bend-osdev-crypto

Releases (1)

• 0.1.0.0 indexed

Definitions (678)

hmac.bend

• type CrHmacKeyThe prepared key: K0 xor ipad and K0 xor opad (open type)
• type CrHmacStateThe state in pieces: the inner hash's state, and the outer padded key
• def cr.hmac.pad
• def cr.hmac.k0
• def cr.hmac.blockK0: the key (hashed if longer than bsize), zero-padded to bsize bytes
• def CrHmac.keyThe prepared key of a raw key of any length
• def CrHmac.key_ofthe same as the MAC interface's ~key (every key length is allowed)
• def CrHmac.macThe tag of m, in one call
• def CrHmac.verifywhether t is m's tag (every byte compared)
• def CrHmac.startThe tag in pieces: start, update for each piece, finish
• def CrHmac.update
• def CrHmac.finish

inst_aes.bend

• def CrAes.keya 16- or 32-byte key (AES-128 or AES-256), with its decryption round keys; CrBadKeyLength for any other length
• def CrAes.key_encthe same without the decryption round keys, for uses that only encrypt (CTR, CMAC, CCM): a key made this way still decrypts, deriving those round keys again for every block

inst_ccm.bend

• def CrCcm.sealthe ciphertext of p, then the tlen-byte tag
• def CrCcm.openthe plaintext of c (the ciphertext, then the tag), or CrTagMismatch

inst_cm.bend

• def CrCm.err
• def CrCm.lifta cipher-modes result as an interface result
• def CrCm.keya cipher-modes key schedule as the interface's ~key
• def cr.f128.bits8
• def cr.f128.wordthe word with bytes a, b, c, d, most significant first
• def cr.f128.bytesthe 16 bytes of a block, most significant byte of w0 first
• def cr.f128.blockexactly 16 bytes as a block
• def CrBlk128.to_octetsa block's 16 bytes
• def CrBlk128.of_octets16 bytes as a block; None for any other length
• def CrBlk128.xor

inst_cmac.bend

• def CrCmac.macthe 16-byte tag of m
• def CrCmac.verifywhether t is m's tag (every byte compared)

inst_crc.bend

• def CrCrc32.init
• def CrCrc32.update
• def CrCrc32.final
• def CrCrc32.digest
• def CrCrc64.init
• def CrCrc64.update
• def CrCrc64.final
• def CrCrc64.digest

inst_kbkdf.bend

• def CrKbkdf.hmac_sha256_counter
• def CrKbkdf.hmac_sha256_feedback

inst_lc.bend

• def CrLc.err
• def CrLc.lifta legacy-ciphers result as an interface result
• def CrLc.keya legacy-ciphers key schedule as the interface's ~key
• def CrBlk64.xorThe 64-bit block's XOR

inst_michael.bend

• def CrMichael.err
• def CrMichael.keythe key of 8 raw bytes (CrBadKeyLength otherwise)
• def CrMichael.verifywhether t is m's tag (the named default verify: every byte compared)

inst_pbkdf2.bend

• def CrPbkdf2.hmac_sha256
• def CrPbkdf2.hmac_sha1

inst_rc4.bend

• def cr.rc4.start
• def CrRc4.startthe state for a key of 1 to 256 bytes (CrBadKeyLength otherwise); RC4 has no IV, so the IV must be empty (CrBadIvLength otherwise)
• def CrRc4.start_dropthe same, with the first n keystream bytes dropped (RC4-drop[n])

inst_sha2.bend

• type CrSha2StateA hash state (opaque): which hash, its chaining value, the bytes of the unfinished block, and the length so far
• def CrSha2.init256
• def CrSha2.init512
• def CrSha2.updatethe state after more bytes (either hash: the state knows which it is)
• def CrSha2.finalthe digest of the bytes so far
• def CrSha2.sha256The digests in one call
• def CrSha2.sha512

inst_sha3.bend

• type CrSha3StateA hash state (opaque): the Keccak state, the bytes of the unfinished block, and the length so far
• def CrSha3.init
• def CrSha3.updatethe state after more bytes
• def CrSha3.finalthe digest of the bytes so far
• def CrSha3.sha3_256the digest in one call

kbkdf.bend

• def cr.kb.head
• def cr.kb.tail
• def CrKbkdf.counter[i]_2 as rlen bytes (the low 8 rlen bits of i, big-endian)
• def cr.kb.ctrn more bytes in counter mode: the rest of the current block cur, then PRF(K_IN, [i + 1]_2 || fixed), ...
• def CrKbkdf.counter_streamThe first n bytes of counter mode under the prepared key k with the fixed input data, unchecked
• def cr.kb.fbn more bytes in feedback mode: the rest of the current block cur, then PRF(K_IN, K(i) || [i + 1]_2 || fixed), with prev = K(i)
• def CrKbkdf.feedback_streamThe first n bytes of feedback mode under the prepared key k from the IV, with the fixed input data (rlen 0: no counter), unchecked
• def CrKbkdf.length[L]_2: L = 8 n bits as llen big-endian bytes
• def CrKbkdf.fixedthe fixed input data Label || 0x00 || Context || [L]_2 for n bytes
• def cr.kb.fitswhether n bytes need at most max blocks of hlen bytes, and L = 8 n fits llen bytes (and 32 bits)
• def cr.kb.key
• def cr.kb.checked
• def CrKbkdf.counter_kdfK_OUT of n bytes in counter mode over the MAC (~K, ~key, ~compute) with hlen-byte tags, an r = 8 rlen bit counter and an llen-byte [L]_2
• def cr.kb.fkey
• def cr.kb.fchecked
• def CrKbkdf.feedback_kdfK_OUT of n bytes in feedback mode from the IV (rlen 0: no counter)
• def CrKbkdf.deriveThe KDF interface's ~derive in counter mode: secret K_IN, salt the Label, info the Context

kdf.bend

• def CrKdf.derive_keyA key for any interface derived from a secret: n bytes, through that interface's key schedule ~key (a block cipher's, a MAC's, an AEAD's)

kex.bend

• def cr.kex.with
• def CrKex.agreeThe shared secret of one's secret key's bytes and the peer's public key's bytes

lrw.bend

• def cr.lrw.tweakthe tweak of index i under the tweak key k2, as a block
• def cr.lrw.bencone block under a tweak
• def cr.lrw.bdec
• def cr.lrw.carry
• def cr.lrw.inci + 1, modulo 2^128
• def cr.lrw.enc
• def cr.lrw.dec
• def cr.lrw.enc.go
• def cr.lrw.dec.go
• def CrLrw.encrypt_blocksLRW on blocks: key k, tweak key k2, the first block's index i (the next call's index is i plus the number of blocks)
• def CrLrw.decrypt_blocks
• type CrLrwKeyThe key pair: the cipher's key schedule and the tweak key
• def cr.lrw.gf
• def CrLrw.keya raw key: the cipher's key followed by the 16-byte tweak key (CrBadKeyLength for a key of 16 bytes or fewer, or one the cipher refuses)
• def cr.lrw.index.of
• def cr.lrw.index
• def CrLrw.encryptLRW on bytes: a message of whole blocks; the IV is the first block's 16-byte big-endian index (CrBadIvLength, CrNotBlockMultiple otherwise)
• def CrLrw.decrypt