úÎÕâNÿÛ      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrs t u v w x y z { | } ~  € ‚ ƒ „ … †‡ˆ‰Š‹Œ‘’“ ” • – — ˜ ™ š › œ Ÿ   ¡ ¢ £ ¤ ¥ ¦ § ¨ © ª « ¬ ­ ® ¯ ° ± ² ³ ´ µ ¶ · ¸ ¹ º » ¼ ½ ¾ ¿ À Á Â Ã Ä Å Æ Ç È É Ê Ë Ì Í Î Ï Ğ Ñ Ò Ó Ô Õ Ö × Ø Ù Ú Û Ü İ Ş ß à á â ã ä å æ ç è é ê ëìíîïğñòóôõö÷øùúûüışÿ      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰Š‹Œ‘’“”•–—˜™š›œŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏĞÑÒÓÔÕÖ×ØÙÚ!Safe ÛÜİŞßàáâãäÛáãä ÛÜİŞßàáâãäSafe0}The behaviour of the SSL library can be changed by setting several options. During a handshake, the option settings of the  object are used. When a new  object is created from a 4, the current option setting is copied. Changes to  do not affect already created  objects..As of OpenSSL 1.0.0 this option has no effect..As of OpenSSL 1.0.0 this option has no effect.;As of OpenSSL 0.9.8q and 1.0.0c, this option has no effect.Don't prefer ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. OS X 10.8..10.8.3 has broken support for ECDHE-ECDSA ciphers. ßDisables a countermeasure against a SSL 3.0/TLS 1.0 protocol vulnerability affecting CBC ciphers, which cannot be handled by some broken SSL implementations. This option has no effect for connections using other ciphers. !All of the above bug workarounds. *Disable version rollback attack detection.ÿ During the client key exchange, the client must send the same information about acceptable SSL/TLS protocol levels as during the first hello. Some clients violate this rule by adapting to the server's answer. (Example: the client sends a SSLv2 hello and accepts up to SSLv3.1=TLSv1, the server only understands up to SSLv3. In this case the client must still use the same SSLv3.1=TLSv1 announcement. Some clients step down to SSLv3 with respect to the server's answer and violate the version rollback protection.) ÿpAlways create a new key when using temporary/ephemeral DH parameters. This option must be used to prevent small subgroup attacks, when the DH parameters were not generated using "strong" primes (e.g. when using DSA-parameters). If "strong" primes were used, it is not strictly necessary to generate a new DH key during each handshake but it is also recommended.  R should therefore be enabled whenever temporary/ephemeral DH parameters are used.ÿAlways use ephemeral (temporary) RSA key when doing RSA operations. According to the specifications this is only done, when a RSA key can only be used for signature operations (namely under export ciphers with restricted RSA keylength). By setting this option, ephemeral RSA keys are always used. This option breaks compatibility with the SSL/TLS specifications and may lead to interoperability problems with clients and should therefore never be used. Ciphers with DHE (ephemeral Diffie-Hellman) key exchange should be used instead.ÿrWhen choosing a cipher, use the server's preferences instead of the client preferences. When not set, the SSL server will always follow the clients preferences. When set, the SSLv3/TLSv1 server will choose following its own preferences. Because of the different protocol, for SSLv2 the server will send its list of preferences to the client and the client chooses.ÈIf we accept a netscape connection, demand a client cert, have a non-self-signed CA which does not have its CA in netscape, and the browser has a cert, it will crash/hang. Works for 3.x and 4.xbetaDo not use the SSLv2 protocol.Do not use the SSLv3 protocol.Do not use the TLSv1 protocol.¿When performing renegotiation as a server, always start a new session (i.e., session resumption requests are only accepted in the initial handshake). This option is not needed for clients.ONormally clients and servers will, where possible, transparently make use of  "http://tools.ietf.org/html/rfc4507RFC 4507+ tickets for stateless session resumption.iIf this option is set this functionality is disabled and tickets will not be used by clients or servers.\Allow legacy insecure renegotiation between OpenSSL and unpatched clients or servers. See  Nhttps://www.openssl.org/docs/ssl/SSL_CTX_set_options.html#secure_renegotiationSECURE RENEGOTIATION for more details.XAllow legacy insecure renegotiation between OpenSSL and unpatched servers _only_. See  Nhttps://www.openssl.org/docs/ssl/SSL_CTX_set_options.html#secure_renegotiationSECURE RENEGOTIATION for more details. å å åSafeæçèéêëìíîïğñòóôæçèéêô æçèéêëìíîïğñòóôNone strµ lazilly encodes a stream of data to Base64. The string doesn't have to be finite. Note that the string must not contain any letters which aren't in the range of U+0000 - U+00FF. bs, strictly encodes a chunk of data to Base64. lbsS lazilly encodes a stream of data to Base64. The string doesn't have to be finite. strU lazilly decodes a stream of data from Base64. The string doesn't have to be finite. bs/ strictly decodes a chunk of data from Base64.   lbsU lazilly decodes a stream of data from Base64. The string doesn't have to be finite. õö÷øù   õö÷øù SafeúûüıûüıúûüıSafeş"Convert an integer to a hex stringÿ"Convert a hex string to an integerşÿşÿşÿNone !Instances of class !% can be converted back and forth to '."Wrap the key (i.g. RSA) into &.#"Extract the concrete key from the & . Returns  if the type mismatches.$Do the same as EVP_PKEY_size().%3Return the default digesting algorithm for the key.'VaguePKey is a  to &P, that is either public key or a ker pair. We can't tell which at compile time.0DigestE is an opaque object that represents an algorithm of message digest.2 CryptoMode represents instruction to cipher and such like.9CipherG is an opaque object that represents an algorithm of symmetric cipher.S!"#$%&'()*+,-./0123456789:     ;<=>? @AkeyIVBCDEF!G"HIJKL#M$NOPQRSTUV6!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUV69:8;<675=>?234@ABCDE01/F-.,GHIJKL*+)MNOP'(&!"#$%RQSTUVG!"#$%&'()*+,-./0123456789:     ;<=>? @ABCDEF!G"HIJKL#M$NOPQRSTUVNoneWW name5 returns a symmetric cipher algorithm whose name is name-. If no algorithms are found, the result is Nothing.XX8 returns a list of name of symmetric cipher algorithms.YEEncrypt a lazy bytestring in a strict manner. Does not leak the keys.ZZh lazilly encrypts or decrypts a stream of data. The input string doesn't necessarily have to be finite.[[/ strictly encrypts or decrypts a chunk of data.\\h lazilly encrypts or decrypts a stream of data. The input string doesn't necessarily have to be finite.%WXYCipherKeyIVEncrypt/DecryptInputZalgorithm to use symmetric keyIV operationŒAn input string to encrypt/decrypt. Note that the string must not contain any letters which aren't in the range of U+0000 - U+00FF.the result string[algorithm to use symmetric keyIV operationinput string to encrypt/decryptthe result string\algorithm to use symmetric keyIV operationinput string to encrypt/decryptthe result string 2349WXYZ[\ 9WX234Z[\Y%WXYZ[\None]] name3 returns a message digest algorithm whose name is name-. If no algorithms are found, the result is Nothing.^^6 returns a list of name of message digest algorithms.__r digests a stream of data. The string must not contain any letters which aren't in the range of U+0000 - U+00FF.`` digests a chunk of data.aa digests a stream of data.bGPerform a private key signing using the HMAC template with a given hashdACalculate a PKCS5-PBKDF2 SHA1-HMAC suitable for password hashing. &'(]^_`ab0the hash function to use in the HMAC calculation the HMAC keythe data to be signedresulting HMACcdpasswordsalt iterationsdestination key lengthdestination key 0]^_`abcd 0]^_`abcd &'(]^_`abcdSafeeNReturn a bytestring consisting of the given number of strongly random bytesfLReturn a bytestring consisting of the given number of pseudo random bytesg¨Add data to the entropy pool. It's safe to add sensitive information (e.g. user passwords etc) to the pool. Also, adding data with an entropy of 0 can never hurt.)*+ethe number of bytes requestedfthe number of bytes requestedg#random data to be added to the pool3the number of bits of entropy in the first argumentefgefg)*+efg Safeh,i-./01234567 hi.01234567 h,i-./01234567Nonen<Construct a new context which holds the key schedule and IV.ooEncrypt some number of blocks using CBC. This is an IO function because the context is destructivly updated.psEncrypt some number of bytes using CTR mode. This is an IO function because the context is destructivly updated.j89klm:;<=>?@An)For CTR mode, this must always be EncryptKey: 128, 192 or 256 bits longIV: 16 bytes longocontext0input, must be multiple of block size (16 bytes)pcontextinput, any number of bytesjklmnopklmjnopj89klm:;<=>?@Anop None Btt/ is an opaque object representing a big number.uu f allocates a t and computes f. Then it frees the t.xConvert a BIGNUM to an IntegerynThis is a GHC specific, fast conversion between Integers and OpenSSL bignums. It returns a malloced BigNum.zz n f converts n to a t and computes f. Then it frees the t.{This is an alias to x.|This is an alias to y.BªConvert a BigNum to an MPI: a serialisation of large ints which has a 4-byte, big endian length followed by the bytes of the number in most-significant-first order.CCConvert an MPI into a BigNum. See bnToMPI for details of the format}8Convert an Integer to an MPI. See bnToMPI for the format~8Convert an MPI to an Integer. See bnToMPI for the format a p m computes a to the p-th power modulo m.€hReturn a strongly random number in the range 0 <= x < n where the given filter function returns true._Return a random number in the range 0 <= x < n where the given filter function returns true.‚7Return a strongly random number in the range 0 <= x < nƒ6Return a strongly random number in the range 0 < x < n„.Return a random number in the range 0 <= x < n…-Return a random number in the range 0 < x < n*DEFGHIstJKLMNOPQRSTUuvwVWxyz{|BC}~X€a filter functionone plus the upper limita filter functionone plus the upper limit‚ƒ„…stuvwxyz{|}~€‚ƒ„…tsuz|wv{yx}~€‚„ƒ…'DEFGHIstJKLMNOPQRSTUuvwVWxyz{|BC}~X€‚ƒ„…None‰‰ gen n generates n-bit long DH parameters.Š#Get DH parameters length (in bits).‹&Check that DH parameters are coherent.ŒHThe first step of a key exchange. Public and private keys are generated.!Get parameters of a key exchange.Get the public key.:Compute the shared key using the other party's public key.†‡ˆYZ[\]^_`‰Š‹Œ hi†‡ˆ‰Š‹Œ ih†‡ˆ‰Š‹Œ†‡ˆYZ[\]^_`‰Š‹Œ None0““ a is either  or .”Return the length of key.•*Return the public prime number of the key.–$Return the public 160-bit subprime,  q | p - 1 of the key.—3Return the public generator of subgroup of the key.˜Return the public key y = g^x.KThe type of a DSA keypair, includes parameters p, q, g, public and private.EThe type of a DSA public key, includes parameters p, q, g and public.Ÿ¾Generate DSA parameters (*not* a key, but required for a key). This is a compute intensive operation. See FIPS 186-2, app 2. This agrees with the test vectors given in FIP 186-2, app 5 2Generate a new DSA keypair, given valid parameters¡Return the private key x.¢YConvert a DSAPubKey object to a tuple of its members in the order p, q, g, and public.£bConvert a DSAKeyPair object to a tuple of its members in the order p, q, g, public and private.¤:Convert a tuple of members (in the same format as from ¢) into a DSAPubKey object¥:Convert a tuple of members (in the same format as from ¢) into a DSAPubKey object¦A utility function to generate both the parameters and the key pair at the same time. Saves serialising and deserialising the parameters too§¦Sign pre-digested data. The DSA specs call for SHA1 to be used so, if you use anything else, YMMV. Returns a pair of Integers which, together, are the signature¨+Verify pre-digested data given a signature.4“”•–—˜™š›œabcdefghijklmnopqrstuvŸ;The number of bits in the generated prime: 512 <= x <= 1024*optional seed, its length must be 20 bytes+(iteration count, generator count, p, q, g) pqg¡¢£¤¥¦;The number of bits in the generated prime: 512 <= x <= 1024*optional seed, its length must be 20 bytes§¨©ª«¬­®¯°“”™•–—˜š›œŸ ¡¢£¤¥¦§¨“”•–—˜™š›œŸ ¦§¨¡¢£¤¥*“”•–—˜™š›œabcdefghijklmnopqrstuvŸ ¡¢£¤¥¦§¨©ª«¬­®¯° None0±±T represents a callback function to get informed the progress of RSA key generation. callback 0 i is called after generating the i-th potential prime number.0While the number is being tested for primality,  callback 1 j is called after the j-th iteration (j = 0, 1, ...). When the nI-th randomly generated prime is rejected as not suitable for the key,  callback 2 n is called.When a random p has been found with p-1 relatively prime to e, it is called as  callback 3 0.'The process is then repeated for prime q with  callback 3 1.²² a is either » or º.³³ key returns the length of key.´´ key' returns the public modulus of the key.µµ key( returns the public exponent of the key.ºº1 is an opaque object that represents RSA keypair.»»4 is an opaque object that represents RSA public key.¼6Make a copy of the public parameters of the given key.¾¾ generates an RSA keypair.¿A simplified alternative to ¾ÀÀ privKey) returns the private exponent of the key.ÁÁ privkey! returns the secret prime factor p of the key. privkey! returns the secret prime factor q of the key.Ãà privkey returns  d mod (p-1) of the key.ÄÄ privkey returns  d mod (q-1) of the key.ÅÅ privkey returns  q^-1 mod p of the key.1w±²³´µ¶·¸¹ºx»yz{|}~€¼½¾LThe number of bits of the public modulus (i.e. key size). Key sizes with  n < 1024 should be considered insecure.FThe public exponent. It is an odd number, typically 3, 17 or 65537.A callback function.The generated keypair.¿LThe number of bits of the public modulus (i.e. key size). Key sizes with  n < 1024 should be considered insecure.FThe public exponent. It is an odd number, typically 3, 17 or 65537.The generated keypair.‚ƒ„…†‡ˆ‰ŠÀÁÂÃÄÅÆÇÈÉÊËÌͱ²¸¶³´µ·¹º»¼½¾¿ÀÁÂÃÄŲ³´µ¶·¸»º¹±¾¿ÀÁÂÃÄż½)w±²³´µ¶·¸¹ºx»yz{|}~€¼½¾¿‚ƒ„…†‡ˆ‰ŠÀÁÂÃÄÅÆÇÈÉÊËÌÍ None‹<Generate a function that decodes a key from ASN.1 DER formatŒ:Generate a function that encodes a key in ASN.1 DER formatÎ%Dump a public key to ASN.1 DER formatÏ(Parse a public key from ASN.1 DER formatĞ&Dump a private key to ASN.1 DER formatÑ)Parse a private key from ASN.1 DER format ‘’‹ŒÎYou can pass either » or º3 because both contain the necessary information./The public key information encoded in ASN.1 DERÏĞÑ0The private key information encoded in ASN.1 DERThis can return either » or º4 because there s sufficient information for both.ÎÏĞÑÎÏĞÑ ‘’‹ŒÎÏĞÑ None0AOTÒqThis is an opaque type to hold an arbitrary keypair in it. The actual key type can be safelly type-casted using Ö.ÓtThis is an opaque type to hold an arbitrary public key in it. The actual key type can be safelly type-casted using Ù.ÔNInstances of this class has both of public and private portions of a keypair.Õ0Wrap an arbitrary keypair into polymorphic type Ò.ÖCast from the polymorphic type Ò to the concrete type. Return  if failed.×pInstances of this class has at least public portion of a keypair. They might or might not have the private key.Ø4Wrap an arbitrary public key into polymorphic type Ó.ÙCast from the polymorphic type Ó to the concrete type. Return  if failed.&Ò“Ó”ÔÕÖ×ØÙ•–—˜™š›œŸÚÛÜİŞßàáâãäåæçèéêÒÓÔÕÖ×ØÙ×ØÙÔÕÖÓÒ Ò“Ó”ÔÕÖ×ØÙ•–—˜™š›œŸÚÛÜİŞßàáâãäåæçèéêNoneëë\ lazilly decrypts a stream of data. The input string doesn't necessarily have to be finite.ìì decrypts a chunk of data.íí\ lazilly decrypts a stream of data. The input string doesn't necessarily have to be finite. ¡ë!symmetric cipher algorithm to use3encrypted symmetric key to decrypt the input stringIV(private key to decrypt the symmetric keyinput string to decryptdecrypted stringì!symmetric cipher algorithm to use3encrypted symmetric key to decrypt the input stringIV(private key to decrypt the symmetric keyinput string to decryptdecrypted stringí!symmetric cipher algorithm to use3encrypted symmetric key to decrypt the input stringIV(private key to decrypt the symmetric keyinput string to decryptdecrypted stringëìíëìí ¡ëìíNoneîî\ lazilly encrypts a stream of data. The input string doesn't necessarily have to be finite.ïï# strictly encrypts a chunk of data.ğğ\ lazilly encrypts a stream of data. The input string doesn't necessarily have to be finite.¢£î!symmetric cipher algorithm to useÿA list of public keys to encrypt a symmetric key. At least one public key must be supplied. If two or more keys are given, the symmetric key are encrypted by each public keys so that any of the corresponding private keys can decrypt the message.input string to encrypt:(encrypted string, list of encrypted asymmetric keys, IV)ï!symmetric cipher algorithm to use1list of public keys to encrypt a symmetric keyinput string to encrypt:(encrypted string, list of encrypted asymmetric keys, IV)ğ!symmetric cipher algorithm to use1list of public keys to encrypt a symmetric keyinput string to encrypt:(encrypted string, list of encrypted asymmetric keys, IV)îïğîïğ¢£îïğNoneññ… generates a signature from a stream of data. The string must not contain any letters which aren't in the range of U+0000 - U+00FF.òò, generates a signature from a chunk of data.óó- generates a signature from a stream of data.¤¥ñmessage digest algorithm to use&private key to sign the message digest input stringthe result signatureòmessage digest algorithm to use&private key to sign the message digest input stringthe result signatureómessage digest algorithm to use&private key to sign the message digest input stringthe result signatureñòóñòó¤¥ñòóNone0ôô% represents a result of verification.÷÷ƒ verifies a signature and a stream of data. The string must not contain any letters which aren't in the range of U+0000 - U+00FF.øø* verifies a signature and a chunk of data.ùù* verifies a signature of a stream of data.ôõö¦§÷message digest algorithm to usemessage signature"public key to verify the signatureinput string to verifythe result of verificationømessage digest algorithm to usemessage signature"public key to verify the signatureinput string to verifythe result of verificationùmessage digest algorithm to usemessage signature"public key to verify the signatureinput string to verifythe result of verificationôõö÷øùôõö÷øùôõö¦§÷øù!None¨BIO is a  ForeignPtr= to an opaque BIO object. They are created by newXXX actions.©Computation of © a b connects b behind a.Example: ÿÿdo b64 <- newBase64 True mem <- newMem bioPush b64 mem -- Encode some text in Base64 and write the result to the -- memory buffer. bioWrite b64 "Hello, world!" bioFlush b64 -- Then dump the memory buffer. bioRead mem >>= putStrLnªa ª b is an alias to © a b.«a « b is an alias to © b a.¬¬ [bio1, bio2, ..] connects many BIOs at once.­­ bio‚ normally writes out any internally buffered data, in some cases it is used to signal EOF and that no more data will be written.®® bio. typically resets a BIO to some initial state.¯¯ bio returns 1 if bioL has read EOF, the precise meaning of EOF varies according to the BIO type.°° bio lazily reads all data in bio.±± bio len attempts to read len bytes from bioK, then return a ByteString. The actual length of result may be less than len.²² bio lazily reads all data in bio , then return a LazyByteString.³³ bio len2 normally attempts to read one line of data from bio of maximum length len5. There are exceptions to this however, for example ³V on a digest BIO will calculate and return the digest and other BIOs may not support ³ at all.´´ does the same as ³ but returns ByteString.µµ does the same as ³ but returns LazyByteString.¶¶ bio str lazily writes entire str to bio4. The string doesn't necessarily have to be finite.·· bio bs writes bs to bio.¸¸ bio lbs lazily writes entire lbs to bio4. The string doesn't necessarily have to be finite.¹¹ noNLŠ creates a Base64 BIO filter. This is a filter bio that base64 encodes any data written through it and decodes any data read through it.If noNLf flag is True, the filter encodes the data all on one line or expects the data to be all on one line.Base64 BIOs do not support ³.­ on a Base64 BIO that is being written through is used to signal that no more data is to be encoded: this is used to flush the final block through the BIO.ºº mBufSizeË creates a buffering BIO filter. Data written to a buffering BIO is buffered and periodically written to the next BIO in the chain. Data read from a buffering BIO comes from the next BIO in the chain.Buffering BIOs support ³.Calling ®- on a buffering BIO clears any buffered data.ÿ|Question: When I created a BIO chain like this and attempted to read from the buf, the buffering BIO weirdly behaved: BIO_read() returned nothing, but both BIO_eof() and BIO_should_retry() returned zero. I tried to examine the source code of crypto/bio/bf_buff.c but it was too complicated to understand. Does anyone know why this happens? The version of OpenSSL was 0.9.7l. ¶main = withOpenSSL $ do mem <- newConstMem "Hello, world!" buf <- newBuffer Nothing mem ==> buf bioRead buf >>= putStrLn -- This fails, but why?4I am being depressed for this unaccountable failure.»»» creates a memory BIO sink/source. Any data written to a memory BIO can be recalled by reading from it. Unless the memory BIO is read only any data read from it is deleted from the BIO.Memory BIOs support ³.Calling ®› on a read write memory BIO clears any data in it. On a read only BIO it restores the BIO to its original state and the read only data can be read again.¯" is true if no data is in the BIO.ÿ>Every read from a read write memory BIO will remove the data just read with an internal copy operation, if a BIO contains a lots of data and it is read in small chunks the operation can be very slow. The use of a read only memory BIO avoids this problem. If the BIO must be read write then adding a buffering BIO (º*) to the chain will speed up the process.¼¼ str' creates a read-only memory BIO source.½½ bs is like ¼ but takes a ByteString.¾¾ lbs is like ¼ but takes a LazyByteString.¿¿_ creates a null BIO sink/source. Data written to the null sink is discarded, reads return EOF.ÿA null sink is useful if, for example, an application wishes to digest some data by writing through a digest bio but not send the digested data anywhere. Since a BIO chain must normally include a source/sink BIO this can be achieved by adding a null sink BIO to the end of the chain.3À¨ÁÂÃÄÅÆÇÈÉÊËÌÍÎÏĞÑÒÓÔÕÖ×Ø©ª«¬ÙÚ­®¯°±²³´µ¶·¸¹ºExplicit buffer size (Just n) or the default size (Nothing).»¼½¾¿À¨Ö×Ø©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿2À¨ÁÂÃÄÅÆÇÈÉÊËÌÍÎÏĞÑÒÓÔÕÖ×Ø©ª«¬ÙÚ­®¯°±²³´µ¶·¸¹º»¼½¾¿"NoneÛÜİŞßàáâãäåæçèéêëìíîïğñò ÛÜİŞéêëìíïğòÛÜİŞßàáâãäåæçèéêëìíîïğñò#None óôõö÷øùúûüışôüış óôõö÷øùúûüışNoneıı7 is an opaque object that represents X.509 certificate.şşZ creates an empty certificate. You must set the following properties to and sign it (see #) to actually use the certificate. VersionSee  . Serial numberSee  . Issuer nameSee . Subject nameSee .ValiditySee  and . Public KeySee . cert+ writes an X.509 certificate to DER string. der reads in a certificate. cert1 cert2 compares two certificates.0 signs a certificate with an issuer private key.@ verifies a signature of certificate with an issuer public key.   cert6 translates a certificate into human-readable format.   certg returns the version number of certificate. It seems the number is 0-origin: version 2 means X.509 v3.   cert ver+ updates the version number of certificate.   cert* returns the serial number of certificate.   cert num+ updates the serial number of certificate.( returns the issuer name of certificate. cert namel updates the issuer name of certificate. Keys of each parts may be of either long form or short form. See . cert wantLongName/ returns the subject name of certificate. See . cert name/ updates the subject name of certificate. See . cert; returns the time when the certificate begins to be valid. cert utc; updates the time when the certificate begins to be valid. cert0 returns the time when the certificate expires. cert utc0 updates the time when the certificate expires. cert7 returns the public key of the subject of certificate. cert pubkey7 updates the public key of the subject of certificate. cert; returns every subject email addresses in the certificate.8üıÿ     şÿThe certificate to be signed.The private key to sign with.A hashing algorithm to use. If NothingE the most suitable algorithm for the key is automatically used.The certificate to be verified.The public key to verify with.     The certificate to examine.TrueU if you want the keys of each parts to be of long form (e.g. "commonName"), or False if you don't (e.g. "CN").%Pairs of key and value, for example 0(\"C\", \"JP\"), (\"ST\", \"Some-State\"), ....üışÿ     ıüşÿ     7üıÿ     şÿ     NoneB is an opaque object that represents PKCS#10 certificate request.b creates an empty certificate request. You must set the following properties to and sign it (see +) to actually use the certificate request. VersionSee #. Subject NameSee %. Public KeySee '.9 signs a certificate request with a subject private key.H verifies a signature of certificate request with a subject public key.   req> translates a certificate request into human-readable format.!! req4 writes a PKCS#10 certificate request to DER string."" req4 returns the version number of certificate request.## req ver4 updates the version number of certificate request.$$ req wantLongName7 returns the subject name of certificate request. See $ of  OpenSSL.X509.%% req name7 updates the subject name of certificate request. See % of  OpenSSL.X509.&& req? returns the public key of the subject of certificate request.'' req? updates the public key of the subject of certificate request.( ( req [(nid, str)]E.g., nid 85 = subjectAltName Ahttp://osxr.org:8080/openssl/source/crypto/objects/objects.h#0476(TODO: more docs; NID type))) req certÖ creates an empty X.509 certificate and copies as much data from the request as possible. The resulting certificate doesn't have the following data and it isn't signed so you must fill them and sign it yourself. Serial number#Validity (Not Before and Not After)Example: ÿimport Data.Time.Clock genCert :: X509 -> EvpPKey -> Integer -> Int -> X509Req -> IO X509 genCert caCert caKey serial days req = do cert <- makeX509FromReq req caCert now <- getCurrentTime setSerialNumber cert serial setNotBefore cert $ addUTCTime (-1) now setNotAfter cert $ addUTCTime (days * 24 * 60 * 60) now signX509 cert caKey Nothing return cert! !"#$%&'()The request to be signed.The private key to sign with."A hashing algorithm to use. If NothingB the most suitable algorithm for the key is automatically used.The request to be verified.The public key to verify with. !"#$%&'() !"#$%&'() !)"#$%&'(  !"#$%&'() !"#$%&'()None0**Æ represents a revoked certificate in a list. Each certificates are supposed to be distinguishable by issuer name and serial number, so it is sufficient to have only serial number on each entries.//B is an opaque object that represents Certificate Revocation List.00^ creates an empty revocation list. You must set the following properties to and sign it (see 3u) to actually use the revocation list. If you have any certificates to be listed, you must of course add them (see ?) before signing the list. VersionSee 7. Last UpdateSee 9. Next UpdateSee ;. Issuer NameSee =.334 signs a revocation list with an issuer private key.44D verifies a signature of revocation list with an issuer public key.55: translates a revocation list into human-readable format.66 crl/ returns the version number of revocation list.77 crl ver0 updates the version number of revocation list.88 crlB returns the time when the revocation list has last been updated.99 crl utcB updates the time when the revocation list has last been updated.:: crlA returns the time when the revocation list will next be updated.;; crl utcA updates the time when the revocation list will next be updated.<< crl wantLongName2 returns the issuer name of revocation list. See & of  OpenSSL.X509.== crl name2 updates the issuer name of revocation list. See ' of  OpenSSL.X509.>> crl* returns the list of revoked certificates.?? crl revoked- add the certificate to the revocation list.@@ crl serial' looks up the corresponding revocation.AA crl/ sorts the certificates in the revocation list.3*+,-*./+,-./0123456789:;<=>?@0123!The revocation list to be signed.The private key to sign with.A hashing algorithm to use. If NothingE the most suitable algorithm for the key is automatically used.456789:;<=>ABCD?@A*+,-./0123456789:;<=>?@A/.*+,-012345A6789:;<=>?@/*+,-*./+,-./0123456789:;<=>?@0123456789:;<=>ABCD?@ANoneGG} is an opaque object that represents X.509 certificate store. The certificate store is usually used for chain verification.HH* creates an empty X.509 certificate store.KK store cert adds a certificate to store.LL store crl! adds a revocation list to store.DEEFGFGHIJKLMNOPHIJKLMNOPQRDEFGHIJKLMNOPQRGFHIJKLDEMNOPQRDEEFGFGHIJKLMNOPHIJKLMNOPQRNone0 SS2 represents a result of PKCS#7 verification. See h.TDNothing if the PKCS#7 signature was a detached signature, and  Just content if it wasn't.VVG is a set of flags that are used in many operations related to PKCS#7.ddÎ represents an abstract PKCS#7 structure. The concrete type of structure is hidden in the object: such polymorphism isn't very haskellish but please get it out of your mind since OpenSSL is written in C.gg' creates a PKCS#7 signedData structure.hh( verifies a PKCS#7 signedData structure.ii* creates a PKCS#7 envelopedData structure.jj7 decrypts content from PKCS#7 envelopedData structure.kk+ writes PKCS#7 structure to S/MIME message.ll parses S/MIME message.,STUVWXYZ[\]^_`abcdQRSTUVWXYZ[ef\]gcertificate to sign withcorresponding private keyƒoptional additional set of certificates to include in the PKCS#7 structure (for example any intermediate CAs in the chain)data to be signedAn optional set of flags: WZMany S/MIME clients expect the signed content to include valid MIME headers. If the WS flag is set MIME headers for type "text/plain" are prepended to the data.XIf Xÿ> is set the signer's certificate will not be included in the PKCS#7 structure, the signer's certificate must still be supplied in the parameter though. This can reduce the size of the signature if the signer's certificate can be obtained by other means: for example a previously signed message.]HThe data being signed is included in the PKCS#7 structure, unless ]› is set in which case it is ommited. This is used for PKCS#7 detached signatures which are used in S/MIME plaintext signed message for example.^…Normally the supplied content is translated into MIME canonical format (as required by the S/MIME specifications) but if ^™ is set no translation occurs. This option should be uesd if the supplied data is in binary format otherwise the translation will corrupt it._`×The signedData structure includes several PKCS#7 authenticatedAttributes including the signing time, the PKCS#7 content type and the supported list of ciphers in an SMIMECapabilities attribute. If _… is set then no authenticatedAttributes will be used. If Pkcs7NoSmimeCap is set then just the SMIMECapabilities are omitted.^hA PKCS#7 structure to verify.JSet of certificates in which to search for the signer's certificate.;Trusted certificate store (used for chain verification).aSigned data if the content is not present in the PKCS#7 structure (that is it is detached).An optional set of flags: [If [È is set the certificates in the message itself are not searched when locating the signer's certificate. This means that all the signers certificates must be in the second argument ([ı]).WIf the W¢ flag is set MIME headers for type "text/plain" are deleted from the content. If the content is not of type "text/plain" then an error is returned.\If \? is set the signer's certificates are not chain verified.ZIf Zß is set then the certificates contained in the message are not used as untrusted CAs. This means that the whole verify chain (apart from the signer's certificate) must be contained in the trusted store.YIf Y> is set then the signatures on the data are not checked._i!A list of recipient certificates.The content to be encrypted.The symmetric cipher to use.An optional set of flags: WIf the WS flag is set MIME headers for type "text/plain" are prepended to the data.^Normally the supplied content is translated into MIME canonical format (as required by the S/MIME specifications) if ^ is set no translation occurs. This option should be used if the supplied data is in binary format otherwise the translation will corrupt it. If ^ is set then W is ignored.`j The PKCS#7 structure to decrypt.!The private key of the recipient.The recipient's certificate.An optional set of flags: WIf the W  flag is set MIME headers for type "text/plain" are deleted from the content. If the content is not of type "text/plain" then an error is thrown.The decrypted content.k!A PKCS#7 structure to be written.gIf cleartext signing (multipart/signed) is being used then the signed data must be supplied here.An optional set of flags: ]If ]h is set then cleartext signing will be used, this option only makes sense for signedData where ] is also set when g is also called.WIf the Wo flag is set MIME headers for type "text/plain" are added to the content, this only makes sense if ] is also set.The result S/MIME message.alThe message to be read.!(The result PKCS#7 structure,  Just content@ if the PKCS#7 structure was a cleartext signature and Nothing if it wasn't.)bSTUVWXYZ[\]^_`abcdefghijkldcVWXYZ[\]^_`abSTUefghijklSTUV WXYZ[\]^_`abcdQRSTUVWXYZ[ef\]g^h_i`jkalbNoneqq3 represents format of PKCS#10 certificate request.r=The new format, whose header is "NEW CERTIFICATE REQUEST".s9The old format, whose header is "CERTIFICATE REQUEST".tt% represents a way to supply password.FIXME: using PwTTY causes an error but I don't know why: "error:0906406D:PEM routines:DEF_CALLBACK:problems getting password"u no passwordvpassword in a static stringw password in a static bytestring.x%get a password by a callbackyread a password from TTYzz represents a context of }.{LThe callback was called to get a password to read something encrypted.|EThe callback was called to get a password to encrypt something.}}6 represents a callback function to supply a password. Int2The maximum length of the password to be accepted.PemPasswordRWState The context. IO StringThe resulting password.~~6 writes a private key to PEM string in PKCS#8 format. pem supply# reads a private key in PEM string.€€ pubkey writes a public to PEM string. pem" reads a public key in PEM string.‚‚ cert+ writes an X.509 certificate to PEM string.ƒƒ pem* reads an X.509 certificate in PEM string.„„5 writes a PKCS#10 certificate request to PEM string.……3 reads a PKCS#10 certificate request in PEM string.†† crl5 writes a Certificate Revocation List to PEM string.‡‡ pem3 reads a Certificate Revocation List in PEM string.ˆˆ p7) writes a PKCS#7 structure to PEM string.‰‰ pem( reads a PKCS#7 structure in PEM string.ŠŠ dh$ writes DH parameters to PEM string.‹‹ pem# reads DH parameters in PEM string.>qrstuvwxyz{|c}defghijklmnopqrstuvw~private key to write>Either (symmetric cipher algorithm, password supply) or Nothing. If Nothing1 is given the private key is not encrypted.the result PEM stringxy€z{‚|ƒ}„requestformatthe result PEM string~…†€‡ˆ‚‰ƒŠ„‹…qrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰Š‹}z{|tuvwxy~€‚ƒqrs„…†‡ˆ‰Š‹5qrstuvwxyz{|c}defghijklmnopqrstuvw~xy€z{‚|ƒ}„~…†€‡ˆ‚‰ƒŠ„‹…None#0234AT:ŒAA failure in the SSL library occurred, usually a protocol error.WThe peer uncleanly terminated the connection without sending the "close notify" alert./The root exception type for all SSL exceptions.‘"wait for the peer to also shutdown’only send our shutdown“¿This is the type of an SSL IO operation. Errors are handled by exceptions while everything else is one of these. Note that reading from an SSL socket can result in WantWrite and vice versa.”operation finished successfully• needs more data from the network– needs more outgoing buffer space—%This is the type of an SSL connectionÿ IO with SSL objects is non-blocking and many SSL functions return a error code which signifies that it needs to read or write more data. We handle these calls and call threadWaitRead and threadWaitWrite at the correct times. Thus multiple OS threads can be blocked™ inside IO in the same SSL object at a time, because they aren't really in the SSL object, they are waiting for the RTS to wake the Haskell thread.˜Get the underlying socket Fd™+Get the socket underlying an SSL connection›See 7http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.htmlis a certificate requiredŸ only request once per connection optional callback¡ÿbAn SSL context. Contexts carry configuration such as a server's private key, root CA certiifcates etc. Contexts are stateful IO objects; they start empty and various options are set on them by the functions in this module. Note that an empty context will pretty much cause any operation to fail since it doesn't even have any ciphers enabled.£Create a new SSL context.¤XRun the given action with the raw context pointer and obtain the lock while doing so.¥%Add a protocol option to the context.¦*Remove a protocol option from the context.§%Install a private key into a context.¨2Install a certificate (public key) into a context.©ĞInstall a private key file in a context. The key is given as a path to the file which contains the key. The file is parsed first as PEM and, if that fails, as ASN1. If both fail, an exception is raised.ªİInstall a certificate (public key) file in a context. The key is given as a path to the file which contains the key. The file is parsed first as PEM and, if that fails, as ASN1. If both fail, an exception is raised.«ÿInstall a certificate chain in a context. The certificates must be in PEM format and must be sorted starting with the subject's certificate (actual client or server certificate), followed by intermediate CA certificates if applicable, and ending at the highest level (root) CA.¬~Set the ciphers to be used by the given context. The string argument is a list of ciphers, comma separated, as given at -http://www.openssl.org/docs/apps/ciphers.htmlhUnrecognised ciphers are ignored. If no ciphers from the list are recognised, an exception is raised.®iReturn true iff the private key installed in the given context matches the certificate also installed.°mSet the location of a PEM encoded list of CA certificates to be used when verifying a server's certificate±nSet the path to a directory which contains the PEM encoded CA root certificates. This is an alternative to ° . See  Bhttp://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html) for details of the file naming scheme²WGet a reference to, not a copy of, the X.509 certificate storage in the SSL context.³ÿWrap a Socket in an SSL connection. Reading and writing to the Socket after this will cause weird errors in the SSL code. The SSL object carries a handle to the Socket so you need not worry about the garbage collector closing the file descriptor out from under you.´&Wrap a socket Fd in an SSL connection.µDRun continuation with exclusive access to the underlying SSL object.¶,Add a protocol option to the SSL connection.·1Remove a protocol option from the SSL connection.¸.Set host name for Server Name Indication (SNI)†&Block until the operation is finished.‡¡Perform an SSL operation which can return non-blocking error codes, thus requesting that the operation be performed when data or buffer space is availible.¹Perform an SSL server handshakeº7Try to perform an SSL server handshake without blocking»Perform an SSL client handshake¼7Try to perform an SSL client handshake without blockingˆºPerform an SSL operation which operates of a buffer and can return non-blocking error codes, thus requesting that it be performed again when more data or buffer space is available.ÿYNote that these SSL functions generally require that the arguments to the repeated call be exactly the same. This presents an issue because multiple threads could try writing at the same time (with different buffers) so the calling function should probably hold the lock on the SSL object over the whole time (include repeated calls)½»Try to read the given number of bytes from an SSL connection. On EOF an empty ByteString is returned. If the connection dies without a graceful SSL shutdown, an exception is raised.¾QTry to read the given number of bytes from an SSL connection without blocking.¿KRead some data into a raw pointer buffer. Retrns the number of bytes read.ÀBTry to read some data into a raw pointer buffer, without blocking.Á€Write a given ByteString to the SSL connection. Either all the data is written or an exception is raised because of an error.ÂGTry to write a given ByteString to the SSL connection without blocking.Ã)Send some data from a raw pointer buffer.Ä;Send some data from a raw pointer buffer, without blocking.Å{Lazily read all data until reaching EOF. If the connection dies without a graceful SSL shutdown, an exception is raised.ÆAWrite a lazy ByteString to the SSL connection. In contrast to Áœ, there is a chance that the string is written partway and then an exception is raised for an error. The string doesn't necessarily have to be finite.ÇÌCleanly shutdown an SSL connection. Note that SSL has a concept of a secure shutdown, which is distinct from just closing the TCP connection. This performs the former and should always be preferred.^This can either just send a shutdown, or can send and wait for the peer's shutdown message.È;Try to cleanly shutdown an SSL connection without blocking.ÉÉAfter a successful connection, get the certificate of the other party. If this is a server connection, you probably won't get a certificate unless you asked for it with contextSetVerificationModeÊôGet the result of verifing the peer's certificate. This is mostly for clients to verify the certificate of the server that they have connected it. You must set a list of root CA certificates with contextSetCA... for this to make sense.ÒNote that this returns True iff the peer's certificate has a valid chain to a root CA. You also need to check that the certificate is correct (i.e. has the correct hostname in it) with getPeerCertificate.uŒ‰Š‘’“”•–—‹Œ˜™š›œŸ ¡‘¢’“”•–—˜™š›œŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±£¤²¥¦³§¨©ª«¬­®¯°±²´³´µ¶·¸µ†‡¹º»¼ˆ#the name of SSL IO function to callthe SSL IO function to callthe buffer to passthe length to pass½¾¿ÀÁÂÃÄÅÆÇÈÉʶ·ËÌÍÎZ Œ‘’“”•–—˜™š›œŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊ\¡£¥¦§¨©ª«¬­®›œŸ ¯°±²—˜™“”•–³´¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈ‘’ÉÊ™˜ Œ¢¤šµ`Œ‰Š‘’“”•–—‹Œ˜™š›œŸ ¡‘¢’“”•–—˜™š›œŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±£¤²¥¦³§¨©ª«¬­®¯°±²´³´µ¶·¸µ†‡¹º»¼ˆ½¾¿ÀÁÂÃÄÅÆÇÈÉʶ·ËÌÍÎNoneÚComputation of Ú action= initializes the OpenSSL library as necessary, and computes actionZ. Every application that uses HsOpenSSL must wrap any operations involving OpenSSL with Ú, or they might crash: Rmodule Main where import OpenSSL main :: IO () main = withOpenSSL $ do ...Since 0.10.3.5, Ú is safe to be applied redundantly. Library authors may wish to wrap their functions not to force their users to think about initialization: Qget :: URI -> IO Response get uri = withOpenSSL $ internalImplementationOfGet uri¸¹ÚºÚÚ¸¹Úº»()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOOPQQRSSTUUVWXYZZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰ Š ‹ŒWX‘’ “ ” • – — ˜ ™ š › œ Ÿ   ¡ ¢ £ ¤ ¥¦§¨©ª«¬­®¯°±² ³ ´ µ ¶ · ¸ ¹ º » ¼ ½ ¾ ¿ À Á Â Ã Ä Å Æ Ç È É Ê Ë Ì Í Î Ï Ğ Ñ Ò Ó Ô Õ Ö × Ø Ù Ú Û Ü İ Ş ß à á â ã ä å æ ç è é ê ë ì í î ï ğ ñ ò ó ô õ ö ÷ ø ù ú û ü ı ş ÿ                !"#$%&'()*+,-&'$%./0123456789:;<=*+$%23>?@@ABCDEFGHIJ*+KLMN&'OPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰Š‹Œ‘’“”•–—˜™š›œŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏĞÑÒÓÔÕÖ×ØÙÚÛÜİŞßàáâãäåæçèéêëìíîïğñòóôõö÷øùúûüışÿ      !"#$%&'()*+,-./0123456789:;< Š ‹ = > ? @ A B C D E FŒGHIJKLMNO P Q R S T T U V ” W X Y Z [ \ ] ^ _ I ` a b cdefghijk ½ ¾ l m n o p q r s t u I v w x y z { | } ~  Ú Û €  l m n I ‚ ƒ „ … † ‡ ˆ ‰ Š ~ ‹ Œ     ‘ ’ “ ò ó ” • – — ˜ ™ š › œ  Ÿ ¡¢£¤¥¦!§!¨!©!ª!«!¬!­!®!¯!°!±!²!³!´!µ!¶!·!¸!¹!º!»!¼!½!¾!¿!§!À!Á!Â!Ã!Ä!Å!Æ!Ç!È!É!Ê!Ë!Ì!Í!Î!Ï!Ğ!I!`!Ñ!Ò!Ó!Ô!Õ!Ö"×"Ø"Ù"Ú"Û"Ü"İ"Ş"ß"à"á"â"ã"ä"å"æ"ç"è"é"ê"ë"ì"í"î#ï#ğ#ñ#ò#ó#ô#õ#I#`#ö#÷#øùúûüışÿ     I`6ÿ  ûüI`D    ûüI`,!"#UX$%&'()*+I`u,-./ûü0I123456789:;<=>?@ABCDùúEFGHIJKLMNOPQRSTUVWXYZ[Ÿ\]^_`abcdefghijklmnopqrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰Š)HsOpenSSL-0.11.4.8-HyB7JSzw6XJ2iPR6bvySwmOpenSSL.SessionOpenSSL.EVP.Base64OpenSSL.EVP.InternalOpenSSL.EVP.CipherOpenSSL.EVP.DigestOpenSSL.Random OpenSSL.DHOpenSSL.Cipher OpenSSL.BN OpenSSL.DSA OpenSSL.RSA OpenSSL.DEROpenSSL.EVP.PKeyOpenSSL.EVP.OpenOpenSSL.EVP.SealOpenSSL.EVP.SignOpenSSL.EVP.Verify OpenSSL.X509OpenSSL.X509.RequestOpenSSL.X509.RevocationOpenSSL.X509.Store OpenSSL.PKCS7 OpenSSL.PEMOpenSSL OpenSSL.StackOpenSSL.SSL.OptionSSL SSLContextOpenSSL.Objects OpenSSL.ERR OpenSSL.UtilsOpenSSL.DH.Internal OpenSSL.BIO OpenSSL.ASN1OpenSSL.X509.NamegetSubjectNamesetSubjectName getIssuerName setIssuerName SSLOptionSSL_OP_MICROSOFT_SESS_ID_BUGSSL_OP_NETSCAPE_CHALLENGE_BUG'SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG"SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG!SSL_OP_MICROSOFT_BIG_SSLV3_BUFFERSSL_OP_SAFARI_ECDHE_ECDSA_BUGSSL_OP_SSLEAY_080_CLIENT_DH_BUGSSL_OP_TLS_D5_BUGSSL_OP_TLS_BLOCK_PADDING_BUG"SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS SSL_OP_ALLSSL_OP_TLS_ROLLBACK_BUGSSL_OP_SINGLE_DH_USESSL_OP_EPHEMERAL_RSASSL_OP_CIPHER_SERVER_PREFERENCESSL_OP_PKCS1_CHECK_1SSL_OP_PKCS1_CHECK_2SSL_OP_NETSCAPE_CA_DN_BUG&SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUGSSL_OP_NO_SSLv2SSL_OP_NO_SSLv3SSL_OP_NO_TLSv1-SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATIONSSL_OP_NO_TICKET(SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATIONSSL_OP_LEGACY_SERVER_CONNECT encodeBase64encodeBase64BSencodeBase64LBS decodeBase64decodeBase64BSdecodeBase64LBSPKeytoPKeyfromPKeypkeySize pkeyDefaultMDEVP_PKEY VaguePKeyHMAC_CTXHmacCtx EVP_MD_CTX DigestCtxEVP_MDDigest CryptoModeEncryptDecryptEVP_CIPHER_CTX CipherCtx EVP_CIPHERCipher withCipherPtrcipherIvLength newCipherCtxwithCipherCtxPtrwithNewCipherCtxPtrcipherSetPadding cipherInitBScipherUpdateBS cipherFinalBScipherStrictly cipherLazily withMDPtrwithDigestCtxPtrdigestUpdateBS digestFinalBS digestFinaldigestStrictly digestLazilywithHmacCtxPtr hmacUpdateBS hmacFinalBS hmacLazily wrapPKeyPtr createPKey withPKeyPtr withPKeyPtr'unsafePKeyToPtr touchPKeygetCipherByNamegetCipherNamescipherStrictLBSciphercipherBS cipherLBSgetDigestByNamegetDigestNamesdigestdigestBS digestLBShmacBShmacLBSpkcs5_pbkdf2_hmac_sha1 randBytes prandBytesaddDHDHPAESCtxMode newAESCtxaesCBCaesCTR$fEqMode $fShowModeBIGNUMBigNumallocaBNunwrapBNwrapBN bnToInteger integerToBNwithBNpeekBNnewBN integerToMPI mpiToIntegermodexp randIntegerUptoNMinusOneSuchThat!prandIntegerUptoNMinusOneSuchThatrandIntegerZeroToNMinusOnerandIntegerOneToNMinusOneprandIntegerZeroToNMinusOneprandIntegerOneToNMinusOneDHGenDHGen2DHGen5 genDHParams getDHLength checkDHParamsgenDH getDHParamsgetDHPublicKey computeDHKey $fEqDHGen $fOrdDHGen $fShowDHGenDSAKeydsaSizedsaPdsaQdsaG dsaPublic withDSAPtr peekDSAPtr absorbDSAPtrDSA DSAKeyPair DSAPubKeygenerateDSAParametersgenerateDSAKey dsaPrivatedsaPubKeyToTupledsaKeyPairToTupletupleToDSAPubKeytupleToDSAKeyPairgenerateDSAParametersAndKeysignDigestedDataWithDSAverifyDigestedDataWithDSA$fShowDSAKeyPair$fShowDSAPubKey$fOrdDSAKeyPair$fOrdDSAPubKey$fEqDSAKeyPair $fEqDSAPubKey$fDSAKeyDSAKeyPair$fDSAKeyDSAPubKeyRSAGenKeyCallbackRSAKeyrsaSizersaNrsaE withRSAPtr peekRSAPtr absorbRSAPtrRSA RSAKeyPair RSAPubKey rsaCopyPublicrsaKeyPairFinalizegenerateRSAKeygenerateRSAKey'rsaDrsaPrsaQrsaDMP1rsaDMQ1rsaIQMP$fShowRSAKeyPair$fShowRSAPubKey$fOrdRSAKeyPair$fOrdRSAPubKey$fEqRSAKeyPair $fEqRSAPubKey$fRSAKeyRSAKeyPair$fRSAKeyRSAPubKeytoDERPub fromDERPub toDERPriv fromDERPriv SomeKeyPair SomePublicKeyKeyPair fromKeyPair toKeyPair PublicKey fromPublicKey toPublicKey$fPKeyDSAKeyPair$fPublicKeyDSAKeyPair$fKeyPairDSAKeyPair$fPKeyDSAPubKey$fPublicKeyDSAPubKey$fPKeyRSAKeyPair$fPublicKeyRSAKeyPair$fKeyPairRSAKeyPair$fPKeyRSAPubKey$fPublicKeyRSAPubKey$fPKeySomeKeyPair$fKeyPairSomeKeyPair$fPublicKeySomeKeyPair$fEqSomeKeyPair$fPKeySomePublicKey$fPublicKeySomePublicKey$fEqSomePublicKeyopenopenBSopenLBSsealsealBSsealLBSsignsignBSsignLBS VerifyStatus VerifySuccess VerifyFailureverifyverifyBS verifyLBS$fShowVerifyStatus$fEqVerifyStatusX509_X509newX509wrapX509 withX509Ptr withX509StackunsafeX509ToPtr touchX509 writeDerX509 readDerX509 compareX509signX509 verifyX509 printX509 getVersion setVersiongetSerialNumbersetSerialNumber getNotBefore setNotBefore getNotAfter setNotAfter getPublicKey setPublicKeygetSubjectEmailX509_REQX509Req newX509Req wrapX509ReqwithX509ReqPtr signX509Req verifyX509Req printX509ReqwriteX509ReqDER addExtensionsmakeX509FromReqRevokedCertificaterevSerialNumberrevRevocationDateX509_CRLCRLnewCRLwrapCRL withCRLPtrsignCRL verifyCRLprintCRL getLastUpdate setLastUpdate getNextUpdate setNextUpdategetRevokedList addRevoked getRevokedsortCRL$fShowRevokedCertificate$fEqRevokedCertificate X509StoreCtxX509_STORE_CTX X509_STORE X509Store newX509Store wrapX509StorewithX509StorePtraddCertToStore addCRLToStorewithX509StoreCtxPtrwrapX509StoreCtxgetStoreCtxCertgetStoreCtxIssuergetStoreCtxCRLgetStoreCtxChainPkcs7VerifyStatusPkcs7VerifySuccessPkcs7VerifyFailure Pkcs7Flag Pkcs7Text Pkcs7NoCerts Pkcs7NoSigs Pkcs7NoChain Pkcs7NoIntern Pkcs7NoVerify Pkcs7Detached Pkcs7Binary Pkcs7NoAttrPkcs7NoSmimeCapPkcs7NoOldMimeType Pkcs7CRLFEOLPKCS7Pkcs7 wrapPkcs7Ptr withPkcs7Ptr pkcs7Sign pkcs7Verify pkcs7Encrypt pkcs7Decrypt writeSmime readSmime$fShowPkcs7Flag $fEqPkcs7Flag$fShowPkcs7VerifyStatus$fEqPkcs7VerifyStatusPemX509ReqFormat ReqNewFormat ReqOldFormatPemPasswordSupplyPwNonePwStrPwBS PwCallbackPwTTYPemPasswordRWStatePwReadPwWritePemPasswordCallbackwritePKCS8PrivateKeyreadPrivateKeywritePublicKey readPublicKey writeX509readX509 writeX509Req readX509ReqwriteCRLreadCRL writePkcs7 readPkcs7 writeDHParams readDHParams ProtocolErrorConnectionAbruptlyTerminatedSomeSSLException ShutdownType BidirectionalUnidirectional SSLResultSSLDoneWantRead WantWritesslFd sslSocketSSL_VerificationMode VerifyNone VerifyPeervpFailIfNoPeerCert vpClientOnce vpCallback SSLContext_context withContextcontextAddOptioncontextRemoveOptioncontextSetPrivateKeycontextSetCertificatecontextSetPrivateKeyFilecontextSetCertificateFilecontextSetCertificateChainFilecontextSetCipherscontextSetDefaultCipherscontextCheckPrivateKeycontextSetVerificationModecontextSetCAFilecontextSetCADirectorycontextGetCAStore connection fdConnectionwithSSL addOption removeOptionsetTlsextHostNameaccept tryAcceptconnect tryConnectreadtryReadreadPtr tryReadPtrwritetryWritewritePtr tryWritePtrlazyRead lazyWriteshutdown tryShutdowngetPeerCertificategetVerifyResult$fExceptionProtocolError'$fExceptionConnectionAbruptlyTerminated$fExceptionSomeSSLException$fShowSomeSSLException $fEqSSLResult$fShowSSLResult$fFunctorSSLResult$fFoldableSSLResult$fTraversableSSLResult$fEqShutdownType$fShowShutdownType"$fShowConnectionAbruptlyTerminated $fEqConnectionAbruptlyTerminated$fShowProtocolError$fEqProtocolError withOpenSSLSTACKskValueskNumskPushskFree skNewNullmapStacknewStack withStackwithForeignStackoptionToIntegral ObjNameType MDMethodTypeCipherMethodTypePKeyMethodTypeCompMethodType DoAllCallbackOBJ_NAMEObjNamemkDoAllCallback_NAME_do_all_sorted _NAME_do_allobjNameTypeToIntiterateObjNames objNameStr getObjNames _DecodeBlock _EncodeBlock nextBlock encodeBlock decodeBlock _error_string peekErrorgetError errorStringtoHexfromHex failIfNull failIfNull_failIffailIf_raiseOpenSSLErrorpeekCStringCLenbaseGHC.BaseNothingGHC.ForeignPtr ForeignPtr _pkey_free' _pkey_free _pkey_new_hmac_ctx_free _hmac_final _hmac_update _hmac_init _hmac_ctx_new _DigestFinal _DigestUpdate _DigestInit _md_ctx_free _md_ctx_reset _md_ctx_new _CipherFinal _CipherUpdate _CipherInit _SetPadding_cipher_ctx_block_size_cipher_ctx_free'_cipher_ctx_free_cipher_ctx_reset_cipher_ctx_new _iv_lengthfromCryptoMode newDigestCtx digestInit newHmacCtxhmacInit_get_cipherbyname_PKCS5_PBKDF2_HMAC_SHA1_HMAC_get_digestbyname _RAND_add_RAND_pseudo_bytes _RAND_bytesDH__DH_free withDHPPtrwrapDHPPtrWith wrapDHPPtr withDHPtr wrapDHPtrWith wrapDHPtrasDHasDHPAES_KEY_AES_ctr_encrypt_free_AES_cbc_encrypt_AES_set_decrypt_key_AES_set_encrypt_key_memset_memcpy modeToIntbnToMPImpiToBNBNCTXBNCtxMBA ByteArrayBA_BN_pseudo_rand_range_BN_rand_range _BN_ctx_free _BN_ctx_new_mod_exp_mpi2bn_bn2mpi _copy_out_copy_in_new newByteArrayfreezeByteArray withBNCtx _DH_length_DH_get_pub_key_DH_dup_DH_size _DH_check_DH_compute_key_DH_generate_key_DH_generate_parameters_size_privDup_pubDup_generate_params _dsa_verify _dsa_sign_dsa_generate_key_dsa_new_bn_freedsa_freehasDSAPrivateKeydsa_pdsa_qdsa_g dsa_pub_key dsa_priv_keysetPQGsetKeypeekIRSAGenKeyCallback' _generate_keymkGenKeyCallbackhasRSAPrivateKeyrsa_nrsa_ersa_drsa_prsa_qrsa_dmp1rsa_dmq1rsa_iqmppeekMI makeDecodeFun makeEncodeFun CEncodeFun CDecodeFun _toDERPriv _fromDERPriv _toDERPub _fromDERPub _set1_DSA _get1_DSA _set1_RSA _get1_RSAgetTypewithConcretePubKeywithConcreteKeyPair rsaToPKey rsaFromPKey dsaToPKey dsaFromPKey _OpenInitopenInit _SealInitsealInit _SignFinal signFinal _VerifyFinal verifyFinalBSBIObioPush==><==bioJoinbioFlushbioResetbioEOFbioRead bioReadBS bioReadLBSbioGets bioGetsBS bioGetsLBSbioWrite bioWriteBS bioWriteLBS newBase64 newBuffernewMem newConstMem newConstMemBSnewConstMemLBS newNullBIOBIO_ BIO_METHODs_null _new_mem_bufs_mem_set_buffer_sizef_buffer_FLAGS_BASE64_NO_NLf_base64_write_gets_read_eof_reset_flush _should_retry _set_flags_pushnew wrapBioPtr withBioPtr withBioPtr'setFlagsbioShouldRetry ASN1_TIME ASN1_INTEGER ASN1_STRING ASN1_OBJECT_ASN1_TIME_print_ASN1_TIME_set_ASN1_TIME_free_ASN1_TIME_new_BN_to_ASN1_INTEGER_ASN1_INTEGER_to_BN_ASN1_INTEGER_free_ASN1_INTEGER_new_nid2ln_nid2snobj2nidnid2snnid2lnpeekASN1StringpeekASN1IntegerallocaASN1IntegerwithASN1Integer peekASN1TimeallocaASN1Time withASN1TimeX509_NAME_ENTRY X509_NAME_ENTRY_get_data_ENTRY_get_object _get_entry _entry_count_add_entry_by_txtallocaX509Name withX509Name peekX509Name_read_bio_X509_write_bio_X509_verify_sign _email_free _get1_email _set_pubkey _get_pubkey _set_notAfter_set_notBefore _get_notAfter_get_notBefore_set_subject_name_get_subject_name_set_issuer_name_get_issuer_name_set_serialNumber_get_serialNumber _set_version _get_version_cmp_print writeX509' readX509'X509_EXT_req_add_extensions _ext_create _req_to_der X509_REVOKED_set_revocationDate freeRevoked _new_revoked_sort_get0_by_serial _add0_revoked _get_REVOKED_set_nextUpdate_set_lastUpdate_get_nextUpdate_get_lastUpdategetRevocationDate peekRevoked newRevoked_crl_ref _x509_ref_store_ctx_get_chain_store_ctx_get0_current_crl_store_ctx_get0_current_issuer_store_ctx_get_current_cert_add_crl _add_cert_SMIME_read_PKCS7_SMIME_write_PKCS7_decrypt_encrypt _is_detached flagToInt flagListToIntisDetachedSignature pkcs7Sign' pkcs7Verify' pkcs7Encrypt' pkcs7Decrypt' writeSmime' readSmime'PemPasswordCallback'memset _read_bio_DH _write_bio_DH_read_bio_PKCS7_write_bio_PKCS7_read_bio_X509_CRL_write_bio_X509_CRL_read_bio_X509_REQ_write_bio_X509_REQ_NEW_write_bio_X509_REQ_read_bio_PUBKEY_write_bio_PUBKEY_read_bio_PrivateKey_write_bio_PKCS8PrivateKeymkPemPasswordCallback rwflagToStatecallPasswordCBwritePKCS8PrivateKey'readPrivateKey'writePublicKey'readPublicKey' writeX509Req' readX509Req' writeCRL'readCRL' writePkcs7' readPkcs7'writeDHParams' readDHParams'withBSsslBlocksslTryHandshake sslIOInnersslCtxsslMVar SSLMethod_ctxMVarctxVfCbVerifyCb_ssl_get_verify_result_ssl_get_peer_cert _ssl_shutdown _ssl_write_ssl_get_shutdown _ssl_read_ssl_get_error _ssl_connect _ssl_accept_SSL_set_tlsext_host_name_SSL_clear_options_SSL_set_options _ssl_set_fd _ssl_free_ssl_new_ssl_get_cert_store_ssl_load_verify_locations_ssl_set_verify_mode_ssl_ctx_check_private_key_ssl_ctx_set_cipher_list#_ssl_ctx_use_certificate_chain_file_ssl_ctx_use_certificate_file_ssl_ctx_use_privatekey_file_ssl_ctx_use_certificate_ssl_ctx_use_privatekey_SSL_CTX_clear_options_SSL_CTX_set_options _ssl_method _ssl_ctx_free _ssl_ctx_new mkVerifyCb touchContextcontextLoadFile connection'throwSSLExceptionsslExceptionToExceptionsslExceptionFromException setupMutexinitSSL isInitialised