Crypto.Store.CMS

Cryptographic Message Syntax

• RFC 5652: Cryptographic Message Syntax (CMS)
• RFC 3370: Cryptographic Message Syntax (CMS) Algorithms
• RFC 3560: Use of the RSAES-OAEP Key Transport Algorithm in the Cryptographic Message Syntax (CMS)
• RFC 4056: Use of the RSASSA-PSS Signature Algorithm in Cryptographic Message Syntax (CMS)
• RFC 3565: Use of the Advanced Encryption Standard (AES) Encryption Algorithm in Cryptographic Message Syntax (CMS)
• RFC 5753: Use of Elliptic Curve Cryptography (ECC) Algorithms in Cryptographic Message Syntax (CMS)
• RFC 5754: Using SHA2 Algorithms with Cryptographic Message Syntax
• RFC 3211: Password-based Encryption for CMS
• RFC 5083: Cryptographic Message Syntax (CMS) Authenticated-Enveloped-Data Content Type
• RFC 5084: Using AES-CCM and AES-GCM Authenticated Encryption in the Cryptographic Message Syntax (CMS)
• RFC 6476: Using Message Authentication Code (MAC) Encryption in the Cryptographic Message Syntax (CMS)
• RFC 8103: Using ChaCha20-Poly1305 Authenticated Encryption in the Cryptographic Message Syntax (CMS)
• RFC 8418: Use of the Elliptic Curve Diffie-Hellman Key Agreement Algorithm with X25519 and X448 in the Cryptographic Message Syntax (CMS)
• RFC 8419: Use of Edwards-Curve Digital Signature Algorithm (EdDSA) Signatures in the Cryptographic Message Syntax (CMS)

Documentation

data ContentType

CMS content information type.

Constructors

DataType

Arbitrary octet string

SignedDataType

Signed content info

EnvelopedDataType

Enveloped content info

DigestedDataType

Content info with associated digest

EncryptedDataType

Encrypted content info

AuthenticatedDataType

Authenticated content info

AuthEnvelopedDataType

Authenticated-enveloped content info

Instances

Eq ContentType

Defined in Crypto.Store.CMS.Type

Methods

(==) :: ContentType -> ContentType -> Bool

(/=) :: ContentType -> ContentType -> Bool

Show ContentType

Defined in Crypto.Store.CMS.Type

Methods

showsPrec :: Int -> ContentType -> ShowS

show :: ContentType -> String

showList :: [ContentType] -> ShowS

OIDable ContentType

Defined in Crypto.Store.CMS.Type

Methods

getObjectID :: ContentType -> OID

OIDNameable ContentType

Defined in Crypto.Store.CMS.Type

Methods

fromObjectID :: OID -> Maybe ContentType

data ContentInfo

CMS content information.

Constructors

DataCI ByteString

Arbitrary octet string

SignedDataCI (SignedData (Encap EncapsulatedContent))

Signed content info

EnvelopedDataCI (EnvelopedData (Encap EncryptedContent))

Enveloped content info

DigestedDataCI (DigestedData (Encap EncapsulatedContent))

Content info with associated digest

EncryptedDataCI (EncryptedData (Encap EncryptedContent))

Encrypted content info

AuthenticatedDataCI (AuthenticatedData (Encap EncapsulatedContent))

Authenticatedcontent info

AuthEnvelopedDataCI (AuthEnvelopedData (Encap EncryptedContent))

Authenticated-enveloped content info

Instances

Eq ContentInfo

Defined in Crypto.Store.CMS.Info

Methods

(==) :: ContentInfo -> ContentInfo -> Bool

(/=) :: ContentInfo -> ContentInfo -> Bool

Show ContentInfo

Defined in Crypto.Store.CMS.Info

Methods

showsPrec :: Int -> ContentInfo -> ShowS

show :: ContentInfo -> String

showList :: [ContentInfo] -> ShowS

getContentType :: ContentInfo -> ContentType

Get the type of a content info.

Reading and writing PEM files

readCMSFile :: FilePath -> IO [ContentInfo]

Read content info elements from a PEM file.

readCMSFileFromMemory :: ByteString -> [ContentInfo]

Read content info elements from a bytearray in PEM format.

pemToContentInfo :: [Maybe ContentInfo] -> PEM -> [Maybe ContentInfo]

Read a content info from a PEM element and add it to the accumulator list.

writeCMSFile :: FilePath -> [ContentInfo] -> IO ()

Write content info elements to a PEM file.

writeCMSFileToMemory :: [ContentInfo] -> ByteString

Write content info elements to a bytearray in PEM format.

contentInfoToPEM :: ContentInfo -> PEM

Generate PEM for a content info.

Content encapsulation

data Encap a

Denotes the state of encapsulated content in a CMS data structure. This type is isomorphic to Maybe.

Constructors

Detached

Attached a

Instances

Functor Encap

Defined in Crypto.Store.CMS.Type

Methods

fmap :: (a -> b) -> Encap a -> Encap b

(<$) :: a -> Encap b -> Encap a

Applicative Encap

Defined in Crypto.Store.CMS.Type

Methods

pure :: a -> Encap a

(<*>) :: Encap (a -> b) -> Encap a -> Encap b

liftA2 :: (a -> b -> c) -> Encap a -> Encap b -> Encap c

(*>) :: Encap a -> Encap b -> Encap b

(<*) :: Encap a -> Encap b -> Encap a

Foldable Encap

Defined in Crypto.Store.CMS.Type

Methods

fold :: Monoid m => Encap m -> m

foldMap :: Monoid m => (a -> m) -> Encap a -> m

foldr :: (a -> b -> b) -> b -> Encap a -> b

foldr' :: (a -> b -> b) -> b -> Encap a -> b

foldl :: (b -> a -> b) -> b -> Encap a -> b

foldl' :: (b -> a -> b) -> b -> Encap a -> b

foldr1 :: (a -> a -> a) -> Encap a -> a

foldl1 :: (a -> a -> a) -> Encap a -> a

toList :: Encap a -> [a]

null :: Encap a -> Bool

length :: Encap a -> Int

elem :: Eq a => a -> Encap a -> Bool

maximum :: Ord a => Encap a -> a

minimum :: Ord a => Encap a -> a

sum :: Num a => Encap a -> a

product :: Num a => Encap a -> a

Traversable Encap

Defined in Crypto.Store.CMS.Type

Methods

traverse :: Applicative f => (a -> f b) -> Encap a -> f (Encap b)

sequenceA :: Applicative f => Encap (f a) -> f (Encap a)

mapM :: Monad m => (a -> m b) -> Encap a -> m (Encap b)

sequence :: Monad m => Encap (m a) -> m (Encap a)

Eq a => Eq (Encap a)

Defined in Crypto.Store.CMS.Type

Methods

(==) :: Encap a -> Encap a -> Bool

(/=) :: Encap a -> Encap a -> Bool

Show a => Show (Encap a)

Defined in Crypto.Store.CMS.Type

Methods

showsPrec :: Int -> Encap a -> ShowS

show :: Encap a -> String

showList :: [Encap a] -> ShowS

fromEncap :: b -> (a -> b) -> Encap a -> b

Fold over an Encap value. This is similar to function maybe. If the content is detached, the first argument is returned. Otherwise the second argument is applied to the content.

class Encapsulates struct

Class of data structures with inner content that may be stored externally. This class has instances for each CMS content type containing other encapsulated or encrypted content info.

Functions fromAttached and fromDetached are used to introspect encapsulation state (attached or detached), and recover a data structure with actionable content.

Functions toAttachedCI and toDetachedCI are needed to decide about the outer encapsulation state and build a ContentInfo.

Minimal complete definition

lens, toCI

Instances

Encapsulates EncryptedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> EncryptedData a -> f (EncryptedData b)

toCI :: EncryptedData (Encap ByteString) -> ContentInfo

Encapsulates EnvelopedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> EnvelopedData a -> f (EnvelopedData b)

toCI :: EnvelopedData (Encap ByteString) -> ContentInfo

Encapsulates AuthEnvelopedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> AuthEnvelopedData a -> f (AuthEnvelopedData b)

toCI :: AuthEnvelopedData (Encap ByteString) -> ContentInfo

Encapsulates SignedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> SignedData a -> f (SignedData b)

toCI :: SignedData (Encap ByteString) -> ContentInfo

Encapsulates DigestedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> DigestedData a -> f (DigestedData b)

toCI :: DigestedData (Encap ByteString) -> ContentInfo

Encapsulates AuthenticatedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> AuthenticatedData a -> f (AuthenticatedData b)

toCI :: AuthenticatedData (Encap ByteString) -> ContentInfo

isAttached :: Encapsulates struct => struct (Encap a) -> Bool

Return True when the encapsulated content is attached.

fromAttached :: (MonadFail m, Encapsulates struct) => struct (Encap a) -> m (struct a)

Unwrap the encapsulation, assuming the inner content is inside the data structure. The monadic computation fails if the content was detached.

toAttachedCI :: Encapsulates struct => struct ByteString -> ContentInfo

Transform the data structure into a content info, keeping the encapsulated content attached. May be applied to structures with EncapsulatedContent or EncryptedContent.

isDetached :: Encapsulates struct => struct (Encap a) -> Bool

Return True when the encapsulated content is detached.

fromDetached :: (MonadFail m, Encapsulates struct) => b -> struct (Encap a) -> m (struct b)

Recover the original data structure from a detached encapsulation and the external content. The monadic computation fails if the content was attached.

toDetachedCI :: Encapsulates struct => struct ByteString -> (ByteString, ContentInfo)

Transform the data structure into a content info, detaching the encapsulated content. May be applied to structures with EncapsulatedContent or EncryptedContent.

Signed data

type SignatureValue = ByteString

Signature value.

data SignatureAlg

CMS signature algorithms and associated parameters.

Constructors

RSAAnyHash

RSA DigestAlgorithm

RSAPSS PSSParams

DSA DigestAlgorithm

ECDSA DigestAlgorithm

Ed25519

Ed448

Instances

Eq SignatureAlg

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: SignatureAlg -> SignatureAlg -> Bool

(/=) :: SignatureAlg -> SignatureAlg -> Bool

Show SignatureAlg

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> SignatureAlg -> ShowS

show :: SignatureAlg -> String

showList :: [SignatureAlg] -> ShowS

type EncapsulatedContent = ByteString

Encapsulated content.

data SignedData content

Signed content information.

Constructors

SignedData

Fields

• sdDigestAlgorithms :: [DigestAlgorithm]

  Digest algorithms

• sdContentType :: ContentType

  Inner content type

• sdEncapsulatedContent :: content

  Encapsulated content

• sdCertificates :: [CertificateChoice]

  The collection of certificates

• sdCRLs :: [RevocationInfoChoice]

  The collection of CRLs

• sdSignerInfos :: [SignerInfo]

  Per-signer information

Instances

Encapsulates SignedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> SignedData a -> f (SignedData b)

toCI :: SignedData (Encap ByteString) -> ContentInfo

Eq content => Eq (SignedData content)

Defined in Crypto.Store.CMS.Signed

Methods

(==) :: SignedData content -> SignedData content -> Bool

(/=) :: SignedData content -> SignedData content -> Bool

Show content => Show (SignedData content)

Defined in Crypto.Store.CMS.Signed

Methods

showsPrec :: Int -> SignedData content -> ShowS

show :: SignedData content -> String

showList :: [SignedData content] -> ShowS

type ProducerOfSI m = ContentType -> ByteString -> m (Either StoreError (SignerInfo, [CertificateChoice], [RevocationInfoChoice]))

Function able to produce a SignerInfo.

type ConsumerOfSI m = ContentType -> ByteString -> SignerInfo -> [CertificateChoice] -> [RevocationInfoChoice] -> m Bool

Function able to consume a SignerInfo.

signData :: Applicative f => [ProducerOfSI f] -> ContentInfo -> f (Either StoreError (SignedData EncapsulatedContent))

Add a signed-data layer on the specified content info. The content is processed by one or several ProducerOfSI functions to create signer info elements.

verifySignedData :: Monad m => ConsumerOfSI m -> SignedData EncapsulatedContent -> m (Either StoreError ContentInfo)

Verify a signed content info using the specified ConsumerOfSI function. Verification of at least one signer info must be successful in order to return the inner content info.

Signer information

data SignerInfo

Information related to a signer of a SignedData. An element contains the signature material that was produced.

Constructors

SignerInfo

Fields

• siSignerId :: SignerIdentifier

  Identifier of the signer certificate

• siDigestAlgorithm :: DigestAlgorithm

  Digest algorithm used for the signature

• siSignedAttrs :: [Attribute]

  Optional signed attributes

• siSignatureAlg :: SignatureAlg

  Algorithm used for signature

• siSignature :: SignatureValue

  The signature value

• siUnsignedAttrs :: [Attribute]

  Optional unsigned attributes

Instances

Eq SignerInfo

Defined in Crypto.Store.CMS.Signed

Methods

(==) :: SignerInfo -> SignerInfo -> Bool

(/=) :: SignerInfo -> SignerInfo -> Bool

Show SignerInfo

Defined in Crypto.Store.CMS.Signed

Methods

showsPrec :: Int -> SignerInfo -> ShowS

show :: SignerInfo -> String

showList :: [SignerInfo] -> ShowS

data SignerIdentifier

Union type related to identification of the signer certificate.

Constructors

SignerIASN IssuerAndSerialNumber

Issuer and Serial Number

SignerSKI ByteString

Subject Key Identifier

Instances

Eq SignerIdentifier

Defined in Crypto.Store.CMS.Signed

Methods

(==) :: SignerIdentifier -> SignerIdentifier -> Bool

(/=) :: SignerIdentifier -> SignerIdentifier -> Bool

Show SignerIdentifier

Defined in Crypto.Store.CMS.Signed

Methods

showsPrec :: Int -> SignerIdentifier -> ShowS

show :: SignerIdentifier -> String

showList :: [SignerIdentifier] -> ShowS

data IssuerAndSerialNumber

Identification of a certificate using the issuer DN and serial number.

Constructors

IssuerAndSerialNumber

Fields

• iasnIssuer :: DistinguishedName

  Distinguished name of the certificate issuer

• iasnSerial :: Integer

  Issuer-specific certificate serial number

Instances

Eq IssuerAndSerialNumber

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: IssuerAndSerialNumber -> IssuerAndSerialNumber -> Bool

(/=) :: IssuerAndSerialNumber -> IssuerAndSerialNumber -> Bool

Show IssuerAndSerialNumber

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> IssuerAndSerialNumber -> ShowS

show :: IssuerAndSerialNumber -> String

showList :: [IssuerAndSerialNumber] -> ShowS

certSigner :: MonadRandom m => SignatureAlg -> PrivKey -> CertificateChain -> Maybe [Attribute] -> [Attribute] -> ProducerOfSI m

Create a signer info with the specified signature algorithm and credentials.

Two lists of optional attributes can be provided. The attributes will be part of message signature when provided in the first list.

When the first list of attributes is provided, even empty list, signature is computed from a digest of the content. When the list of attributes is Nothing, no intermediate digest is used and the signature is computed from the full message.

withPublicKey :: Applicative f => PubKey -> ConsumerOfSI f

Verify that the signature was produced from the specified public key. Ignores all certificates and CRLs contained in the signed data.

withSignerKey :: Applicative f => ConsumerOfSI f

Verify that the signature is valid with one of the X.509 certificates contained in the signed data, but does not validate that the certificates are valid. All transmitted certificates are implicitely trusted and all CRLs are ignored.

withSignerCertificate :: Applicative f => (CertificateChain -> f Bool) -> ConsumerOfSI f

Verify that the signature is valid with one of the X.509 certificates contained in the signed data, and verify that the signer certificate is valid using the validation function supplied. All CRLs are ignored.

Enveloped data

type EncryptedKey = ByteString

Encrypted key.

data KeyEncryptionParams

Key encryption algorithm with associated parameters (i.e. the underlying encryption algorithm).

Constructors

PWRIKEK ContentEncryptionParams

PWRI-KEK key wrap algorithm

AES128_WRAP

AES-128 key wrap

AES192_WRAP

AES-192 key wrap

AES256_WRAP

AES-256 key wrap

AES128_WRAP_PAD

AES-128 extended key wrap

AES192_WRAP_PAD

AES-192 extended key wrap

AES256_WRAP_PAD

AES-256 extended key wrap

DES_EDE3_WRAP

Triple-DES key wrap

RC2_WRAP Int

RC2 key wrap with effective key length

Instances

Eq KeyEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: KeyEncryptionParams -> KeyEncryptionParams -> Bool

(/=) :: KeyEncryptionParams -> KeyEncryptionParams -> Bool

Show KeyEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> KeyEncryptionParams -> ShowS

show :: KeyEncryptionParams -> String

showList :: [KeyEncryptionParams] -> ShowS

HasKeySize KeyEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

getKeySizeSpecifier :: KeyEncryptionParams -> KeySizeSpecifier

data KeyTransportParams

Key transport algorithm with associated parameters.

Constructors

RSAES

RSAES-PKCS1

RSAESOAEP OAEPParams

RSAES-OAEP

Instances

Eq KeyTransportParams

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: KeyTransportParams -> KeyTransportParams -> Bool

(/=) :: KeyTransportParams -> KeyTransportParams -> Bool

Show KeyTransportParams

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> KeyTransportParams -> ShowS

show :: KeyTransportParams -> String

showList :: [KeyTransportParams] -> ShowS

data KeyAgreementParams

Key agreement algorithm with associated parameters.

Constructors

StdDH DigestAlgorithm KeyEncryptionParams

1-Pass D-H with Stardard ECDH

CofactorDH DigestAlgorithm KeyEncryptionParams

1-Pass D-H with Cofactor ECDH

Instances

Eq KeyAgreementParams

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: KeyAgreementParams -> KeyAgreementParams -> Bool

(/=) :: KeyAgreementParams -> KeyAgreementParams -> Bool

Show KeyAgreementParams

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> KeyAgreementParams -> ShowS

show :: KeyAgreementParams -> String

showList :: [KeyAgreementParams] -> ShowS

data RecipientInfo

Information for a recipient of an EnvelopedData. An element contains the content-encryption key in encrypted form.

Constructors

KTRI KTRecipientInfo

Recipient using key transport

KARI KARecipientInfo

Recipient using key agreement

KEKRI KEKRecipientInfo

Recipient using key encryption

PasswordRI PasswordRecipientInfo

Recipient using password-based protection

Instances

Eq RecipientInfo

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: RecipientInfo -> RecipientInfo -> Bool

(/=) :: RecipientInfo -> RecipientInfo -> Bool

Show RecipientInfo

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> RecipientInfo -> ShowS

show :: RecipientInfo -> String

showList :: [RecipientInfo] -> ShowS

data EnvelopedData content

Enveloped content information.

Constructors

EnvelopedData

Fields

• evOriginatorInfo :: OriginatorInfo

  Optional information about the originator

• evRecipientInfos :: [RecipientInfo]

  Information for recipients, allowing to decrypt the content

• evContentType :: ContentType

  Inner content type

• evContentEncryptionParams :: ContentEncryptionParams

  Encryption algorithm

• evEncryptedContent :: content

  Encrypted content info

• evUnprotectedAttrs :: [Attribute]

  Optional unprotected attributes

Instances

Encapsulates EnvelopedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> EnvelopedData a -> f (EnvelopedData b)

toCI :: EnvelopedData (Encap ByteString) -> ContentInfo

Eq content => Eq (EnvelopedData content)

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: EnvelopedData content -> EnvelopedData content -> Bool

(/=) :: EnvelopedData content -> EnvelopedData content -> Bool

Show content => Show (EnvelopedData content)

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> EnvelopedData content -> ShowS

show :: EnvelopedData content -> String

showList :: [EnvelopedData content] -> ShowS

type ProducerOfRI m = ContentEncryptionKey -> m (Either StoreError RecipientInfo)

Function able to produce a RecipientInfo.

type ConsumerOfRI m = RecipientInfo -> m (Either StoreError ContentEncryptionKey)

Function able to consume a RecipientInfo.

envelopData :: Applicative f => OriginatorInfo -> ContentEncryptionKey -> ContentEncryptionParams -> [ProducerOfRI f] -> [Attribute] -> ContentInfo -> f (Either StoreError (EnvelopedData EncryptedContent))

Add an enveloped-data layer on the specified content info. The content is encrypted with specified key and algorithm. The key is then processed by one or several ProducerOfRI functions to create recipient info elements.

Some optional attributes can be added but will not be encrypted.

openEnvelopedData :: Monad m => ConsumerOfRI m -> EnvelopedData EncryptedContent -> m (Either StoreError ContentInfo)

Recover an enveloped content info using the specified ConsumerOfRI function.

Key Transport recipients

data KTRecipientInfo

Recipient using key transport.

Constructors

KTRecipientInfo

Fields

• ktRid :: RecipientIdentifier

  identifier of recipient

• ktKeyTransportParams :: KeyTransportParams

  key transport algorithm

• ktEncryptedKey :: EncryptedKey

  encrypted content-encryption key

Instances

Eq KTRecipientInfo

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: KTRecipientInfo -> KTRecipientInfo -> Bool

(/=) :: KTRecipientInfo -> KTRecipientInfo -> Bool

Show KTRecipientInfo

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> KTRecipientInfo -> ShowS

show :: KTRecipientInfo -> String

showList :: [KTRecipientInfo] -> ShowS

data RecipientIdentifier

Union type related to identification of the recipient.

Constructors

RecipientIASN IssuerAndSerialNumber

Issuer and Serial Number

RecipientSKI ByteString

Subject Key Identifier

Instances

Eq RecipientIdentifier

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: RecipientIdentifier -> RecipientIdentifier -> Bool

(/=) :: RecipientIdentifier -> RecipientIdentifier -> Bool

Show RecipientIdentifier

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> RecipientIdentifier -> ShowS

show :: RecipientIdentifier -> String

showList :: [RecipientIdentifier] -> ShowS

forKeyTransRecipient :: MonadRandom m => SignedCertificate -> KeyTransportParams -> ProducerOfRI m

Generate a Key Transport recipient from a certificate and desired algorithm. The recipient will contain certificate identifier.

This function can be used as parameter to envelopData.

withRecipientKeyTrans :: MonadRandom m => PrivKey -> ConsumerOfRI m

Use a Key Transport recipient, knowing the private key.

This function can be used as parameter to openEnvelopedData.

Key Agreement recipients

data KARecipientInfo

Recipient using key agreement.

Constructors

KARecipientInfo

Fields

• kaOriginator :: OriginatorIdentifierOrKey

  identifier of orginator or anonymous key

• kaUkm :: Maybe UserKeyingMaterial

  user keying material

• kaKeyAgreementParams :: KeyAgreementParams

  key agreement algorithm

• kaRecipientEncryptedKeys :: [RecipientEncryptedKey]

  encrypted content-encryption key for one or multiple recipients

Instances

Eq KARecipientInfo

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: KARecipientInfo -> KARecipientInfo -> Bool

(/=) :: KARecipientInfo -> KARecipientInfo -> Bool

Show KARecipientInfo

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> KARecipientInfo -> ShowS

show :: KARecipientInfo -> String

showList :: [KARecipientInfo] -> ShowS

data OriginatorIdentifierOrKey

Union type related to identification of the originator.

Constructors

OriginatorIASN IssuerAndSerialNumber

Issuer and Serial Number

OriginatorSKI ByteString

Subject Key Identifier

OriginatorPublic OriginatorPublicKey

Anonymous public key

Instances

Eq OriginatorIdentifierOrKey

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: OriginatorIdentifierOrKey -> OriginatorIdentifierOrKey -> Bool

(/=) :: OriginatorIdentifierOrKey -> OriginatorIdentifierOrKey -> Bool

Show OriginatorIdentifierOrKey

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> OriginatorIdentifierOrKey -> ShowS

show :: OriginatorIdentifierOrKey -> String

showList :: [OriginatorIdentifierOrKey] -> ShowS

data OriginatorPublicKey

Originator public key used for key-agreement. Contrary to PubKey the domain parameters are not used and may be left empty.

Instances

Eq OriginatorPublicKey

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: OriginatorPublicKey -> OriginatorPublicKey -> Bool

(/=) :: OriginatorPublicKey -> OriginatorPublicKey -> Bool

Show OriginatorPublicKey

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> OriginatorPublicKey -> ShowS

show :: OriginatorPublicKey -> String

showList :: [OriginatorPublicKey] -> ShowS

data RecipientEncryptedKey

Encrypted key for a recipient in a key-agreement RI.

Constructors

RecipientEncryptedKey

Fields

• rekRid :: KeyAgreeRecipientIdentifier

  identifier of recipient

• rekEncryptedKey :: EncryptedKey

  encrypted content-encryption key

Instances

Eq RecipientEncryptedKey

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: RecipientEncryptedKey -> RecipientEncryptedKey -> Bool

(/=) :: RecipientEncryptedKey -> RecipientEncryptedKey -> Bool

Show RecipientEncryptedKey

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> RecipientEncryptedKey -> ShowS

show :: RecipientEncryptedKey -> String

showList :: [RecipientEncryptedKey] -> ShowS

data KeyAgreeRecipientIdentifier

Union type related to identification of a key-agreement recipient.

Constructors

KeyAgreeRecipientIASN IssuerAndSerialNumber

Issuer and Serial Number

KeyAgreeRecipientKI KeyIdentifier

Key identifier

Instances

Eq KeyAgreeRecipientIdentifier

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: KeyAgreeRecipientIdentifier -> KeyAgreeRecipientIdentifier -> Bool

(/=) :: KeyAgreeRecipientIdentifier -> KeyAgreeRecipientIdentifier -> Bool

Show KeyAgreeRecipientIdentifier

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> KeyAgreeRecipientIdentifier -> ShowS

show :: KeyAgreeRecipientIdentifier -> String

showList :: [KeyAgreeRecipientIdentifier] -> ShowS

type UserKeyingMaterial = ByteString

User keying material.

forKeyAgreeRecipient :: MonadRandom m => SignedCertificate -> KeyAgreementParams -> ProducerOfRI m

Generate a Key Agreement recipient from a certificate and desired algorithm. The recipient info will contain an ephemeral public key.

This function can be used as parameter to envelopData.

To avoid decreasing the security strength, Key Encryption parameters should use a key size equal or greater than the content encryption key.

withRecipientKeyAgree :: MonadRandom m => PrivKey -> SignedCertificate -> ConsumerOfRI m

Use a Key Agreement recipient, knowing the recipient private key. The recipient certificate is also required to locate which encrypted key to use.

This function can be used as parameter to openEnvelopedData.

Key Encryption Key recipients

data KEKRecipientInfo

Recipient using key encryption.

Constructors

KEKRecipientInfo

Fields

• kekId :: KeyIdentifier

  identifier of key encryption key

• kekKeyEncryptionParams :: KeyEncryptionParams

  key encryption algorithm

• kekEncryptedKey :: EncryptedKey

  encrypted content-encryption key

Instances

Eq KEKRecipientInfo

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: KEKRecipientInfo -> KEKRecipientInfo -> Bool

(/=) :: KEKRecipientInfo -> KEKRecipientInfo -> Bool

Show KEKRecipientInfo

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> KEKRecipientInfo -> ShowS

show :: KEKRecipientInfo -> String

showList :: [KEKRecipientInfo] -> ShowS

data KeyIdentifier

Key identifier and optional attributes.

Constructors

KeyIdentifier

Fields

• keyIdentifier :: ByteString

  identifier of the key

• keyDate :: Maybe DateTime

  optional timestamp

• keyOther :: Maybe OtherKeyAttribute

  optional information

Instances

Eq KeyIdentifier

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: KeyIdentifier -> KeyIdentifier -> Bool

(/=) :: KeyIdentifier -> KeyIdentifier -> Bool

Show KeyIdentifier

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> KeyIdentifier -> ShowS

show :: KeyIdentifier -> String

showList :: [KeyIdentifier] -> ShowS

data OtherKeyAttribute

Additional information in a KeyIdentifier.

Constructors

OtherKeyAttribute

Fields

• keyAttrId :: OID

  attribute identifier

• keyAttr :: [ASN1]

  attribute value

Instances

Eq OtherKeyAttribute

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: OtherKeyAttribute -> OtherKeyAttribute -> Bool

(/=) :: OtherKeyAttribute -> OtherKeyAttribute -> Bool

Show OtherKeyAttribute

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> OtherKeyAttribute -> ShowS

show :: OtherKeyAttribute -> String

showList :: [OtherKeyAttribute] -> ShowS

type KeyEncryptionKey = ByteString

Key used for key encryption.

forKeyRecipient :: MonadRandom m => KeyEncryptionKey -> KeyIdentifier -> KeyEncryptionParams -> ProducerOfRI m

Generate a Key Encryption Key recipient from a key encryption key and desired algorithm. The recipient may identify the KEK that was used with the supplied identifier.

This function can be used as parameter to envelopData.

To avoid decreasing the security strength, Key Encryption parameters should use a key size equal or greater than the content encryption key.

withRecipientKey :: Applicative f => KeyEncryptionKey -> ConsumerOfRI f

Use a Key Encryption Key recipient, knowing the key encryption key.

This function can be used as parameter to openEnvelopedData.

Password recipients

data PasswordRecipientInfo

Recipient using password-based protection.

Constructors

PasswordRecipientInfo

Fields

• priKeyDerivationFunc :: KeyDerivationFunc

  function to derive key

• priKeyEncryptionParams :: KeyEncryptionParams

  key encryption algorithm

• priEncryptedKey :: EncryptedKey

  encrypted content-encryption key

Instances

Eq PasswordRecipientInfo

Defined in Crypto.Store.CMS.Enveloped

Methods

(==) :: PasswordRecipientInfo -> PasswordRecipientInfo -> Bool

(/=) :: PasswordRecipientInfo -> PasswordRecipientInfo -> Bool

Show PasswordRecipientInfo

Defined in Crypto.Store.CMS.Enveloped

Methods

showsPrec :: Int -> PasswordRecipientInfo -> ShowS

show :: PasswordRecipientInfo -> String

showList :: [PasswordRecipientInfo] -> ShowS

forPasswordRecipient :: MonadRandom m => Password -> KeyDerivationFunc -> KeyEncryptionParams -> ProducerOfRI m

Generate a password recipient from a password.

This function can be used as parameter to envelopData.

withRecipientPassword :: Applicative f => Password -> ConsumerOfRI f

Use a password recipient, knowing the password.

This function can be used as parameter to openEnvelopedData.

Digested data

data DigestProxy hashAlg where

CMS digest proxy. Acts like Proxy, i.e. provides a hash algorithm as type parameter. The GADT constructors map to known algorithms.

Constructors

MD2 :: DigestProxy MD2

MD2

MD4 :: DigestProxy MD4

MD4

MD5 :: DigestProxy MD5

MD5

SHA1 :: DigestProxy SHA1

SHA-1

SHA224 :: DigestProxy SHA224

SHA-224

SHA256 :: DigestProxy SHA256

SHA-256

SHA384 :: DigestProxy SHA384

SHA-384

SHA512 :: DigestProxy SHA512

SHA-512

SHAKE128_256 :: DigestProxy (SHAKE128 256)

SHAKE128 (256 bits)

SHAKE256_512 :: DigestProxy (SHAKE256 512)

SHAKE256 (512 bits)

SHAKE128 :: KnownNat n => Proxy n -> DigestProxy (SHAKE128 n)

SHAKE128 (variable size)

SHAKE256 :: KnownNat n => Proxy n -> DigestProxy (SHAKE256 n)

SHAKE256 (variable size)

Instances

Eq (DigestProxy hashAlg)

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: DigestProxy hashAlg -> DigestProxy hashAlg -> Bool

(/=) :: DigestProxy hashAlg -> DigestProxy hashAlg -> Bool

Show (DigestProxy hashAlg)

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> DigestProxy hashAlg -> ShowS

show :: DigestProxy hashAlg -> String

showList :: [DigestProxy hashAlg] -> ShowS

data DigestAlgorithm

CMS digest algorithm.

Constructors

HashAlgorithm hashAlg => DigestAlgorithm (DigestProxy hashAlg)

Instances

Eq DigestAlgorithm

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: DigestAlgorithm -> DigestAlgorithm -> Bool

(/=) :: DigestAlgorithm -> DigestAlgorithm -> Bool

Show DigestAlgorithm

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> DigestAlgorithm -> ShowS

show :: DigestAlgorithm -> String

showList :: [DigestAlgorithm] -> ShowS

data DigestedData content

Digested content information.

Constructors

HashAlgorithm hashAlg => DigestedData

Fields

• ddDigestAlgorithm :: DigestProxy hashAlg

  Digest algorithm

• ddContentType :: ContentType

  Inner content type

• ddEncapsulatedContent :: content

  Encapsulated content

• ddDigest :: Digest hashAlg

  Digest value

Instances

Encapsulates DigestedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> DigestedData a -> f (DigestedData b)

toCI :: DigestedData (Encap ByteString) -> ContentInfo

Eq content => Eq (DigestedData content)

Defined in Crypto.Store.CMS.Digested

Methods

(==) :: DigestedData content -> DigestedData content -> Bool

(/=) :: DigestedData content -> DigestedData content -> Bool

Show content => Show (DigestedData content)

Defined in Crypto.Store.CMS.Digested

Methods

showsPrec :: Int -> DigestedData content -> ShowS

show :: DigestedData content -> String

showList :: [DigestedData content] -> ShowS

digestData :: DigestAlgorithm -> ContentInfo -> DigestedData EncapsulatedContent

Add a digested-data layer on the specified content info.

digestVerify :: DigestedData EncapsulatedContent -> Either StoreError ContentInfo

Return the inner content info but only if the digest is valid.

Encrypted data

type ContentEncryptionKey = ByteString

Key used for content encryption.

data ContentEncryptionCipher cipher where

CMS content encryption cipher.

Constructors

DES :: ContentEncryptionCipher DES

DES

DES_EDE2 :: ContentEncryptionCipher DES_EDE2

Triple-DES with 2 keys used in alternative direction

DES_EDE3 :: ContentEncryptionCipher DES_EDE3

Triple-DES with 3 keys used in alternative direction

AES128 :: ContentEncryptionCipher AES128

AES with 128-bit key

AES192 :: ContentEncryptionCipher AES192

AES with 192-bit key

AES256 :: ContentEncryptionCipher AES256

AES with 256-bit key

CAST5 :: ContentEncryptionCipher CAST5

CAST5 (aka CAST-128) with key between 40 and 128 bits

Camellia128 :: ContentEncryptionCipher Camellia128

Camellia with 128-bit key

Instances

Eq (ContentEncryptionCipher cipher)

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: ContentEncryptionCipher cipher -> ContentEncryptionCipher cipher -> Bool

(/=) :: ContentEncryptionCipher cipher -> ContentEncryptionCipher cipher -> Bool

Show (ContentEncryptionCipher cipher)

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> ContentEncryptionCipher cipher -> ShowS

show :: ContentEncryptionCipher cipher -> String

showList :: [ContentEncryptionCipher cipher] -> ShowS

data ContentEncryptionAlg

Cipher and mode of operation for content encryption.

Constructors

BlockCipher c => ECB (ContentEncryptionCipher c)

Electronic Codebook

BlockCipher c => CBC (ContentEncryptionCipher c)

Cipher Block Chaining

CBC_RC2

RC2 in CBC mode

BlockCipher c => CFB (ContentEncryptionCipher c)

Cipher Feedback

BlockCipher c => CTR (ContentEncryptionCipher c)

Counter

Instances

Show ContentEncryptionAlg

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> ContentEncryptionAlg -> ShowS

show :: ContentEncryptionAlg -> String

showList :: [ContentEncryptionAlg] -> ShowS

OIDable ContentEncryptionAlg

Defined in Crypto.Store.CMS.Algorithms

Methods

getObjectID :: ContentEncryptionAlg -> OID

OIDNameable ContentEncryptionAlg

Defined in Crypto.Store.CMS.Algorithms

Methods

fromObjectID :: OID -> Maybe ContentEncryptionAlg

data ContentEncryptionParams

Content encryption algorithm with associated parameters (i.e. the initialization vector).

A value can be generated with generateEncryptionParams.

Instances

Eq ContentEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: ContentEncryptionParams -> ContentEncryptionParams -> Bool

(/=) :: ContentEncryptionParams -> ContentEncryptionParams -> Bool

Show ContentEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> ContentEncryptionParams -> ShowS

show :: ContentEncryptionParams -> String

showList :: [ContentEncryptionParams] -> ShowS

HasKeySize ContentEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

getKeySizeSpecifier :: ContentEncryptionParams -> KeySizeSpecifier

type EncryptedContent = ByteString

Encrypted content.

data EncryptedData content

Encrypted content information.

Constructors

EncryptedData

Fields

• edContentType :: ContentType

  Inner content type

• edContentEncryptionParams :: ContentEncryptionParams

  Encryption algorithm

• edEncryptedContent :: content

  Encrypted content info

• edUnprotectedAttrs :: [Attribute]

  Optional unprotected attributes

Instances

Encapsulates EncryptedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> EncryptedData a -> f (EncryptedData b)

toCI :: EncryptedData (Encap ByteString) -> ContentInfo

Eq content => Eq (EncryptedData content)

Defined in Crypto.Store.CMS.Encrypted

Methods

(==) :: EncryptedData content -> EncryptedData content -> Bool

(/=) :: EncryptedData content -> EncryptedData content -> Bool

Show content => Show (EncryptedData content)

Defined in Crypto.Store.CMS.Encrypted

Methods

showsPrec :: Int -> EncryptedData content -> ShowS

show :: EncryptedData content -> String

showList :: [EncryptedData content] -> ShowS

generateEncryptionParams :: MonadRandom m => ContentEncryptionAlg -> m ContentEncryptionParams

Generate random parameters for the specified content encryption algorithm.

generateRC2EncryptionParams :: MonadRandom m => Int -> m ContentEncryptionParams

Generate random RC2 parameters with the specified effective key length (in bits).

getContentEncryptionAlg :: ContentEncryptionParams -> ContentEncryptionAlg

Get the content encryption algorithm.

encryptData :: ContentEncryptionKey -> ContentEncryptionParams -> [Attribute] -> ContentInfo -> Either StoreError (EncryptedData EncryptedContent)

Add an encrypted-data layer on the specified content info. The content is encrypted with specified key and algorithm.

Some optional attributes can be added but will not be encrypted.

decryptData :: ContentEncryptionKey -> EncryptedData EncryptedContent -> Either StoreError ContentInfo

Decrypt an encrypted content info using the specified key.

Authenticated data

type AuthenticationKey = ContentEncryptionKey

Key used for authentication.

data MACAlgorithm

Message Authentication Code (MAC) Algorithm.

Constructors

HashAlgorithm hashAlg => HMAC (DigestProxy hashAlg)

Instances

Eq MACAlgorithm

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: MACAlgorithm -> MACAlgorithm -> Bool

(/=) :: MACAlgorithm -> MACAlgorithm -> Bool

Show MACAlgorithm

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> MACAlgorithm -> ShowS

show :: MACAlgorithm -> String

showList :: [MACAlgorithm] -> ShowS

OIDable MACAlgorithm

Defined in Crypto.Store.CMS.Algorithms

Methods

getObjectID :: MACAlgorithm -> OID

OIDNameable MACAlgorithm

Defined in Crypto.Store.CMS.Algorithms

Methods

fromObjectID :: OID -> Maybe MACAlgorithm

HasKeySize MACAlgorithm

Defined in Crypto.Store.CMS.Algorithms

Methods

getKeySizeSpecifier :: MACAlgorithm -> KeySizeSpecifier

type MessageAuthenticationCode = AuthTag

Message authentication code. Equality is time constant.

data AuthenticatedData content

Authenticated content information.

Constructors

AuthenticatedData

Fields

• adOriginatorInfo :: OriginatorInfo

  Optional information about the originator

• adRecipientInfos :: [RecipientInfo]

  Information for recipients, allowing to authenticate the content

• adMACAlgorithm :: MACAlgorithm

  MAC algorithm

• adDigestAlgorithm :: Maybe DigestAlgorithm

  Optional digest algorithm

• adContentType :: ContentType

  Inner content type

• adEncapsulatedContent :: content

  Encapsulated content

• adAuthAttrs :: [Attribute]

  Optional authenticated attributes

• adMAC :: MessageAuthenticationCode

  Message authentication code

• adUnauthAttrs :: [Attribute]

  Optional unauthenticated attributes

Instances

Encapsulates AuthenticatedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> AuthenticatedData a -> f (AuthenticatedData b)

toCI :: AuthenticatedData (Encap ByteString) -> ContentInfo

Eq content => Eq (AuthenticatedData content)

Defined in Crypto.Store.CMS.Authenticated

Methods

(==) :: AuthenticatedData content -> AuthenticatedData content -> Bool

(/=) :: AuthenticatedData content -> AuthenticatedData content -> Bool

Show content => Show (AuthenticatedData content)

Defined in Crypto.Store.CMS.Authenticated

Methods

showsPrec :: Int -> AuthenticatedData content -> ShowS

show :: AuthenticatedData content -> String

showList :: [AuthenticatedData content] -> ShowS

generateAuthenticatedData :: Applicative f => OriginatorInfo -> AuthenticationKey -> MACAlgorithm -> Maybe DigestAlgorithm -> [ProducerOfRI f] -> [Attribute] -> [Attribute] -> ContentInfo -> f (Either StoreError (AuthenticatedData EncapsulatedContent))

Add an authenticated-data layer on the specified content info. The content is MACed with the specified key and algorithms. The key is then processed by one or several ProducerOfRI functions to create recipient info elements.

Two lists of optional attributes can be provided. The attributes will be part of message authentication when provided in the first list.

verifyAuthenticatedData :: Monad m => ConsumerOfRI m -> AuthenticatedData EncapsulatedContent -> m (Either StoreError ContentInfo)

Verify the integrity of an authenticated content info using the specified ConsumerOfRI function. The inner content info is returned only if the MAC could be verified.

Authenticated-enveloped data

data AuthContentEncryptionAlg

Cipher and mode of operation for authenticated-content encryption.

Constructors

AUTH_ENC_128

authEnc with 128-bit key

AUTH_ENC_256

authEnc with 256-bit key

CHACHA20_POLY1305

ChaCha20-Poly1305 Authenticated Encryption

BlockCipher c => CCM (ContentEncryptionCipher c)

Counter with CBC-MAC

BlockCipher c => GCM (ContentEncryptionCipher c)

Galois Counter Mode

Instances

Show AuthContentEncryptionAlg

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> AuthContentEncryptionAlg -> ShowS

show :: AuthContentEncryptionAlg -> String

showList :: [AuthContentEncryptionAlg] -> ShowS

OIDable AuthContentEncryptionAlg

Defined in Crypto.Store.CMS.Algorithms

Methods

getObjectID :: AuthContentEncryptionAlg -> OID

OIDNameable AuthContentEncryptionAlg

Defined in Crypto.Store.CMS.Algorithms

Methods

fromObjectID :: OID -> Maybe AuthContentEncryptionAlg

data AuthContentEncryptionParams

Authenticated-content encryption algorithm with associated parameters (i.e. the nonce).

A value can be generated with functions generateAuthEnc128Params, generateAuthEnc256Params, generateChaChaPoly1305Params, generateCCMParams and generateGCMParams.

Instances

Eq AuthContentEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: AuthContentEncryptionParams -> AuthContentEncryptionParams -> Bool

(/=) :: AuthContentEncryptionParams -> AuthContentEncryptionParams -> Bool

Show AuthContentEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> AuthContentEncryptionParams -> ShowS

show :: AuthContentEncryptionParams -> String

showList :: [AuthContentEncryptionParams] -> ShowS

HasKeySize AuthContentEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

getKeySizeSpecifier :: AuthContentEncryptionParams -> KeySizeSpecifier

data AuthEnvelopedData content

Authenticated-enveloped content information.

Constructors

AuthEnvelopedData

Fields

• aeOriginatorInfo :: OriginatorInfo

  Optional information about the originator

• aeRecipientInfos :: [RecipientInfo]

  Information for recipients, allowing to decrypt the content

• aeContentType :: ContentType

  Inner content type

• aeContentEncryptionParams :: ASN1ObjectExact AuthContentEncryptionParams

  Encryption algorithm

• aeEncryptedContent :: content

  Encrypted content info

• aeAuthAttrs :: [Attribute]

  Optional authenticated attributes

• aeMAC :: MessageAuthenticationCode

  Message authentication code

• aeUnauthAttrs :: [Attribute]

  Optional unauthenticated attributes

Instances

Encapsulates AuthEnvelopedData

Defined in Crypto.Store.CMS.Info

Methods

lens :: Functor f => (a -> f b) -> AuthEnvelopedData a -> f (AuthEnvelopedData b)

toCI :: AuthEnvelopedData (Encap ByteString) -> ContentInfo

Eq content => Eq (AuthEnvelopedData content)

Defined in Crypto.Store.CMS.AuthEnveloped

Methods

(==) :: AuthEnvelopedData content -> AuthEnvelopedData content -> Bool

(/=) :: AuthEnvelopedData content -> AuthEnvelopedData content -> Bool

Show content => Show (AuthEnvelopedData content)

Defined in Crypto.Store.CMS.AuthEnveloped

Methods

showsPrec :: Int -> AuthEnvelopedData content -> ShowS

show :: AuthEnvelopedData content -> String

showList :: [AuthEnvelopedData content] -> ShowS

generateAuthEnc128Params :: MonadRandom m => PBKDF2_PRF -> ContentEncryptionAlg -> MACAlgorithm -> m AuthContentEncryptionParams

Generate random AUTH_ENC_128 parameters with the specified algorithms.

generateAuthEnc256Params :: MonadRandom m => PBKDF2_PRF -> ContentEncryptionAlg -> MACAlgorithm -> m AuthContentEncryptionParams

Generate random AUTH_ENC_256 parameters with the specified algorithms.

generateChaChaPoly1305Params :: MonadRandom m => m AuthContentEncryptionParams

Generate random CHACHA20_POLY1305 parameters.

generateCCMParams :: (MonadRandom m, BlockCipher c) => ContentEncryptionCipher c -> CCM_M -> CCM_L -> m AuthContentEncryptionParams

Generate random CCM parameters for the specified cipher.

generateGCMParams :: (MonadRandom m, BlockCipher c) => ContentEncryptionCipher c -> Int -> m AuthContentEncryptionParams

Generate random GCM parameters for the specified cipher.

authEnvelopData :: Applicative f => OriginatorInfo -> ContentEncryptionKey -> AuthContentEncryptionParams -> [ProducerOfRI f] -> [Attribute] -> [Attribute] -> ContentInfo -> f (Either StoreError (AuthEnvelopedData EncryptedContent))

Add an authenticated-enveloped-data layer on the specified content info. The content is encrypted with specified key and algorithm. The key is then processed by one or several ProducerOfRI functions to create recipient info elements.

Some attributes can be added but will not be encrypted. The attributes will be part of message authentication when provided in the first list.

openAuthEnvelopedData :: Monad m => ConsumerOfRI m -> AuthEnvelopedData EncryptedContent -> m (Either StoreError ContentInfo)

Recover an authenticated-enveloped content info using the specified ConsumerOfRI function.

Key derivation

type Salt = ByteString

Salt value used for key derivation.

generateSalt :: MonadRandom m => Int -> m Salt

Generate a random salt with the specified length in bytes. To be most effective, the length should be at least 8 bytes.

data KeyDerivationFunc

Key derivation algorithm and associated parameters.

Constructors

PBKDF2

Key derivation with PBKDF2

Fields

• pbkdf2Salt :: Salt

  Salt value

• pbkdf2IterationCount :: Int

  Iteration count

• pbkdf2KeyLength :: Maybe Int

  Optional key length

• pbkdf2Prf :: PBKDF2_PRF

  Pseudorandom function

Scrypt

Key derivation with Scrypt

Fields

• scryptSalt :: Salt

  Salt value

• scryptN :: Word64

  N value

• scryptR :: Int

  R value

• scryptP :: Int

  P value

• scryptKeyLength :: Maybe Int

  Optional key length

Instances

Eq KeyDerivationFunc

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: KeyDerivationFunc -> KeyDerivationFunc -> Bool

(/=) :: KeyDerivationFunc -> KeyDerivationFunc -> Bool

Show KeyDerivationFunc

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> KeyDerivationFunc -> ShowS

show :: KeyDerivationFunc -> String

showList :: [KeyDerivationFunc] -> ShowS

data PBKDF2_PRF

Pseudorandom function used for PBKDF2.

Constructors

PBKDF2_SHA1

hmacWithSHA1

PBKDF2_SHA256

hmacWithSHA256

PBKDF2_SHA512

hmacWithSHA512

Instances

Eq PBKDF2_PRF

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: PBKDF2_PRF -> PBKDF2_PRF -> Bool

(/=) :: PBKDF2_PRF -> PBKDF2_PRF -> Bool

Show PBKDF2_PRF

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> PBKDF2_PRF -> ShowS

show :: PBKDF2_PRF -> String

showList :: [PBKDF2_PRF] -> ShowS

OIDable PBKDF2_PRF

Defined in Crypto.Store.CMS.Algorithms

Methods

getObjectID :: PBKDF2_PRF -> OID

OIDNameable PBKDF2_PRF

Defined in Crypto.Store.CMS.Algorithms

Methods

fromObjectID :: OID -> Maybe PBKDF2_PRF

Secret-key algorithms

class HasKeySize params where

Algorithms that are based on a secret key. This includes ciphers but also MAC algorithms.

Methods

getKeySizeSpecifier :: params -> KeySizeSpecifier

Get a specification of the key sizes allowed by the algorithm.

Instances

HasKeySize KeyEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

getKeySizeSpecifier :: KeyEncryptionParams -> KeySizeSpecifier

HasKeySize AuthContentEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

getKeySizeSpecifier :: AuthContentEncryptionParams -> KeySizeSpecifier

HasKeySize ContentEncryptionParams

Defined in Crypto.Store.CMS.Algorithms

Methods

getKeySizeSpecifier :: ContentEncryptionParams -> KeySizeSpecifier

HasKeySize MACAlgorithm

Defined in Crypto.Store.CMS.Algorithms

Methods

getKeySizeSpecifier :: MACAlgorithm -> KeySizeSpecifier

generateKey :: (HasKeySize params, MonadRandom m, ByteArray key) => params -> m key

Generate a random key suitable for the specified algorithm. This uses the maximum size allowed by the parameters.

RSA padding modes

newtype MaskGenerationFunc

Mask Generation Functions (MGF) and associated parameters.

Constructors

MGF1 DigestAlgorithm

Instances

Eq MaskGenerationFunc

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: MaskGenerationFunc -> MaskGenerationFunc -> Bool

(/=) :: MaskGenerationFunc -> MaskGenerationFunc -> Bool

Show MaskGenerationFunc

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> MaskGenerationFunc -> ShowS

show :: MaskGenerationFunc -> String

showList :: [MaskGenerationFunc] -> ShowS

data OAEPParams

Encryption parameters for RSAES-OAEP.

Constructors

OAEPParams

Fields

• oaepHashAlgorithm :: DigestAlgorithm

  Hash function

• oaepMaskGenAlgorithm :: MaskGenerationFunc

  Mask generation function

Instances

Eq OAEPParams

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: OAEPParams -> OAEPParams -> Bool

(/=) :: OAEPParams -> OAEPParams -> Bool

Show OAEPParams

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> OAEPParams -> ShowS

show :: OAEPParams -> String

showList :: [OAEPParams] -> ShowS

data PSSParams

Signature parameters for RSASSA-PSS.

Constructors

PSSParams

Fields

• pssHashAlgorithm :: DigestAlgorithm

  Hash function

• pssMaskGenAlgorithm :: MaskGenerationFunc

  Mask generation function

• pssSaltLength :: Int

  Length of the salt in bytes

Instances

Eq PSSParams

Defined in Crypto.Store.CMS.Algorithms

Methods

(==) :: PSSParams -> PSSParams -> Bool

(/=) :: PSSParams -> PSSParams -> Bool

Show PSSParams

Defined in Crypto.Store.CMS.Algorithms

Methods

showsPrec :: Int -> PSSParams -> ShowS

show :: PSSParams -> String

showList :: [PSSParams] -> ShowS

CMS attributes

data Attribute

An attribute extending the parent structure with arbitrary data.

Constructors

Attribute

Fields

• attrType :: OID

  Attribute type

• attrValues :: [ASN1]

  Attribute values

Instances

Eq Attribute

Defined in Crypto.Store.CMS.Attribute

Methods

(==) :: Attribute -> Attribute -> Bool

(/=) :: Attribute -> Attribute -> Bool

Show Attribute

Defined in Crypto.Store.CMS.Attribute

Methods

showsPrec :: Int -> Attribute -> ShowS

show :: Attribute -> String

showList :: [Attribute] -> ShowS

findAttribute :: OID -> [Attribute] -> Maybe [ASN1]

Return the values for the first attribute with the specified type.

setAttribute :: OID -> [ASN1] -> [Attribute] -> [Attribute]

Add or replace an attribute in a list of attributes.

filterAttributes :: (OID -> Bool) -> [Attribute] -> [Attribute]

Filter a list of attributes based on a predicate applied to attribute type.

Originator information

data OriginatorInfo

Information about the originator of the content info, to be used when a key management algorithm requires this information.

Constructors

OriginatorInfo

Fields

• originatorCerts :: [CertificateChoice]

  The collection of certificates

• originatorCRLs :: [RevocationInfoChoice]

  The collection of CRLs

Instances

Eq OriginatorInfo

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

(==) :: OriginatorInfo -> OriginatorInfo -> Bool

(/=) :: OriginatorInfo -> OriginatorInfo -> Bool

Show OriginatorInfo

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

showsPrec :: Int -> OriginatorInfo -> ShowS

show :: OriginatorInfo -> String

showList :: [OriginatorInfo] -> ShowS

Semigroup OriginatorInfo

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

(<>) :: OriginatorInfo -> OriginatorInfo -> OriginatorInfo

sconcat :: NonEmpty OriginatorInfo -> OriginatorInfo

stimes :: Integral b => b -> OriginatorInfo -> OriginatorInfo

Monoid OriginatorInfo

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

mempty :: OriginatorInfo

mappend :: OriginatorInfo -> OriginatorInfo -> OriginatorInfo

mconcat :: [OriginatorInfo] -> OriginatorInfo

data CertificateChoice

Union type related to certificate formats.

Constructors

CertificateCertificate SignedCertificate

X.509 certificate

CertificateOther OtherCertificateFormat

Other format

Instances

Eq CertificateChoice

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

(==) :: CertificateChoice -> CertificateChoice -> Bool

(/=) :: CertificateChoice -> CertificateChoice -> Bool

Show CertificateChoice

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

showsPrec :: Int -> CertificateChoice -> ShowS

show :: CertificateChoice -> String

showList :: [CertificateChoice] -> ShowS

data OtherCertificateFormat

Certificate information in a format not supported natively.

Constructors

OtherCertificateFormat

Fields

• otherCertFormat :: OID

  Format identifier

• otherCertValues :: [ASN1]

  ASN.1 values using this format

Instances

Eq OtherCertificateFormat

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

(==) :: OtherCertificateFormat -> OtherCertificateFormat -> Bool

(/=) :: OtherCertificateFormat -> OtherCertificateFormat -> Bool

Show OtherCertificateFormat

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

showsPrec :: Int -> OtherCertificateFormat -> ShowS

show :: OtherCertificateFormat -> String

showList :: [OtherCertificateFormat] -> ShowS

data RevocationInfoChoice

Union type related to revocation info formats.

Constructors

RevocationInfoCRL SignedCRL

A CRL, ARL, Delta CRL, or an ACRL

RevocationInfoOther OtherRevocationInfoFormat

Other format

Instances

Eq RevocationInfoChoice

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

(==) :: RevocationInfoChoice -> RevocationInfoChoice -> Bool

(/=) :: RevocationInfoChoice -> RevocationInfoChoice -> Bool

Show RevocationInfoChoice

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

showsPrec :: Int -> RevocationInfoChoice -> ShowS

show :: RevocationInfoChoice -> String

showList :: [RevocationInfoChoice] -> ShowS

data OtherRevocationInfoFormat

Revocation information in a format not supported natively.

Constructors

OtherRevocationInfoFormat

Fields

• otherRevInfoFormat :: OID

  Format identifier

• otherRevInfoValues :: [ASN1]

  ASN.1 values using this format

Instances

Eq OtherRevocationInfoFormat

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

(==) :: OtherRevocationInfoFormat -> OtherRevocationInfoFormat -> Bool

(/=) :: OtherRevocationInfoFormat -> OtherRevocationInfoFormat -> Bool

Show OtherRevocationInfoFormat

Defined in Crypto.Store.CMS.OriginatorInfo

Methods

showsPrec :: Int -> OtherRevocationInfoFormat -> ShowS

show :: OtherRevocationInfoFormat -> String

showList :: [OtherRevocationInfoFormat] -> ShowS

ASN.1 representation

data ASN1ObjectExact a

An ASN.1 object associated with the raw data it was parsed from.

Instances

Eq a => Eq (ASN1ObjectExact a)

Defined in Crypto.Store.CMS.Util

Methods

(==) :: ASN1ObjectExact a -> ASN1ObjectExact a -> Bool

(/=) :: ASN1ObjectExact a -> ASN1ObjectExact a -> Bool

Show a => Show (ASN1ObjectExact a)

Defined in Crypto.Store.CMS.Util

Methods

showsPrec :: Int -> ASN1ObjectExact a -> ShowS

show :: ASN1ObjectExact a -> String

showList :: [ASN1ObjectExact a] -> ShowS