Passphrase Primitives (encryption & check)

[KtorZ]

Issue Number

#95

Overview

• I have added some crypto primitives to hash / encrypt a passphrase and check an existing one against an already stored hash

Comments

This has been checked with the crypto team. A possible improvement later: use a timing loop instead of a fixed iteration count (i.e. loop for a short & constant period, and then, store the total number of iterations so that iterations are non-deterministic).

This is preparatory work for an upcoming keystore to store and retrieve encrypted private keys.

[Anviking]

LGTM. Some thoughts on the MonadRandom ((->) (Passphrase "salt")) doc-comment.

This has been checked with the crypto team

👍

[Anviking]

I found this very confusing at first.

our own random "salt"

why call it random then?

Suggested change

	-- | Little trick to be able to provide our own random "salt" in order to
	-- | Little trick to be able to provide our own "random" salt in order to

or maybe:

Suggested change

	-- | Little trick to be able to provide our own random "salt" in order to
	-- | Little trick to provide a specific salt instead of a random one in order to

Regardless, adding the type signature as FYI in this comment somehow would make the point more explicit / difficult to miss:

>>> encryptPassphrase
	    :: MonadRandom m => Passphrase purpose -> m (Hash purpose)
>>> encryptPassphrase pwd (Passphrase @"salt" salt)
Hash "..."

if you don't find it too ugly.

Also, interesting trick 😮

[KtorZ]

I am all for better comments 👍

[Anviking]

👍