaskGenerationFunc
  }
- data PSSParams = PSSParams {
  - pssHashAlgorithm :: DigestAlgorithm
  - pssMaskGenAlgorithm :: MaskGenerationFunc
  - pssSaltLength :: Int
  }
- data Attribute = Attribute {
  - attrType :: OID
  - attrValues :: [ASN1]
  }
- findAttribute :: OID -> [Attribute] -> Maybe [ASN1]
- setAttribute :: OID -> [ASN1] -> [Attribute] -> [Attribute]
- filterAttributes :: (OID -> Bool) -> [Attribute] -> [Attribute]
- getSigningTimeAttr :: [Attribute] -> Maybe DateTime
- setSigningTimeAttr :: DateTime -> [Attribute] -> [Attribute]
- setSigningTimeAttrCurrent :: MonadIO m => [Attribute] -> m [Attribute]
- data OriginatorInfo = OriginatorInfo {
  - originatorCerts :: [CertificateChoice]
  - originatorCRLs :: [RevocationInfoChoice]
  }
- data CertificateChoice
  - = CertificateCertificate SignedCertificate
  - | CertificateOther OtherCertificateFormat
- data OtherCertificateFormat = OtherCertificateFormat {
  - otherCertFormat :: OID
  - otherCertValues :: [ASN1]
  }
- data RevocationInfoChoice
  - = RevocationInfoCRL SignedCRL
  - | RevocationInfoOther OtherRevocationInfoFormat
- data OtherRevocationInfoFormat = OtherRevocationInfoFormat {
  - otherRevInfoFormat :: OID
  - otherRevInfoValues :: [ASN1]
  }
- data ASN1ObjectExact a

# Documentation

data ContentType Source #

CMS content information type.

Constructors

DataType | Arbitrary octet string
SignedDataType | Signed content info
EnvelopedDataType | Enveloped content info
DigestedDataType | Content info with associated digest
EncryptedDataType | Encrypted content info
AuthenticatedDataType | Authenticated content info
AuthEnvelopedDataType | Authenticated-enveloped content info

#### Instances

Instances details

OIDNameable ContentType Source # |
Instance details Defined in Crypto.Store.CMS.Type Methods fromObjectID :: OID -> Maybe ContentType Source #
OIDable ContentType Source # |
Instance details Defined in Crypto.Store.CMS.Type Methods getObjectID :: ContentType -> OID Source #
Show ContentType Source # |
Instance details Defined in Crypto.Store.CMS.Type Methods showsPrec :: Int -> ContentType -> ShowS Source # show :: ContentType -> String Source # showList :: [ContentType] -> ShowS Source #
Eq ContentType Source # |
Instance details Defined in Crypto.Store.CMS.Type Methods (==) :: ContentType -> ContentType -> Bool Source # (/=) :: ContentType -> ContentType -> Bool Source #

data ContentInfo Source #

CMS content information.

Constructors

DataCI ByteString | Arbitrary octet string
SignedDataCI (SignedData (Encap EncapsulatedContent)) | Signed content info
EnvelopedDataCI (EnvelopedData (Encap EncryptedContent)) | Enveloped content info
DigestedDataCI (DigestedData (Encap EncapsulatedContent)) | Content info with associated digest
EncryptedDataCI (EncryptedData (Encap EncryptedContent)) | Encrypted content info
AuthenticatedDataCI (AuthenticatedData (Encap EncapsulatedContent)) | Authenticatedcontent info
AuthEnvelopedDataCI (AuthEnvelopedData (Encap EncryptedContent)) | Authenticated-enveloped content info

#### Instances

Instances details

Show ContentInfo Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods showsPrec :: Int -> ContentInfo -> ShowS Source # show :: ContentInfo -> String Source # showList :: [ContentInfo] -> ShowS Source #
Eq ContentInfo Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods (==) :: ContentInfo -> ContentInfo -> Bool Source # (/=) :: ContentInfo -> ContentInfo -> Bool Source #

getContentType :: ContentInfo -> ContentType Source #

Get the type of a content info.

# Reading and writing PEM files

readCMSFile :: FilePath -> IO [ContentInfo] Source #

Read content info elements from a PEM file.

readCMSFileFromMemory :: ByteString -> [ContentInfo] Source #

Read content info elements from a bytearray in PEM format.

berToContentInfo :: ByteString -> Either StoreError ContentInfo Source #

Read a content info from a bytearray in BER format.

pemToContentInfo :: [Maybe ContentInfo] -> PEM -> [Maybe ContentInfo] Source #

Read a content info from a `PEM` element and add it to the accumulator list.

writeCMSFile :: FilePath -> [ContentInfo] -> IO () Source #

Write content info elements to a PEM file.

writeCMSFileToMemory :: [ContentInfo] -> ByteString Source #

Write content info elements to a bytearray in PEM format.

contentInfoToDER :: ContentInfo -> ByteString Source #

Generate a bytearray in DER format for a content info.

contentInfoToPEM :: ContentInfo -> PEM Source #

Generate PEM for a content info.

# Content encapsulation

data Encap a Source #

Denote the state of encapsulated content in a CMS data structure. This type is isomorphic to `Maybe`.

Constructors

Detached | Content is stored externally to the structure
Attached a | Content is stored inside the CMS struture

#### Instances

Instances details

Foldable Encap Source # |

Instance details

Defined in Crypto.Store.CMS.Type

Methods

fold :: Monoid m => Encap m -> m Source #

foldMap :: Monoid m => (a -> m) -> Encap a -> m Source #

foldMap' :: Monoid m => (a -> m) -> Encap a -> m Source #

foldr :: (a -> b -> b) -> b -> Encap a -> b Source #

foldr' :: (a -> b -> b) -> b -> Encap a -> b Source #

foldl :: (b -> a -> b) -> b -> Encap a -> b Source #

foldl' :: (b -> a -> b) -> b -> Encap a -> b Source #

foldr1 :: (a -> a -> a) -> Encap a -> a Source #

foldl1 :: (a -> a -> a) -> Encap a -> a Source #

toList :: Encap a -> [a] Source #

null :: Encap a -> Bool Source #

length :: Encap a -> Int Source #

elem :: Eq a => a -> Encap a -> Bool Source #

maximum :: Ord a => Encap a -> a Source #

minimum :: Ord a => Encap a -> a Source #

sum :: Num a => Encap a -> a Source #

product :: Num a => Encap a -> a Source #

Traversable Encap Source # |
Instance details Defined in Crypto.Store.CMS.Type Methods traverse :: Applicative f => (a -> f b) -> Encap a -> f (Encap b) Source # sequenceA :: Applicative f => Encap (f a) -> f (Encap a) Source # mapM :: Monad m => (a -> m b) -> Encap a -> m (Encap b) Source # sequence :: Monad m => Encap (m a) -> m (Encap a) Source #
Applicative Encap Source # |
Instance details Defined in Crypto.Store.CMS.Type Methods pure :: a -> Encap a Source # (<*>) :: Encap (a -> b) -> Encap a -> Encap b Source # liftA2 :: (a -> b -> c) -> Encap a -> Encap b -> Encap c Source # (*>) :: Encap a -> Encap b -> Encap b Source # (<*) :: Encap a -> Encap b -> Encap a Source #
Functor Encap Source # |
Instance details Defined in Crypto.Store.CMS.Type Methods fmap :: (a -> b) -> Encap a -> Encap b Source # (<$) :: a -> Encap b -> Encap a Source #
Show a => Show (Encap a) Source # |
Instance details Defined in Crypto.Store.CMS.Type Methods showsPrec :: Int -> Encap a -> ShowS Source # show :: Encap a -> String Source # showList :: [Encap a] -> ShowS Source #
Eq a => Eq (Encap a) Source # |
Instance details Defined in Crypto.Store.CMS.Type Methods (==) :: Encap a -> Encap a -> Bool Source # (/=) :: Encap a -> Encap a -> Bool Source #

fromEncap :: b -> (a -> b) -> Encap a -> b Source #

Fold over an `Encap` value. This is similar to function `maybe`. If the content is detached, the first argument is returned. Otherwise the second argument is applied to the content.

class Encapsulates struct Source #

Class of data structures with inner content that may be stored externally. This class has instances for each CMS content type containing other encapsulated or encrypted content info.

Functions `fromAttached` and `fromDetached` are used to introspect encapsulation state (attached or detached), and recover a data structure with actionable content.

Functions `toAttachedCI` and `toDetachedCI` are needed to decide about the outer encapsulation state and build a `ContentInfo`.

Minimal complete definition

lens, toCI

#### Instances

Instances details

Encapsulates AuthEnvelopedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> AuthEnvelopedData a -> f (AuthEnvelopedData b) toCI :: AuthEnvelopedData (Encap ByteString) -> ContentInfo
Encapsulates AuthenticatedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> AuthenticatedData a -> f (AuthenticatedData b) toCI :: AuthenticatedData (Encap ByteString) -> ContentInfo
Encapsulates DigestedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> DigestedData a -> f (DigestedData b) toCI :: DigestedData (Encap ByteString) -> ContentInfo
Encapsulates EncryptedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> EncryptedData a -> f (EncryptedData b) toCI :: EncryptedData (Encap ByteString) -> ContentInfo
Encapsulates EnvelopedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> EnvelopedData a -> f (EnvelopedData b) toCI :: EnvelopedData (Encap ByteString) -> ContentInfo
Encapsulates SignedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> SignedData a -> f (SignedData b) toCI :: SignedData (Encap ByteString) -> ContentInfo

isAttached :: Encapsulates struct => struct (Encap a) -> Bool Source #

Return `True` when the encapsulated content is attached.

fromAttached :: (MonadFail m, Encapsulates struct) => struct (Encap a) -> m (struct a) Source #

Unwrap the encapsulation, assuming the inner content is inside the data structure. The monadic computation fails if the content was detached.

toAttachedCI :: Encapsulates struct => struct ByteString -> ContentInfo Source #

Transform the data structure into a content info, keeping the encapsulated content attached. May be applied to structures with `EncapsulatedContent` or `EncryptedContent`.

isDetached :: Encapsulates struct => struct (Encap a) -> Bool Source #

Return `True` when the encapsulated content is detached.

fromDetached :: (MonadFail m, Encapsulates struct) => b -> struct (Encap a) -> m (struct b) Source #

Recover the original data structure from a detached encapsulation and the external content. The monadic computation fails if the content was attached.

toDetachedCI :: Encapsulates struct => struct ByteString -> (ByteString, ContentInfo) Source #

Transform the data structure into a content info, detaching the encapsulated content. May be applied to structures with `EncapsulatedContent` or `EncryptedContent`.

# Signed data

type SignatureValue = ByteString Source #

Signature value.

data SignatureAlg Source #

CMS signature algorithms and associated parameters.

Constructors

RSAAnyHash |
RSA DigestAlgorithm |
RSAPSS PSSParams |
DSA DigestAlgorithm |
ECDSA DigestAlgorithm |
Ed25519 |
Ed448 |

#### Instances

Instances details

Show SignatureAlg Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> SignatureAlg -> ShowS Source # show :: SignatureAlg -> String Source # showList :: [SignatureAlg] -> ShowS Source #
Eq SignatureAlg Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: SignatureAlg -> SignatureAlg -> Bool Source # (/=) :: SignatureAlg -> SignatureAlg -> Bool Source #

type EncapsulatedContent = ByteString Source #

Encapsulated content.

data SignedData content Source #

Signed content information.

Constructors

SignedData |

Fields

- sdDigestAlgorithms :: [DigestAlgorithm]

  Digest algorithms

- sdContentType :: ContentType

  Inner content type

- sdEncapsulatedContent :: content

  Encapsulated content

- sdCertificates :: [CertificateChoice]

  The collection of certificates

- sdCRLs :: [RevocationInfoChoice]

  The collection of CRLs

- sdSignerInfos :: [SignerInfo]

  Per-signer information

#### Instances

Instances details

Encapsulates SignedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> SignedData a -> f (SignedData b) toCI :: SignedData (Encap ByteString) -> ContentInfo
Show content => Show (SignedData content) Source # |
Instance details Defined in Crypto.Store.CMS.Signed Methods showsPrec :: Int -> SignedData content -> ShowS Source # show :: SignedData content -> String Source # showList :: [SignedData content] -> ShowS Source #
Eq content => Eq (SignedData content) Source # |
Instance details Defined in Crypto.Store.CMS.Signed Methods (==) :: SignedData content -> SignedData content -> Bool Source # (/=) :: SignedData content -> SignedData content -> Bool Source #

type ProducerOfSI m = ContentType -> ByteString -> m (Either StoreError (SignerInfo, [CertificateChoice], [RevocationInfoChoice])) Source #

Function able to produce a `SignerInfo`.

type ConsumerOfSI m = ContentType -> ByteString -> SignerInfo -> [CertificateChoice] -> [RevocationInfoChoice] -> m Bool Source #

Function able to consume a `SignerInfo`.

signData :: Applicative f => [ProducerOfSI f] -> ContentInfo -> f (Either StoreError (SignedData EncapsulatedContent)) Source #

Add a signed-data layer on the specified content info. The content is processed by one or several `ProducerOfSI` functions to create signer info elements.

verifySignedData :: Monad m => ConsumerOfSI m -> SignedData EncapsulatedContent -> m (Either StoreError ContentInfo) Source #

Verify a signed content info using the specified `ConsumerOfSI` function. Verification of at least one signer info must be successful in order to return the inner content info.

## Signer information

data SignerInfo Source #

Information related to a signer of a `SignedData`. An element contains the signature material that was produced.

Constructors

SignerInfo |

Fields

- siSignerId :: SignerIdentifier

  Identifier of the signer certificate

- siDigestAlgorithm :: DigestAlgorithm

  Digest algorithm used for the signature

- siSignedAttrs :: [Attribute]

  Optional signed attributes

- siSignatureAlg :: SignatureAlg

  Algorithm used for signature

- siSignature :: SignatureValue

  The signature value

- siUnsignedAttrs :: [Attribute]

  Optional unsigned attributes

#### Instances

Instances details

Show SignerInfo Source # |
Instance details Defined in Crypto.Store.CMS.Signed Methods showsPrec :: Int -> SignerInfo -> ShowS Source # show :: SignerInfo -> String Source # showList :: [SignerInfo] -> ShowS Source #
Eq SignerInfo Source # |
Instance details Defined in Crypto.Store.CMS.Signed Methods (==) :: SignerInfo -> SignerInfo -> Bool Source # (/=) :: SignerInfo -> SignerInfo -> Bool Source #

data SignerIdentifier Source #

Union type related to identification of the signer certificate.

Constructors

SignerIASN IssuerAndSerialNumber | Issuer and Serial Number
SignerSKI ByteString | Subject Key Identifier

#### Instances

Instances details

Show SignerIdentifier Source # |
Instance details Defined in Crypto.Store.CMS.Signed Methods showsPrec :: Int -> SignerIdentifier -> ShowS Source # show :: SignerIdentifier -> String Source # showList :: [SignerIdentifier] -> ShowS Source #
Eq SignerIdentifier Source # |
Instance details Defined in Crypto.Store.CMS.Signed Methods (==) :: SignerIdentifier -> SignerIdentifier -> Bool Source # (/=) :: SignerIdentifier -> SignerIdentifier -> Bool Source #

data IssuerAndSerialNumber Source #

Identification of a certificate using the issuer DN and serial number.

Constructors

IssuerAndSerialNumber |

Fields

- iasnIssuer :: DistinguishedName

  Distinguished name of the certificate issuer

- iasnSerial :: Integer

  Issuer-specific certificate serial number

#### Instances

Instances details

Show IssuerAndSerialNumber Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> IssuerAndSerialNumber -> ShowS Source # show :: IssuerAndSerialNumber -> String Source # showList :: [IssuerAndSerialNumber] -> ShowS Source #
Eq IssuerAndSerialNumber Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: IssuerAndSerialNumber -> IssuerAndSerialNumber -> Bool Source # (/=) :: IssuerAndSerialNumber -> IssuerAndSerialNumber -> Bool Source #

certSigner :: MonadRandom m => SignatureAlg -> PrivKey -> CertificateChain -> Maybe [Attribute] -> [Attribute] -> ProducerOfSI m Source #

Create a signer info with the specified signature algorithm and credentials.

Two lists of optional attributes can be provided. The attributes will be part of message signature when provided in the first list.

When the first list of attributes is provided, even empty list, signature is computed from a digest of the content. When the list of attributes is `Nothing`, no intermediate digest is used and the signature is computed from the full message.

withPublicKey :: Applicative f => PubKey -> ConsumerOfSI f Source #

Verify that the signature was produced from the specified public key. Ignores all certificates and CRLs contained in the signed data.

withSignerKey :: Applicative f => ConsumerOfSI f Source #

Verify that the signature is valid with one of the X.509 certificates contained in the signed data, but does not validate that the certificates are valid. All transmitted certificates are implicitely trusted and all CRLs are ignored.

withSignerCertificate :: Applicative f => (Maybe DateTime -> CertificateChain -> f Bool) -> ConsumerOfSI f Source #

Verify that the signature is valid with one of the X.509 certificates contained in the signed data, and verify that the signer certificate is valid using the validation function supplied. All CRLs are ignored.

# Enveloped data

type EncryptedKey = ByteString Source #

Encrypted key.

data KeyEncryptionParams Source #

Key encryption algorithm with associated parameters (i.e. the underlying encryption algorithm).

Constructors

PWRIKEK ContentEncryptionParams | PWRI-KEK key wrap algorithm
AES128_WRAP | AES-128 key wrap
AES192_WRAP | AES-192 key wrap
AES256_WRAP | AES-256 key wrap
AES128_WRAP_PAD | AES-128 extended key wrap
AES192_WRAP_PAD | AES-192 extended key wrap
AES256_WRAP_PAD | AES-256 extended key wrap
DES_EDE3_WRAP | Triple-DES key wrap
RC2_WRAP Int | RC2 key wrap with effective key length

#### Instances

Instances details

Show KeyEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> KeyEncryptionParams -> ShowS Source # show :: KeyEncryptionParams -> String Source # showList :: [KeyEncryptionParams] -> ShowS Source #
HasKeySize KeyEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: KeyEncryptionParams -> KeySizeSpecifier Source #
Eq KeyEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: KeyEncryptionParams -> KeyEncryptionParams -> Bool Source # (/=) :: KeyEncryptionParams -> KeyEncryptionParams -> Bool Source #

data KeyTransportParams Source #

Key transport algorithm with associated parameters.

Constructors

RSAES | RSAES-PKCS1
RSAESOAEP OAEPParams | RSAES-OAEP

#### Instances

Instances details

Show KeyTransportParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> KeyTransportParams -> ShowS Source # show :: KeyTransportParams -> String Source # showList :: [KeyTransportParams] -> ShowS Source #
Eq KeyTransportParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: KeyTransportParams -> KeyTransportParams -> Bool Source # (/=) :: KeyTransportParams -> KeyTransportParams -> Bool Source #

data KeyAgreementParams Source #

Key agreement algorithm with associated parameters.

Constructors

StdDH KeyAgreementKDF KeyEncryptionParams | 1-Pass D-H with Stardard ECDH
CofactorDH KeyAgreementKDF KeyEncryptionParams | 1-Pass D-H with Cofactor ECDH

#### Instances

Instances details

Show KeyAgreementParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> KeyAgreementParams -> ShowS Source # show :: KeyAgreementParams -> String Source # showList :: [KeyAgreementParams] -> ShowS Source #
Eq KeyAgreementParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: KeyAgreementParams -> KeyAgreementParams -> Bool Source # (/=) :: KeyAgreementParams -> KeyAgreementParams -> Bool Source #

data KeyAgreementKDF Source #

Key derivation function used for key agreement.

Constructors

forall hashAlg.HashAlgorithm hashAlg => KA_X963_KDF (DigestProxy hashAlg) | ANSI-X9.63-KDF key derivation function
forall hashAlg.HashAlgorithm hashAlg => KA_HKDF (DigestProxy hashAlg) | Extract-and-Expand HMAC-based key derivation function

#### Instances

Instances details

Show KeyAgreementKDF Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> KeyAgreementKDF -> ShowS Source # show :: KeyAgreementKDF -> String Source # showList :: [KeyAgreementKDF] -> ShowS Source #
Eq KeyAgreementKDF Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: KeyAgreementKDF -> KeyAgreementKDF -> Bool Source # (/=) :: KeyAgreementKDF -> KeyAgreementKDF -> Bool Source #

data RecipientInfo Source #

Information for a recipient of an `EnvelopedData`. An element contains the content-encryption key in encrypted form.

Constructors

KTRI KTRecipientInfo | Recipient using key transport
KARI KARecipientInfo | Recipient using key agreement
KEKRI KEKRecipientInfo | Recipient using key encryption
PasswordRI PasswordRecipientInfo | Recipient using password-based protection

#### Instances

Instances details

Show RecipientInfo Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> RecipientInfo -> ShowS Source # show :: RecipientInfo -> String Source # showList :: [RecipientInfo] -> ShowS Source #
Eq RecipientInfo Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: RecipientInfo -> RecipientInfo -> Bool Source # (/=) :: RecipientInfo -> RecipientInfo -> Bool Source #

data EnvelopedData content Source #

Enveloped content information.

Constructors

EnvelopedData |

Fields

- evOriginatorInfo :: OriginatorInfo

  Optional information about the originator

- evRecipientInfos :: [RecipientInfo]

  Information for recipients, allowing to decrypt the content

- evContentType :: ContentType

  Inner content type

- evContentEncryptionParams :: ContentEncryptionParams

  Encryption algorithm

- evEncryptedContent :: content

  Encrypted content info

- evUnprotectedAttrs :: [Attribute]

  Optional unprotected attributes

#### Instances

Instances details

Encapsulates EnvelopedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> EnvelopedData a -> f (EnvelopedData b) toCI :: EnvelopedData (Encap ByteString) -> ContentInfo
Show content => Show (EnvelopedData content) Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> EnvelopedData content -> ShowS Source # show :: EnvelopedData content -> String Source # showList :: [EnvelopedData content] -> ShowS Source #
Eq content => Eq (EnvelopedData content) Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: EnvelopedData content -> EnvelopedData content -> Bool Source # (/=) :: EnvelopedData content -> EnvelopedData content -> Bool Source #

type ProducerOfRI m = ContentEncryptionKey -> m (Either StoreError RecipientInfo) Source #

Function able to produce a `RecipientInfo`.

type ConsumerOfRI m = RecipientInfo -> m (Either StoreError ContentEncryptionKey) Source #

Function able to consume a `RecipientInfo`.

envelopData :: Applicative f => OriginatorInfo -> ContentEncryptionKey -> ContentEncryptionParams -> [ProducerOfRI f] -> [Attribute] -> ContentInfo -> f (Either StoreError (EnvelopedData EncryptedContent)) Source #

Add an enveloped-data layer on the specified content info. The content is encrypted with specified key and algorithm. The key is then processed by one or several `ProducerOfRI` functions to create recipient info elements.

Some optional attributes can be added but will not be encrypted.

openEnvelopedData :: Monad m => ConsumerOfRI m -> EnvelopedData EncryptedContent -> m (Either StoreError ContentInfo) Source #

Recover an enveloped content info using the specified `ConsumerOfRI` function.

## Key Transport recipients

data KTRecipientInfo Source #

Recipient using key transport.

Constructors

KTRecipientInfo |

Fields

- ktRid :: RecipientIdentifier

  identifier of recipient

- ktKeyTransportParams :: KeyTransportParams

  key transport algorithm

- ktEncryptedKey :: EncryptedKey

  encrypted content-encryption key

#### Instances

Instances details

Show KTRecipientInfo Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> KTRecipientInfo -> ShowS Source # show :: KTRecipientInfo -> String Source # showList :: [KTRecipientInfo] -> ShowS Source #
Eq KTRecipientInfo Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: KTRecipientInfo -> KTRecipientInfo -> Bool Source # (/=) :: KTRecipientInfo -> KTRecipientInfo -> Bool Source #

data RecipientIdentifier Source #

Union type related to identification of the recipient.

Constructors

RecipientIASN IssuerAndSerialNumber | Issuer and Serial Number
RecipientSKI ByteString | Subject Key Identifier

#### Instances

Instances details

Show RecipientIdentifier Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> RecipientIdentifier -> ShowS Source # show :: RecipientIdentifier -> String Source # showList :: [RecipientIdentifier] -> ShowS Source #
Eq RecipientIdentifier Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: RecipientIdentifier -> RecipientIdentifier -> Bool Source # (/=) :: RecipientIdentifier -> RecipientIdentifier -> Bool Source #

forKeyTransRecipient :: MonadRandom m => SignedCertificate -> KeyTransportParams -> ProducerOfRI m Source #

Generate a Key Transport recipient from a certificate and desired algorithm. The recipient will contain certificate identifier.

This function can be used as parameter to `envelopData`.

withRecipientKeyTrans :: MonadRandom m => PrivKey -> ConsumerOfRI m Source #

Use a Key Transport recipient, knowing the private key.

This function can be used as parameter to `openEnvelopedData`.

## Key Agreement recipients

data KARecipientInfo Source #

Recipient using key agreement.

Constructors

KARecipientInfo |

Fields

- kaOriginator :: OriginatorIdentifierOrKey

  identifier of orginator or anonymous key

- kaUkm :: Maybe UserKeyingMaterial

  user keying material

- kaKeyAgreementParams :: KeyAgreementParams

  key agreement algorithm

- kaRecipientEncryptedKeys :: [RecipientEncryptedKey]

  encrypted content-encryption key for one or multiple recipients

#### Instances

Instances details

Show KARecipientInfo Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> KARecipientInfo -> ShowS Source # show :: KARecipientInfo -> String Source # showList :: [KARecipientInfo] -> ShowS Source #
Eq KARecipientInfo Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: KARecipientInfo -> KARecipientInfo -> Bool Source # (/=) :: KARecipientInfo -> KARecipientInfo -> Bool Source #

data OriginatorIdentifierOrKey Source #

Union type related to identification of the originator.

Constructors

OriginatorIASN IssuerAndSerialNumber | Issuer and Serial Number
OriginatorSKI ByteString | Subject Key Identifier
OriginatorPublic OriginatorPublicKey | Anonymous public key

#### Instances

Instances details

Show OriginatorIdentifierOrKey Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> OriginatorIdentifierOrKey -> ShowS Source # show :: OriginatorIdentifierOrKey -> String Source # showList :: [OriginatorIdentifierOrKey] -> ShowS Source #
Eq OriginatorIdentifierOrKey Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: OriginatorIdentifierOrKey -> OriginatorIdentifierOrKey -> Bool Source # (/=) :: OriginatorIdentifierOrKey -> OriginatorIdentifierOrKey -> Bool Source #

data OriginatorPublicKey Source #

Originator public key used for key-agreement. Contrary to `PubKey` the domain parameters are not used and may be left empty.

#### Instances

Instances details

Show OriginatorPublicKey Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> OriginatorPublicKey -> ShowS Source # show :: OriginatorPublicKey -> String Source # showList :: [OriginatorPublicKey] -> ShowS Source #
Eq OriginatorPublicKey Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: OriginatorPublicKey -> OriginatorPublicKey -> Bool Source # (/=) :: OriginatorPublicKey -> OriginatorPublicKey -> Bool Source #

data RecipientEncryptedKey Source #

Encrypted key for a recipient in a key-agreement RI.

Constructors

RecipientEncryptedKey |

Fields

- rekRid :: KeyAgreeRecipientIdentifier

  identifier of recipient

- rekEncryptedKey :: EncryptedKey

  encrypted content-encryption key

#### Instances

Instances details

Show RecipientEncryptedKey Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> RecipientEncryptedKey -> ShowS Source # show :: RecipientEncryptedKey -> String Source # showList :: [RecipientEncryptedKey] -> ShowS Source #
Eq RecipientEncryptedKey Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: RecipientEncryptedKey -> RecipientEncryptedKey -> Bool Source # (/=) :: RecipientEncryptedKey -> RecipientEncryptedKey -> Bool Source #

data KeyAgreeRecipientIdentifier Source #

Union type related to identification of a key-agreement recipient.

Constructors

KeyAgreeRecipientIASN IssuerAndSerialNumber | Issuer and Serial Number
KeyAgreeRecipientKI KeyIdentifier | Key identifier

#### Instances

Instances details

Show KeyAgreeRecipientIdentifier Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> KeyAgreeRecipientIdentifier -> ShowS Source # show :: KeyAgreeRecipientIdentifier -> String Source # showList :: [KeyAgreeRecipientIdentifier] -> ShowS Source #
Eq KeyAgreeRecipientIdentifier Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: KeyAgreeRecipientIdentifier -> KeyAgreeRecipientIdentifier -> Bool Source # (/=) :: KeyAgreeRecipientIdentifier -> KeyAgreeRecipientIdentifier -> Bool Source #

type UserKeyingMaterial = ByteString Source #

User keying material.

forKeyAgreeRecipient :: MonadRandom m => SignedCertificate -> KeyAgreementParams -> ProducerOfRI m Source #

Generate a Key Agreement recipient from a certificate and desired algorithm. The recipient info will contain an ephemeral public key.

This function can be used as parameter to `envelopData`.

To avoid decreasing the security strength, Key Encryption parameters should use a key size equal or greater than the content encryption key.

withRecipientKeyAgree :: MonadRandom m => PrivKey -> SignedCertificate -> ConsumerOfRI m Source #

Use a Key Agreement recipient, knowing the recipient private key. The recipient certificate is also required to locate which encrypted key to use.

This function can be used as parameter to `openEnvelopedData`.

## Key Encryption Key recipients

data KEKRecipientInfo Source #

Recipient using key encryption.

Constructors

KEKRecipientInfo |

Fields

- kekId :: KeyIdentifier

  identifier of key encryption key

- kekKeyEncryptionParams :: KeyEncryptionParams

  key encryption algorithm

- kekEncryptedKey :: EncryptedKey

  encrypted content-encryption key

#### Instances

Instances details

Show KEKRecipientInfo Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> KEKRecipientInfo -> ShowS Source # show :: KEKRecipientInfo -> String Source # showList :: [KEKRecipientInfo] -> ShowS Source #
Eq KEKRecipientInfo Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: KEKRecipientInfo -> KEKRecipientInfo -> Bool Source # (/=) :: KEKRecipientInfo -> KEKRecipientInfo -> Bool Source #

data KeyIdentifier Source #

Key identifier and optional attributes.

Constructors

KeyIdentifier |

Fields

- keyIdentifier :: ByteString

  identifier of the key

- keyDate :: Maybe DateTime

  optional timestamp

- keyOther :: Maybe OtherKeyAttribute

  optional information

#### Instances

Instances details

Show KeyIdentifier Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> KeyIdentifier -> ShowS Source # show :: KeyIdentifier -> String Source # showList :: [KeyIdentifier] -> ShowS Source #
Eq KeyIdentifier Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: KeyIdentifier -> KeyIdentifier -> Bool Source # (/=) :: KeyIdentifier -> KeyIdentifier -> Bool Source #

data OtherKeyAttribute Source #

Additional information in a `KeyIdentifier`.

Constructors

OtherKeyAttribute |

Fields

- keyAttrId :: OID

  attribute identifier

- keyAttr :: [ASN1]

  attribute value

#### Instances

Instances details

Show OtherKeyAttribute Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> OtherKeyAttribute -> ShowS Source # show :: OtherKeyAttribute -> String Source # showList :: [OtherKeyAttribute] -> ShowS Source #
Eq OtherKeyAttribute Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: OtherKeyAttribute -> OtherKeyAttribute -> Bool Source # (/=) :: OtherKeyAttribute -> OtherKeyAttribute -> Bool Source #

type KeyEncryptionKey = ByteString Source #

Key used for key encryption.

forKeyRecipient :: MonadRandom m => KeyEncryptionKey -> KeyIdentifier -> KeyEncryptionParams -> ProducerOfRI m Source #

Generate a Key Encryption Key recipient from a key encryption key and desired algorithm. The recipient may identify the KEK that was used with the supplied identifier.

This function can be used as parameter to `envelopData`.

To avoid decreasing the security strength, Key Encryption parameters should use a key size equal or greater than the content encryption key.

withRecipientKey :: Applicative f => KeyEncryptionKey -> ConsumerOfRI f Source #

Use a Key Encryption Key recipient, knowing the key encryption key.

This function can be used as parameter to `openEnvelopedData`.

## Password recipients

data PasswordRecipientInfo Source #

Recipient using password-based protection.

Constructors

PasswordRecipientInfo |

Fields

- priKeyDerivationFunc :: KeyDerivationFunc

  function to derive key

- priKeyEncryptionParams :: KeyEncryptionParams

  key encryption algorithm

- priEncryptedKey :: EncryptedKey

  encrypted content-encryption key

#### Instances

Instances details

Show PasswordRecipientInfo Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> PasswordRecipientInfo -> ShowS Source # show :: PasswordRecipientInfo -> String Source # showList :: [PasswordRecipientInfo] -> ShowS Source #
Eq PasswordRecipientInfo Source # |
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: PasswordRecipientInfo -> PasswordRecipientInfo -> Bool Source # (/=) :: PasswordRecipientInfo -> PasswordRecipientInfo -> Bool Source #

forPasswordRecipient :: MonadRandom m => Password -> KeyDerivationFunc -> KeyEncryptionParams -> ProducerOfRI m Source #

Generate a password recipient from a password.

This function can be used as parameter to `envelopData`.

withRecipientPassword :: Applicative f => Password -> ConsumerOfRI f Source #

Use a password recipient, knowing the password.

This function can be used as parameter to `openEnvelopedData`.

# Digested data

data DigestProxy hashAlg where Source #

CMS digest proxy. Acts like `Proxy`, i.e. provides a hash algorithm as type parameter. The GADT constructors map to known algorithms.

Constructors

MD2 :: DigestProxy MD2 | MD2
MD4 :: DigestProxy MD4 | MD4
MD5 :: DigestProxy MD5 | MD5
SHA1 :: DigestProxy SHA1 | SHA-1
SHA224 :: DigestProxy SHA224 | SHA-224
SHA256 :: DigestProxy SHA256 | SHA-256
SHA384 :: DigestProxy SHA384 | SHA-384
SHA512 :: DigestProxy SHA512 | SHA-512
SHAKE128_256 :: DigestProxy (SHAKE128 256) | SHAKE128 (256 bits)
SHAKE256_512 :: DigestProxy (SHAKE256 512) | SHAKE256 (512 bits)
SHAKE128 :: KnownNat n => Proxy n -> DigestProxy (SHAKE128 n) | SHAKE128 (variable size)
SHAKE256 :: KnownNat n => Proxy n -> DigestProxy (SHAKE256 n) | SHAKE256 (variable size)

#### Instances

Instances details

Show (DigestProxy hashAlg) Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> DigestProxy hashAlg -> ShowS Source # show :: DigestProxy hashAlg -> String Source # showList :: [DigestProxy hashAlg] -> ShowS Source #
Eq (DigestProxy hashAlg) Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: DigestProxy hashAlg -> DigestProxy hashAlg -> Bool Source # (/=) :: DigestProxy hashAlg -> DigestProxy hashAlg -> Bool Source #

data DigestAlgorithm Source #

CMS digest algorithm.

Constructors

forall hashAlg.HashAlgorithm hashAlg => DigestAlgorithm (DigestProxy hashAlg) |

#### Instances

Instances details

Show DigestAlgorithm Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> DigestAlgorithm -> ShowS Source # show :: DigestAlgorithm -> String Source # showList :: [DigestAlgorithm] -> ShowS Source #
Eq DigestAlgorithm Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: DigestAlgorithm -> DigestAlgorithm -> Bool Source # (/=) :: DigestAlgorithm -> DigestAlgorithm -> Bool Source #

data DigestedData content Source #

Digested content information.

Constructors

forall hashAlg.HashAlgorithm hashAlg => DigestedData |

Fields

- ddDigestAlgorithm :: DigestProxy hashAlg

  Digest algorithm

- ddContentType :: ContentType

  Inner content type

- ddEncapsulatedContent :: content

  Encapsulated content

- ddDigest :: Digest hashAlg

  Digest value

#### Instances

Instances details

Encapsulates DigestedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> DigestedData a -> f (DigestedData b) toCI :: DigestedData (Encap ByteString) -> ContentInfo
Show content => Show (DigestedData content) Source # |
Instance details Defined in Crypto.Store.CMS.Digested Methods showsPrec :: Int -> DigestedData content -> ShowS Source # show :: DigestedData content -> String Source # showList :: [DigestedData content] -> ShowS Source #
Eq content => Eq (DigestedData content) Source # |
Instance details Defined in Crypto.Store.CMS.Digested Methods (==) :: DigestedData content -> DigestedData content -> Bool Source # (/=) :: DigestedData content -> DigestedData content -> Bool Source #

digestData :: DigestAlgorithm -> ContentInfo -> DigestedData EncapsulatedContent Source #

Add a digested-data layer on the specified content info.

digestVerify :: DigestedData EncapsulatedContent -> Either StoreError ContentInfo Source #

Return the inner content info but only if the digest is valid.

# Encrypted data

type ContentEncryptionKey = ByteString Source #

Key used for content encryption.

data ContentEncryptionCipher cipher where Source #

CMS content encryption cipher.

Constructors

DES :: ContentEncryptionCipher DES | DES
DES_EDE2 :: ContentEncryptionCipher DES_EDE2 | Triple-DES with 2 keys used in alternative direction
DES_EDE3 :: ContentEncryptionCipher DES_EDE3 | Triple-DES with 3 keys used in alternative direction
AES128 :: ContentEncryptionCipher AES128 | AES with 128-bit key
AES192 :: ContentEncryptionCipher AES192 | AES with 192-bit key
AES256 :: ContentEncryptionCipher AES256 | AES with 256-bit key
CAST5 :: ContentEncryptionCipher CAST5 | CAST5 (aka CAST-128) with key between 40 and 128 bits
Camellia128 :: ContentEncryptionCipher Camellia128 | Camellia with 128-bit key

#### Instances

Instances details

Show (ContentEncryptionCipher cipher) Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> ContentEncryptionCipher cipher -> ShowS Source # show :: ContentEncryptionCipher cipher -> String Source # showList :: [ContentEncryptionCipher cipher] -> ShowS Source #
Eq (ContentEncryptionCipher cipher) Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: ContentEncryptionCipher cipher -> ContentEncryptionCipher cipher -> Bool Source # (/=) :: ContentEncryptionCipher cipher -> ContentEncryptionCipher cipher -> Bool Source #

data ContentEncryptionAlg Source #

Cipher and mode of operation for content encryption.

Constructors

forall c.BlockCipher c => ECB (ContentEncryptionCipher c) | Electronic Codebook
forall c.BlockCipher c => CBC (ContentEncryptionCipher c) | Cipher Block Chaining
CBC_RC2 | RC2 in CBC mode
forall c.BlockCipher c => CFB (ContentEncryptionCipher c) | Cipher Feedback
forall c.BlockCipher c => CTR (ContentEncryptionCipher c) | Counter

#### Instances

Instances details

OIDNameable ContentEncryptionAlg Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods fromObjectID :: OID -> Maybe ContentEncryptionAlg Source #
OIDable ContentEncryptionAlg Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getObjectID :: ContentEncryptionAlg -> OID Source #
Show ContentEncryptionAlg Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> ContentEncryptionAlg -> ShowS Source # show :: ContentEncryptionAlg -> String Source # showList :: [ContentEncryptionAlg] -> ShowS Source #

data ContentEncryptionParams Source #

Content encryption algorithm with associated parameters (i.e. the initialization vector).

A value can be generated with `generateEncryptionParams`.

#### Instances

Instances details

Show ContentEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> ContentEncryptionParams -> ShowS Source # show :: ContentEncryptionParams -> String Source # showList :: [ContentEncryptionParams] -> ShowS Source #
HasKeySize ContentEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: ContentEncryptionParams -> KeySizeSpecifier Source #
Eq ContentEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: ContentEncryptionParams -> ContentEncryptionParams -> Bool Source # (/=) :: ContentEncryptionParams -> ContentEncryptionParams -> Bool Source #

type EncryptedContent = ByteString Source #

Encrypted content.

data EncryptedData content Source #

Encrypted content information.

Constructors

EncryptedData |

Fields

- edContentType :: ContentType

  Inner content type

- edContentEncryptionParams :: ContentEncryptionParams

  Encryption algorithm

- edEncryptedContent :: content

  Encrypted content info

- edUnprotectedAttrs :: [Attribute]

  Optional unprotected attributes

#### Instances

Instances details

Encapsulates EncryptedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> EncryptedData a -> f (EncryptedData b) toCI :: EncryptedData (Encap ByteString) -> ContentInfo
Show content => Show (EncryptedData content) Source # |
Instance details Defined in Crypto.Store.CMS.Encrypted Methods showsPrec :: Int -> EncryptedData content -> ShowS Source # show :: EncryptedData content -> String Source # showList :: [EncryptedData content] -> ShowS Source #
Eq content => Eq (EncryptedData content) Source # |
Instance details Defined in Crypto.Store.CMS.Encrypted Methods (==) :: EncryptedData content -> EncryptedData content -> Bool Source # (/=) :: EncryptedData content -> EncryptedData content -> Bool Source #

generateEncryptionParams :: MonadRandom m => ContentEncryptionAlg -> m ContentEncryptionParams Source #

Generate random parameters for the specified content encryption algorithm.

generateRC2EncryptionParams :: MonadRandom m => Int -> m ContentEncryptionParams Source #

Generate random RC2 parameters with the specified effective key length (in bits).

getContentEncryptionAlg :: ContentEncryptionParams -> ContentEncryptionAlg Source #

Get the content encryption algorithm.

encryptData :: ContentEncryptionKey -> ContentEncryptionParams -> [Attribute] -> ContentInfo -> Either StoreError (EncryptedData EncryptedContent) Source #

Add an encrypted-data layer on the specified content info. The content is encrypted with specified key and algorithm.

Some optional attributes can be added but will not be encrypted.

decryptData :: ContentEncryptionKey -> EncryptedData EncryptedContent -> Either StoreError ContentInfo Source #

Decrypt an encrypted content info using the specified key.

# Authenticated data

type AuthenticationKey = ContentEncryptionKey Source #

Key used for authentication.

data MACAlgorithm Source #

Message Authentication Code (MAC) Algorithm.

Constructors

forall hashAlg.HashAlgorithm hashAlg => HMAC (DigestProxy hashAlg) |
forall n.KnownNat n => KMAC_SHAKE128 (Proxy n) ByteString |
forall n.KnownNat n => KMAC_SHAKE256 (Proxy n) ByteString |

#### Instances

Instances details

Show MACAlgorithm Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> MACAlgorithm -> ShowS Source # show :: MACAlgorithm -> String Source # showList :: [MACAlgorithm] -> ShowS Source #
HasKeySize MACAlgorithm Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: MACAlgorithm -> KeySizeSpecifier Source #
Eq MACAlgorithm Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: MACAlgorithm -> MACAlgorithm -> Bool Source # (/=) :: MACAlgorithm -> MACAlgorithm -> Bool Source #

type MessageAuthenticationCode = AuthTag Source #

Message authentication code. Equality is time constant.

data AuthenticatedData content Source #

Authenticated content information.

Constructors

AuthenticatedData |

Fields

- adOriginatorInfo :: OriginatorInfo

  Optional information about the originator

- adRecipientInfos :: [RecipientInfo]

  Information for recipients, allowing to authenticate the content

- adMACAlgorithm :: MACAlgorithm

  MAC algorithm

- adDigestAlgorithm :: Maybe DigestAlgorithm

  Optional digest algorithm

- adContentType :: ContentType

  Inner content type

- adEncapsulatedContent :: content

  Encapsulated content

- adAuthAttrs :: [Attribute]

  Optional authenticated attributes

- adMAC :: MessageAuthenticationCode

  Message authentication code

- adUnauthAttrs :: [Attribute]

  Optional unauthenticated attributes

#### Instances

Instances details

Encapsulates AuthenticatedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> AuthenticatedData a -> f (AuthenticatedData b) toCI :: AuthenticatedData (Encap ByteString) -> ContentInfo
Show content => Show (AuthenticatedData content) Source # |
Instance details Defined in Crypto.Store.CMS.Authenticated Methods showsPrec :: Int -> AuthenticatedData content -> ShowS Source # show :: AuthenticatedData content -> String Source # showList :: [AuthenticatedData content] -> ShowS Source #
Eq content => Eq (AuthenticatedData content) Source # |
Instance details Defined in Crypto.Store.CMS.Authenticated Methods (==) :: AuthenticatedData content -> AuthenticatedData content -> Bool Source # (/=) :: AuthenticatedData content -> AuthenticatedData content -> Bool Source #

generateAuthenticatedData :: Applicative f => OriginatorInfo -> AuthenticationKey -> MACAlgorithm -> Maybe DigestAlgorithm -> [ProducerOfRI f] -> [Attribute] -> [Attribute] -> ContentInfo -> f (Either StoreError (AuthenticatedData EncapsulatedContent)) Source #

Add an authenticated-data layer on the specified content info. The content is MACed with the specified key and algorithms. The key is then processed by one or several `ProducerOfRI` functions to create recipient info elements.

Two lists of optional attributes can be provided. The attributes will be part of message authentication when provided in the first list.

verifyAuthenticatedData :: Monad m => ConsumerOfRI m -> AuthenticatedData EncapsulatedContent -> m (Either StoreError ContentInfo) Source #

Verify the integrity of an authenticated content info using the specified `ConsumerOfRI` function. The inner content info is returned only if the MAC could be verified.

# Authenticated-enveloped data

data AuthContentEncryptionAlg Source #

Cipher and mode of operation for authenticated-content encryption.

Constructors

AUTH_ENC_128 | authEnc with 128-bit key
AUTH_ENC_256 | authEnc with 256-bit key
CHACHA20_POLY1305 | ChaCha20-Poly1305 Authenticated Encryption
forall c.BlockCipher c => CCM (ContentEncryptionCipher c) | Counter with CBC-MAC
forall c.BlockCipher c => GCM (ContentEncryptionCipher c) | Galois Counter Mode

#### Instances

Instances details

OIDNameable AuthContentEncryptionAlg Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods fromObjectID :: OID -> Maybe AuthContentEncryptionAlg Source #
OIDable AuthContentEncryptionAlg Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getObjectID :: AuthContentEncryptionAlg -> OID Source #
Show AuthContentEncryptionAlg Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> AuthContentEncryptionAlg -> ShowS Source # show :: AuthContentEncryptionAlg -> String Source # showList :: [AuthContentEncryptionAlg] -> ShowS Source #

data AuthContentEncryptionParams Source #

Authenticated-content encryption algorithm with associated parameters (i.e. the nonce).

A value can be generated with functions `generateAuthEnc128Params`, `generateAuthEnc256Params`, `generateChaChaPoly1305Params`, `generateCCMParams` and `generateGCMParams`.

#### Instances

Instances details

Show AuthContentEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> AuthContentEncryptionParams -> ShowS Source # show :: AuthContentEncryptionParams -> String Source # showList :: [AuthContentEncryptionParams] -> ShowS Source #
HasKeySize AuthContentEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: AuthContentEncryptionParams -> KeySizeSpecifier Source #
Eq AuthContentEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: AuthContentEncryptionParams -> AuthContentEncryptionParams -> Bool Source # (/=) :: AuthContentEncryptionParams -> AuthContentEncryptionParams -> Bool Source #

data AuthEnvelopedData content Source #

Authenticated-enveloped content information.

Constructors

AuthEnvelopedData |

Fields

- aeOriginatorInfo :: OriginatorInfo

  Optional information about the originator

- aeRecipientInfos :: [RecipientInfo]

  Information for recipients, allowing to decrypt the content

- aeContentType :: ContentType

  Inner content type

- aeContentEncryptionParams :: ASN1ObjectExact AuthContentEncryptionParams

  Encryption algorithm

- aeEncryptedContent :: content

  Encrypted content info

- aeAuthAttrs :: [Attribute]

  Optional authenticated attributes

- aeMAC :: MessageAuthenticationCode

  Message authentication code

- aeUnauthAttrs :: [Attribute]

  Optional unauthenticated attributes

#### Instances

Instances details

Encapsulates AuthEnvelopedData Source # |
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> AuthEnvelopedData a -> f (AuthEnvelopedData b) toCI :: AuthEnvelopedData (Encap ByteString) -> ContentInfo
Show content => Show (AuthEnvelopedData content) Source # |
Instance details Defined in Crypto.Store.CMS.AuthEnveloped Methods showsPrec :: Int -> AuthEnvelopedData content -> ShowS Source # show :: AuthEnvelopedData content -> String Source # showList :: [AuthEnvelopedData content] -> ShowS Source #
Eq content => Eq (AuthEnvelopedData content) Source # |
Instance details Defined in Crypto.Store.CMS.AuthEnveloped Methods (==) :: AuthEnvelopedData content -> AuthEnvelopedData content -> Bool Source # (/=) :: AuthEnvelopedData content -> AuthEnvelopedData content -> Bool Source #

generateAuthEnc128Params :: MonadRandom m => PBKDF2_PRF -> ContentEncryptionAlg -> MACAlgorithm -> m AuthContentEncryptionParams Source #

Generate random `AUTH_ENC_128` parameters with the specified algorithms.

generateAuthEnc256Params :: MonadRandom m => PBKDF2_PRF -> ContentEncryptionAlg -> MACAlgorithm -> m AuthContentEncryptionParams Source #

Generate random `AUTH_ENC_256` parameters with the specified algorithms.

generateChaChaPoly1305Params :: MonadRandom m => m AuthContentEncryptionParams Source #

Generate random `CHACHA20_POLY1305` parameters.

generateCCMParams :: (MonadRandom m, BlockCipher c) => ContentEncryptionCipher c -> CCM_M -> CCM_L -> m AuthContentEncryptionParams Source #

Generate random `CCM` parameters for the specified cipher.

generateGCMParams :: (MonadRandom m, BlockCipher c) => ContentEncryptionCipher c -> Int -> m AuthContentEncryptionParams Source #

Generate random `GCM` parameters for the specified cipher.

authEnvelopData :: Applicative f => OriginatorInfo -> ContentEncryptionKey -> AuthContentEncryptionParams -> [ProducerOfRI f] -> [Attribute] -> [Attribute] -> ContentInfo -> f (Either StoreError (AuthEnvelopedData EncryptedContent)) Source #

Add an authenticated-enveloped-data layer on the specified content info. The content is encrypted with specified key and algorithm. The key is then processed by one or several `ProducerOfRI` functions to create recipient info elements.

Some attributes can be added but will not be encrypted. The attributes will be part of message authentication when provided in the first list.

openAuthEnvelopedData :: Monad m => ConsumerOfRI m -> AuthEnvelopedData EncryptedContent -> m (Either StoreError ContentInfo) Source #

Recover an authenticated-enveloped content info using the specified `ConsumerOfRI` function.

# Key derivation

type Salt = ByteString Source #

Salt value used for key derivation.

generateSalt :: MonadRandom m => Int -> m Salt Source #

Generate a random salt with the specified length in bytes. To be most effective, the length should be at least 8 bytes.

data KeyDerivationFunc Source #

Key derivation algorithm and associated parameters.

Constructors

PBKDF2 | Key derivation with PBKDF2

Fields

- pbkdf2Salt :: Salt

  Salt value

- pbkdf2IterationCount :: Int

  Iteration count

- pbkdf2KeyLength :: Maybe Int

  Optional key length

- pbkdf2Prf :: PBKDF2_PRF

  Pseudorandom function

Scrypt | Key derivation with Scrypt

Fields

- scryptSalt :: Salt

  Salt value

- scryptN :: Word64

  N value

- scryptR :: Int

  R value

- scryptP :: Int

  P value

- scryptKeyLength :: Maybe Int

  Optional key length

#### Instances

Instances details

Show KeyDerivationFunc Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> KeyDerivationFunc -> ShowS Source # show :: KeyDerivationFunc -> String Source # showList :: [KeyDerivationFunc] -> ShowS Source #
Eq KeyDerivationFunc Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: KeyDerivationFunc -> KeyDerivationFunc -> Bool Source # (/=) :: KeyDerivationFunc -> KeyDerivationFunc -> Bool Source #

data PBKDF2_PRF Source #

Pseudorandom function used for PBKDF2.

Constructors

PBKDF2_SHA1 | hmacWithSHA1
PBKDF2_SHA256 | hmacWithSHA256
PBKDF2_SHA512 | hmacWithSHA512

#### Instances

Instances details

OIDNameable PBKDF2_PRF Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods fromObjectID :: OID -> Maybe PBKDF2_PRF Source #
OIDable PBKDF2_PRF Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getObjectID :: PBKDF2_PRF -> OID Source #
Show PBKDF2_PRF Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> PBKDF2_PRF -> ShowS Source # show :: PBKDF2_PRF -> String Source # showList :: [PBKDF2_PRF] -> ShowS Source #
Eq PBKDF2_PRF Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: PBKDF2_PRF -> PBKDF2_PRF -> Bool Source # (/=) :: PBKDF2_PRF -> PBKDF2_PRF -> Bool Source #

# Secret-key algorithms

class HasKeySize params where Source #

Algorithms that are based on a secret key. This includes ciphers but also MAC algorithms.

Methods

getKeySizeSpecifier :: params -> KeySizeSpecifier Source #

Get a specification of the key sizes allowed by the algorithm.

#### Instances

Instances details

HasKeySize AuthContentEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: AuthContentEncryptionParams -> KeySizeSpecifier Source #
HasKeySize ContentEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: ContentEncryptionParams -> KeySizeSpecifier Source #
HasKeySize KeyEncryptionParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: KeyEncryptionParams -> KeySizeSpecifier Source #
HasKeySize MACAlgorithm Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: MACAlgorithm -> KeySizeSpecifier Source #

generateKey :: (HasKeySize params, MonadRandom m, ByteArray key) => params -> m key Source #

Generate a random key suitable for the specified algorithm. This uses the maximum size allowed by the parameters.

# RSA padding modes

newtype MaskGenerationFunc Source #

Mask Generation Functions (MGF) and associated parameters.

Constructors

MGF1 DigestAlgorithm |

#### Instances

Instances details

Show MaskGenerationFunc Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> MaskGenerationFunc -> ShowS Source # show :: MaskGenerationFunc -> String Source # showList :: [MaskGenerationFunc] -> ShowS Source #
Eq MaskGenerationFunc Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: MaskGenerationFunc -> MaskGenerationFunc -> Bool Source # (/=) :: MaskGenerationFunc -> MaskGenerationFunc -> Bool Source #

data OAEPParams Source #

Encryption parameters for RSAES-OAEP.

Constructors

OAEPParams |

Fields

- oaepHashAlgorithm :: DigestAlgorithm

  Hash function

- oaepMaskGenAlgorithm :: MaskGenerationFunc

  Mask generation function

#### Instances

Instances details

Show OAEPParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> OAEPParams -> ShowS Source # show :: OAEPParams -> String Source # showList :: [OAEPParams] -> ShowS Source #
Eq OAEPParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: OAEPParams -> OAEPParams -> Bool Source # (/=) :: OAEPParams -> OAEPParams -> Bool Source #

data PSSParams Source #

Signature parameters for RSASSA-PSS.

Constructors

PSSParams |

Fields

- pssHashAlgorithm :: DigestAlgorithm

  Hash function

- pssMaskGenAlgorithm :: MaskGenerationFunc

  Mask generation function

- pssSaltLength :: Int

  Length of the salt in bytes

#### Instances

Instances details

Show PSSParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> PSSParams -> ShowS Source # show :: PSSParams -> String Source # showList :: [PSSParams] -> ShowS Source #
Eq PSSParams Source # |
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: PSSParams -> PSSParams -> Bool Source # (/=) :: PSSParams -> PSSParams -> Bool Source #

# CMS attributes

data Attribute Source #

An attribute extending the parent structure with arbitrary data.

Constructors

Attribute |

Fields

- attrType :: OID

  Attribute type

- attrValues :: [ASN1]

  Attribute values

#### Instances

Instances details

Show Attribute Source # |
Instance details Defined in Crypto.Store.CMS.Attribute Methods showsPrec :: Int -> Attribute -> ShowS Source # show :: Attribute -> String Source # showList :: [Attribute] -> ShowS Source #
Eq Attribute Source # |
Instance details Defined in Crypto.Store.CMS.Attribute Methods (==) :: Attribute -> Attribute -> Bool Source # (/=) :: Attribute -> Attribute -> Bool Source #

findAttribute :: OID -> [Attribute] -> Maybe [ASN1] Source #

Return the values for the first attribute with the specified type.

setAttribute :: OID -> [ASN1] -> [Attribute] -> [Attribute] Source #

Add or replace an attribute in a list of attributes.

filterAttributes :: (OID -> Bool) -> [Attribute] -> [Attribute] Source #

Filter a list of attributes based on a predicate applied to attribute type.

# CMS standard attributes

getSigningTimeAttr :: [Attribute] -> Maybe DateTime Source #

Return the value of the `signingTime` attribute.

setSigningTimeAttr :: DateTime -> [Attribute] -> [Attribute] Source #

Add or replace the `signingTime` attribute in a list of attributes.

setSigningTimeAttrCurrent :: MonadIO m => [Attribute] -> m [Attribute] Source #

Add or replace the `signingTime` attribute in a list of attributes with the current time. This is equivalent to calling `setSigningTimeAttr` with the result of `dateCurrent`.

# Originator information

data OriginatorInfo Source #

Information about the originator of the content info, to be used when a key management algorithm requires this information.

Constructors

OriginatorInfo |

Fields

- originatorCerts :: [CertificateChoice]

  The collection of certificates

- originatorCRLs :: [RevocationInfoChoice]

  The collection of CRLs

#### Instances

Instances details

Monoid OriginatorInfo Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods mempty :: OriginatorInfo Source # mappend :: OriginatorInfo -> OriginatorInfo -> OriginatorInfo Source # mconcat :: [OriginatorInfo] -> OriginatorInfo Source #
Semigroup OriginatorInfo Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (<>) :: OriginatorInfo -> OriginatorInfo -> OriginatorInfo Source # sconcat :: NonEmpty OriginatorInfo -> OriginatorInfo Source # stimes :: Integral b => b -> OriginatorInfo -> OriginatorInfo Source #
Show OriginatorInfo Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods showsPrec :: Int -> OriginatorInfo -> ShowS Source # show :: OriginatorInfo -> String Source # showList :: [OriginatorInfo] -> ShowS Source #
Eq OriginatorInfo Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (==) :: OriginatorInfo -> OriginatorInfo -> Bool Source # (/=) :: OriginatorInfo -> OriginatorInfo -> Bool Source #

data CertificateChoice Source #

Union type related to certificate formats.

Constructors

CertificateCertificate SignedCertificate | X.509 certificate
CertificateOther OtherCertificateFormat | Other format

#### Instances

Instances details

Show CertificateChoice Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods showsPrec :: Int -> CertificateChoice -> ShowS Source # show :: CertificateChoice -> String Source # showList :: [CertificateChoice] -> ShowS Source #
Eq CertificateChoice Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (==) :: CertificateChoice -> CertificateChoice -> Bool Source # (/=) :: CertificateChoice -> CertificateChoice -> Bool Source #

data OtherCertificateFormat Source #

Certificate information in a format not supported natively.

Constructors

OtherCertificateFormat |

Fields

- otherCertFormat :: OID

  Format identifier

- otherCertValues :: [ASN1]

  ASN.1 values using this format

#### Instances

Instances details

Show OtherCertificateFormat Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods showsPrec :: Int -> OtherCertificateFormat -> ShowS Source # show :: OtherCertificateFormat -> String Source # showList :: [OtherCertificateFormat] -> ShowS Source #
Eq OtherCertificateFormat Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (==) :: OtherCertificateFormat -> OtherCertificateFormat -> Bool Source # (/=) :: OtherCertificateFormat -> OtherCertificateFormat -> Bool Source #

data RevocationInfoChoice Source #

Union type related to revocation info formats.

Constructors

RevocationInfoCRL SignedCRL | A CRL, ARL, Delta CRL, or an ACRL
RevocationInfoOther OtherRevocationInfoFormat | Other format

#### Instances

Instances details

Show RevocationInfoChoice Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods showsPrec :: Int -> RevocationInfoChoice -> ShowS Source # show :: RevocationInfoChoice -> String Source # showList :: [RevocationInfoChoice] -> ShowS Source #
Eq RevocationInfoChoice Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (==) :: RevocationInfoChoice -> RevocationInfoChoice -> Bool Source # (/=) :: RevocationInfoChoice -> RevocationInfoChoice -> Bool Source #

data OtherRevocationInfoFormat Source #

Revocation information in a format not supported natively.

Constructors

OtherRevocationInfoFormat |

Fields

- otherRevInfoFormat :: OID

  Format identifier

- otherRevInfoValues :: [ASN1]

  ASN.1 values using this format

#### Instances

Instances details

Show OtherRevocationInfoFormat Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods showsPrec :: Int -> OtherRevocationInfoFormat -> ShowS Source # show :: OtherRevocationInfoFormat -> String Source # showList :: [OtherRevocationInfoFormat] -> ShowS Source #
Eq OtherRevocationInfoFormat Source # |
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (==) :: OtherRevocationInfoFormat -> OtherRevocationInfoFormat -> Bool Source # (/=) :: OtherRevocationInfoFormat -> OtherRevocationInfoFormat -> Bool Source #

# ASN.1 representation

data ASN1ObjectExact a Source #

An ASN.1 object associated with the raw data it was parsed from.

#### Instances

Instances details

Show a => Show (ASN1ObjectExact a) Source # |
Instance details Defined in Crypto.Store.CMS.Util Methods showsPrec :: Int -> ASN1ObjectExact a -> ShowS Source # show :: ASN1ObjectExact a -> String Source # showList :: [ASN1ObjectExact a] -> ShowS Source #
Eq a => Eq (ASN1ObjectExact a) Source # |
Instance details Defined in Crypto.Store.CMS.Util Methods (==) :: ASN1ObjectExact a -> ASN1ObjectExact a -> Bool Source # (/=) :: ASN1ObjectExact a -> ASN1ObjectExact a -> Bool Source #