Crypto.JOSE.JWK

Generate a JWK. Apart from key parameters, no other parameters are set.

Keygen parameters.

"crv" (Curve) Parameter

RFC 7517 §4. JSON Web Key (JWK) Format

Keys that may have have public material

RFC 7517 §4.2. "use" (Public Key Use) Parameter

RFC 7517 §4.3. "key_ops" (Key Operations) Parameter

RFC 7517 §4.4. "alg" (Algorithm) Parameter

See also RFC 7518 §6.4. which states that for "oct" keys, an "alg" member SHOULD be present to identify the algorithm intended to be used with the key, unless the application uses another means or convention to determine the algorithm used.

Get the certificate chain. Not a lens, because the key of the first certificate in the chain must correspond be the public key of the JWK. To set the certificate chain use setJWKX5c.

Set the "x5c" Certificate Chain parameter. If setting the list, checks that the key in the first certificate matches the JWK; returns Nothing if it does not.

Convert RSA private key into a JWK

Convert an RSA public key into a JWK

Convert octet string into a JWK

Convert an X.509 certificate into a JWK.

Supports RSA, ECDSA (curves defined for use in JOSE), and Edwards curves (Ed25519, Ed448, X25519, X448).

The "x5c" field of the resulting JWK contains the certificate.

Convert from a PubKey (such as can be read via the crypton-x509-store package). Supports RSA, ECDSA, Ed25519, Ed448, X25519 and X448 keys.

Convert from a PrivKey (such as can be read via the crypton-x509-store package). Supports RSA, ECDSA, Ed25519, Ed448, X25519 and X448 keys.

Compute the JWK Thumbprint of a JWK

Prism from ByteString to HashAlgorithm a => Digest a.

Use re digest to view the bytes of a digest

Prism for encoding / decoding base64url.

To encode, review base64url. To decode, preview base64url.

Works with any combinations of strict/lazy ByteString.

Try to transform a bytearray into a Digest of specific algorithm.

If the digest is not the right size for the algorithm specified, then Nothing is returned.

Hash a strict bytestring into a digest.

Finalize a context and return a digest.

Update the context with the first N bytes of a bytestring and return the digest. The code path is independent from N but much slower than a normal hashUpdate. The function can be called for the last bytes of a message, in order to exclude a variable padding, without leaking the padding length. The begining of the message, never impacted by the padding, should preferably go through hashUpdate for better performance.

Initialize a new context for this hash algorithm

Initialize a new context for a specified hash algorithm

Hash the first N bytes of a bytestring, with code path independent from N.

Run the hashPrefix function but takes an explicit hash algorithm parameter

run hashUpdates on one single bytestring and return the updated context.

Update the context with a list of strict bytestring, and return a new context with the updates.

Run the hash function but takes an explicit hash algorithm parameter

Hash a lazy bytestring into a digest.

Fast cryptographic hash.

It is especially known to target 64bits architectures.

Known supported digest sizes:

• Blake2b 160

• Blake2b 224

• Blake2b 256

• Blake2b 384

• Blake2b 512

Fast and secure alternative to SHA1 and HMAC-SHA1

It is espacially known to target 32bits architectures.

Known supported digest sizes:

• Blake2s 160

• Blake2s 224

• Blake2s 256

Blake2b (160 bits) cryptographic hash algorithm

Blake2b (224 bits) cryptographic hash algorithm

Blake2b (256 bits) cryptographic hash algorithm

Blake2b (384 bits) cryptographic hash algorithm

Blake2b (512 bits) cryptographic hash algorithm

Blake2bp (512 bits) cryptographic hash algorithm

Blake2s (160 bits) cryptographic hash algorithm

Blake2s (224 bits) cryptographic hash algorithm

Blake2s (256 bits) cryptographic hash algorithm

Blake2sp (224 bits) cryptographic hash algorithm

Blake2sp (256 bits) cryptographic hash algorithm

Keccak (224 bits) cryptographic hash algorithm

Keccak (256 bits) cryptographic hash algorithm

Keccak (384 bits) cryptographic hash algorithm

Keccak (512 bits) cryptographic hash algorithm

MD2 cryptographic hash algorithm

MD4 cryptographic hash algorithm

MD5 cryptographic hash algorithm

RIPEMD160 cryptographic hash algorithm

SHA1 cryptographic hash algorithm

SHA224 cryptographic hash algorithm

SHA256 cryptographic hash algorithm

SHA3 (224 bits) cryptographic hash algorithm

SHA3 (256 bits) cryptographic hash algorithm

SHA3 (384 bits) cryptographic hash algorithm

SHA3 (512 bits) cryptographic hash algorithm

SHA384 cryptographic hash algorithm

SHA512 cryptographic hash algorithm

SHA512t (224 bits) cryptographic hash algorithm

SHA512t (256 bits) cryptographic hash algorithm

SHAKE128 (128 bits) extendable output function. Supports an arbitrary digest size, to be specified as a type parameter of kind Nat.

Note: outputs from SHAKE128 n and SHAKE128 m for the same input are correlated (one being a prefix of the other). Results are unrelated to SHAKE256 results.

SHAKE256 (256 bits) extendable output function. Supports an arbitrary digest size, to be specified as a type parameter of kind Nat.

Note: outputs from SHAKE256 n and SHAKE256 m for the same input are correlated (one being a prefix of the other). Results are unrelated to SHAKE128 results.

Skein256 with the digest size given as a type parameter of kind Nat, in bits. Skein256 256 is Skein256_256; the sizes with a type of their own above are there for their names, and this one also takes the sizes that have none.

A size that is not a whole number of bytes is rounded up to the next one, as the implementation underneath does.

The output is produced in counter mode, a block of it per Threefish call, so one large digest is a good deal cheaper than the same number of bytes taken from repeated small ones: on an Apple M4, 512 KiB arrives at 947 MB/s in one digest against 172 MB/s as 8192 separate Skein256_256 ones.

Note the digest size goes into the configuration block, so it changes the value the message is hashed from: a longer digest is not an extension of a shorter one. That is the opposite of how SHAKE128 behaves.

Skein256 (224 bits) cryptographic hash algorithm

Skein256 (256 bits) cryptographic hash algorithm

Skein512 with the digest size given as a type parameter of kind Nat, in bits. Skein512 512 is Skein512_512; the sizes with a type of their own above are there for their names, and this one also takes the sizes that have none.

A size that is not a whole number of bytes is rounded up to the next one, as the implementation underneath does.

The output is produced in counter mode, a block of it per Threefish call, so one large digest is a good deal cheaper than the same number of bytes taken from repeated small ones: on an Apple M4, 512 KiB arrives at 947 MB/s in one digest against 172 MB/s as 8192 separate Skein512_512 ones.

Note the digest size goes into the configuration block, so it changes the value the message is hashed from: a longer digest is not an extension of a shorter one. That is the opposite of how SHAKE128 behaves.

Skein512 (224 bits) cryptographic hash algorithm

Skein512 (256 bits) cryptographic hash algorithm

Skein512 (384 bits) cryptographic hash algorithm

Skein512 (512 bits) cryptographic hash algorithm

Tiger cryptographic hash algorithm

Represent a context for a given hash algorithm.

This type is an instance of ByteArrayAccess for debugging purpose. Internal layout is architecture dependent, may contain uninitialized data fragments, and change in future versions. The bytearray should not be used as input to cryptographic algorithms.

A context is not erased when it is finished with. A hash algorithm buffers its input a block at a time, and finalizing does not clear what is left there. How much survives depends on where the message ended relative to the block: with SHA-256, a 32-byte message is still in the context in full afterwards, and a 100-byte one leaves its last 36 bytes. hashFinalize works on a copy, so the caller's own context keeps what it had as well. Nothing clears either of them: this is Bytes rather than ScrubbedBytes, and the C clears nothing. They go to the garbage collector as they are, and a core file, a crash dump or a swapped page can carry them away afterwards.

That is a deliberate trade rather than an oversight, and there is no way to ask for the other side of it: no operation here clears a context. Scrubbing them all was measured at about 70% of a 32-byte hash and a third of an incremental one, because the allocation is most of the work when the message is short -- and short hashes are the common case, in HMAC, in HKDF, and anywhere a key or an identifier is hashed. A 64 KB hash does not notice it. Anything that must not be left in memory this way is better not hashed through this interface at all.

Represent a digest for a given hash algorithm.

This type is an instance of ByteArrayAccess from package ram. Module Data.ByteArray provides many primitives to work with those values including conversion to other types.

Creating a digest from a bytearray is also possible with function digestFromByteString.

Class representing hashing algorithms.

The interface presented here is update in place and lowlevel. the Hash module takes care of hidding the mutable interface properly.

Hashing algorithms with a constant-time implementation.

Whirlpool cryptographic hash algorithm

RFC 7517 §5. JWK Set Format

Sanity-check a JWK.

Return an appropriate error if the key is size is too small to be used with any JOSE algorithm, or for other problems that mean the key cannot be used.

Choose the cryptographically strongest JWS algorithm for a given key, restricted to a given set of algorithms. This function supports negotiation use cases where verifier's supported algorithms are advertised or known.

Throws an error if the key is too small or cannot be used for signing, or if there is no overlap between the allowed algorithms and the algorithms supported by the key type.

RSASSA-PSS algorithms are preferred over RSASSA-PKCS1-v1_5.

The JWK "alg" parameter is ignored.

Choose the cryptographically strongest JWS algorithm for a given key. The JWK "alg" algorithm parameter is ignored.

See also negotiateJWSAlg.

bestJWSAlg k = negotiateJWSAlg k Nothing