| Safe Haskell | Safe-Inferred |
|---|---|
| Language | Haskell2010 |
Cardano.Crypto.WalletHD.Encrypted
Description
Keys are stored as CBOR-encoded v2 envelopes: a random 32-byte salt and 24-byte nonce, Argon2id-derived 32-byte wrapping key, and the 64-byte extended secret key encrypted with XChaCha20-Poly1305. The public key and chain code are bound as AEAD additional data so they cannot be silently swapped without detection.
The plaintext secret key is held exclusively in sodium_malloc'd memory
(MLockedSizedBytes) which is locked against swapping and is never moved
by the GC. All public operations are in IO; callers must mlsbFinalize
any MLockedSizedBytes they receive when done with it.
Synopsis
- data EncryptedKey
- data XPrvFormat
- data XPrvError
- = XPrvDecodeError
- | XPrvUnsupportedVersion
- | XPrvUnsupportedKdf
- | XPrvUnsupportedCipher
- | XPrvInvalidKdfParams
- | XPrvInvalidSaltLength
- | XPrvInvalidNonceLength
- | XPrvInvalidTagLength
- | XPrvInvalidCiphertextLength
- | XPrvAuthenticationFailed
- | XPrvInvalidSecretKey
- | XPrvInvalidPublicKey
- | XPrvInvalidChainCode
- | XPrvPublicKeyMismatch
- | XPrvInternalError
- | XPrvHardenedDerivationUnsupported
- newtype Signature = Signature ByteString
- data DerivationScheme
- type DerivationIndex = Word32
- data PublicKey
- publicKeySize ∷ Int
- mkPublicKey ∷ MonadFail f ⇒ ByteString → f PublicKey
- publicKeyByteArray ∷ PublicKey → ByteArray
- publicKeyByteString ∷ PublicKey → ByteString
- data EncSecretKey
- encSecretKeySize ∷ Int
- mkEncSecretKey ∷ MonadFail f ⇒ ByteString → f EncSecretKey
- encSecretKeyByteArray ∷ EncSecretKey → ByteArray
- encSecretKeyByteString ∷ EncSecretKey → ByteString
- data ChainCode
- chainCodeSize ∷ Int
- mkChainCode ∷ MonadFail f ⇒ ByteString → f ChainCode
- chainCodeByteArray ∷ ChainCode → ByteArray
- chainCodeByteString ∷ ChainCode → ByteString
- data Salt
- saltSize ∷ Int
- mkSalt ∷ MonadFail f ⇒ ByteString → f Salt
- saltByteArray ∷ Salt → ByteArray
- saltByteString ∷ Salt → ByteString
- data Nonce
- nonceSize ∷ Int
- mkNonce ∷ MonadFail f ⇒ ByteString → f Nonce
- nonceByteArray ∷ Nonce → ByteArray
- nonceByteString ∷ Nonce → ByteString
- data Tag
- tagSize ∷ Int
- mkTag ∷ MonadFail f ⇒ ByteString → f Tag
- tagByteArray ∷ Tag → ByteArray
- tagByteString ∷ Tag → ByteString
- data Envelope
- decodeEncryptedKey ∷ EncryptedKey → Either XPrvError Envelope
- encodeEnvelope ∷ Envelope → Encoding
- decodeEnvelope ∷ Decoder s Envelope
- encryptedCreate ∷ (ByteArrayAccess passphrase, ByteArrayAccess secret, ByteArrayAccess cc) ⇒ secret → passphrase → cc → IO (Either XPrvError EncryptedKey)
- encryptedCreateDirectWithTweak ∷ (ByteArrayAccess passphrase, ByteArrayAccess secret) ⇒ secret → passphrase → IO (Either XPrvError EncryptedKey)
- mkEncryptedKey ∷ ByteString → Either XPrvError EncryptedKey
- unEncryptedKey ∷ EncryptedKey → ByteString
- encryptedKey ∷ ByteString → Either XPrvError EncryptedKey
- encryptedKeyFormat ∷ EncryptedKey → XPrvFormat
- encryptedValidatePassphrase ∷ ByteArrayAccess passphrase ⇒ EncryptedKey → passphrase → IO (Either XPrvError ())
- encryptedChangePassphrase ∷ (ByteArrayAccess oldPassPhrase, ByteArrayAccess newPassPhrase) ⇒ oldPassPhrase → newPassPhrase → EncryptedKey → IO (Either XPrvError EncryptedKey)
- encryptedSign ∷ (ByteArrayAccess passphrase, ByteArrayAccess msg) ⇒ EncryptedKey → passphrase → msg → IO (Either XPrvError Signature)
- encryptedDerivePrivate ∷ ByteArrayAccess passphrase ⇒ DerivationScheme → EncryptedKey → passphrase → DerivationIndex → IO (Either XPrvError EncryptedKey)
- encryptedDerivePublic ∷ DerivationScheme → (PublicKey, ChainCode) → DerivationIndex → Either XPrvError (PublicKey, ChainCode)
- encryptedPublic ∷ HasCallStack ⇒ EncryptedKey → PublicKey
- encryptedChainCode ∷ HasCallStack ⇒ EncryptedKey → ChainCode
- withFastKdfForTesting ∷ IO a → IO a
- withDeterministicRandomnessForTesting ∷ IO a → IO a
Types
data EncryptedKey Source #
Instances
| Show EncryptedKey Source # | |
Defined in Cardano.Crypto.WalletHD.Encrypted Methods showsPrec ∷ Int → EncryptedKey → ShowS # show ∷ EncryptedKey → String # showList ∷ [EncryptedKey] → ShowS # | |
| NFData EncryptedKey Source # | |
Defined in Cardano.Crypto.WalletHD.Encrypted Methods rnf ∷ EncryptedKey → () # | |
| Eq EncryptedKey Source # | |
Defined in Cardano.Crypto.WalletHD.Encrypted | |
| ByteArrayAccess EncryptedKey Source # | |
Defined in Cardano.Crypto.WalletHD.Encrypted Methods length ∷ EncryptedKey → Int Source # withByteArray ∷ EncryptedKey → (Ptr p → IO a) → IO a Source # copyByteArrayToPtr ∷ EncryptedKey → Ptr p → IO () Source # | |
data XPrvFormat Source #
Constructors
| LegacyV1 | |
| EnvelopeV2 |
Instances
| Show XPrvFormat Source # | |
Defined in Cardano.Crypto.WalletHD.Encrypted Methods showsPrec ∷ Int → XPrvFormat → ShowS # show ∷ XPrvFormat → String # showList ∷ [XPrvFormat] → ShowS # | |
| Eq XPrvFormat Source # | |
Defined in Cardano.Crypto.WalletHD.Encrypted | |
Constructors
Constructors
| Signature ByteString |
data DerivationScheme Source #
Constructors
| DerivationScheme1 | |
| DerivationScheme2 |
Instances
type DerivationIndex = Word32 Source #
PublicKey
mkPublicKey ∷ MonadFail f ⇒ ByteString → f PublicKey Source #
Encrypted SecretKey
data EncSecretKey Source #
Encrypted version of SecretKey
Instances
| Show EncSecretKey Source # | |
Defined in Cardano.Crypto.WalletHD.Encrypted Methods showsPrec ∷ Int → EncSecretKey → ShowS # show ∷ EncSecretKey → String # showList ∷ [EncSecretKey] → ShowS # | |
| Eq EncSecretKey Source # | |
Defined in Cardano.Crypto.WalletHD.Encrypted | |
mkEncSecretKey ∷ MonadFail f ⇒ ByteString → f EncSecretKey Source #
ChainCode
mkChainCode ∷ MonadFail f ⇒ ByteString → f ChainCode Source #
Salt
Nonce
Tag
tagByteArray ∷ Tag → ByteArray Source #
Envelope
Construction & validation
encryptedCreate ∷ (ByteArrayAccess passphrase, ByteArrayAccess secret, ByteArrayAccess cc) ⇒ secret → passphrase → cc → IO (Either XPrvError EncryptedKey) Source #
encryptedCreateDirectWithTweak ∷ (ByteArrayAccess passphrase, ByteArrayAccess secret) ⇒ secret → passphrase → IO (Either XPrvError EncryptedKey) Source #
mkEncryptedKey ∷ ByteString → Either XPrvError EncryptedKey Source #
Construct EncryptedKey from bytes.
encryptedKey ∷ ByteString → Either XPrvError EncryptedKey Source #
Deprecated: In favor of mkEncryptedKey
In order to promote smoother migration from cardano-crypto. Use mkEncryptedKey instead
Passphrase operations
encryptedValidatePassphrase ∷ ByteArrayAccess passphrase ⇒ EncryptedKey → passphrase → IO (Either XPrvError ()) Source #
encryptedChangePassphrase ∷ (ByteArrayAccess oldPassPhrase, ByteArrayAccess newPassPhrase) ⇒ oldPassPhrase → newPassPhrase → EncryptedKey → IO (Either XPrvError EncryptedKey) Source #
Signing & derivation
encryptedSign ∷ (ByteArrayAccess passphrase, ByteArrayAccess msg) ⇒ EncryptedKey → passphrase → msg → IO (Either XPrvError Signature) Source #
encryptedDerivePrivate ∷ ByteArrayAccess passphrase ⇒ DerivationScheme → EncryptedKey → passphrase → DerivationIndex → IO (Either XPrvError EncryptedKey) Source #
encryptedDerivePublic ∷ DerivationScheme → (PublicKey, ChainCode) → DerivationIndex → Either XPrvError (PublicKey, ChainCode) Source #
Accessors
Test helpers
withFastKdfForTesting ∷ IO a → IO a Source #
Reduce Argon2id cost for fast tests while keeping all v2 envelope structure intact.
withDeterministicRandomnessForTesting ∷ IO a → IO a Source #
Replace system randomness with a deterministic counter for reproducible test output.