Add generic hash docs
This commit is contained in:
parent
69183a0eb9
commit
b0c6b43f2e
@ -5,7 +5,7 @@
|
|||||||
This is a form of symmetric encryption, that assures both confidentiality and authenticity of the data to be encrypted as well
|
This is a form of symmetric encryption, that assures both confidentiality and authenticity of the data to be encrypted as well
|
||||||
as associated data that will not be encrypted.
|
as associated data that will not be encrypted.
|
||||||
|
|
||||||
In general it works like this:
|
In general, it works like this:
|
||||||
|
|
||||||
Inputs:
|
Inputs:
|
||||||
- Message to encrypt and authenticate
|
- Message to encrypt and authenticate
|
||||||
@ -14,7 +14,7 @@ Inputs:
|
|||||||
- Additional data that is not encrypted but also authenticated
|
- Additional data that is not encrypted but also authenticated
|
||||||
|
|
||||||
Simplified encryption algorithm:
|
Simplified encryption algorithm:
|
||||||
1. Encrypt message with key and nonce
|
1. Encrypt a message with key and nonce
|
||||||
1. Apply MAC algorithm to encrypted message + unencrypted associated data to generate authentication data (tag)
|
1. Apply MAC algorithm to encrypted message + unencrypted associated data to generate authentication data (tag)
|
||||||
1. Send the encrypted data + associated data + authentication data + nonce
|
1. Send the encrypted data + associated data + authentication data + nonce
|
||||||
|
|
||||||
|
@ -5,14 +5,16 @@
|
|||||||
Public key encryption is a system that relies on a pair of keys to establish secure communication.
|
Public key encryption is a system that relies on a pair of keys to establish secure communication.
|
||||||
|
|
||||||
A simplified overview of communication between Bob and Alice using public-key encryption:
|
A simplified overview of communication between Bob and Alice using public-key encryption:
|
||||||
- Key exchange
|
#### Key exchange
|
||||||
1. Alice creates 2 keys, one public, one private (public key is actually calculated from the private key)
|
1. Alice creates 2 keys, one public, one private (public key is actually calculated from the private key)
|
||||||
1. Bob creates 2 keys, one public, one private
|
1. Bob creates 2 keys, one public, one private
|
||||||
1. Alice sends her **public** key to Bob
|
1. Alice sends her **public** key to Bob
|
||||||
1. Bob does the same and sends his **public** key to Alice
|
1. Bob does the same and sends his **public** key to Alice
|
||||||
- Encryption
|
|
||||||
|
|
||||||
Alice wants to establish a secure communication channel with Bob, they already changed public keys in previous steps.
|
#### Encryption
|
||||||
|
|
||||||
|
Alice wants to establish a secure communication channel with Bob, they already exchanged public keys in previous steps.
|
||||||
|
|
||||||
1. Alice uses Bobs **private** key to encrypt a *secret value* (Usually just a key for symmetric encryption)
|
1. Alice uses Bobs **private** key to encrypt a *secret value* (Usually just a key for symmetric encryption)
|
||||||
1. Alice sends encrypted data to Bob
|
1. Alice sends encrypted data to Bob
|
||||||
1. Bob is the only one who has the matching private key, and can decrypt the data
|
1. Bob is the only one who has the matching private key, and can decrypt the data
|
||||||
|
@ -21,14 +21,34 @@ data class GenericHashState(val hashLength: Int, val internalState: GenericHashS
|
|||||||
|
|
||||||
|
|
||||||
expect object GenericHash {
|
expect object GenericHash {
|
||||||
|
/**
|
||||||
|
* Request computing a hash of message, with a specific hash length and optional key. The specific hash length can be
|
||||||
|
* between [crypto_generichash_blake2b_BYTES_MIN] and [crypto_generichash_blake2b_BYTES_MAX]. If the key is provided
|
||||||
|
* it needs the hash will be different for each different key.
|
||||||
|
*/
|
||||||
|
fun genericHash(message : UByteArray, requestedHashLength: Int = crypto_generichash_BYTES, key : UByteArray? = null) : UByteArray
|
||||||
|
|
||||||
fun genericHash(message : UByteArray, requestedHashLength: Int, key : UByteArray? = null) : UByteArray
|
/**
|
||||||
|
* Prepare a Generic Hash State object that will be used to compute hash of data with arbitrary length. Secific hash length
|
||||||
|
* can be requested
|
||||||
|
*/
|
||||||
|
fun genericHashInit(requestedHashLength: Int = crypto_generichash_BYTES, key : UByteArray? = null) : GenericHashState
|
||||||
|
|
||||||
fun genericHashInit(requestedHashLength: Int, key : UByteArray? = null) : GenericHashState
|
/**
|
||||||
|
* Feed another chunk of message to the updateable hash object
|
||||||
|
*/
|
||||||
fun genericHashUpdate(state: GenericHashState, messagePart : UByteArray)
|
fun genericHashUpdate(state: GenericHashState, messagePart : UByteArray)
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Feed the last chunk of message to the updateable hash object. This returns the actual hash.
|
||||||
|
*/
|
||||||
fun genericHashFinal(state : GenericHashState) : UByteArray
|
fun genericHashFinal(state : GenericHashState) : UByteArray
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Generate a key of length [crypto_generichash_blake2b_KEYBYTES] that can be used with the generic hash funciton
|
||||||
|
*/
|
||||||
fun genericHashKeygen() : UByteArray
|
fun genericHashKeygen() : UByteArray
|
||||||
|
|
||||||
// ---- Not present in LazySodium nor libsodium.js
|
// ---- Not present in LazySodium nor libsodium.js
|
||||||
// fun blake2b(message : UByteArray, requestedHashLength: Int, key : UByteArray? = null) : UByteArray
|
// fun blake2b(message : UByteArray, requestedHashLength: Int, key : UByteArray? = null) : UByteArray
|
||||||
//
|
//
|
||||||
|
@ -2,5 +2,22 @@
|
|||||||
|
|
||||||
## Generic hash
|
## Generic hash
|
||||||
|
|
||||||
Generic hash package provides a easy to use
|
Generic hash package provides a easy to use hashing API that computes fixed-length fingerprint for an arbitrary long message.
|
||||||
|
|
||||||
|
In this case hashing is a process of mapping a set of input bytes to a fixed length (32 bytes) output. Loosely speaking
|
||||||
|
hash function should be practically irreversible and resistant to collisions (a case where two different inputs result in a same output)
|
||||||
|
|
||||||
|
Some examples of hash function usage:
|
||||||
|
- Verifying data integrity, i.e. downloading a file and it's hash and then recalculating the hash of the downloaded
|
||||||
|
file to verify that it hasn't changed
|
||||||
|
- Creating unique identifiers to index long data
|
||||||
|
- Password verification, i.e. server stores just the hash of the users password and then when user wants to log in, they send
|
||||||
|
the password, which server then hashes and compares to the stored hash. This way in case of breach of server security cleartext
|
||||||
|
passwords are not revealed. With that said **DONT USE GENERIC HASH FOR PASSWORD HASHING**. Use PasswordHash funcitons.
|
||||||
|
|
||||||
|
Underneath this set of functions uses BLAKE2b secure hash function, Here is what Libsodium documentation says about it
|
||||||
|
>The crypto_generichash_* function set is implemented using BLAKE2b, a simple, standardized (RFC 7693) secure hash
|
||||||
|
>function that is as strong as SHA-3 but faster than SHA-1 and MD5.
|
||||||
|
>Unlike MD5, SHA-1 and SHA-256, this function is safe against hash length extension attacks.
|
||||||
|
>BLAKE2b is not suitable for hashing passwords. For this purpose, use the crypto_pwhash API documented
|
||||||
|
>in the Password Hashing section.
|
||||||
|
Loading…
x
Reference in New Issue
Block a user