License	BSD-style
Maintainer	Olivier Chéron <olivier.cheron@gmail.com>
Stability	experimental
Portability	unknown
Safe Haskell	Safe-Inferred
Language	Haskell2010

Crypto.Store.CMS

Contents

Reading and writing PEM files
Content encapsulation
Signed data
- Signer information
Enveloped data
Digested data
Encrypted data
Authenticated data
Authenticated-enveloped data
Key derivation
Secret-key algorithms
RSA padding modes
CMS attributes
CMS standard attributes
Originator information
ASN.1 representation

Description

Cryptographic Message Syntax

RFC 5652: Cryptographic Message Syntax (CMS)
RFC 3370: Cryptographic Message Syntax (CMS) Algorithms
RFC 3560: Use of the RSAES-OAEP Key Transport Algorithm in the Cryptographic Message Syntax (CMS)
RFC 4056: Use of the RSASSA-PSS Signature Algorithm in Cryptographic Message Syntax (CMS)
RFC 3565: Use of the Advanced Encryption Standard (AES) Encryption Algorithm in Cryptographic Message Syntax (CMS)
RFC 5753: Use of Elliptic Curve Cryptography (ECC) Algorithms in Cryptographic Message Syntax (CMS)
RFC 5754: Using SHA2 Algorithms with Cryptographic Message Syntax
RFC 3211: Password-based Encryption for CMS
RFC 5083: Cryptographic Message Syntax (CMS) Authenticated-Enveloped-Data Content Type
RFC 5084: Using AES-CCM and AES-GCM Authenticated Encryption in the Cryptographic Message Syntax (CMS)
RFC 6476: Using Message Authentication Code (MAC) Encryption in the Cryptographic Message Syntax (CMS)
RFC 8103: Using ChaCha20-Poly1305 Authenticated Encryption in the Cryptographic Message Syntax (CMS)
RFC 8418: Use of the Elliptic Curve Diffie-Hellman Key Agreement Algorithm with X25519 and X448 in the Cryptographic Message Syntax (CMS)
RFC 8419: Use of Edwards-Curve Digital Signature Algorithm (EdDSA) Signatures in the Cryptographic Message Syntax (CMS)
RFC 8702: Use of the SHAKE One-Way Hash Functions in the Cryptographic Message Syntax (CMS)

Synopsis

data ContentType
- = DataType
- | SignedDataType
- | EnvelopedDataType
- | DigestedDataType
- | EncryptedDataType
- | AuthenticatedDataType
- | AuthEnvelopedDataType
data ContentInfo
- = DataCI ByteString
- | SignedDataCI (SignedData (Encap EncapsulatedContent))
- | EnvelopedDataCI (EnvelopedData (Encap EncryptedContent))
- | DigestedDataCI (DigestedData (Encap EncapsulatedContent))
- | EncryptedDataCI (EncryptedData (Encap EncryptedContent))
- | AuthenticatedDataCI (AuthenticatedData (Encap EncapsulatedContent))
- | AuthEnvelopedDataCI (AuthEnvelopedData (Encap EncryptedContent))
getContentType :: ContentInfo -> ContentType
readCMSFile :: FilePath -> IO [ContentInfo]
readCMSFileFromMemory :: ByteString -> [ContentInfo]
berToContentInfo :: ByteString -> Either StoreError ContentInfo
pemToContentInfo :: [Maybe ContentInfo] -> PEM -> [Maybe ContentInfo]
writeCMSFile :: FilePath -> [ContentInfo] -> IO ()
writeCMSFileToMemory :: [ContentInfo] -> ByteString
contentInfoToDER :: ContentInfo -> ByteString
contentInfoToPEM :: ContentInfo -> PEM
data Encap a
- = Detached
- | Attached a
fromEncap :: b -> (a -> b) -> Encap a -> b
class Encapsulates struct
isAttached :: Encapsulates struct => struct (Encap a) -> Bool
fromAttached :: (MonadFail m, Encapsulates struct) => struct (Encap a) -> m (struct a)
toAttachedCI :: Encapsulates struct => struct ByteString -> ContentInfo
isDetached :: Encapsulates struct => struct (Encap a) -> Bool
fromDetached :: (MonadFail m, Encapsulates struct) => b -> struct (Encap a) -> m (struct b)
toDetachedCI :: Encapsulates struct => struct ByteString -> (ByteString, ContentInfo)
type SignatureValue = ByteString
data SignatureAlg
- = RSAAnyHash
- | RSA DigestAlgorithm
- | RSAPSS PSSParams
- | DSA DigestAlgorithm
- | ECDSA DigestAlgorithm
- | Ed25519
- | Ed448
type EncapsulatedContent = ByteString
data SignedData content = SignedData {
- sdDigestAlgorithms :: [DigestAlgorithm]
- sdContentType :: ContentType
- sdEncapsulatedContent :: content
- sdCertificates :: [CertificateChoice]
- sdCRLs :: [RevocationInfoChoice]
- sdSignerInfos :: [SignerInfo]
}
type ProducerOfSI m = ContentType -> ByteString -> m (Either StoreError (SignerInfo, [CertificateChoice], [RevocationInfoChoice]))
type ConsumerOfSI m = ContentType -> ByteString -> SignerInfo -> [CertificateChoice] -> [RevocationInfoChoice] -> m Bool
signData :: Applicative f => [ProducerOfSI f] -> ContentInfo -> f (Either StoreError (SignedData EncapsulatedContent))
verifySignedData :: Monad m => ConsumerOfSI m -> SignedData EncapsulatedContent -> m (Either StoreError ContentInfo)
data SignerInfo = SignerInfo {
- siSignerId :: SignerIdentifier
- siDigestAlgorithm :: DigestAlgorithm
- siSignedAttrs :: [Attribute]
- siSignatureAlg :: SignatureAlg
- siSignature :: SignatureValue
- siUnsignedAttrs :: [Attribute]
}
data SignerIdentifier
- = SignerIASN IssuerAndSerialNumber
- | SignerSKI ByteString
data IssuerAndSerialNumber = IssuerAndSerialNumber {
- iasnIssuer :: DistinguishedName
- iasnSerial :: Integer
}
certSigner :: MonadRandom m => SignatureAlg -> PrivKey -> CertificateChain -> Maybe [Attribute] -> [Attribute] -> ProducerOfSI m
withPublicKey :: Applicative f => PubKey -> ConsumerOfSI f
withSignerKey :: Applicative f => ConsumerOfSI f
withSignerCertificate :: Applicative f => (Maybe DateTime -> CertificateChain -> f Bool) -> ConsumerOfSI f
type EncryptedKey = ByteString
data KeyEncryptionParams
- = PWRIKEK ContentEncryptionParams
- | AES128_WRAP
- | AES192_WRAP
- | AES256_WRAP
- | AES128_WRAP_PAD
- | AES192_WRAP_PAD
- | AES256_WRAP_PAD
- | DES_EDE3_WRAP
- | RC2_WRAP Int
data KeyTransportParams
- = RSAES
- | RSAESOAEP OAEPParams
data KeyAgreementParams
- = StdDH KeyAgreementKDF KeyEncryptionParams
- | CofactorDH KeyAgreementKDF KeyEncryptionParams
data KeyAgreementKDF
- = forall hashAlg.HashAlgorithm hashAlg => KA_X963_KDF (DigestProxy hashAlg)
- | forall hashAlg.HashAlgorithm hashAlg => KA_HKDF (DigestProxy hashAlg)
data RecipientInfo
- = KTRI KTRecipientInfo
- | KARI KARecipientInfo
- | KEKRI KEKRecipientInfo
- | PasswordRI PasswordRecipientInfo
data EnvelopedData content = EnvelopedData {
- evOriginatorInfo :: OriginatorInfo
- evRecipientInfos :: [RecipientInfo]
- evContentType :: ContentType
- evContentEncryptionParams :: ContentEncryptionParams
- evEncryptedContent :: content
- evUnprotectedAttrs :: [Attribute]
}
type ProducerOfRI m = ContentEncryptionKey -> m (Either StoreError RecipientInfo)
type ConsumerOfRI m = RecipientInfo -> m (Either StoreError ContentEncryptionKey)
envelopData :: Applicative f => OriginatorInfo -> ContentEncryptionKey -> ContentEncryptionParams -> [ProducerOfRI f] -> [Attribute] -> ContentInfo -> f (Either StoreError (EnvelopedData EncryptedContent))
openEnvelopedData :: Monad m => ConsumerOfRI m -> EnvelopedData EncryptedContent -> m (Either StoreError ContentInfo)
data KTRecipientInfo = KTRecipientInfo {
- ktRid :: RecipientIdentifier
- ktKeyTransportParams :: KeyTransportParams
- ktEncryptedKey :: EncryptedKey
}
data RecipientIdentifier
- = RecipientIASN IssuerAndSerialNumber
- | RecipientSKI ByteString
forKeyTransRecipient :: MonadRandom m => SignedCertificate -> KeyTransportParams -> ProducerOfRI m
withRecipientKeyTrans :: MonadRandom m => PrivKey -> ConsumerOfRI m
data KARecipientInfo = KARecipientInfo {
- kaOriginator :: OriginatorIdentifierOrKey
- kaUkm :: Maybe UserKeyingMaterial
- kaKeyAgreementParams :: KeyAgreementParams
- kaRecipientEncryptedKeys :: [RecipientEncryptedKey]
}
data OriginatorIdentifierOrKey
- = OriginatorIASN IssuerAndSerialNumber
- | OriginatorSKI ByteString
- | OriginatorPublic OriginatorPublicKey
data OriginatorPublicKey
data RecipientEncryptedKey = RecipientEncryptedKey {
- rekRid :: KeyAgreeRecipientIdentifier
- rekEncryptedKey :: EncryptedKey
}
data KeyAgreeRecipientIdentifier
- = KeyAgreeRecipientIASN IssuerAndSerialNumber
- | KeyAgreeRecipientKI KeyIdentifier
type UserKeyingMaterial = ByteString
forKeyAgreeRecipient :: MonadRandom m => SignedCertificate -> KeyAgreementParams -> ProducerOfRI m
withRecipientKeyAgree :: MonadRandom m => PrivKey -> SignedCertificate -> ConsumerOfRI m
data KEKRecipientInfo = KEKRecipientInfo {
- kekId :: KeyIdentifier
- kekKeyEncryptionParams :: KeyEncryptionParams
- kekEncryptedKey :: EncryptedKey
}
data KeyIdentifier = KeyIdentifier {
- keyIdentifier :: ByteString
- keyDate :: Maybe DateTime
- keyOther :: Maybe OtherKeyAttribute
}
data OtherKeyAttribute = OtherKeyAttribute {
- keyAttrId :: OID
- keyAttr :: [ASN1]
}
type KeyEncryptionKey = ByteString
forKeyRecipient :: MonadRandom m => KeyEncryptionKey -> KeyIdentifier -> KeyEncryptionParams -> ProducerOfRI m
withRecipientKey :: Applicative f => KeyEncryptionKey -> ConsumerOfRI f
data PasswordRecipientInfo = PasswordRecipientInfo {
- priKeyDerivationFunc :: KeyDerivationFunc
- priKeyEncryptionParams :: KeyEncryptionParams
- priEncryptedKey :: EncryptedKey
}
forPasswordRecipient :: MonadRandom m => Password -> KeyDerivationFunc -> KeyEncryptionParams -> ProducerOfRI m
withRecipientPassword :: Applicative f => Password -> ConsumerOfRI f
data DigestProxy hashAlg where
- MD2 :: DigestProxy MD2
- MD4 :: DigestProxy MD4
- MD5 :: DigestProxy MD5
- SHA1 :: DigestProxy SHA1
- SHA224 :: DigestProxy SHA224
- SHA256 :: DigestProxy SHA256
- SHA384 :: DigestProxy SHA384
- SHA512 :: DigestProxy SHA512
- SHAKE128_256 :: DigestProxy (SHAKE128 256)
- SHAKE256_512 :: DigestProxy (SHAKE256 512)
- SHAKE128 :: KnownNat n => Proxy n -> DigestProxy (SHAKE128 n)
- SHAKE256 :: KnownNat n => Proxy n -> DigestProxy (SHAKE256 n)
data DigestAlgorithm = forall hashAlg.HashAlgorithm hashAlg => DigestAlgorithm (DigestProxy hashAlg)
data DigestedData content = forall hashAlg.HashAlgorithm hashAlg => DigestedData {
- ddDigestAlgorithm :: DigestProxy hashAlg
- ddContentType :: ContentType
- ddEncapsulatedContent :: content
- ddDigest :: Digest hashAlg
}
digestData :: DigestAlgorithm -> ContentInfo -> DigestedData EncapsulatedContent
digestVerify :: DigestedData EncapsulatedContent -> Either StoreError ContentInfo
type ContentEncryptionKey = ByteString
data ContentEncryptionCipher cipher where
- DES :: ContentEncryptionCipher DES
- DES_EDE2 :: ContentEncryptionCipher DES_EDE2
- DES_EDE3 :: ContentEncryptionCipher DES_EDE3
- AES128 :: ContentEncryptionCipher AES128
- AES192 :: ContentEncryptionCipher AES192
- AES256 :: ContentEncryptionCipher AES256
- CAST5 :: ContentEncryptionCipher CAST5
- Camellia128 :: ContentEncryptionCipher Camellia128
data ContentEncryptionAlg
- = forall c.BlockCipher c => ECB (ContentEncryptionCipher c)
- | forall c.BlockCipher c => CBC (ContentEncryptionCipher c)
- | CBC_RC2
- | forall c.BlockCipher c => CFB (ContentEncryptionCipher c)
- | forall c.BlockCipher c => CTR (ContentEncryptionCipher c)
data ContentEncryptionParams
type EncryptedContent = ByteString
data EncryptedData content = EncryptedData {
- edContentType :: ContentType
- edContentEncryptionParams :: ContentEncryptionParams
- edEncryptedContent :: content
- edUnprotectedAttrs :: [Attribute]
}
generateEncryptionParams :: MonadRandom m => ContentEncryptionAlg -> m ContentEncryptionParams
generateRC2EncryptionParams :: MonadRandom m => Int -> m ContentEncryptionParams
getContentEncryptionAlg :: ContentEncryptionParams -> ContentEncryptionAlg
encryptData :: ContentEncryptionKey -> ContentEncryptionParams -> [Attribute] -> ContentInfo -> Either StoreError (EncryptedData EncryptedContent)
decryptData :: ContentEncryptionKey -> EncryptedData EncryptedContent -> Either StoreError ContentInfo
type AuthenticationKey = ContentEncryptionKey
data MACAlgorithm
- = forall hashAlg.HashAlgorithm hashAlg => HMAC (DigestProxy hashAlg)
- | forall n.KnownNat n => KMAC_SHAKE128 (Proxy n) ByteString
- | forall n.KnownNat n => KMAC_SHAKE256 (Proxy n) ByteString
type MessageAuthenticationCode = AuthTag
data AuthenticatedData content = AuthenticatedData {
- adOriginatorInfo :: OriginatorInfo
- adRecipientInfos :: [RecipientInfo]
- adMACAlgorithm :: MACAlgorithm
- adDigestAlgorithm :: Maybe DigestAlgorithm
- adContentType :: ContentType
- adEncapsulatedContent :: content
- adAuthAttrs :: [Attribute]
- adMAC :: MessageAuthenticationCode
- adUnauthAttrs :: [Attribute]
}
generateAuthenticatedData :: Applicative f => OriginatorInfo -> AuthenticationKey -> MACAlgorithm -> Maybe DigestAlgorithm -> [ProducerOfRI f] -> [Attribute] -> [Attribute] -> ContentInfo -> f (Either StoreError (AuthenticatedData EncapsulatedContent))
verifyAuthenticatedData :: Monad m => ConsumerOfRI m -> AuthenticatedData EncapsulatedContent -> m (Either StoreError ContentInfo)
data AuthContentEncryptionAlg
- = AUTH_ENC_128
- | AUTH_ENC_256
- | CHACHA20_POLY1305
- | forall c.BlockCipher c => CCM (ContentEncryptionCipher c)
- | forall c.BlockCipher c => GCM (ContentEncryptionCipher c)
data AuthContentEncryptionParams
data AuthEnvelopedData content = AuthEnvelopedData {
- aeOriginatorInfo :: OriginatorInfo
- aeRecipientInfos :: [RecipientInfo]
- aeContentType :: ContentType
- aeContentEncryptionParams :: ASN1ObjectExact AuthContentEncryptionParams
- aeEncryptedContent :: content
- aeAuthAttrs :: [Attribute]
- aeMAC :: MessageAuthenticationCode
- aeUnauthAttrs :: [Attribute]
}
generateAuthEnc128Params :: MonadRandom m => PBKDF2_PRF -> ContentEncryptionAlg -> MACAlgorithm -> m AuthContentEncryptionParams
generateAuthEnc256Params :: MonadRandom m => PBKDF2_PRF -> ContentEncryptionAlg -> MACAlgorithm -> m AuthContentEncryptionParams
generateChaChaPoly1305Params :: MonadRandom m => m AuthContentEncryptionParams
generateCCMParams :: (MonadRandom m, BlockCipher c) => ContentEncryptionCipher c -> CCM_M -> CCM_L -> m AuthContentEncryptionParams
generateGCMParams :: (MonadRandom m, BlockCipher c) => ContentEncryptionCipher c -> Int -> m AuthContentEncryptionParams
authEnvelopData :: Applicative f => OriginatorInfo -> ContentEncryptionKey -> AuthContentEncryptionParams -> [ProducerOfRI f] -> [Attribute] -> [Attribute] -> ContentInfo -> f (Either StoreError (AuthEnvelopedData EncryptedContent))
openAuthEnvelopedData :: Monad m => ConsumerOfRI m -> AuthEnvelopedData EncryptedContent -> m (Either StoreError ContentInfo)
type Salt = ByteString
generateSalt :: MonadRandom m => Int -> m Salt
data KeyDerivationFunc
- = PBKDF2 {
  - pbkdf2Salt :: Salt
  - pbkdf2IterationCount :: Int
  - pbkdf2KeyLength :: Maybe Int
  - pbkdf2Prf :: PBKDF2_PRF
  }
- | Scrypt {
  - scryptSalt :: Salt
  - scryptN :: Word64
  - scryptR :: Int
  - scryptP :: Int
  - scryptKeyLength :: Maybe Int
  }
data PBKDF2_PRF
- = PBKDF2_SHA1
- | PBKDF2_SHA256
- | PBKDF2_SHA512
class HasKeySize params where
- getKeySizeSpecifier :: params -> KeySizeSpecifier
generateKey :: (HasKeySize params, MonadRandom m, ByteArray key) => params -> m key
newtype MaskGenerationFunc = MGF1 DigestAlgorithm
data OAEPParams = OAEPParams {
- oaepHashAlgorithm :: DigestAlgorithm
- oaepMaskGenAlgorithm :: MaskGenerationFunc
}
data PSSParams = PSSParams {
- pssHashAlgorithm :: DigestAlgorithm
- pssMaskGenAlgorithm :: MaskGenerationFunc
- pssSaltLength :: Int
}
data Attribute = Attribute {
- attrType :: OID
- attrValues :: [ASN1]
}
findAttribute :: OID -> [Attribute] -> Maybe [ASN1]
setAttribute :: OID -> [ASN1] -> [Attribute] -> [Attribute]
filterAttributes :: (OID -> Bool) -> [Attribute] -> [Attribute]
getSigningTimeAttr :: [Attribute] -> Maybe DateTime
setSigningTimeAttr :: DateTime -> [Attribute] -> [Attribute]
setSigningTimeAttrCurrent :: MonadIO m => [Attribute] -> m [Attribute]
data OriginatorInfo = OriginatorInfo {
- originatorCerts :: [CertificateChoice]
- originatorCRLs :: [RevocationInfoChoice]
}
data CertificateChoice
- = CertificateCertificate SignedCertificate
- | CertificateOther OtherCertificateFormat
data OtherCertificateFormat = OtherCertificateFormat {
- otherCertFormat :: OID
- otherCertValues :: [ASN1]
}
data RevocationInfoChoice
- = RevocationInfoCRL SignedCRL
- | RevocationInfoOther OtherRevocationInfoFormat
data OtherRevocationInfoFormat = OtherRevocationInfoFormat {
- otherRevInfoFormat :: OID
- otherRevInfoValues :: [ASN1]
}
data ASN1ObjectExact a

Documentation

data ContentType Source #

CMS content information type.

Constructors

DataType	Arbitrary octet string
SignedDataType	Signed content info
EnvelopedDataType	Enveloped content info
DigestedDataType	Content info with associated digest
EncryptedDataType	Encrypted content info
AuthenticatedDataType	Authenticated content info
AuthEnvelopedDataType	Authenticated-enveloped content info

Instances

Instances details

OIDNameable ContentType Source #
Instance details Defined in Crypto.Store.CMS.Type Methods fromObjectID :: OID -> Maybe ContentType
OIDable ContentType Source #
Instance details Defined in Crypto.Store.CMS.Type Methods getObjectID :: ContentType -> OID
Show ContentType Source #
Instance details Defined in Crypto.Store.CMS.Type Methods showsPrec :: Int -> ContentType -> ShowS Source # show :: ContentType -> String Source # showList :: [ContentType] -> ShowS Source #
Eq ContentType Source #
Instance details Defined in Crypto.Store.CMS.Type Methods (==) :: ContentType -> ContentType -> Bool Source # (/=) :: ContentType -> ContentType -> Bool Source #

data ContentInfo Source #

CMS content information.

Constructors

DataCI ByteString	Arbitrary octet string
SignedDataCI (SignedData (Encap EncapsulatedContent))	Signed content info
EnvelopedDataCI (EnvelopedData (Encap EncryptedContent))	Enveloped content info
DigestedDataCI (DigestedData (Encap EncapsulatedContent))	Content info with associated digest
EncryptedDataCI (EncryptedData (Encap EncryptedContent))	Encrypted content info
AuthenticatedDataCI (AuthenticatedData (Encap EncapsulatedContent))	Authenticatedcontent info
AuthEnvelopedDataCI (AuthEnvelopedData (Encap EncryptedContent))	Authenticated-enveloped content info

Instances

Instances details

Show ContentInfo Source #
Instance details Defined in Crypto.Store.CMS.Info Methods showsPrec :: Int -> ContentInfo -> ShowS Source # show :: ContentInfo -> String Source # showList :: [ContentInfo] -> ShowS Source #
Eq ContentInfo Source #
Instance details Defined in Crypto.Store.CMS.Info Methods (==) :: ContentInfo -> ContentInfo -> Bool Source # (/=) :: ContentInfo -> ContentInfo -> Bool Source #

getContentType :: ContentInfo -> ContentType Source #

Get the type of a content info.

Reading and writing PEM files

readCMSFile :: FilePath -> IO [ContentInfo] Source #

Read content info elements from a PEM file.

readCMSFileFromMemory :: ByteString -> [ContentInfo] Source #

Read content info elements from a bytearray in PEM format.

berToContentInfo :: ByteString -> Either StoreError ContentInfo Source #

Read a content info from a bytearray in BER format.

pemToContentInfo :: [Maybe ContentInfo] -> PEM -> [Maybe ContentInfo] Source #

Read a content info from a PEM element and add it to the accumulator list.

writeCMSFile :: FilePath -> [ContentInfo] -> IO () Source #

Write content info elements to a PEM file.

writeCMSFileToMemory :: [ContentInfo] -> ByteString Source #

Write content info elements to a bytearray in PEM format.

contentInfoToDER :: ContentInfo -> ByteString Source #

Generate a bytearray in DER format for a content info.

contentInfoToPEM :: ContentInfo -> PEM Source #

Generate PEM for a content info.

Content encapsulation

data Encap a Source #

Denote the state of encapsulated content in a CMS data structure. This type is isomorphic to Maybe.

Constructors

Detached	Content is stored externally to the structure
Attached a	Content is stored inside the CMS struture

Instances

Instances details

Foldable Encap Source #
Instance details Defined in Crypto.Store.CMS.Type Methods fold :: Monoid m => Encap m -> m Source # foldMap :: Monoid m => (a -> m) -> Encap a -> m Source # foldMap' :: Monoid m => (a -> m) -> Encap a -> m Source # foldr :: (a -> b -> b) -> b -> Encap a -> b Source # foldr' :: (a -> b -> b) -> b -> Encap a -> b Source # foldl :: (b -> a -> b) -> b -> Encap a -> b Source # foldl' :: (b -> a -> b) -> b -> Encap a -> b Source # foldr1 :: (a -> a -> a) -> Encap a -> a Source # foldl1 :: (a -> a -> a) -> Encap a -> a Source # toList :: Encap a -> [a] Source # null :: Encap a -> Bool Source # length :: Encap a -> Int Source # elem :: Eq a => a -> Encap a -> Bool Source # maximum :: Ord a => Encap a -> a Source # minimum :: Ord a => Encap a -> a Source # sum :: Num a => Encap a -> a Source # product :: Num a => Encap a -> a Source #
Traversable Encap Source #
Instance details Defined in Crypto.Store.CMS.Type Methods traverse :: Applicative f => (a -> f b) -> Encap a -> f (Encap b) Source # sequenceA :: Applicative f => Encap (f a) -> f (Encap a) Source # mapM :: Monad m => (a -> m b) -> Encap a -> m (Encap b) Source # sequence :: Monad m => Encap (m a) -> m (Encap a) Source #
Applicative Encap Source #
Instance details Defined in Crypto.Store.CMS.Type Methods pure :: a -> Encap a Source # (<>) :: Encap (a -> b) -> Encap a -> Encap b Source # liftA2 :: (a -> b -> c) -> Encap a -> Encap b -> Encap c Source # (>) :: Encap a -> Encap b -> Encap b Source # (<*) :: Encap a -> Encap b -> Encap a Source #
Functor Encap Source #
Instance details Defined in Crypto.Store.CMS.Type Methods fmap :: (a -> b) -> Encap a -> Encap b Source # (<$) :: a -> Encap b -> Encap a Source #
Show a => Show (Encap a) Source #
Instance details Defined in Crypto.Store.CMS.Type Methods showsPrec :: Int -> Encap a -> ShowS Source # show :: Encap a -> String Source # showList :: [Encap a] -> ShowS Source #
Eq a => Eq (Encap a) Source #
Instance details Defined in Crypto.Store.CMS.Type Methods (==) :: Encap a -> Encap a -> Bool Source # (/=) :: Encap a -> Encap a -> Bool Source #

fromEncap :: b -> (a -> b) -> Encap a -> b Source #

Fold over an Encap value. This is similar to function maybe. If the content is detached, the first argument is returned. Otherwise the second argument is applied to the content.

class Encapsulates struct Source #

Class of data structures with inner content that may be stored externally. This class has instances for each CMS content type containing other encapsulated or encrypted content info.

Functions fromAttached and fromDetached are used to introspect encapsulation state (attached or detached), and recover a data structure with actionable content.

Functions toAttachedCI and toDetachedCI are needed to decide about the outer encapsulation state and build a ContentInfo.

Minimal complete definition

lens, toCI

Instances

Instances details

Encapsulates AuthEnvelopedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> AuthEnvelopedData a -> f (AuthEnvelopedData b) toCI :: AuthEnvelopedData (Encap ByteString) -> ContentInfo
Encapsulates AuthenticatedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> AuthenticatedData a -> f (AuthenticatedData b) toCI :: AuthenticatedData (Encap ByteString) -> ContentInfo
Encapsulates DigestedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> DigestedData a -> f (DigestedData b) toCI :: DigestedData (Encap ByteString) -> ContentInfo
Encapsulates EncryptedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> EncryptedData a -> f (EncryptedData b) toCI :: EncryptedData (Encap ByteString) -> ContentInfo
Encapsulates EnvelopedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> EnvelopedData a -> f (EnvelopedData b) toCI :: EnvelopedData (Encap ByteString) -> ContentInfo
Encapsulates SignedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> SignedData a -> f (SignedData b) toCI :: SignedData (Encap ByteString) -> ContentInfo

isAttached :: Encapsulates struct => struct (Encap a) -> Bool Source #

Return True when the encapsulated content is attached.

fromAttached :: (MonadFail m, Encapsulates struct) => struct (Encap a) -> m (struct a) Source #

Unwrap the encapsulation, assuming the inner content is inside the data structure. The monadic computation fails if the content was detached.

toAttachedCI :: Encapsulates struct => struct ByteString -> ContentInfo Source #

Transform the data structure into a content info, keeping the encapsulated content attached. May be applied to structures with EncapsulatedContent or EncryptedContent.

isDetached :: Encapsulates struct => struct (Encap a) -> Bool Source #

Return True when the encapsulated content is detached.

fromDetached :: (MonadFail m, Encapsulates struct) => b -> struct (Encap a) -> m (struct b) Source #

Recover the original data structure from a detached encapsulation and the external content. The monadic computation fails if the content was attached.

toDetachedCI :: Encapsulates struct => struct ByteString -> (ByteString, ContentInfo) Source #

Transform the data structure into a content info, detaching the encapsulated content. May be applied to structures with EncapsulatedContent or EncryptedContent.

Signed data

type SignatureValue = ByteString Source #

Signature value.

data SignatureAlg Source #

CMS signature algorithms and associated parameters.

Constructors

RSAAnyHash
RSA DigestAlgorithm
RSAPSS PSSParams
DSA DigestAlgorithm
ECDSA DigestAlgorithm
Ed25519
Ed448

Instances

Instances details

Show SignatureAlg Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> SignatureAlg -> ShowS Source # show :: SignatureAlg -> String Source # showList :: [SignatureAlg] -> ShowS Source #
Eq SignatureAlg Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: SignatureAlg -> SignatureAlg -> Bool Source # (/=) :: SignatureAlg -> SignatureAlg -> Bool Source #

type EncapsulatedContent = ByteString Source #

Encapsulated content.

data SignedData content Source #

Signed content information.

Constructors

SignedData
Fields sdDigestAlgorithms :: [DigestAlgorithm] Digest algorithms sdContentType :: ContentType Inner content type sdEncapsulatedContent :: content Encapsulated content sdCertificates :: [CertificateChoice] The collection of certificates sdCRLs :: [RevocationInfoChoice] The collection of CRLs sdSignerInfos :: [SignerInfo] Per-signer information

Instances

Instances details

Encapsulates SignedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> SignedData a -> f (SignedData b) toCI :: SignedData (Encap ByteString) -> ContentInfo
Show content => Show (SignedData content) Source #
Instance details Defined in Crypto.Store.CMS.Signed Methods showsPrec :: Int -> SignedData content -> ShowS Source # show :: SignedData content -> String Source # showList :: [SignedData content] -> ShowS Source #
Eq content => Eq (SignedData content) Source #
Instance details Defined in Crypto.Store.CMS.Signed Methods (==) :: SignedData content -> SignedData content -> Bool Source # (/=) :: SignedData content -> SignedData content -> Bool Source #

type ProducerOfSI m = ContentType -> ByteString -> m (Either StoreError (SignerInfo, [CertificateChoice], [RevocationInfoChoice])) Source #

Function able to produce a SignerInfo.

type ConsumerOfSI m = ContentType -> ByteString -> SignerInfo -> [CertificateChoice] -> [RevocationInfoChoice] -> m Bool Source #

Function able to consume a SignerInfo.

signData :: Applicative f => [ProducerOfSI f] -> ContentInfo -> f (Either StoreError (SignedData EncapsulatedContent)) Source #

Add a signed-data layer on the specified content info. The content is processed by one or several ProducerOfSI functions to create signer info elements.

verifySignedData :: Monad m => ConsumerOfSI m -> SignedData EncapsulatedContent -> m (Either StoreError ContentInfo) Source #

Verify a signed content info using the specified ConsumerOfSI function. Verification of at least one signer info must be successful in order to return the inner content info.

Signer information

data SignerInfo Source #

Information related to a signer of a SignedData. An element contains the signature material that was produced.

Constructors

SignerInfo
Fields siSignerId :: SignerIdentifier Identifier of the signer certificate siDigestAlgorithm :: DigestAlgorithm Digest algorithm used for the signature siSignedAttrs :: [Attribute] Optional signed attributes siSignatureAlg :: SignatureAlg Algorithm used for signature siSignature :: SignatureValue The signature value siUnsignedAttrs :: [Attribute] Optional unsigned attributes

Instances

Instances details

Show SignerInfo Source #
Instance details Defined in Crypto.Store.CMS.Signed Methods showsPrec :: Int -> SignerInfo -> ShowS Source # show :: SignerInfo -> String Source # showList :: [SignerInfo] -> ShowS Source #
Eq SignerInfo Source #
Instance details Defined in Crypto.Store.CMS.Signed Methods (==) :: SignerInfo -> SignerInfo -> Bool Source # (/=) :: SignerInfo -> SignerInfo -> Bool Source #

data SignerIdentifier Source #

Union type related to identification of the signer certificate.

Constructors

SignerIASN IssuerAndSerialNumber	Issuer and Serial Number
SignerSKI ByteString	Subject Key Identifier

Instances

Instances details

Show SignerIdentifier Source #
Instance details Defined in Crypto.Store.CMS.Signed Methods showsPrec :: Int -> SignerIdentifier -> ShowS Source # show :: SignerIdentifier -> String Source # showList :: [SignerIdentifier] -> ShowS Source #
Eq SignerIdentifier Source #
Instance details Defined in Crypto.Store.CMS.Signed Methods (==) :: SignerIdentifier -> SignerIdentifier -> Bool Source # (/=) :: SignerIdentifier -> SignerIdentifier -> Bool Source #

data IssuerAndSerialNumber Source #

Identification of a certificate using the issuer DN and serial number.

Constructors

IssuerAndSerialNumber
Fields iasnIssuer :: DistinguishedName Distinguished name of the certificate issuer iasnSerial :: Integer Issuer-specific certificate serial number

Instances

Instances details

Show IssuerAndSerialNumber Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> IssuerAndSerialNumber -> ShowS Source # show :: IssuerAndSerialNumber -> String Source # showList :: [IssuerAndSerialNumber] -> ShowS Source #
Eq IssuerAndSerialNumber Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: IssuerAndSerialNumber -> IssuerAndSerialNumber -> Bool Source # (/=) :: IssuerAndSerialNumber -> IssuerAndSerialNumber -> Bool Source #

certSigner :: MonadRandom m => SignatureAlg -> PrivKey -> CertificateChain -> Maybe [Attribute] -> [Attribute] -> ProducerOfSI m Source #

Create a signer info with the specified signature algorithm and credentials.

Two lists of optional attributes can be provided. The attributes will be part of message signature when provided in the first list.

When the first list of attributes is provided, even empty list, signature is computed from a digest of the content. When the list of attributes is Nothing, no intermediate digest is used and the signature is computed from the full message.

withPublicKey :: Applicative f => PubKey -> ConsumerOfSI f Source #

Verify that the signature was produced from the specified public key. Ignores all certificates and CRLs contained in the signed data.

withSignerKey :: Applicative f => ConsumerOfSI f Source #

Verify that the signature is valid with one of the X.509 certificates contained in the signed data, but does not validate that the certificates are valid. All transmitted certificates are implicitely trusted and all CRLs are ignored.

withSignerCertificate :: Applicative f => (Maybe DateTime -> CertificateChain -> f Bool) -> ConsumerOfSI f Source #

Verify that the signature is valid with one of the X.509 certificates contained in the signed data, and verify that the signer certificate is valid using the validation function supplied. All CRLs are ignored.

Enveloped data

type EncryptedKey = ByteString Source #

Encrypted key.

data KeyEncryptionParams Source #

Key encryption algorithm with associated parameters (i.e. the underlying encryption algorithm).

Constructors

PWRIKEK ContentEncryptionParams	PWRI-KEK key wrap algorithm
AES128_WRAP	AES-128 key wrap
AES192_WRAP	AES-192 key wrap
AES256_WRAP	AES-256 key wrap
AES128_WRAP_PAD	AES-128 extended key wrap
AES192_WRAP_PAD	AES-192 extended key wrap
AES256_WRAP_PAD	AES-256 extended key wrap
DES_EDE3_WRAP	Triple-DES key wrap
RC2_WRAP Int	RC2 key wrap with effective key length

Instances

Instances details

Show KeyEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> KeyEncryptionParams -> ShowS Source # show :: KeyEncryptionParams -> String Source # showList :: [KeyEncryptionParams] -> ShowS Source #
HasKeySize KeyEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: KeyEncryptionParams -> KeySizeSpecifier Source #
Eq KeyEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: KeyEncryptionParams -> KeyEncryptionParams -> Bool Source # (/=) :: KeyEncryptionParams -> KeyEncryptionParams -> Bool Source #

data KeyTransportParams Source #

Key transport algorithm with associated parameters.

Constructors

RSAES	RSAES-PKCS1
RSAESOAEP OAEPParams	RSAES-OAEP

Instances

Instances details

Show KeyTransportParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> KeyTransportParams -> ShowS Source # show :: KeyTransportParams -> String Source # showList :: [KeyTransportParams] -> ShowS Source #
Eq KeyTransportParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: KeyTransportParams -> KeyTransportParams -> Bool Source # (/=) :: KeyTransportParams -> KeyTransportParams -> Bool Source #

data KeyAgreementParams Source #

Key agreement algorithm with associated parameters.

Constructors

StdDH KeyAgreementKDF KeyEncryptionParams	1-Pass D-H with Stardard ECDH
CofactorDH KeyAgreementKDF KeyEncryptionParams	1-Pass D-H with Cofactor ECDH

Instances

Instances details

Show KeyAgreementParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> KeyAgreementParams -> ShowS Source # show :: KeyAgreementParams -> String Source # showList :: [KeyAgreementParams] -> ShowS Source #
Eq KeyAgreementParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: KeyAgreementParams -> KeyAgreementParams -> Bool Source # (/=) :: KeyAgreementParams -> KeyAgreementParams -> Bool Source #

data KeyAgreementKDF Source #

Key derivation function used for key agreement.

Constructors

forall hashAlg.HashAlgorithm hashAlg => KA_X963_KDF (DigestProxy hashAlg)	ANSI-X9.63-KDF key derivation function
forall hashAlg.HashAlgorithm hashAlg => KA_HKDF (DigestProxy hashAlg)	Extract-and-Expand HMAC-based key derivation function

Instances

Instances details

Show KeyAgreementKDF Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> KeyAgreementKDF -> ShowS Source # show :: KeyAgreementKDF -> String Source # showList :: [KeyAgreementKDF] -> ShowS Source #
Eq KeyAgreementKDF Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: KeyAgreementKDF -> KeyAgreementKDF -> Bool Source # (/=) :: KeyAgreementKDF -> KeyAgreementKDF -> Bool Source #

data RecipientInfo Source #

Information for a recipient of an EnvelopedData. An element contains the content-encryption key in encrypted form.

Constructors

KTRI KTRecipientInfo	Recipient using key transport
KARI KARecipientInfo	Recipient using key agreement
KEKRI KEKRecipientInfo	Recipient using key encryption
PasswordRI PasswordRecipientInfo	Recipient using password-based protection

Instances

Instances details

Show RecipientInfo Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> RecipientInfo -> ShowS Source # show :: RecipientInfo -> String Source # showList :: [RecipientInfo] -> ShowS Source #
Eq RecipientInfo Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: RecipientInfo -> RecipientInfo -> Bool Source # (/=) :: RecipientInfo -> RecipientInfo -> Bool Source #

data EnvelopedData content Source #

Enveloped content information.

Constructors

EnvelopedData

Fields

evOriginatorInfo :: OriginatorInfo
Optional information about the originator
evRecipientInfos :: [RecipientInfo]
Information for recipients, allowing to decrypt the content
evContentType :: ContentType
Inner content type
evContentEncryptionParams :: ContentEncryptionParams
Encryption algorithm
evEncryptedContent :: content
Encrypted content info
evUnprotectedAttrs :: [Attribute]
Optional unprotected attributes

Instances

Instances details

Encapsulates EnvelopedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> EnvelopedData a -> f (EnvelopedData b) toCI :: EnvelopedData (Encap ByteString) -> ContentInfo
Show content => Show (EnvelopedData content) Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> EnvelopedData content -> ShowS Source # show :: EnvelopedData content -> String Source # showList :: [EnvelopedData content] -> ShowS Source #
Eq content => Eq (EnvelopedData content) Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: EnvelopedData content -> EnvelopedData content -> Bool Source # (/=) :: EnvelopedData content -> EnvelopedData content -> Bool Source #

type ProducerOfRI m = ContentEncryptionKey -> m (Either StoreError RecipientInfo) Source #

Function able to produce a RecipientInfo.

type ConsumerOfRI m = RecipientInfo -> m (Either StoreError ContentEncryptionKey) Source #

Function able to consume a RecipientInfo.

envelopData :: Applicative f => OriginatorInfo -> ContentEncryptionKey -> ContentEncryptionParams -> [ProducerOfRI f] -> [Attribute] -> ContentInfo -> f (Either StoreError (EnvelopedData EncryptedContent)) Source #

Add an enveloped-data layer on the specified content info. The content is encrypted with specified key and algorithm. The key is then processed by one or several ProducerOfRI functions to create recipient info elements.

Some optional attributes can be added but will not be encrypted.

openEnvelopedData :: Monad m => ConsumerOfRI m -> EnvelopedData EncryptedContent -> m (Either StoreError ContentInfo) Source #

Recover an enveloped content info using the specified ConsumerOfRI function.

Key Transport recipients

data KTRecipientInfo Source #

Recipient using key transport.

Constructors

KTRecipientInfo
Fields ktRid :: RecipientIdentifier identifier of recipient ktKeyTransportParams :: KeyTransportParams key transport algorithm ktEncryptedKey :: EncryptedKey encrypted content-encryption key

Instances

Instances details

Show KTRecipientInfo Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> KTRecipientInfo -> ShowS Source # show :: KTRecipientInfo -> String Source # showList :: [KTRecipientInfo] -> ShowS Source #
Eq KTRecipientInfo Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: KTRecipientInfo -> KTRecipientInfo -> Bool Source # (/=) :: KTRecipientInfo -> KTRecipientInfo -> Bool Source #

data RecipientIdentifier Source #

Union type related to identification of the recipient.

Constructors

RecipientIASN IssuerAndSerialNumber	Issuer and Serial Number
RecipientSKI ByteString	Subject Key Identifier

Instances

Instances details

Show RecipientIdentifier Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> RecipientIdentifier -> ShowS Source # show :: RecipientIdentifier -> String Source # showList :: [RecipientIdentifier] -> ShowS Source #
Eq RecipientIdentifier Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: RecipientIdentifier -> RecipientIdentifier -> Bool Source # (/=) :: RecipientIdentifier -> RecipientIdentifier -> Bool Source #

forKeyTransRecipient :: MonadRandom m => SignedCertificate -> KeyTransportParams -> ProducerOfRI m Source #

Generate a Key Transport recipient from a certificate and desired algorithm. The recipient will contain certificate identifier.

This function can be used as parameter to envelopData.

withRecipientKeyTrans :: MonadRandom m => PrivKey -> ConsumerOfRI m Source #

Use a Key Transport recipient, knowing the private key.

This function can be used as parameter to openEnvelopedData.

Key Agreement recipients

data KARecipientInfo Source #

Recipient using key agreement.

Constructors

KARecipientInfo
Fields kaOriginator :: OriginatorIdentifierOrKey identifier of orginator or anonymous key kaUkm :: Maybe UserKeyingMaterial user keying material kaKeyAgreementParams :: KeyAgreementParams key agreement algorithm kaRecipientEncryptedKeys :: [RecipientEncryptedKey] encrypted content-encryption key for one or multiple recipients

Instances

Instances details

Show KARecipientInfo Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> KARecipientInfo -> ShowS Source # show :: KARecipientInfo -> String Source # showList :: [KARecipientInfo] -> ShowS Source #
Eq KARecipientInfo Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: KARecipientInfo -> KARecipientInfo -> Bool Source # (/=) :: KARecipientInfo -> KARecipientInfo -> Bool Source #

data OriginatorIdentifierOrKey Source #

Union type related to identification of the originator.

Constructors

OriginatorIASN IssuerAndSerialNumber	Issuer and Serial Number
OriginatorSKI ByteString	Subject Key Identifier
OriginatorPublic OriginatorPublicKey	Anonymous public key

Instances

Instances details

Show OriginatorIdentifierOrKey Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> OriginatorIdentifierOrKey -> ShowS Source # show :: OriginatorIdentifierOrKey -> String Source # showList :: [OriginatorIdentifierOrKey] -> ShowS Source #
Eq OriginatorIdentifierOrKey Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: OriginatorIdentifierOrKey -> OriginatorIdentifierOrKey -> Bool Source # (/=) :: OriginatorIdentifierOrKey -> OriginatorIdentifierOrKey -> Bool Source #

data OriginatorPublicKey Source #

Originator public key used for key-agreement. Contrary to PubKey the domain parameters are not used and may be left empty.

Instances

Instances details

Show OriginatorPublicKey Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> OriginatorPublicKey -> ShowS Source # show :: OriginatorPublicKey -> String Source # showList :: [OriginatorPublicKey] -> ShowS Source #
Eq OriginatorPublicKey Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: OriginatorPublicKey -> OriginatorPublicKey -> Bool Source # (/=) :: OriginatorPublicKey -> OriginatorPublicKey -> Bool Source #

data RecipientEncryptedKey Source #

Encrypted key for a recipient in a key-agreement RI.

Constructors

RecipientEncryptedKey
Fields rekRid :: KeyAgreeRecipientIdentifier identifier of recipient rekEncryptedKey :: EncryptedKey encrypted content-encryption key

Instances

Instances details

Show RecipientEncryptedKey Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> RecipientEncryptedKey -> ShowS Source # show :: RecipientEncryptedKey -> String Source # showList :: [RecipientEncryptedKey] -> ShowS Source #
Eq RecipientEncryptedKey Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: RecipientEncryptedKey -> RecipientEncryptedKey -> Bool Source # (/=) :: RecipientEncryptedKey -> RecipientEncryptedKey -> Bool Source #

data KeyAgreeRecipientIdentifier Source #

Union type related to identification of a key-agreement recipient.

Constructors

KeyAgreeRecipientIASN IssuerAndSerialNumber	Issuer and Serial Number
KeyAgreeRecipientKI KeyIdentifier	Key identifier

Instances

Instances details

Show KeyAgreeRecipientIdentifier Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> KeyAgreeRecipientIdentifier -> ShowS Source # show :: KeyAgreeRecipientIdentifier -> String Source # showList :: [KeyAgreeRecipientIdentifier] -> ShowS Source #
Eq KeyAgreeRecipientIdentifier Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: KeyAgreeRecipientIdentifier -> KeyAgreeRecipientIdentifier -> Bool Source # (/=) :: KeyAgreeRecipientIdentifier -> KeyAgreeRecipientIdentifier -> Bool Source #

type UserKeyingMaterial = ByteString Source #

User keying material.

forKeyAgreeRecipient :: MonadRandom m => SignedCertificate -> KeyAgreementParams -> ProducerOfRI m Source #

Generate a Key Agreement recipient from a certificate and desired algorithm. The recipient info will contain an ephemeral public key.

This function can be used as parameter to envelopData.

To avoid decreasing the security strength, Key Encryption parameters should use a key size equal or greater than the content encryption key.

withRecipientKeyAgree :: MonadRandom m => PrivKey -> SignedCertificate -> ConsumerOfRI m Source #

Use a Key Agreement recipient, knowing the recipient private key. The recipient certificate is also required to locate which encrypted key to use.

This function can be used as parameter to openEnvelopedData.

Key Encryption Key recipients

data KEKRecipientInfo Source #

Recipient using key encryption.

Constructors

KEKRecipientInfo
Fields kekId :: KeyIdentifier identifier of key encryption key kekKeyEncryptionParams :: KeyEncryptionParams key encryption algorithm kekEncryptedKey :: EncryptedKey encrypted content-encryption key

Instances

Instances details

Show KEKRecipientInfo Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> KEKRecipientInfo -> ShowS Source # show :: KEKRecipientInfo -> String Source # showList :: [KEKRecipientInfo] -> ShowS Source #
Eq KEKRecipientInfo Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: KEKRecipientInfo -> KEKRecipientInfo -> Bool Source # (/=) :: KEKRecipientInfo -> KEKRecipientInfo -> Bool Source #

data KeyIdentifier Source #

Key identifier and optional attributes.

Constructors

KeyIdentifier
Fields keyIdentifier :: ByteString identifier of the key keyDate :: Maybe DateTime optional timestamp keyOther :: Maybe OtherKeyAttribute optional information

Instances

Instances details

Show KeyIdentifier Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> KeyIdentifier -> ShowS Source # show :: KeyIdentifier -> String Source # showList :: [KeyIdentifier] -> ShowS Source #
Eq KeyIdentifier Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: KeyIdentifier -> KeyIdentifier -> Bool Source # (/=) :: KeyIdentifier -> KeyIdentifier -> Bool Source #

data OtherKeyAttribute Source #

Additional information in a KeyIdentifier.

Constructors

OtherKeyAttribute
Fields keyAttrId :: OID attribute identifier keyAttr :: [ASN1] attribute value

Instances

Instances details

Show OtherKeyAttribute Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> OtherKeyAttribute -> ShowS Source # show :: OtherKeyAttribute -> String Source # showList :: [OtherKeyAttribute] -> ShowS Source #
Eq OtherKeyAttribute Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: OtherKeyAttribute -> OtherKeyAttribute -> Bool Source # (/=) :: OtherKeyAttribute -> OtherKeyAttribute -> Bool Source #

type KeyEncryptionKey = ByteString Source #

Key used for key encryption.

forKeyRecipient :: MonadRandom m => KeyEncryptionKey -> KeyIdentifier -> KeyEncryptionParams -> ProducerOfRI m Source #

Generate a Key Encryption Key recipient from a key encryption key and desired algorithm. The recipient may identify the KEK that was used with the supplied identifier.

This function can be used as parameter to envelopData.

To avoid decreasing the security strength, Key Encryption parameters should use a key size equal or greater than the content encryption key.

withRecipientKey :: Applicative f => KeyEncryptionKey -> ConsumerOfRI f Source #

Use a Key Encryption Key recipient, knowing the key encryption key.

This function can be used as parameter to openEnvelopedData.

Password recipients

data PasswordRecipientInfo Source #

Recipient using password-based protection.

Constructors

PasswordRecipientInfo
Fields priKeyDerivationFunc :: KeyDerivationFunc function to derive key priKeyEncryptionParams :: KeyEncryptionParams key encryption algorithm priEncryptedKey :: EncryptedKey encrypted content-encryption key

Instances

Instances details

Show PasswordRecipientInfo Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods showsPrec :: Int -> PasswordRecipientInfo -> ShowS Source # show :: PasswordRecipientInfo -> String Source # showList :: [PasswordRecipientInfo] -> ShowS Source #
Eq PasswordRecipientInfo Source #
Instance details Defined in Crypto.Store.CMS.Enveloped Methods (==) :: PasswordRecipientInfo -> PasswordRecipientInfo -> Bool Source # (/=) :: PasswordRecipientInfo -> PasswordRecipientInfo -> Bool Source #

forPasswordRecipient :: MonadRandom m => Password -> KeyDerivationFunc -> KeyEncryptionParams -> ProducerOfRI m Source #

Generate a password recipient from a password.

This function can be used as parameter to envelopData.

withRecipientPassword :: Applicative f => Password -> ConsumerOfRI f Source #

Use a password recipient, knowing the password.

This function can be used as parameter to openEnvelopedData.

Digested data

data DigestProxy hashAlg where Source #

CMS digest proxy. Acts like Proxy, i.e. provides a hash algorithm as type parameter. The GADT constructors map to known algorithms.

Constructors

MD2 :: DigestProxy MD2	MD2
MD4 :: DigestProxy MD4	MD4
MD5 :: DigestProxy MD5	MD5
SHA1 :: DigestProxy SHA1	SHA-1
SHA224 :: DigestProxy SHA224	SHA-224
SHA256 :: DigestProxy SHA256	SHA-256
SHA384 :: DigestProxy SHA384	SHA-384
SHA512 :: DigestProxy SHA512	SHA-512
SHAKE128_256 :: DigestProxy (SHAKE128 256)	SHAKE128 (256 bits)
SHAKE256_512 :: DigestProxy (SHAKE256 512)	SHAKE256 (512 bits)
SHAKE128 :: KnownNat n => Proxy n -> DigestProxy (SHAKE128 n)	SHAKE128 (variable size)
SHAKE256 :: KnownNat n => Proxy n -> DigestProxy (SHAKE256 n)	SHAKE256 (variable size)

Instances

Instances details

Show (DigestProxy hashAlg) Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> DigestProxy hashAlg -> ShowS Source # show :: DigestProxy hashAlg -> String Source # showList :: [DigestProxy hashAlg] -> ShowS Source #
Eq (DigestProxy hashAlg) Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: DigestProxy hashAlg -> DigestProxy hashAlg -> Bool Source # (/=) :: DigestProxy hashAlg -> DigestProxy hashAlg -> Bool Source #

data DigestAlgorithm Source #

CMS digest algorithm.

Constructors

forall hashAlg.HashAlgorithm hashAlg => DigestAlgorithm (DigestProxy hashAlg)

Instances

Instances details

Show DigestAlgorithm Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> DigestAlgorithm -> ShowS Source # show :: DigestAlgorithm -> String Source # showList :: [DigestAlgorithm] -> ShowS Source #
Eq DigestAlgorithm Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: DigestAlgorithm -> DigestAlgorithm -> Bool Source # (/=) :: DigestAlgorithm -> DigestAlgorithm -> Bool Source #

data DigestedData content Source #

Digested content information.

Constructors

forall hashAlg.HashAlgorithm hashAlg => DigestedData
Fields ddDigestAlgorithm :: DigestProxy hashAlg Digest algorithm ddContentType :: ContentType Inner content type ddEncapsulatedContent :: content Encapsulated content ddDigest :: Digest hashAlg Digest value

Instances

Instances details

Encapsulates DigestedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> DigestedData a -> f (DigestedData b) toCI :: DigestedData (Encap ByteString) -> ContentInfo
Show content => Show (DigestedData content) Source #
Instance details Defined in Crypto.Store.CMS.Digested Methods showsPrec :: Int -> DigestedData content -> ShowS Source # show :: DigestedData content -> String Source # showList :: [DigestedData content] -> ShowS Source #
Eq content => Eq (DigestedData content) Source #
Instance details Defined in Crypto.Store.CMS.Digested Methods (==) :: DigestedData content -> DigestedData content -> Bool Source # (/=) :: DigestedData content -> DigestedData content -> Bool Source #

digestData :: DigestAlgorithm -> ContentInfo -> DigestedData EncapsulatedContent Source #

Add a digested-data layer on the specified content info.

digestVerify :: DigestedData EncapsulatedContent -> Either StoreError ContentInfo Source #

Return the inner content info but only if the digest is valid.

Encrypted data

type ContentEncryptionKey = ByteString Source #

Key used for content encryption.

data ContentEncryptionCipher cipher where Source #

CMS content encryption cipher.

Constructors

DES :: ContentEncryptionCipher DES	DES
DES_EDE2 :: ContentEncryptionCipher DES_EDE2	Triple-DES with 2 keys used in alternative direction
DES_EDE3 :: ContentEncryptionCipher DES_EDE3	Triple-DES with 3 keys used in alternative direction
AES128 :: ContentEncryptionCipher AES128	AES with 128-bit key
AES192 :: ContentEncryptionCipher AES192	AES with 192-bit key
AES256 :: ContentEncryptionCipher AES256	AES with 256-bit key
CAST5 :: ContentEncryptionCipher CAST5	CAST5 (aka CAST-128) with key between 40 and 128 bits
Camellia128 :: ContentEncryptionCipher Camellia128	Camellia with 128-bit key

Instances

Instances details

Show (ContentEncryptionCipher cipher) Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> ContentEncryptionCipher cipher -> ShowS Source # show :: ContentEncryptionCipher cipher -> String Source # showList :: [ContentEncryptionCipher cipher] -> ShowS Source #
Eq (ContentEncryptionCipher cipher) Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: ContentEncryptionCipher cipher -> ContentEncryptionCipher cipher -> Bool Source # (/=) :: ContentEncryptionCipher cipher -> ContentEncryptionCipher cipher -> Bool Source #

data ContentEncryptionAlg Source #

Cipher and mode of operation for content encryption.

Constructors

forall c.BlockCipher c => ECB (ContentEncryptionCipher c)	Electronic Codebook
forall c.BlockCipher c => CBC (ContentEncryptionCipher c)	Cipher Block Chaining
CBC_RC2	RC2 in CBC mode
forall c.BlockCipher c => CFB (ContentEncryptionCipher c)	Cipher Feedback
forall c.BlockCipher c => CTR (ContentEncryptionCipher c)	Counter

Instances

Instances details

OIDNameable ContentEncryptionAlg Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods fromObjectID :: OID -> Maybe ContentEncryptionAlg
OIDable ContentEncryptionAlg Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getObjectID :: ContentEncryptionAlg -> OID
Show ContentEncryptionAlg Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> ContentEncryptionAlg -> ShowS Source # show :: ContentEncryptionAlg -> String Source # showList :: [ContentEncryptionAlg] -> ShowS Source #

data ContentEncryptionParams Source #

Content encryption algorithm with associated parameters (i.e. the initialization vector).

A value can be generated with generateEncryptionParams.

Instances

Instances details

Show ContentEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> ContentEncryptionParams -> ShowS Source # show :: ContentEncryptionParams -> String Source # showList :: [ContentEncryptionParams] -> ShowS Source #
HasKeySize ContentEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: ContentEncryptionParams -> KeySizeSpecifier Source #
Eq ContentEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: ContentEncryptionParams -> ContentEncryptionParams -> Bool Source # (/=) :: ContentEncryptionParams -> ContentEncryptionParams -> Bool Source #

type EncryptedContent = ByteString Source #

Encrypted content.

data EncryptedData content Source #

Encrypted content information.

Constructors

EncryptedData
Fields edContentType :: ContentType Inner content type edContentEncryptionParams :: ContentEncryptionParams Encryption algorithm edEncryptedContent :: content Encrypted content info edUnprotectedAttrs :: [Attribute] Optional unprotected attributes

Instances

Instances details

Encapsulates EncryptedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> EncryptedData a -> f (EncryptedData b) toCI :: EncryptedData (Encap ByteString) -> ContentInfo
Show content => Show (EncryptedData content) Source #
Instance details Defined in Crypto.Store.CMS.Encrypted Methods showsPrec :: Int -> EncryptedData content -> ShowS Source # show :: EncryptedData content -> String Source # showList :: [EncryptedData content] -> ShowS Source #
Eq content => Eq (EncryptedData content) Source #
Instance details Defined in Crypto.Store.CMS.Encrypted Methods (==) :: EncryptedData content -> EncryptedData content -> Bool Source # (/=) :: EncryptedData content -> EncryptedData content -> Bool Source #

generateEncryptionParams :: MonadRandom m => ContentEncryptionAlg -> m ContentEncryptionParams Source #

Generate random parameters for the specified content encryption algorithm.

generateRC2EncryptionParams :: MonadRandom m => Int -> m ContentEncryptionParams Source #

Generate random RC2 parameters with the specified effective key length (in bits).

getContentEncryptionAlg :: ContentEncryptionParams -> ContentEncryptionAlg Source #

Get the content encryption algorithm.

encryptData :: ContentEncryptionKey -> ContentEncryptionParams -> [Attribute] -> ContentInfo -> Either StoreError (EncryptedData EncryptedContent) Source #

Add an encrypted-data layer on the specified content info. The content is encrypted with specified key and algorithm.

Some optional attributes can be added but will not be encrypted.

decryptData :: ContentEncryptionKey -> EncryptedData EncryptedContent -> Either StoreError ContentInfo Source #

Decrypt an encrypted content info using the specified key.

Authenticated data

type AuthenticationKey = ContentEncryptionKey Source #

Key used for authentication.

data MACAlgorithm Source #

Message Authentication Code (MAC) Algorithm.

Constructors

forall hashAlg.HashAlgorithm hashAlg => HMAC (DigestProxy hashAlg)
forall n.KnownNat n => KMAC_SHAKE128 (Proxy n) ByteString
forall n.KnownNat n => KMAC_SHAKE256 (Proxy n) ByteString

Instances

Instances details

Show MACAlgorithm Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> MACAlgorithm -> ShowS Source # show :: MACAlgorithm -> String Source # showList :: [MACAlgorithm] -> ShowS Source #
HasKeySize MACAlgorithm Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: MACAlgorithm -> KeySizeSpecifier Source #
Eq MACAlgorithm Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: MACAlgorithm -> MACAlgorithm -> Bool Source # (/=) :: MACAlgorithm -> MACAlgorithm -> Bool Source #

type MessageAuthenticationCode = AuthTag Source #

Message authentication code. Equality is time constant.

data AuthenticatedData content Source #

Authenticated content information.

Constructors

AuthenticatedData

Fields

adOriginatorInfo :: OriginatorInfo
Optional information about the originator
adRecipientInfos :: [RecipientInfo]
Information for recipients, allowing to authenticate the content
adMACAlgorithm :: MACAlgorithm
MAC algorithm
adDigestAlgorithm :: Maybe DigestAlgorithm
Optional digest algorithm
adContentType :: ContentType
Inner content type
adEncapsulatedContent :: content
Encapsulated content
adAuthAttrs :: [Attribute]
Optional authenticated attributes
adMAC :: MessageAuthenticationCode
Message authentication code
adUnauthAttrs :: [Attribute]
Optional unauthenticated attributes

Instances

Instances details

Encapsulates AuthenticatedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> AuthenticatedData a -> f (AuthenticatedData b) toCI :: AuthenticatedData (Encap ByteString) -> ContentInfo
Show content => Show (AuthenticatedData content) Source #
Instance details Defined in Crypto.Store.CMS.Authenticated Methods showsPrec :: Int -> AuthenticatedData content -> ShowS Source # show :: AuthenticatedData content -> String Source # showList :: [AuthenticatedData content] -> ShowS Source #
Eq content => Eq (AuthenticatedData content) Source #
Instance details Defined in Crypto.Store.CMS.Authenticated Methods (==) :: AuthenticatedData content -> AuthenticatedData content -> Bool Source # (/=) :: AuthenticatedData content -> AuthenticatedData content -> Bool Source #

generateAuthenticatedData :: Applicative f => OriginatorInfo -> AuthenticationKey -> MACAlgorithm -> Maybe DigestAlgorithm -> [ProducerOfRI f] -> [Attribute] -> [Attribute] -> ContentInfo -> f (Either StoreError (AuthenticatedData EncapsulatedContent)) Source #

Add an authenticated-data layer on the specified content info. The content is MACed with the specified key and algorithms. The key is then processed by one or several ProducerOfRI functions to create recipient info elements.

Two lists of optional attributes can be provided. The attributes will be part of message authentication when provided in the first list.

verifyAuthenticatedData :: Monad m => ConsumerOfRI m -> AuthenticatedData EncapsulatedContent -> m (Either StoreError ContentInfo) Source #

Verify the integrity of an authenticated content info using the specified ConsumerOfRI function. The inner content info is returned only if the MAC could be verified.

Authenticated-enveloped data

data AuthContentEncryptionAlg Source #

Cipher and mode of operation for authenticated-content encryption.

Constructors

AUTH_ENC_128	authEnc with 128-bit key
AUTH_ENC_256	authEnc with 256-bit key
CHACHA20_POLY1305	ChaCha20-Poly1305 Authenticated Encryption
forall c.BlockCipher c => CCM (ContentEncryptionCipher c)	Counter with CBC-MAC
forall c.BlockCipher c => GCM (ContentEncryptionCipher c)	Galois Counter Mode

Instances

Instances details

OIDNameable AuthContentEncryptionAlg Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods fromObjectID :: OID -> Maybe AuthContentEncryptionAlg
OIDable AuthContentEncryptionAlg Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getObjectID :: AuthContentEncryptionAlg -> OID
Show AuthContentEncryptionAlg Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> AuthContentEncryptionAlg -> ShowS Source # show :: AuthContentEncryptionAlg -> String Source # showList :: [AuthContentEncryptionAlg] -> ShowS Source #

data AuthContentEncryptionParams Source #

Authenticated-content encryption algorithm with associated parameters (i.e. the nonce).

A value can be generated with functions generateAuthEnc128Params, generateAuthEnc256Params, generateChaChaPoly1305Params, generateCCMParams and generateGCMParams.

Instances

Instances details

Show AuthContentEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> AuthContentEncryptionParams -> ShowS Source # show :: AuthContentEncryptionParams -> String Source # showList :: [AuthContentEncryptionParams] -> ShowS Source #
HasKeySize AuthContentEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: AuthContentEncryptionParams -> KeySizeSpecifier Source #
Eq AuthContentEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: AuthContentEncryptionParams -> AuthContentEncryptionParams -> Bool Source # (/=) :: AuthContentEncryptionParams -> AuthContentEncryptionParams -> Bool Source #

data AuthEnvelopedData content Source #

Authenticated-enveloped content information.

Constructors

AuthEnvelopedData

Fields

aeOriginatorInfo :: OriginatorInfo
Optional information about the originator
aeRecipientInfos :: [RecipientInfo]
Information for recipients, allowing to decrypt the content
aeContentType :: ContentType
Inner content type
aeContentEncryptionParams :: ASN1ObjectExact AuthContentEncryptionParams
Encryption algorithm
aeEncryptedContent :: content
Encrypted content info
aeAuthAttrs :: [Attribute]
Optional authenticated attributes
aeMAC :: MessageAuthenticationCode
Message authentication code
aeUnauthAttrs :: [Attribute]
Optional unauthenticated attributes

Instances

Instances details

Encapsulates AuthEnvelopedData Source #
Instance details Defined in Crypto.Store.CMS.Info Methods lens :: Functor f => (a -> f b) -> AuthEnvelopedData a -> f (AuthEnvelopedData b) toCI :: AuthEnvelopedData (Encap ByteString) -> ContentInfo
Show content => Show (AuthEnvelopedData content) Source #
Instance details Defined in Crypto.Store.CMS.AuthEnveloped Methods showsPrec :: Int -> AuthEnvelopedData content -> ShowS Source # show :: AuthEnvelopedData content -> String Source # showList :: [AuthEnvelopedData content] -> ShowS Source #
Eq content => Eq (AuthEnvelopedData content) Source #
Instance details Defined in Crypto.Store.CMS.AuthEnveloped Methods (==) :: AuthEnvelopedData content -> AuthEnvelopedData content -> Bool Source # (/=) :: AuthEnvelopedData content -> AuthEnvelopedData content -> Bool Source #

generateAuthEnc128Params :: MonadRandom m => PBKDF2_PRF -> ContentEncryptionAlg -> MACAlgorithm -> m AuthContentEncryptionParams Source #

Generate random AUTH_ENC_128 parameters with the specified algorithms.

generateAuthEnc256Params :: MonadRandom m => PBKDF2_PRF -> ContentEncryptionAlg -> MACAlgorithm -> m AuthContentEncryptionParams Source #

Generate random AUTH_ENC_256 parameters with the specified algorithms.

generateChaChaPoly1305Params :: MonadRandom m => m AuthContentEncryptionParams Source #

Generate random CHACHA20_POLY1305 parameters.

generateCCMParams :: (MonadRandom m, BlockCipher c) => ContentEncryptionCipher c -> CCM_M -> CCM_L -> m AuthContentEncryptionParams Source #

Generate random CCM parameters for the specified cipher.

generateGCMParams :: (MonadRandom m, BlockCipher c) => ContentEncryptionCipher c -> Int -> m AuthContentEncryptionParams Source #

Generate random GCM parameters for the specified cipher.

authEnvelopData :: Applicative f => OriginatorInfo -> ContentEncryptionKey -> AuthContentEncryptionParams -> [ProducerOfRI f] -> [Attribute] -> [Attribute] -> ContentInfo -> f (Either StoreError (AuthEnvelopedData EncryptedContent)) Source #

Add an authenticated-enveloped-data layer on the specified content info. The content is encrypted with specified key and algorithm. The key is then processed by one or several ProducerOfRI functions to create recipient info elements.

Some attributes can be added but will not be encrypted. The attributes will be part of message authentication when provided in the first list.

openAuthEnvelopedData :: Monad m => ConsumerOfRI m -> AuthEnvelopedData EncryptedContent -> m (Either StoreError ContentInfo) Source #

Recover an authenticated-enveloped content info using the specified ConsumerOfRI function.

Key derivation

type Salt = ByteString Source #

Salt value used for key derivation.

generateSalt :: MonadRandom m => Int -> m Salt Source #

Generate a random salt with the specified length in bytes. To be most effective, the length should be at least 8 bytes.

data KeyDerivationFunc Source #

Key derivation algorithm and associated parameters.

Constructors

PBKDF2	Key derivation with PBKDF2
Fields pbkdf2Salt :: Salt Salt value pbkdf2IterationCount :: Int Iteration count pbkdf2KeyLength :: Maybe Int Optional key length pbkdf2Prf :: PBKDF2_PRF Pseudorandom function
Scrypt	Key derivation with Scrypt
Fields scryptSalt :: Salt Salt value scryptN :: Word64 N value scryptR :: Int R value scryptP :: Int P value scryptKeyLength :: Maybe Int Optional key length

Instances

Instances details

Show KeyDerivationFunc Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> KeyDerivationFunc -> ShowS Source # show :: KeyDerivationFunc -> String Source # showList :: [KeyDerivationFunc] -> ShowS Source #
Eq KeyDerivationFunc Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: KeyDerivationFunc -> KeyDerivationFunc -> Bool Source # (/=) :: KeyDerivationFunc -> KeyDerivationFunc -> Bool Source #

data PBKDF2_PRF Source #

Pseudorandom function used for PBKDF2.

Constructors

PBKDF2_SHA1	hmacWithSHA1
PBKDF2_SHA256	hmacWithSHA256
PBKDF2_SHA512	hmacWithSHA512

Instances

Instances details

OIDNameable PBKDF2_PRF Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods fromObjectID :: OID -> Maybe PBKDF2_PRF
OIDable PBKDF2_PRF Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getObjectID :: PBKDF2_PRF -> OID
Show PBKDF2_PRF Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> PBKDF2_PRF -> ShowS Source # show :: PBKDF2_PRF -> String Source # showList :: [PBKDF2_PRF] -> ShowS Source #
Eq PBKDF2_PRF Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: PBKDF2_PRF -> PBKDF2_PRF -> Bool Source # (/=) :: PBKDF2_PRF -> PBKDF2_PRF -> Bool Source #

Secret-key algorithms

class HasKeySize params where Source #

Algorithms that are based on a secret key. This includes ciphers but also MAC algorithms.

Methods

getKeySizeSpecifier :: params -> KeySizeSpecifier Source #

Get a specification of the key sizes allowed by the algorithm.

Instances

Instances details

HasKeySize AuthContentEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: AuthContentEncryptionParams -> KeySizeSpecifier Source #
HasKeySize ContentEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: ContentEncryptionParams -> KeySizeSpecifier Source #
HasKeySize KeyEncryptionParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: KeyEncryptionParams -> KeySizeSpecifier Source #
HasKeySize MACAlgorithm Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods getKeySizeSpecifier :: MACAlgorithm -> KeySizeSpecifier Source #

generateKey :: (HasKeySize params, MonadRandom m, ByteArray key) => params -> m key Source #

Generate a random key suitable for the specified algorithm. This uses the maximum size allowed by the parameters.

RSA padding modes

newtype MaskGenerationFunc Source #

Mask Generation Functions (MGF) and associated parameters.

Constructors

MGF1 DigestAlgorithm

Instances

Instances details

Show MaskGenerationFunc Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> MaskGenerationFunc -> ShowS Source # show :: MaskGenerationFunc -> String Source # showList :: [MaskGenerationFunc] -> ShowS Source #
Eq MaskGenerationFunc Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: MaskGenerationFunc -> MaskGenerationFunc -> Bool Source # (/=) :: MaskGenerationFunc -> MaskGenerationFunc -> Bool Source #

data OAEPParams Source #

Encryption parameters for RSAES-OAEP.

Constructors

OAEPParams
Fields oaepHashAlgorithm :: DigestAlgorithm Hash function oaepMaskGenAlgorithm :: MaskGenerationFunc Mask generation function

Instances

Instances details

Show OAEPParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> OAEPParams -> ShowS Source # show :: OAEPParams -> String Source # showList :: [OAEPParams] -> ShowS Source #
Eq OAEPParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: OAEPParams -> OAEPParams -> Bool Source # (/=) :: OAEPParams -> OAEPParams -> Bool Source #

data PSSParams Source #

Signature parameters for RSASSA-PSS.

Constructors

PSSParams
Fields pssHashAlgorithm :: DigestAlgorithm Hash function pssMaskGenAlgorithm :: MaskGenerationFunc Mask generation function pssSaltLength :: Int Length of the salt in bytes

Instances

Instances details

Show PSSParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods showsPrec :: Int -> PSSParams -> ShowS Source # show :: PSSParams -> String Source # showList :: [PSSParams] -> ShowS Source #
Eq PSSParams Source #
Instance details Defined in Crypto.Store.CMS.Algorithms Methods (==) :: PSSParams -> PSSParams -> Bool Source # (/=) :: PSSParams -> PSSParams -> Bool Source #

CMS attributes

data Attribute Source #

An attribute extending the parent structure with arbitrary data.

Constructors

Attribute
Fields attrType :: OID Attribute type attrValues :: [ASN1] Attribute values

Instances

Instances details

Show Attribute Source #
Instance details Defined in Crypto.Store.CMS.Attribute Methods showsPrec :: Int -> Attribute -> ShowS Source # show :: Attribute -> String Source # showList :: [Attribute] -> ShowS Source #
Eq Attribute Source #
Instance details Defined in Crypto.Store.CMS.Attribute Methods (==) :: Attribute -> Attribute -> Bool Source # (/=) :: Attribute -> Attribute -> Bool Source #

findAttribute :: OID -> [Attribute] -> Maybe [ASN1] Source #

Return the values for the first attribute with the specified type.

setAttribute :: OID -> [ASN1] -> [Attribute] -> [Attribute] Source #

Add or replace an attribute in a list of attributes.

filterAttributes :: (OID -> Bool) -> [Attribute] -> [Attribute] Source #

Filter a list of attributes based on a predicate applied to attribute type.

CMS standard attributes

getSigningTimeAttr :: [Attribute] -> Maybe DateTime Source #

Return the value of the signingTime attribute.

setSigningTimeAttr :: DateTime -> [Attribute] -> [Attribute] Source #

Add or replace the signingTime attribute in a list of attributes.

setSigningTimeAttrCurrent :: MonadIO m => [Attribute] -> m [Attribute] Source #

Add or replace the signingTime attribute in a list of attributes with the current time. This is equivalent to calling setSigningTimeAttr with the result of dateCurrent.

Originator information

data OriginatorInfo Source #

Information about the originator of the content info, to be used when a key management algorithm requires this information.

Constructors

OriginatorInfo
Fields originatorCerts :: [CertificateChoice] The collection of certificates originatorCRLs :: [RevocationInfoChoice] The collection of CRLs

Instances

Instances details

Monoid OriginatorInfo Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods mempty :: OriginatorInfo Source # mappend :: OriginatorInfo -> OriginatorInfo -> OriginatorInfo Source # mconcat :: [OriginatorInfo] -> OriginatorInfo Source #
Semigroup OriginatorInfo Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (<>) :: OriginatorInfo -> OriginatorInfo -> OriginatorInfo Source # sconcat :: NonEmpty OriginatorInfo -> OriginatorInfo Source # stimes :: Integral b => b -> OriginatorInfo -> OriginatorInfo Source #
Show OriginatorInfo Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods showsPrec :: Int -> OriginatorInfo -> ShowS Source # show :: OriginatorInfo -> String Source # showList :: [OriginatorInfo] -> ShowS Source #
Eq OriginatorInfo Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (==) :: OriginatorInfo -> OriginatorInfo -> Bool Source # (/=) :: OriginatorInfo -> OriginatorInfo -> Bool Source #

data CertificateChoice Source #

Union type related to certificate formats.

Constructors

CertificateCertificate SignedCertificate	X.509 certificate
CertificateOther OtherCertificateFormat	Other format

Instances

Instances details

Show CertificateChoice Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods showsPrec :: Int -> CertificateChoice -> ShowS Source # show :: CertificateChoice -> String Source # showList :: [CertificateChoice] -> ShowS Source #
Eq CertificateChoice Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (==) :: CertificateChoice -> CertificateChoice -> Bool Source # (/=) :: CertificateChoice -> CertificateChoice -> Bool Source #

data OtherCertificateFormat Source #

Certificate information in a format not supported natively.

Constructors

OtherCertificateFormat
Fields otherCertFormat :: OID Format identifier otherCertValues :: [ASN1] ASN.1 values using this format

Instances

Instances details

Show OtherCertificateFormat Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods showsPrec :: Int -> OtherCertificateFormat -> ShowS Source # show :: OtherCertificateFormat -> String Source # showList :: [OtherCertificateFormat] -> ShowS Source #
Eq OtherCertificateFormat Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (==) :: OtherCertificateFormat -> OtherCertificateFormat -> Bool Source # (/=) :: OtherCertificateFormat -> OtherCertificateFormat -> Bool Source #

data RevocationInfoChoice Source #

Union type related to revocation info formats.

Constructors

RevocationInfoCRL SignedCRL	A CRL, ARL, Delta CRL, or an ACRL
RevocationInfoOther OtherRevocationInfoFormat	Other format

Instances

Instances details

Show RevocationInfoChoice Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods showsPrec :: Int -> RevocationInfoChoice -> ShowS Source # show :: RevocationInfoChoice -> String Source # showList :: [RevocationInfoChoice] -> ShowS Source #
Eq RevocationInfoChoice Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (==) :: RevocationInfoChoice -> RevocationInfoChoice -> Bool Source # (/=) :: RevocationInfoChoice -> RevocationInfoChoice -> Bool Source #

data OtherRevocationInfoFormat Source #

Revocation information in a format not supported natively.

Constructors

OtherRevocationInfoFormat
Fields otherRevInfoFormat :: OID Format identifier otherRevInfoValues :: [ASN1] ASN.1 values using this format

Instances

Instances details

Show OtherRevocationInfoFormat Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods showsPrec :: Int -> OtherRevocationInfoFormat -> ShowS Source # show :: OtherRevocationInfoFormat -> String Source # showList :: [OtherRevocationInfoFormat] -> ShowS Source #
Eq OtherRevocationInfoFormat Source #
Instance details Defined in Crypto.Store.CMS.OriginatorInfo Methods (==) :: OtherRevocationInfoFormat -> OtherRevocationInfoFormat -> Bool Source # (/=) :: OtherRevocationInfoFormat -> OtherRevocationInfoFormat -> Bool Source #

ASN.1 representation

data ASN1ObjectExact a Source #

An ASN.1 object associated with the raw data it was parsed from.

Instances

Instances details

Show a => Show (ASN1ObjectExact a) Source #
Instance details Defined in Crypto.Store.CMS.Util Methods showsPrec :: Int -> ASN1ObjectExact a -> ShowS Source # show :: ASN1ObjectExact a -> String Source # showList :: [ASN1ObjectExact a] -> ShowS Source #
Eq a => Eq (ASN1ObjectExact a) Source #
Instance details Defined in Crypto.Store.CMS.Util Methods (==) :: ASN1ObjectExact a -> ASN1ObjectExact a -> Bool Source # (/=) :: ASN1ObjectExact a -> ASN1ObjectExact a -> Bool Source #