Add initial bindings to hashing algorithms, and add code style #1

Kleidukos · 2022-01-10T17:29:05Z

This PR brings:

Code guidelines for C FFI
Proper license for IOG / Cardano code
Bindings to hashing algorithms
- Blake2b
- SHA-256
- SHA-512

Dependencies

Kleidukos · 2022-01-10T21:01:46Z

src/Cryptography/LibSodium/FFI.hsc

+-- | @int sodium_compare(const void * const b1_, const void * const b2_, size_t len);@
+--
+-- <https://libsodium.gitbook.io/doc/helpers#comparing-large-numbers>
+foreign import capi unsafe "sodium.h sodium_compare" c_sodium_compare :: Ptr a -> Ptr a -> CSize -> IO CInt


Put that in its own module

Kleidukos · 2022-01-10T21:01:59Z

src/Cryptography/LibSodium/FFI.hsc

+-- From https://libsodium.gitbook.io/doc/advanced/sha-2_hash_function
+-- and https://libsodium.gitbook.io/doc/hashing/generic_hashing
+
+type CRYPTO_SHA256_BYTES = #{const crypto_hash_sha256_BYTES}
+type CRYPTO_SHA512_BYTES = #{const crypto_hash_sha512_BYTES}
+type CRYPTO_BLAKE2B_256_BYTES = #{const crypto_generichash_blake2b_BYTES}
+
+type CRYPTO_SHA256_STATE_SIZE = #{size crypto_hash_sha256_state}
+type CRYPTO_SHA512_STATE_SIZE = #{size crypto_hash_sha512_state}
+type CRYPTO_BLAKE2B_256_STATE_SIZE = #{size crypto_generichash_blake2b_state}
+
+type CRYPTO_SIGN_ED25519_BYTES = #{const crypto_sign_ed25519_BYTES}
+type CRYPTO_SIGN_ED25519_SEEDBYTES = #{const crypto_sign_ed25519_SEEDBYTES}
+type CRYPTO_SIGN_ED25519_PUBLICKEYBYTES = #{const crypto_sign_ed25519_PUBLICKEYBYTES}
+type CRYPTO_SIGN_ED25519_SECRETKEYBYTES = #{const crypto_sign_ed25519_SECRETKEYBYTES}


Everything goes

Kleidukos · 2022-01-10T21:02:10Z

src/Cryptography/LibSodium/Utils.hs

+
+-- A pointer which knows the size of underlying memory block
+newtype SizedPtr (n :: Nat) = SizedPtr (Ptr Void)


Kleidukos · 2022-01-10T21:02:26Z

src/Cryptography/LibSodium/Utils.hs

+
+-- | Like 'allocaBytes'.
+allocaSized :: forall n b. KnownNat n => (SizedPtr n -> IO b) -> IO b
+allocaSized k = allocaBytes (fromCInt size) (k . SizedPtr)
+  where
+    size :: CInt
+    size = fromInteger (natVal (Proxy @n))
+
+memcpySized :: forall n. KnownNat n => SizedPtr n -> SizedPtr n -> IO ()
+memcpySized (SizedPtr dest) (SizedPtr src) = void (c_memcpy dest src size)
+  where
+    size :: CSize
+    size = fromInteger (natVal (Proxy @n))
+
+memsetSized :: forall n. KnownNat n => SizedPtr n -> Word8 -> IO ()
+memsetSized (SizedPtr s) c = void (c_memset s (fromIntegral c) size)
+  where
+    size :: CSize
+    size = fromInteger (natVal (Proxy @n))
+
+fromCInt :: CInt -> Int
+fromCInt = fromIntegral


That can go away

Kleidukos · 2022-01-10T21:02:45Z

src/Cryptography/LibSodium/Utils.hs

+
+-------------------------------------------------------------------------------
+-- Some C functions
+-------------------------------------------------------------------------------
+
+-- | @void *memcpy(void *dest, const void *src, size_t n);@
+--
+-- Note: this is safe foreign import
+foreign import ccall "memcpy"
+    c_memcpy :: Ptr a -> Ptr a -> CSize -> IO (Ptr ())
+
+-- | @void *memset(void *s, int c, size_t n);@
+--
+-- Note: for sure zeroing memory use @c_sodium_memzero@.
+foreign import ccall "memset"
+    c_memset :: Ptr a -> CInt -> CSize -> IO (Ptr ())


That goes away

Kleidukos · 2022-01-10T21:03:07Z

src/Cryptography/LibSodium/FFI.hsc

+foreign import capi unsafe "sodium.h crypto_hash_sha256" c_crypto_hash_sha256 :: SizedPtr CRYPTO_SHA256_BYTES -> Ptr CUChar -> CULLong -> IO CInt
+
+-- | @int crypto_hash_sha256_init(crypto_hash_sha256_state *state);@
+foreign import capi unsafe "sodium.h crypto_hash_sha256_init" c_crypto_hash_sha256_init :: SizedPtr CRYPTO_SHA256_STATE_SIZE -> IO CInt
+
+-- | @int crypto_hash_sha256_update(crypto_hash_sha256_state *state, const unsigned char *in, unsigned long long inlen);@
+foreign import capi unsafe "sodium.h crypto_hash_sha256_update" c_crypto_hash_sha256_update :: SizedPtr CRYPTO_SHA256_STATE_SIZE -> Ptr CUChar -> CULLong -> IO CInt
+
+-- | @int crypto_hash_sha256_final(crypto_hash_sha256_state *state, unsigned char *out);@
+foreign import capi unsafe "sodium.h crypto_hash_sha256_final" c_crypto_hash_sha256_final :: SizedPtr CRYPTO_SHA256_STATE_SIZE -> SizedPtr CRYPTO_SHA256_BYTES -> IO CInt


Use the real C types instead of SizedPtr

Kleidukos · 2022-01-10T21:03:21Z

src/Cryptography/LibSodium/FFI.hsc

+foreign import capi unsafe "sodium.h crypto_generichash_blake2b" c_crypto_generichash_blake2b
+    :: Ptr out -> CSize
+    -> Ptr CUChar -> CULLong
+    -> Ptr key -> CSize
+    -> IO CInt


Document each parameter and their relation.

Kleidukos · 2022-01-10T21:05:42Z

src/Cryptography/LibSodium/FFI.hsc

+-- | @int crypto_generichash_blake2b(unsigned char *out, size_t outlen, const unsigned char *in, unsigned long long inlen, const unsigned char *key, size_t keylen);@
+--
+-- <https://libsodium.gitbook.io/doc/hashing/generic_hashing>
+foreign import capi unsafe "sodium.h crypto_generichash_blake2b" c_crypto_generichash_blake2b


Out parameter, this is where the result of the hash will go

Length of the result

In parameter ,what you want to hash

Length of what you want to hash

Key

Length of the key

Kleidukos · 2022-01-11T20:54:39Z

So, I'm a little worried here because:

The only signing algorithm here is Ed25519ph
The RFC says about *ph variants:

The Ed25519ph and Ed448ph variants are prehashed. […] These variants SHOULD NOT be used.

The crypto state is based on crypto_hash_sha512_state

typedef struct crypto_sign_ed25519ph_state {
    crypto_hash_sha512_state hs;
} crypto_sign_ed25519ph_state;

But the sha512 file starts with this warning:


/*
 * WARNING: Unless you absolutely need to use SHA512 for interoperability,
 * purposes, you might want to consider crypto_generichash() instead.
 * Unlike SHA512, crypto_generichash() is not vulnerable to length
 * extension attacks.
 */

@jmcardon Am I missing anything? Does that mean we should provide signing from another backend?

ghost · 2022-01-13T00:32:49Z

cbits/libsodium-stable/src/libsodium/include/sodium/version.h

+#define SODIUM_VERSION_STRING "1.0.18"
+
+#define SODIUM_LIBRARY_VERSION_MAJOR 10
+#define SODIUM_LIBRARY_VERSION_MINOR 3


Should these correspond to each other?

ghost · 2022-01-13T00:43:50Z

src/Cryptography/LibSodium/FFI.chs

+-- <https://libsodium.gitbook.io/doc/usage>
+--
+-- @since 0.0.1.0
+foreign import capi "sodium.h sodium_init"  c_sodium_init :: IO CInt


How do we ensure that users of the library call this? it would be nice to make sure it's run when the program starts without having to remember to do anything.

@jmcardon and @kozross suggested a secureMain function just like other defaultMain functions that exist, where the sodium_init function is called. Something like

main :: IO () main = secureMain $ do rest of the function

Yeah, I think that's the easiest way. You can (and indeed, should) also document that c_sodium_init must be called before any other functionality is used for those who don't want to use secureMain.

ghost · 2022-01-13T00:56:32Z

src/Cryptography/LibSodium/FFI.chs

+  -> IO CInt
+
+-- | @int crypto_generichash_blake2b_update(crypto_generichash_blake2b_state *state, const unsigned char *in, unsigned long long inlen)@
+foreign import capi unsafe "sodium.h crypto_generichash_blake2b_update" c_crypto_generichash_blake2b_update


It's hard to tell if these should be safe or unsafe, it feels like for small inputs unsafe would be fine, but if someone mmaps a 4TB file and hashes it, this is going to be problematic. I'd thought about exposing both and then on the Haskell side choosing based on the data size. Whether the runtime of hashing algorithms has security concerns I have no idea...

Good thinking

I'd say this is a case of 'offer both options, explain why they're different' for sure. Automagical deciding could be done at a higher level, but even then, I'm not sure if it's a good idea.

ghost · 2022-01-13T01:09:03Z

src/Cryptography/LibSodium/Hash/Types.chs

+    go outPtr arrPtr = traverse_
+      (\i -> peek @CUChar (plusPtr arrPtr i) >>= poke (plusPtr outPtr i)) [0..383]


Any chance this could be a memcpy? https://hackage.haskell.org/package/base-4.16.0.0/docs/Foreign-Marshal-Utils.html#v:copyBytes

Actually I'd rather generate those with c2hs, these are not here to stay. :)

ghost · 2022-01-13T01:09:33Z

src/Cryptography/LibSodium/Orphans.hs

+instance Ix CSize where
+  range (CSize m, CSize n) = CSize <$> range (m, n)
+  unsafeIndex (CSize m, CSize n) (CSize i) = unsafeIndex (m, n) i
+  inRange (CSize m, CSize n) (CSize i) = inRange (m, n) i


Might be a useful thing to get added to base

You don't say: https://gitlab.haskell.org/ghc/ghc/-/issues/20934

I'm honestly surprised these don't exist already.

Kleidukos force-pushed the add-initial-bindings branch 5 times, most recently from 84c1d33 to ca4f755 Compare January 10, 2022 19:08

Kleidukos commented Jan 10, 2022

View reviewed changes

Kleidukos force-pushed the add-initial-bindings branch 2 times, most recently from 3e2d8e5 to 174d2d0 Compare January 11, 2022 19:31

Kleidukos changed the title ~~Add initial bindings and code style~~ Add initial bindings to hashing algorithms and code style Jan 11, 2022

Kleidukos force-pushed the add-initial-bindings branch from fcdfb75 to 43f4e7a Compare January 12, 2022 08:35

Add initial bindings to hashing algorithms, and add code style

92eb677

Kleidukos force-pushed the add-initial-bindings branch from b722e5d to 92eb677 Compare January 13, 2022 00:13

Kleidukos changed the title ~~Add initial bindings to hashing algorithms and code style~~ Add initial bindings to hashing algorithms, and add code style Jan 13, 2022

fixup! Add initial bindings to hashing algorithms, and add code style

a37177f

ghost reviewed Jan 13, 2022

View reviewed changes

Kleidukos assigned kozross Jan 20, 2022

Kleidukos closed this Feb 8, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add initial bindings to hashing algorithms, and add code style #1

Add initial bindings to hashing algorithms, and add code style #1

Kleidukos commented Jan 10, 2022 •

edited

Kleidukos Jan 10, 2022

Kleidukos Jan 10, 2022

Kleidukos Jan 10, 2022

Kleidukos Jan 10, 2022

Kleidukos Jan 10, 2022

Kleidukos Jan 10, 2022

Kleidukos Jan 10, 2022

Kleidukos Jan 10, 2022

Kleidukos commented Jan 11, 2022

ghost Jan 13, 2022

ghost Jan 13, 2022

Kleidukos Jan 13, 2022

kozross Jan 13, 2022

Kleidukos Jan 13, 2022

ghost Jan 13, 2022

Kleidukos Jan 13, 2022

kozross Jan 13, 2022 •

edited

ghost Jan 13, 2022

Kleidukos Jan 13, 2022

ghost Jan 13, 2022

Kleidukos Jan 13, 2022

kozross Jan 13, 2022


		-- A pointer which knows the size of underlying memory block
		newtype SizedPtr (n :: Nat) = SizedPtr (Ptr Void)

		go outPtr arrPtr = traverse_
		(\i -> peek @CUChar (plusPtr arrPtr i) >>= poke (plusPtr outPtr i)) [0..383]

Add initial bindings to hashing algorithms, and add code style #1

Add initial bindings to hashing algorithms, and add code style #1

Conversation

Kleidukos commented Jan 10, 2022 • edited

Dependencies

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Kleidukos commented Jan 11, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kozross Jan 13, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Kleidukos commented Jan 10, 2022 •

edited

kozross Jan 13, 2022 •

edited