hmac-drbg

Pure Haskell HMAC-DRBG (docs.ppad.tech/hmac-drbg).
git clone git://git.ppad.tech/hmac-drbg.git
Log | Files | Refs | README | LICENSE

commit d49f5c7c03c82d4d8321f2932b19160822715ebc
parent 567288a1f3a558a69a6ee10a26e44f00310692f9
Author: Jared Tobin <jared@jtobin.io>
Date:   Sun, 22 Jun 2025 13:00:15 +0400

lib: vertical integration

Diffstat:
MREADME.md | 36++++++++++++++++--------------------
Mflake.lock | 32++++++++++++++++++++++++++++++++
Mflake.nix | 11++++++++++-
Mppad-hmac-drbg.cabal | 2+-
Mtest/Main.hs | 5++++-
5 files changed, 63 insertions(+), 23 deletions(-)

diff --git a/README.md b/README.md @@ -71,37 +71,33 @@ Haddocks (API documentation, etc.) are hosted at The aim is best-in-class performance for pure, highly-auditable Haskell code. -Current benchmark figures on my mid-2020 MacBook Air look like (use +Current benchmark figures on an M4 Silicon MacBook Air look like (use `cabal bench` to run the benchmark suite): ``` benchmarking ppad-hmac-drbg/HMAC-SHA256/new - time 20.86 μs (20.78 μs .. 20.94 μs) + time 10.46 μs (10.45 μs .. 10.46 μs) 1.000 R² (1.000 R² .. 1.000 R²) - mean 20.82 μs (20.72 μs .. 20.93 μs) - std dev 370.6 ns (299.3 ns .. 456.6 ns) - variance introduced by outliers: 15% (moderately inflated) + mean 10.44 μs (10.44 μs .. 10.46 μs) + std dev 28.45 ns (19.59 ns .. 46.15 ns) benchmarking ppad-hmac-drbg/HMAC-SHA256/reseed - time 13.98 μs (13.83 μs .. 14.18 μs) - 0.999 R² (0.998 R² .. 1.000 R²) - mean 13.89 μs (13.79 μs .. 14.03 μs) - std dev 398.9 ns (296.7 ns .. 580.8 ns) - variance introduced by outliers: 32% (moderately inflated) + time 6.917 μs (6.900 μs .. 6.934 μs) + 1.000 R² (1.000 R² .. 1.000 R²) + mean 6.908 μs (6.893 μs .. 6.921 μs) + std dev 47.40 ns (27.59 ns .. 84.31 ns) benchmarking ppad-hmac-drbg/HMAC-SHA256/gen (32B) - time 21.10 μs (20.95 μs .. 21.25 μs) - 1.000 R² (0.999 R² .. 1.000 R²) - mean 21.19 μs (21.06 μs .. 21.36 μs) - std dev 509.2 ns (390.7 ns .. 812.2 ns) - variance introduced by outliers: 24% (moderately inflated) + time 10.55 μs (10.52 μs .. 10.59 μs) + 1.000 R² (1.000 R² .. 1.000 R²) + mean 10.51 μs (10.50 μs .. 10.53 μs) + std dev 44.48 ns (25.76 ns .. 78.90 ns) benchmarking ppad-hmac-drbg/HMAC-SHA256/gen (256B) - time 68.17 μs (67.62 μs .. 68.82 μs) - 1.000 R² (0.999 R² .. 1.000 R²) - mean 68.74 μs (68.42 μs .. 69.09 μs) - std dev 1.172 μs (1.022 μs .. 1.410 μs) - variance introduced by outliers: 12% (moderately inflated) + time 36.08 μs (34.94 μs .. 37.26 μs) + 0.996 R² (0.994 R² .. 1.000 R²) + mean 35.30 μs (35.09 μs .. 35.96 μs) + std dev 1.085 μs (488.0 ns .. 2.012 μs) ``` ## Security diff --git a/flake.lock b/flake.lock @@ -34,6 +34,37 @@ "type": "github" } }, + "ppad-base16": { + "inputs": { + "flake-utils": [ + "ppad-base16", + "ppad-nixpkgs", + "flake-utils" + ], + "nixpkgs": [ + "ppad-base16", + "ppad-nixpkgs", + "nixpkgs" + ], + "ppad-nixpkgs": [ + "ppad-nixpkgs" + ] + }, + "locked": { + "lastModified": 1741625558, + "narHash": "sha256-ZBDXRD5fsVqA5bGrAlcnhiu67Eo50q0M9614nR3NBwY=", + "ref": "master", + "rev": "fb63457f2e894eda28250dfe65d0fcd1d195ac2f", + "revCount": 24, + "type": "git", + "url": "git://git.ppad.tech/base16.git" + }, + "original": { + "ref": "master", + "type": "git", + "url": "git://git.ppad.tech/base16.git" + } + }, "ppad-nixpkgs": { "inputs": { "flake-utils": "flake-utils", @@ -126,6 +157,7 @@ "ppad-nixpkgs", "nixpkgs" ], + "ppad-base16": "ppad-base16", "ppad-nixpkgs": "ppad-nixpkgs", "ppad-sha256": "ppad-sha256", "ppad-sha512": "ppad-sha512" diff --git a/flake.nix b/flake.nix @@ -7,6 +7,12 @@ url = "git://git.ppad.tech/nixpkgs.git"; ref = "master"; }; + ppad-base16 = { + type = "git"; + url = "git://git.ppad.tech/base16.git"; + ref = "master"; + inputs.ppad-nixpkgs.follows = "ppad-nixpkgs"; + }; ppad-sha256 = { type = "git"; url = "git://git.ppad.tech/sha256.git"; @@ -24,7 +30,7 @@ }; outputs = { self, nixpkgs, flake-utils, ppad-nixpkgs - , ppad-sha256, ppad-sha512 + , ppad-base16, ppad-sha256, ppad-sha512 }: flake-utils.lib.eachDefaultSystem (system: let @@ -33,13 +39,16 @@ pkgs = import nixpkgs { inherit system; }; hlib = pkgs.haskell.lib; + base16 = ppad-base16.packages.${system}.default; sha256 = ppad-sha256.packages.${system}.default; sha512 = ppad-sha512.packages.${system}.default; hpkgs = pkgs.haskell.packages.ghc981.extend (new: old: { + ppad-base16 = base16; ppad-sha256 = sha256; ppad-sha512 = sha512; ${lib} = new.callCabal2nix lib ./. { + ppad-base16 = new.ppad-base16; ppad-sha256 = new.ppad-sha256; ppad-sha512 = new.ppad-sha512; }; diff --git a/ppad-hmac-drbg.cabal b/ppad-hmac-drbg.cabal @@ -42,8 +42,8 @@ test-suite hmac-drbg-tests build-depends: attoparsec , base - , base16-bytestring , bytestring + , ppad-base16 , ppad-hmac-drbg , ppad-sha256 , ppad-sha512 diff --git a/test/Main.hs b/test/Main.hs @@ -129,7 +129,10 @@ hex_digit = A.satisfy hd where || (c >= 'A' && c <= 'F') parse_hex :: A.Parser BS.ByteString -parse_hex = (B16.decodeLenient . B8.pack) <$> A.many1 hex_digit +parse_hex = (decodeLenient . B8.pack) <$> A.many1 hex_digit where + decodeLenient bs = case B16.decode bs of + Nothing -> error "bang" + Just v -> v parse_kv :: BS.ByteString -> A.Parser BS.ByteString parse_kv k =