frereth.cp.shared.crypto — com.frereth/cp 0.0.5

Wrap up the low-level crypto functions

box-after clj

(box-after shared-key plain-text length nonce)

(box-after shared-key plain-text offset length nonce)

Accept some plain text and turn it into cipher text

box-prepare clj

(box-prepare public secret)

Set up shared secret so I can avoid the if logic to see whether it's been done. At least, I think that's the point.

build-box clj

(build-box log-state tmplt src shared-key nonce-prefix nonce-suffix)

Compose a map into bytes and encrypt it

Note that tmplt should not include the requisite 32 bytes of 0 padding

build-random-iv clj

(build-random-iv n)

decompose-box clj

(decompose-box log-state
               template
               nonce-prefix
               nonce-suffix
               crypto-box
               shared-key)

do-load-keypair clj

(do-load-keypair log-state keydir)

Honestly, these should be stored with something like base64 encoding

do-safe-nonce clj

(do-safe-nonce log-state dst offset)

(do-safe-nonce logger log-state dst key-dir offset long-term?)

Shoves a theoretically safe 16-byte nonce suffix into dst at offset

encrypt-block clj

(encrypt-block secret-key clear-text)

Block-encrypt a byte-array

generate-symmetric-key clj

(generate-symmetric-key bit-size)

(generate-symmetric-key algorithm bit-size)

get-nonce-agent-state clj

(get-nonce-agent-state)

get-random-bytes clj

(get-random-bytes n)

get-safe-client-nonce-suffix clj

(get-safe-client-nonce-suffix logger log-state)

Get a new byte array containing the next client nonce suffix

get-safe-server-nonce-suffix clj

(get-safe-server-nonce-suffix log-state)

Get a new byte array containing the next server nonce suffix

initial-nonce-agent-state clj

(initial-nonce-agent-state)

load-nonce-key clj

(load-nonce-key {:keys [:frereth.cp.shared.crypto/key-loaded?]
                 log-state :frereth.weald.specs/state
                 :as this}
                logger
                key-dir)

new-nonce-key! clj

(new-nonce-key! key-dir)

Generates a new secret nonce key and stores it under key-dir

nonce-key-length clj

obscure-nonce clj

(obscure-nonce {:keys [:frereth.cp.shared.crypto/counter-low
                       :frereth.cp.shared.crypto/data
                       :frereth.cp.shared.crypto/nonce-key]
                :as this}
               random-portion)

More side effects. Encrypt and increment the nonce counter

open-after clj

(open-after log-state box box-offset box-length nonce shared-key)

Low-level direct crypto box opening

@parameter box: crypto box byte array to open @parameter box-offset: first byte of box to start opening @parameter box-length: how many bytes of box to open @parameter nonce: Number used Once for this specific box @parameter shared-key: combination of their-public and my-private

Note that this does cope with the extra required 16 bytes of prefix padding

The parameter order is screwy to match the java API.

Which was probably modeled to match the C API.

It's annoying and subject to change at a a whim. The only reason it hasn't yet is that I'm giving this entire translation the white-glove treatment.

If nothing else, the shared-key should come first to match the instance-level API and allow me to set it up as a partial.

It would also be nice to be able to provide a reusable buffer byte array destination that could just be reused without GC.

That looks like it would get into the gory implementation details which I'm really not qualified to touch.

And it would be premature optimization

open-box clj

(open-box log-state nonce-prefix nonce-suffix crypto-box shared-key)

Builds a nonce and open a crypto box

random-array clj

(random-array n)

Returns an array of n random bytes

random-bytes! clj

(random-bytes! dst)

Fills dst with random bytes

random-key clj

(random-key)

Returns a byte array suitable for use as a random key

random-key-pair clj

(random-key-pair)

Generates a pair of random keys

random-keys clj

(random-keys which)

Sticks a new random key pair into a map

random-mod clj

(random-mod denominator)

Picks a big random number and securely

random-nonce clj

(random-nonce)

Generates a number suitable for use as a cryptographically secure random nonce

randomize-buffer! clj

(randomize-buffer! dst)

Fills the bytes of dst with crypto-random ints

reload-nonce clj

(reload-nonce {:keys [:frereth.cp.shared.crypto/counter-low
                      :frereth.cp.shared.crypto/counter-high]
               log-state :frereth.weald.specs/state
               data :frereth.cp.shared.crypto/data
               :as this}
              logger
              key-dir
              long-term?)

Do this inside an agent for thread safety

reset-safe-nonce-state! clj

(reset-safe-nonce-state!)

secret-box clj

(secret-box cleartext length nonce key)

Symmetric encryption

Note that this does not do anything about the initial padding.

It may be an implementation detail, but box-after above is really just a wrapper around this

secret-unbox clj

(secret-unbox cipher-text length nonce key)

Symmetric-key decryption