jose-jwt-0.3: JSON Object Signing and Encryption Library

Safe HaskellNone
LanguageHaskell2010

Jose.Internal.Crypto

Description

Internal functions for encrypting and signing / decrypting and verifying JWT content.

Synopsis

Documentation

hmacSign Source

Arguments

:: JwsAlg

HMAC algorithm to use

-> ByteString

Key

-> ByteString

The message/content

-> Either JwtError ByteString

HMAC output

Sign a message with an HMAC key.

hmacVerify Source

Arguments

:: JwsAlg

HMAC Algorithm to use

-> ByteString

Key

-> ByteString

The message/content

-> ByteString

The signature to check

-> Bool

Whether the signature is correct

Verify the HMAC for a given message. Returns false if the MAC is incorrect or the Alg is not an HMAC.

rsaSign Source

Arguments

:: Maybe Blinder

RSA blinder

-> JwsAlg

Algorithm to use. Must be one of RSA256, RSA384 or RSA512

-> PrivateKey

Private key to sign with

-> ByteString

Message to sign

-> Either JwtError ByteString

The signature

Sign a message using an RSA private key.

The failure condition should only occur if the algorithm is not an RSA algorithm, or the RSA key is too small, causing the padding of the signature to fail. With real-world RSA keys this shouldn't happen in practice.

rsaVerify Source

Arguments

:: JwsAlg

The signature algorithm. Used to obtain the hash function.

-> PublicKey

The key to check the signature with

-> ByteString

The message/content

-> ByteString

The signature to check

-> Bool

Whether the signature is correct

Verify the signature for a message using an RSA public key.

Returns false if the check fails or if the Alg value is not an RSA signature algorithm.

rsaEncrypt Source

Arguments

:: CPRG g 
=> g

Random number generator

-> JweAlg

The algorithm (either RSA1_5 or RSA_OAEP)

-> PublicKey

The encryption key

-> ByteString

The message to encrypt

-> (ByteString, g)

The encrypted messaged and new generator

Encrypts a message (typically a symmetric key) using RSA.

rsaDecrypt Source

Arguments

:: Maybe Blinder 
-> JweAlg

The RSA algorithm to use

-> PrivateKey

The decryption key

-> ByteString

The encrypted content

-> Either JwtError ByteString

The decrypted key

Decrypts an RSA encrypted message.

ecVerify Source

Arguments

:: JwsAlg

The signature algorithm. Used to obtain the hash function.

-> PublicKey

The key to check the signature with

-> ByteString

The message/content

-> ByteString

The signature to check

-> Bool

Whether the signature is correct

Verify the signature for a message using an EC public key.

Returns false if the check fails or if the Alg value is not an EC signature algorithm.

encryptPayload Source

Arguments

:: Enc

Encryption algorithm

-> ByteString

Content management key

-> ByteString

IV

-> ByteString

Additional authenticated data

-> ByteString

The message/JWT claims

-> (ByteString, AuthTag)

Ciphertext claims and signature tag

Encrypt a message using AES.

decryptPayload Source

Arguments

:: Enc

Encryption algorithm

-> ByteString

Content management key

-> ByteString

IV

-> ByteString

Additional authentication data

-> ByteString

The integrity protection value to be checked

-> ByteString

The encrypted JWT payload

-> Either JwtError ByteString 

Decrypt an AES encrypted message.

generateCmkAndIV Source

Arguments

:: CPRG g 
=> g

The random number generator

-> Enc

The encryption algorithm to be used

-> (ByteString, ByteString, g)

The key, IV and generator

Generates the symmetric key (content management key) and IV

Used to encrypt a message.