|
125 | 125 | ;; (defn hash-murmur3 ^long [^String s] (clojure.lang.Murmur3/hashUnencodedChars s)) |
126 | 126 | ;; (comment (hash-murmur3 "hello")) |
127 | 127 |
|
128 | | -(let [md-md5_ (enc/thread-local (java.security.MessageDigest/getInstance "MD5")) |
129 | | - md-sha-1_ (enc/thread-local (java.security.MessageDigest/getInstance "SHA-1")) |
130 | | - md-sha-256_ (enc/thread-local (java.security.MessageDigest/getInstance "SHA-256")) |
131 | | - md-sha-512_ (enc/thread-local (java.security.MessageDigest/getInstance "SHA-512"))] |
| 128 | +(let [tl:md-md5 (enc/threadlocal (java.security.MessageDigest/getInstance "MD5")) |
| 129 | + tl:md-sha-1 (enc/threadlocal (java.security.MessageDigest/getInstance "SHA-1")) |
| 130 | + tl:md-sha-256 (enc/threadlocal (java.security.MessageDigest/getInstance "SHA-256")) |
| 131 | + tl:md-sha-512 (enc/threadlocal (java.security.MessageDigest/getInstance "SHA-512"))] |
132 | 132 |
|
133 | 133 | (defn as-message-digest |
134 | 134 | "Returns `java.security.MessageDigest`, or throws. |
135 | 135 | Takes `hash-algo` ∈ #{:md5 :sha-1 :sha-256 :sha-512}." |
136 | 136 | ^java.security.MessageDigest [hash-algo] |
137 | 137 | (case hash-algo |
138 | | - :md5 @md-md5_ |
139 | | - :sha-1 @md-sha-1_ |
140 | | - :sha-256 @md-sha-256_ |
141 | | - :sha-512 @md-sha-512_ |
| 138 | + :md5 (.get tl:md-md5) |
| 139 | + :sha-1 (.get tl:md-sha-1) |
| 140 | + :sha-256 (.get tl:md-sha-256) |
| 141 | + :sha-512 (.get tl:md-sha-512) |
142 | 142 | (truss/unexpected-arg! hash-algo |
143 | 143 | {:expected #{:md5 :sha-1 :sha-256 :sha-512} |
144 | 144 | :context `as-message-digest})))) |
|
187 | 187 | ;; Note that HMAC can also be used as part of HKDF (RFC 5869), in which case |
188 | 188 | ;; an optional/zeroed salt is used as shared secret. |
189 | 189 |
|
190 | | -(let [hmac-md5_ (enc/thread-local (javax.crypto.Mac/getInstance "HmacMD5")) |
191 | | - hmac-sha-1_ (enc/thread-local (javax.crypto.Mac/getInstance "HmacSHA1")) |
192 | | - hmac-sha-256_ (enc/thread-local (javax.crypto.Mac/getInstance "HmacSHA256")) |
193 | | - hmac-sha-512_ (enc/thread-local (javax.crypto.Mac/getInstance "HmacSHA512"))] |
| 190 | +(let [tl:hmac-md5 (enc/threadlocal (javax.crypto.Mac/getInstance "HmacMD5")) |
| 191 | + tl:hmac-sha-1 (enc/threadlocal (javax.crypto.Mac/getInstance "HmacSHA1")) |
| 192 | + tl:hmac-sha-256 (enc/threadlocal (javax.crypto.Mac/getInstance "HmacSHA256")) |
| 193 | + tl:hmac-sha-512 (enc/threadlocal (javax.crypto.Mac/getInstance "HmacSHA512"))] |
194 | 194 |
|
195 | 195 | (defn- as-hmac |
196 | 196 | "Returns `javax.crypto.Mac`, or throws. |
197 | 197 | Takes `hash-algo` ∈ #{:md5 :sha-1 :sha-256 :sha-512}." |
198 | 198 | ^javax.crypto.Mac [hash-algo] |
199 | 199 | (case hash-algo |
200 | | - :md5 @hmac-md5_ |
201 | | - :sha-1 @hmac-sha-1_ |
202 | | - :sha-256 @hmac-sha-256_ |
203 | | - :sha-512 @hmac-sha-512_ |
| 200 | + :md5 (.get tl:hmac-md5) |
| 201 | + :sha-1 (.get tl:hmac-sha-1) |
| 202 | + :sha-256 (.get tl:hmac-sha-256) |
| 203 | + :sha-512 (.get tl:hmac-sha-512) |
204 | 204 | (truss/unexpected-arg! hash-algo |
205 | 205 | {:expected #{:md5 :sha-1 :sha-256 :sha-512} |
206 | 206 | :context `as-hmac})))) |
|
253 | 253 | (def ^:const default-sym-key-len "256 bits" 32) |
254 | 254 | (def ^:const min-iv-len "128 bits" 16) |
255 | 255 |
|
256 | | -(let [cipher-aes-gcm_ (enc/thread-local (javax.crypto.Cipher/getInstance "AES/GCM/NoPadding")) |
257 | | - cipher-aes-cbc_ (enc/thread-local (javax.crypto.Cipher/getInstance "AES/CBC/PKCS5Padding")) |
258 | | - chacha20-poly1305_ (enc/thread-local (javax.crypto.Cipher/getInstance "ChaCha20-Poly1305"))] |
| 256 | +(let [tl:cipher-aes-gcm (enc/threadlocal (javax.crypto.Cipher/getInstance "AES/GCM/NoPadding")) |
| 257 | + tl:cipher-aes-cbc (enc/threadlocal (javax.crypto.Cipher/getInstance "AES/CBC/PKCS5Padding")) |
| 258 | + tl:chacha20-poly1305 (enc/threadlocal (javax.crypto.Cipher/getInstance "ChaCha20-Poly1305"))] |
259 | 259 |
|
260 | 260 | (defn- as-symmetric-cipher |
261 | 261 | "Returns `javax.crypto.Cipher`, or throws. |
262 | 262 | Takes `sym-cipher-algo` ∈ #{:aes-gcm :aes-cbc :chacha20-poly1305}." |
263 | 263 | ^javax.crypto.Cipher [sym-cipher-algo] |
264 | 264 | (case sym-cipher-algo |
265 | | - :aes-gcm @cipher-aes-gcm_ |
266 | | - :aes-cbc @cipher-aes-cbc_ |
267 | | - :chacha20-poly1305 @chacha20-poly1305_ |
| 265 | + :aes-gcm (.get tl:cipher-aes-gcm) |
| 266 | + :aes-cbc (.get tl:cipher-aes-cbc) |
| 267 | + :chacha20-poly1305 (.get tl:chacha20-poly1305) |
268 | 268 | (truss/unexpected-arg! sym-cipher-algo |
269 | 269 | {:expected #{:aes-gcm :aes-cbc :chacha20-poly1305} |
270 | 270 | :context `as-symmetric-cipher})))) |
|
561 | 561 |
|
562 | 562 | kpg)) |
563 | 563 |
|
564 | | -(let [;; Avoid thread-locals here since we want fresh *srng* |
565 | | - ;; kpb-get* |
566 | | - ;; (fn [algo-name algo-params] |
567 | | - ;; (enc/thread-local (kpg-get algo-name algo-params))) |
568 | | - ;; |
569 | | - ;; kpg-rsa-1024_ (kpg-get* "RSA" 1024) ; etc. |
| 564 | +(let [;; Avoid ThreadLocals here since we want fresh *srng* |
| 565 | + ;; kpb-get* (fn [algo-name algo-params] (enc/threadlocal (kpg-get algo-name algo-params))) |
| 566 | + ;; tl:kpg-rsa-1024 (kpg-get* "RSA" 1024) ; etc. |
570 | 567 | ] |
571 | 568 |
|
572 | 569 | (defn- as-keypair-generator |
|
776 | 773 |
|
777 | 774 | ;;;; |
778 | 775 |
|
779 | | -(let [kf-rsa_ (enc/thread-local (java.security.KeyFactory/getInstance "RSA")) |
780 | | - kf-dh_ (enc/thread-local (java.security.KeyFactory/getInstance "DiffieHellman")) |
781 | | - kf-ec_ (enc/thread-local (java.security.KeyFactory/getInstance "EC"))] |
| 776 | +(let [tl:kf-rsa (enc/threadlocal (java.security.KeyFactory/getInstance "RSA")) |
| 777 | + tl:kf-dh (enc/threadlocal (java.security.KeyFactory/getInstance "DiffieHellman")) |
| 778 | + tl:kf-ec (enc/threadlocal (java.security.KeyFactory/getInstance "EC"))] |
782 | 779 |
|
783 | 780 | (defn- as-key-factory |
784 | 781 | "Returns `java.security.KeyFactory`, or throws. |
785 | 782 | Takes `key-algo` ∈ #{:rsa :rsa-<nbits> :dh :dh-<nbits> :ec-<curve>}." |
786 | 783 | ^java.security.KeyFactory |
787 | 784 | [key-algo] |
788 | 785 | (case key-algo |
789 | | - (:rsa :rsa-1024 :rsa-2048 :rsa-3072 :rsa-4096) @kf-rsa_ |
790 | | - (:dh :dh-1024 :dh-2048 :dh-3072 :dh-4096) @kf-dh_ |
791 | | - (:ec :ec-secp256r1 :ec-secp384r1 :ec-secp521r1) @kf-ec_ |
| 786 | + (:rsa :rsa-1024 :rsa-2048 :rsa-3072 :rsa-4096) (.get tl:kf-rsa) |
| 787 | + (:dh :dh-1024 :dh-2048 :dh-3072 :dh-4096) (.get tl:kf-dh) |
| 788 | + (:ec :ec-secp256r1 :ec-secp384r1 :ec-secp521r1) (.get tl:kf-ec) |
792 | 789 |
|
793 | 790 | (truss/unexpected-arg! key-algo |
794 | 791 | {:expected #{:rsa :rsa-<nbits> :dh :dh-<nbits> :ec :ec-<curve>} |
|
881 | 878 |
|
882 | 879 | ;;;; Asymmetric ciphers using 1 keypair |
883 | 880 |
|
884 | | -(let [cipher-rsa-oaep-sha-256-mgf1_ |
885 | | - (enc/thread-local |
886 | | - (javax.crypto.Cipher/getInstance |
887 | | - "RSA/ECB/OAEPWithSHA-256AndMGF1Padding"))] |
| 881 | +(let [tl:cipher-rsa-oaep-sha-256-mgf1 (enc/threadlocal (javax.crypto.Cipher/getInstance "RSA/ECB/OAEPWithSHA-256AndMGF1Padding"))] |
888 | 882 |
|
889 | 883 | (defn- as-asymmetric-cipher |
890 | 884 | "Returns `javax.crypto.Cipher`, or throws. |
891 | 885 | Takes `asym-cipher-algo` ∈ #{:rsa-oaep-sha-256-mgf1}." |
892 | 886 | ^javax.crypto.Cipher [asym-cipher-algo] |
893 | 887 | (case asym-cipher-algo |
894 | | - :rsa-oaep-sha-256-mgf1 @cipher-rsa-oaep-sha-256-mgf1_ |
| 888 | + :rsa-oaep-sha-256-mgf1 (.get tl:cipher-rsa-oaep-sha-256-mgf1) |
895 | 889 | (truss/unexpected-arg! asym-cipher-algo |
896 | 890 | {:expected #{:rsa-oaep-sha-256-mgf1} |
897 | 891 | :context `as-asymmetric-cipher})))) |
|
930 | 924 | ;; Ref. <https://stackoverflow.com/a/58993471/1982742>, |
931 | 925 | ;; <https://crypto.stackexchange.com/a/1026/106804> |
932 | 926 |
|
933 | | -(let [ka-dh_ (enc/thread-local (javax.crypto.KeyAgreement/getInstance "DiffieHellman")) ; PKCS #3 |
934 | | - ka-ecdh_ (enc/thread-local (javax.crypto.KeyAgreement/getInstance "ECDH")) ; RFC 3278 |
935 | | - ;; ka-ecmqv_ (enc/thread-local (javax.crypto.KeyAgreement/getInstance "ECMQV")) |
| 927 | +(let [tl:ka-dh (enc/threadlocal (javax.crypto.KeyAgreement/getInstance "DiffieHellman")) ; PKCS #3 |
| 928 | + tl:ka-ecdh (enc/threadlocal (javax.crypto.KeyAgreement/getInstance "ECDH")) ; RFC 3278 |
| 929 | + ;; tl:ka-ecmqv (enc/threadlocal (javax.crypto.KeyAgreement/getInstance "ECMQV")) |
936 | 930 | ] |
937 | 931 |
|
938 | 932 | (defn as-key-agreement |
939 | 933 | "Returns `javax.crypto.KeyAgreement`, or throws. |
940 | 934 | Takes `ka-algo` ∈ #{:dh :ecdh}." |
941 | 935 | ^javax.crypto.KeyAgreement [ka-algo] |
942 | 936 | (case ka-algo |
943 | | - :dh @ka-dh_ |
944 | | - :ecdh @ka-ecdh_ |
| 937 | + :dh (.get tl:ka-dh) |
| 938 | + :ecdh (.get tl:ka-ecdh) |
945 | 939 | (truss/unexpected-arg! ka-algo |
946 | 940 | {:expected #{:dh :ecdh} |
947 | 941 | :context `as-key-agreement})))) |
|
966 | 960 |
|
967 | 961 | ;;;; Signatures |
968 | 962 |
|
969 | | -(let [sig-sha-256-rsa_ (enc/thread-local (java.security.Signature/getInstance "SHA256withRSA")) |
970 | | - sig-sha-512-rsa_ (enc/thread-local (java.security.Signature/getInstance "SHA512withRSA")) |
971 | | - sig-sha-256-ecdsa_ (enc/thread-local (java.security.Signature/getInstance "SHA256withECDSA")) |
972 | | - sig-sha-512-ecdsa_ (enc/thread-local (java.security.Signature/getInstance "SHA512withECDSA"))] |
| 963 | +(let [tl:sig-sha-256-rsa (enc/threadlocal (java.security.Signature/getInstance "SHA256withRSA")) |
| 964 | + tl:sig-sha-512-rsa (enc/threadlocal (java.security.Signature/getInstance "SHA512withRSA")) |
| 965 | + tl:sig-sha-256-ecdsa (enc/threadlocal (java.security.Signature/getInstance "SHA256withECDSA")) |
| 966 | + tl:sig-sha-512-ecdsa (enc/threadlocal (java.security.Signature/getInstance "SHA512withECDSA"))] |
973 | 967 |
|
974 | 968 | (defn- as-signature |
975 | 969 | "Returns `java.security.Signature` or throws. |
976 | 970 | Takes `sig-algo` ∈ #{:sha-<nbits>-rsa :sha-<nbits>-ecdsa}." |
977 | 971 | ^java.security.Signature [sig-algo] |
978 | 972 | (case sig-algo |
979 | | - :sha-256-rsa @sig-sha-256-rsa_ |
980 | | - :sha-512-rsa @sig-sha-512-rsa_ |
981 | | - :sha-256-ecdsa @sig-sha-256-ecdsa_ |
982 | | - :sha-512-ecdsa @sig-sha-512-ecdsa_ |
| 973 | + :sha-256-rsa (.get tl:sig-sha-256-rsa) |
| 974 | + :sha-512-rsa (.get tl:sig-sha-512-rsa) |
| 975 | + :sha-256-ecdsa (.get tl:sig-sha-256-ecdsa) |
| 976 | + :sha-512-ecdsa (.get tl:sig-sha-512-ecdsa) |
983 | 977 | (truss/unexpected-arg! sig-algo |
984 | 978 | {:expected #{:sha-<nbits>-rsa :sha-<nbits>-ecdsa} |
985 | 979 | :context `as-signature})))) |
|
0 commit comments