tommd / drbg

Deterministic Random Bit Generators (English -> Haskell translation from SP 800-90)

The Deterministic Random Bit Generator (DRBG) is a collection of cryptographically secure random bit generators and modifiers written to the NIST 800-90 specification. Namely, the HMAC and Hash generators are implemented and pass the known answer tests (KATS) while the CTR based generator exists with the intent of matching spec but does not pass KATS for unknown reasons (mis-interpretation of KATS or otherwise).

The combinators allow users to combine two or more generators for new desired effects, such as XORing two generators together, using one generator to reseed another (for obtaining a longer lifetime, presumably), and precomputing randoms in batch (buffering).

drbg's Issues

Test suite failure with 0.5.4

Available at:

https://gist.github.com/snoyberg/6aff9f7798f4b1358344

Improve data structures

Use Word64, remove Integer, from State types. Unbox the word.

splitGen fails on GenAutoReseed CtrDRBG SystemRandom

The following program attempts to split a GenAutoReseed CtrDRBG SystemRandom, which fails with NotEnoughEntropy. For control, it first successfully splits a GenAutoReseed CtrDRBG CtrDRBG.

{-# LANGUAGE PackageImports #-}

module Main (main) where

import qualified Crypto.Random.DRBG as DRBG
import "crypto-api" Crypto.Random
import qualified Data.ByteString.Base64 as B64

main :: IO ()
main = do
  testSplit (undefined :: DRBG.CtrDRBG)
  testSplit (undefined :: DRBG.SystemRandom)

testSplit :: CryptoRandomGen g => g -> IO ()
testSplit g = do
  g1 <- genWithType g
  putStrLn $ case splitGen g1 of
    Left err      -> "Error: " ++ show err
    Right (g2, _) -> "OK: " ++ show (B64.encode $ fst $ throwLeft $ genBytes 20 g2)

genWithType :: CryptoRandomGen g => g -> IO (DRBG.GenAutoReseed DRBG.CtrDRBG g)
genWithType _ = DRBG.newGenAutoReseedIO (2^(48::Int))

The output is something along the lines of:

$ ghc -Wall Main.hs --make
[1 of 1] Compiling Main             ( Main.hs, Main.o )
Linking Main ...
$ ./Main
OK: "hza/a+tHlWsGCJLyaC7WM2nHHog="
Error: NotEnoughEntropy

I've chased the issue as far as the value for genSeedLength :: Tagged SystemRandom Int which is 2^63:

$ ghci -XPackageImports
GHCi, version 7.8.3: http://www.haskell.org/ghc/  :? for help
Loading package ghc-prim ... linking ... done.
Loading package integer-gmp ... linking ... done.
Loading package base ... linking ... done.
Prelude> import "crypto-api" Crypto.Random
Prelude Crypto.Random> genSeedLength :: Data.Tagged.Tagged Crypto.Random.DRBG.SystemRandom Int
Loading package array-0.5.0.0 ... linking ... done.
Loading package deepseq-1.3.0.2 ... linking ... done.
Loading package bytestring-0.10.4.0 ... linking ... done.
Loading package old-locale-1.0.0.6 ... linking ... done.
Loading package time-1.4.2 ... linking ... done.
Loading package unix-2.7.0.1 ... linking ... done.
Loading package containers-0.5.5.1 ... linking ... done.
Loading package cereal-0.4.1.0 ... linking ... done.
Loading package entropy-0.3.4.1 ... linking ... done.
Loading package tagged-0.7.3 ... linking ... done.
Loading package transformers-0.3.0.0 ... linking ... done.
Loading package crypto-api-0.13.2 ... linking ... done.
Tagged 9223372036854775807
Prelude Crypto.Random>
Leaving GHCi.

Not sure what to suggest at this point.

Fix GenAutoReseed signature

GenAutoReseed uses an Int for the period but should use Word64 to cope with sensible periods (larger than 2^29).

Add pointer to repo

EOM

Compilation failure with cereal-0.5

Crypto/Random/DRBG/HMAC.hs:13:8:
    Could not find module ‘Data.Serialize.Builder’
    Perhaps you meant
      Data.Serialize.Get (from cereal-0.5.0.0@cerea_BBfptUfmSBYLBoW9Jgic7f)
      Data.Serialize.Put (from cereal-0.5.0.0@cerea_BBfptUfmSBYLBoW9Jgic7f)
    Use -v to see a list of the files searched for.

Hackage revision: http://hackage.haskell.org/package/DRBG-0.5.4/revisions/
Build matrix: http://matrix.hackage.haskell.org/package/DRBG (as of writing build has been queued)