HN Explorer

10 comments

[ 3.7 ms ] story [ 13.9 ms ] thread
mrkgnao
The extensive README is also a pretty good intro to how one can do crypto (as in cryptography: get off my lawn!) in Haskell using the excellent cryptonite library.

For those who won't click through to TFR:

    > import Crypto.Number.Hash (SHA3_256)
    > import Crypto.PubKey.ECC.ECDSA (sign, verify)
    > import Crypto.PubKey.ECC.Generate (generate)
    > import Crypto.PubKey.ECC.Types (getCurveByName, SEC_p256k1)
    
    > let msg = "hello world" :: ByteString
    > let secp256k1 = getCurveByName SEC_p256k1
    > (pubKey, privKey) <- generate secp256k1
    > sig <- sign privKey SHA3_256 msg
    > verify SHA3_256 pubKey sig msg
    True
somenewacc
Is cryptonite anything like production ready? I mean, does it protect against timing side channels (perhaps using crypto instructions like AES-NI), etc.

Something I didn't like about it is that it exposes crypto primitives, including stuff like TripleDES, with no warning[0]. The tutorial also has you handle IVs directly.[1]

[0] https://hackage.haskell.org/package/cryptonite-0.24/docs/Cry...

[1] https://hackage.haskell.org/package/cryptonite-0.24/docs/Cry...

lambdaxdotx
If you notice, it only exposes the _types_ of the TripleDES, not the constructors, meaning you don't have access to the values unless you clone the cryptonite repo and modify it to expose the constructors, giving access to the values at run time.

Also, the tutorial is a bit advanced and is meant to show a particular use case of using symmetric block ciphers for encryption/decryption, you are not always using such bare-bones primitives-- check out the hashing part of the README.md in Nanocoin.

IMO it's production ready, and has most all potential known attacks documented above the functions that are vulnerable.

[dead] seattle_spring
Related question: What does one need to do before they can downvote posts?
jrs95
Posts can't be downvoted, only comments.
[dead] AckSyn
I've wondered that myself. There's also no 'flag' link for comments that I can see as well.

And to the guy who says there's no downvoting, why do some comments get lighter and lighter until they're almost impossible to see? Especially if it's an unpopular opinion?

suprfnk
How is that related? Do you want to downvote this? May I ask why? As someone interested in Haskell, I found this a really helpful example.
ythn
Reach 500 karma and you can downvote comments. The only way to "downvote" posts is via flagging.

Don't like it? Hide it.