License	BSD-style
Maintainer	Carlos Rodriguez-Vega <crodveg@yahoo.es>
Stability	experimental
Portability	unknown
Safe Haskell	None
Language	Haskell2010

Crypto.PubKey.Rabin.OAEP

Description

OAEP padding scheme. See http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding.

Synopsis

data OAEPParams hash seed output = OAEPParams {
- oaepHash :: hash
- oaepMaskGenAlg :: MaskGenAlgorithm seed output
- oaepLabel :: Maybe ByteString
}
defaultOAEPParams :: (ByteArrayAccess seed, ByteArray output, HashAlgorithm hash) => hash -> OAEPParams hash seed output
pad :: HashAlgorithm hash => ByteString -> OAEPParams hash ByteString ByteString -> Int -> ByteString -> Either Error ByteString
unpad :: HashAlgorithm hash => OAEPParams hash ByteString ByteString -> Int -> ByteString -> Either Error ByteString

Documentation

data OAEPParams hash seed output Source #

Parameters for OAEP padding.

Constructors

OAEPParams
Fields oaepHash :: hash hash function to use oaepMaskGenAlg :: MaskGenAlgorithm seed output mask Gen algorithm to use oaepLabel :: Maybe ByteString optional label prepended to message

defaultOAEPParams :: (ByteArrayAccess seed, ByteArray output, HashAlgorithm hash) => hash -> OAEPParams hash seed output Source #

Default Params with a specified hash function.

pad Source #

Arguments

:: HashAlgorithm hash
=> ByteString	Seed
-> OAEPParams hash ByteString ByteString	OAEP params to use
-> Int	size of public key in bytes
-> ByteString	Message pad
-> Either Error ByteString

Pad a message using OAEP.

unpad Source #

Arguments

:: HashAlgorithm hash
=> OAEPParams hash ByteString ByteString	OAEP params to use
-> Int	size of public key in bytes
-> ByteString	encoded message (not encrypted)
-> Either Error ByteString

Un-pad a OAEP encoded message.

The data block is scanned in full rather than up to the 01 octet separating the padding from the message, and the label hash and the leading octet are compared without an early exit, so neither the length of the padding nor where a comparison first differs shows up in how long this takes. This is what Crypto.PubKey.RSA.OAEP does with the same block.

What remains visible is the result itself: whether the block was well formed, and the length of the message when it was. That is the signal Manger's attack needs, so a caller that decrypts attacker-supplied ciphertext must not pass the distinction on.