HORIZON HASKELLDocslts/ghc-9.14.xb2f3bfd2026-10-11Search names, modules, packages, or :: a typeCtrl K

GHC 9.14.1 · lts/ghc-9.14.x · b2f3bfd · 2026-10-11

Modulecrypton-2.1.7Haskell2010

Crypto.ECC

Elliptic Curve Cryptography

Timing

Curve_P256R1 reaches a dedicated implementation whose scalar multiplication does not branch on the scalar. Curve_P384R1 and Curve_P521R1 do not: they are built on Crypto.ECC.Simple.Prim, whose scalar multiplication is a double-and-add over Integer and is documented there as vulnerable to timing attacks.

That matters wherever the scalar is secret, which is both operations that have one: ecdh, which multiplies by the private key, and ECDSA signing, which multiplies by the secret nonce. Verification and public-key derivation work on values an attacker already has, so they are unaffected.

Note also that Integer arithmetic is variable-time underneath, so no curve built on Crypto.ECC.Simple.Prim can be made constant-time without leaving it. Where that matters, use Curve_P256R1, Curve_X25519, Curve_X448 or Curve_Edwards25519.

  • 8 types
  • 4 classes
  • Packagecrypton-2.1.7
  • Exports12
  • LanguageHaskell2010
  • LicenceBSD-3-Clause AND MIT AND ISC
  • SourceECC.hs
datadata Curve_P256R1
#

P256 Curve

also known as P256

Curve_P256R1
Instances9Data, Show, EllipticCurve, EllipticCurveArith, EllipticCurveBasepointArith, EllipticCurveDH, …
datadata Curve_P384R1
#

NIST P-384.

Scalar multiplication branches on the scalar; see the note on timing at the head of this module.

Curve_P384R1
Instances9Data, Show, EllipticCurve, EllipticCurveArith, EllipticCurveBasepointArith, EllipticCurveDH, …
datadata Curve_P521R1
#

NIST P-521.

Scalar multiplication branches on the scalar; see the note on timing at the head of this module.

Curve_P521R1
Instances9Data, Show, EllipticCurve, EllipticCurveArith, EllipticCurveBasepointArith, EllipticCurveDH, …
datadata Curve_Edwards25519
#
Curve_Edwards25519
Instances9Data, Show, EllipticCurve, EllipticCurveArith, EllipticCurveBasepointArith, EllipticCurveEdDSA, …
classclass EllipticCurve curve where
#

Associated types

  • type family Point curve

    Point on an Elliptic Curve

  • type family Scalar curve

    Scalar in the Elliptic Curve domain

Methods

Instances6EllipticCurve
classclass EllipticCurve curve => EllipticCurveDH curve where
#

Methods

  • ecdhRaw :: proxy curve -> Scalar curve -> Point curve -> SharedSecret

    Generate a Diffie hellman secret value.

    This is generally just the .x coordinate of the resulting point, that is not hashed.

    use pointSmul to keep the result in Point format.

    WARNING: Curve implementations may return a special value or an exception when the public point lies in a subgroup of small order. This function is adequate when the scalar is in expected range and contributory behaviour is not needed. Otherwise use ecdh.

  • ecdh :: proxy curve -> Scalar curve -> Point curve -> CryptoFailable SharedSecret

    Generate a Diffie hellman secret value and verify that the result is not the point at infinity.

    This additional test avoids risks existing with function ecdhRaw. Implementations always return a CryptoError instead of a special value or an exception.

Instances5EllipticCurveDH
classclass (EllipticCurve curve, Eq (Point curve)) => EllipticCurveArith curve where
#

Methods

Instances4EllipticCurveArith
classclass (EllipticCurveArith curve, Eq (Scalar curve)) => EllipticCurveBasepointArith curve where
#

Methods

Instances4EllipticCurveBasepointArith