Wai.CryptoCookie.Encryption

You will need to import this module if you are planning to define an Encryption scheme other than the defaults provided by this library.

Documentation

class (KnownNat (KeyLength e), Eq (Key e)) => Encryption (e :: k) where

Encryption method.

Associated Types

data Key e :: Type

Key used for encryption. You can obtain an initial random Key using genKey. As long as you have access to said Key, you will be able to decrypt data previously encrypted with it. For this reason, be sure to save and load the key using keyToBytes and keyFromBytes.

type KeyLength e :: Natural

Statically known Key length.

data Encrypt e :: Type

Encryption context used by encrypt.

data Decrypt e :: Type

Decryption context used by decrypt.

Methods

genKey :: MonadRandom m => m (Key e)

Generate a random encryption Key.

keyFromBytes :: ByteArrayAccess raw => raw -> Either String (Key e)

Load a Key from its bytes representation, if possible.

keyToBytes :: ByteArrayN (KeyLength e) raw => Key e -> raw

Dump the bytes representation of a Key.

initial :: MonadRandom m => Key e -> m (Encrypt e, Decrypt e)

Generate initial Encryption and Decryption context for a Key.

The Encryption context could carry for example the next randomly generated nonce to use for encryption, the Key itself or its derivative used during the actual encryption process, or a deterministic random number generator.

The Decryption context could carry for example the Key itself or its derivative used during the decryption process.

advance :: Encrypt e -> Encrypt e

After each encryption, the Encryption context will be automatically advanced through this function. For example, if your Encryption context carries a nonce or a deterministic random number generator, this is the place to update them.

encrypt :: Encrypt e -> ByteString -> ByteString

Encrypt a plaintext message according to the Encryption context.

decrypt :: Decrypt e -> ByteString -> Either String ByteString

Decrypt a message according to the Decryption context.

The String is for internal debugging purposes only.

Instances

Encryption "AEAD_AES_128_GCM_SIV"

AEAD_AES_128_GCM_SIV is a nonce-misuse resistant AEAD encryption scheme defined in RFC 8452.

Defined in Wai.CryptoCookie.Encryption.AEAD_AES_128_GCM_SIV

Associated Types

data Key "AEAD_AES_128_GCM_SIV"

type KeyLength "AEAD_AES_128_GCM_SIV" :: Natural

data Encrypt "AEAD_AES_128_GCM_SIV"

data Decrypt "AEAD_AES_128_GCM_SIV"

Methods

genKey :: MonadRandom m => m (Key "AEAD_AES_128_GCM_SIV")

keyFromBytes :: ByteArrayAccess raw => raw -> Either String (Key "AEAD_AES_128_GCM_SIV")

keyToBytes :: ByteArrayN (KeyLength "AEAD_AES_128_GCM_SIV") raw => Key "AEAD_AES_128_GCM_SIV" -> raw

initial :: MonadRandom m => Key "AEAD_AES_128_GCM_SIV" -> m (Encrypt "AEAD_AES_128_GCM_SIV", Decrypt "AEAD_AES_128_GCM_SIV")

advance :: Encrypt "AEAD_AES_128_GCM_SIV" -> Encrypt "AEAD_AES_128_GCM_SIV"

encrypt :: Encrypt "AEAD_AES_128_GCM_SIV" -> ByteString -> ByteString

decrypt :: Decrypt "AEAD_AES_128_GCM_SIV" -> ByteString -> Either String ByteString

Encryption "AEAD_AES_256_GCM_SIV"

AEAD_AES_256_GCM_SIV is a nonce-misuse resistant AEAD encryption scheme defined in RFC 8452.

Defined in Wai.CryptoCookie.Encryption.AEAD_AES_256_GCM_SIV

Associated Types

data Key "AEAD_AES_256_GCM_SIV"

type KeyLength "AEAD_AES_256_GCM_SIV" :: Natural

data Encrypt "AEAD_AES_256_GCM_SIV"

data Decrypt "AEAD_AES_256_GCM_SIV"

Methods

genKey :: MonadRandom m => m (Key "AEAD_AES_256_GCM_SIV")

keyFromBytes :: ByteArrayAccess raw => raw -> Either String (Key "AEAD_AES_256_GCM_SIV")

keyToBytes :: ByteArrayN (KeyLength "AEAD_AES_256_GCM_SIV") raw => Key "AEAD_AES_256_GCM_SIV" -> raw

initial :: MonadRandom m => Key "AEAD_AES_256_GCM_SIV" -> m (Encrypt "AEAD_AES_256_GCM_SIV", Decrypt "AEAD_AES_256_GCM_SIV")

advance :: Encrypt "AEAD_AES_256_GCM_SIV" -> Encrypt "AEAD_AES_256_GCM_SIV"

encrypt :: Encrypt "AEAD_AES_256_GCM_SIV" -> ByteString -> ByteString

decrypt :: Decrypt "AEAD_AES_256_GCM_SIV" -> ByteString -> Either String ByteString

autoKeyFileBase16 :: forall e m. (Encryption e, MonadIO m) => FilePath -> m (Key e)

If the FilePath exists, then read the base-16 representation of a Key from it. Ignores trailing newlines.

Otherwise, generate a random new Key and write its base-16 representation in the FilePath.

Finally, return the Key.

readKeyFileBase16 :: forall e m. (Encryption e, MonadIO m) => FilePath -> m (Key e)

Read a base-16 encoded Key from a file. Ignores trailing newlines.

readKeyFile

Arguments

:: forall e m. (Encryption e, MonadIO m)

=> (ScrubbedBytes -> Either String ScrubbedBytes)

Convert the raw content of the file into input suitable for keyFromBytes.

-> FilePath

-> m (Key e)

Read a Key from a file.

writeKeyFile

Arguments

:: forall e m. (Encryption e, MonadIO m)

=> (SizedByteArray (KeyLength e) ScrubbedBytes -> ScrubbedBytes)

Convert the raw keyToBytes bytes to file contents.

-> FilePath

-> Key e

-> m ()

Save a key to a file.