Modulecrypton-2.1.7Haskell2010

Crypto.PubKey.ECDSA

Elliptic Curve Digital Signature Algorithm, with the parameterized curve implementations provided by module Crypto.ECC.

Public/private key pairs can be generated using curveGenerateKeyPair or decoded from binary.

WARNING: Only curve P-256 has constant-time implementation. Signature operations with P-384 and P-521 may leak the private key.

Signature verification should be safe for all curves.

3 types
1 class
16 values

Packagecrypton-2.1.7
Exports20
LanguageHaskell2010
LicenceBSD-3-Clause AND MIT AND ISC
SourceECDSA.hs

classclass EllipticCurveBasepointArith curve => EllipticCurveECDSA curve where

Elliptic curves with ECDSA capabilities.

Methods

scalarIsValid :: proxy curve -> Scalar curve -> Bool
Is a scalar in the accepted range for ECDSA
scalarIsZero :: proxy curve -> Scalar curve -> Bool
Test whether the scalar is zero
scalarInv :: proxy curve -> Scalar curve -> Maybe (Scalar curve)
Scalar inversion modulo the curve order
pointX :: proxy curve -> Point curve -> Maybe (Scalar curve)
Return the point X coordinate as a scalar

Instances3EllipticCurveECDSA

EllipticCurveECDSA Curve_P256R1Defined in crypton-2.1.7 · Crypto.PubKey.ECDSA
EllipticCurveECDSA Curve_P384R1Defined in crypton-2.1.7 · Crypto.PubKey.ECDSA
EllipticCurveECDSA Curve_P521R1Defined in crypton-2.1.7 · Crypto.PubKey.ECDSA

Public keys

4 declarations

typetype PublicKey curve = Point curve

ECDSA Public Key.

valueencodePublic

:: (EllipticCurve curve, ByteArray bs)
=> proxy curve
-> PublicKey curve
-> bs

Encode a public key into binary form, i.e. the uncompressed encoding referenced from RFC 5480 section 2.2.

valuedecodePublic

:: (EllipticCurve curve, ByteArray bs)
=> proxy curve
-> bs
-> CryptoFailable (PublicKey curve)

Try to decode the binary form of a public key.

valuetoPublic

:: EllipticCurveECDSA curve
=> proxy curve
-> PrivateKey curve
-> PublicKey curve

Create a public key from a private key.

Private keys

3 declarations

typetype PrivateKey curve = Scalar curve

ECDSA Private Key.

valueencodePrivate

:: (EllipticCurveECDSA curve, ByteArray bs)
=> proxy curve
-> PrivateKey curve
-> bs

Encode a private key into binary form, i.e. the privateKey field described in RFC 5915.

valuedecodePrivate

:: (EllipticCurveECDSA curve, ByteArray bs)
=> proxy curve
-> bs
-> CryptoFailable (PrivateKey curve)

Try to decode the binary form of a private key.

Signatures

3 declarations

datadata Signature curve

Represent a ECDSA signature namely R and S.

Constructors

Signature
- sign_r :: Scalar curve
  ECDSA r
- sign_s :: Scalar curve
  ECDSA s

Instances3Eq, Show, NFData

Eq (Scalar curve) => Eq (Signature curve)Defined in crypton-2.1.7 · Crypto.PubKey.ECDSA
Show (Scalar curve) => Show (Signature curve)Defined in crypton-2.1.7 · Crypto.PubKey.ECDSA
NFData (Scalar curve) => NFData (Signature curve)Defined in crypton-2.1.7 · Crypto.PubKey.ECDSA

valuesignatureFromIntegers

:: EllipticCurveECDSA curve
=> proxy curve
-> (Integer, Integer)
-> CryptoFailable (Signature curve)

Create a signature from integers (R, S).

valuesignatureToIntegers

:: EllipticCurveECDSA curve
=> proxy curve
-> Signature curve
-> (Integer, Integer)

Get integers (R, S) from a signature.

The values can then be used to encode the signature to binary with ASN.1.

Generation and verification

6 declarations

valuesignWith

:: (EllipticCurveECDSA curve, ByteArrayAccess msg, HashAlgorithm hash)
=> proxy curve
-> Scalar curve
-> PrivateKey curve
-> hash
-> msg
-> Maybe (Signature curve)

Sign message using the private key and an explicit k scalar.

valuesignDigestWith

:: (EllipticCurveECDSA curve, HashAlgorithm hash)
=> proxy curve
-> Scalar curve
-> PrivateKey curve
-> Digest hash
-> Maybe (Signature curve)

Sign digest using the private key and an explicit k scalar.

valuesign

:: (EllipticCurveECDSA curve, MonadRandom m, ByteArrayAccess msg, HashAlgorithm hash)
=> proxy curve
-> PrivateKey curve
-> hash
-> msg
-> m (Signature curve)

Sign a message using hash and private key.

valuesignDigest

:: (EllipticCurveECDSA curve, MonadRandom m, HashAlgorithm hash)
=> proxy curve
-> PrivateKey curve
-> Digest hash
-> m (Signature curve)

Sign a digest using hash and private key.

valueverify

:: (EllipticCurveECDSA curve, ByteArrayAccess msg, HashAlgorithm hash)
=> proxy curve
-> hash
-> PublicKey curve
-> Signature curve
-> msg
-> Bool

Verify a signature using hash and public key.

valueverifyDigest

:: (EllipticCurveECDSA curve, HashAlgorithm hash)
=> proxy curve
-> PublicKey curve
-> Signature curve
-> Digest hash
-> Bool

Verify a digest using hash and public key.

Deterministic nonces

3 declarations

valuedeterministicNonce

:: (EllipticCurveECDSA curve, HashAlgorithm hashDRG, HashAlgorithm hashDigest)
=> proxy curve
-> hashDRG
-> PrivateKey curve
-> Digest hashDigest
-> Scalar curve -> Maybe a
-> a

Truncate a digest based on curve order size. | Deterministic nonce generation according to RFC 6979.

The nonce is derived from the private key and the message alone, so a signature made this way needs no random number generator and cannot be the one that repeats a nonce -- which, for ECDSA, hands over the private key.

The hash used to seed the generator is given separately from the one the message was digested with, as RFC 6979 allows.

The last argument is what to do with a candidate nonce. It may answer Nothing, in which case another candidate is drawn, which is what signDigestDeterministic does for the r or s that comes out zero:

deterministicNonce prx SHA256 priv digest (\k -> signDigestWith prx k priv digest)

valuesignDeterministic

:: (EllipticCurveECDSA curve, HashAlgorithm hashDRG, HashAlgorithm hash, ByteArrayAccess msg)
=> proxy curve
-> hashDRG
-> PrivateKey curve
-> hash
-> msg
-> Signature curve

Sign a message with a nonce derived from the private key and the message, as RFC 6979 says, rather than from a random number generator.

valuesignDigestDeterministic

:: (EllipticCurveECDSA curve, HashAlgorithm hashDRG, HashAlgorithm hashDigest)
=> proxy curve
-> hashDRG
-> PrivateKey curve
-> Digest hashDigest
-> Signature curve

Sign a digest with a nonce derived from the private key and the digest, as RFC 6979 says, rather than from a random number generator.