Hackage :: [Package]

saltine: Cryptography that's easy to digest (NaCl/libsodium bindings).

This is a package candidate release! Here you can preview how this package release will appear once published to the main package index (which can be accomplished via the 'maintain' link below). Please note that once a package has been published to the main package index it cannot be undone! Please consult the package uploading documentation for more information.

[maintain] [Publish]

Warnings:

NaCl (pronounced "salt") is a new easy-to-use high-speed software library for network communication, encryption, decryption, signatures, etc. NaCl's goal is to provide all of the core operations needed to build higher-level cryptographic tools.

http://nacl.cr.yp.to/

Sodium is a portable, cross-compilable, installable, packageable crypto library based on NaCl, with a compatible API.

https://github.com/jedisct1/libsodium

Saltine is a Haskell binding to the NaCl primitives going through Sodium for build convenience and, eventually, portability.

[Skip to Readme]

Properties

Versions 0.0.0.1, 0.0.0.2, 0.0.0.3, 0.0.0.4, 0.0.0.5, 0.0.0.6, 0.0.1.0, 0.1.0.0, 0.1.0.1, 0.1.0.2, 0.1.1.0, 0.1.1.1, 0.2.0.0, 0.2.0.0, 0.2.0.1, 0.2.1.0
Change log CHANGELOG.md
Dependencies base (>=4.5 && <5), bytestring (>=0.10.8 && <0.11), deepseq (>=1.4 && <1.5), hashable, profunctors (>=5.3 && <5.7), text (>=1.2 && <1.3) [details]
License MIT
Copyright Copyright (c) Joseph Abrahamson 2013
Author Joseph Abrahamson
Maintainer Max Amanshauser <max@lambdalifting.org>
Category Cryptography
Bug tracker http://github.com/tel/saltine/issues
Source repo head: git clone https://github.com/tel/saltine.git
Uploaded by amx at 2021-05-27T23:34:18Z

Modules

Downloads

Maintainer's Corner

Package maintainers

For package maintainers and hackage trustees

Readme for saltine-0.2.0.0

[back to package description]

Saltine 0.2.0.0 Hackage version

A Haskell binding for @jedisct1's portable binding for djb's NaCl. This is an early release. Please try it out, but don't just yet stake your life or job on it.

It is imperative you call sodiumInit before using any other function.

import           Crypto.Saltine
import           Crypto.Saltine.Core.SecretBox
import qualified Data.ByteString.Char8 as BSC8

main = do
  sodiumInit
  k <- newKey
  n <- newNonce
  let ciphertext = secretbox k n (BSC8.pack "foobar")
  print $ secretboxOpen k n ciphertext

-- Just "foobar"

In The Security Impact of a New Cryptographic Library Bernstein, Lange, and Schwabe argue that high-level cryptographic libraries eliminate whole spaces of cryptographic disasters which are nigh inevitable whenever programmers use low-level crypto primitives.

Crypto is complicated, so pre-rolled solutions are important prevention mechanisms.

NaCl is Bernstein, Lange, and Schwabe's solution: a high-level, performant cryptography library with a no-fuss interface. Saltine is a Haskell binding to NaCl (via libsodium) which hopes to provide even more simplicity and safety to the usage of cryptography.

Note that it's still possible to shoot yourself in the foot pretty easily using Saltine. Nonces must always be unique which must be managed by the library user. Crypto.Saltine.Core.Stream produces messages which can beundetectably tampered with in-flight. Keys are insecurely read from disk—they may be copied and then paged back to disk.

When uncertain, use Crypto.Saltine.Core.SecretBox and Crypto.Saltine.Core.Box. If you can think of ways to use Haskell's type system to enforce security invariants, please suggest them.

To use it on Windows systems, download a prebuild libsodium-*-stable-mingw.tar.gz file and copy the files in libsodium-win64 into the equivalent places in C:\Program Files\Haskell Platform\*\mingw. Then just add saltine to your cabal file and watch it go.

Tested with libsodium-1.0.18.

Inspired by @thoughtpolice's salt library. salt also binds to NaCl, but uses a Haskell managed version of djb's code instead of libsodium.