# Standard Security Reference

Hasher

The `Hasher` class is a base class that is used to build a message hash. The hash result is stored in an array of bytes and can be retrieved byte by byte or as a formatted printable string. This class does not have a constructor.

hasher-p
Nameable
reset
none
none

The `reset` method reset the hasher object with its associated internal states.

hash-p
Boolean
String

The `hash-p` predicate returns true if the string argument is potentially a hash value. It is not possible, with our current technology, to reverse a hash value to one or several representations, nor it is possible to assert that such value exists.

get-byte
Byte
Integer

The `get-byte` method returns the hash byte value by index. The argument is the byte index which must be in the range of the hash result length.

format
String
none

The `format` method return a string representation of the hash value.

compute
String
Literal|Buffer|InputStream

The `compute` method computes the hash value from a string, a buffer or an input stream. The method returns a string representation of the result hash value. When the argument is a buffer object or an input stream, the characters are consumed from the object.

derive
String
String

The `derive` method computes the hash value from an octet string which is converted before the hash computation. The method returns a string representation of the result hash value.

get-hash-length
Integer
none

The `get-hash-length` method returns the hasher length in bytes.

get-result-length
Integer
none

The `get-result-length` method returns the hasher result length in bytes. The result length is less or equal to the hasher length and is set at construction.

Md2

The `Md2` class is a hashing class that implements the MD-2 algorithm.

md2-p
Hasher
Md2
none

The `Md2` constructor creates a default hashing object that implements the MD-2 algorithm.

Md2
Integer

The `Md2` constructor creates a MD-2 hashing object with a result length. The argument is the hasher result length that must be less or equal to the hasher length.

Md4

The `Md4` class is a hashing class that implements the MD-4 algorithm.

md4-p
Hasher
Md4
none

The `Md4` constructor creates a default hashing object that implements the MD-4 algorithm.

Md4
Integer

The `Md4` constructor creates a MD-4 hashing object with a result length. The argument is the hasher result length that must be less or equal to the hasher length.

Md5

The `Md5` class is a hashing class that implements the MD-5 algorithm.

md5-p
Hasher
Md5
none

The `Md5` constructor creates a default hashing object that implements the MD-5 algorithm.

Md5
Integer

The `Md5` constructor creates a MD-5 hashing object with a result length. The argument is the hasher result length that must be less or equal to the hasher length.

Sha1

The `Sha1` class is a hashing class that implements the SHA-1 algorithm.

sha1-p
Hasher
Sha1
none

The `Sha1` constructor creates a default hashing object that implements the SHA-1 algorithm.

Sha1
Integer

The `Sha1` constructor creates a SHA-1 hashing object with a result length. The argument is the hasher result length that must be less or equal to the hasher length.

Sha224

The `Sha224` class is a hashing class that implements the SHA-224 algorithm.

sha224-p
Hasher
Sha224
none

The `Sha224` constructor creates a default hashing object that implements the SHA-224 algorithm.

Sha224
Integer

The `Sha224` constructor creates a SHA-224 hashing object with a result length. The argument is the hasher result length that must be less or equal to the hasher length.

Sha256

The `Sha256` class is a hashing class that implements the SHA-256 algorithm.

sha256-p
Hasher
Sha256
none

The `Sha256` constructor creates a default hashing object that implements the SHA-256 algorithm.

Sha256
Integer

The `Sha256` constructor creates a SHA-256 hashing object with a result length. The argument is the hasher result length that must be less or equal to the hasher length.

Sha384

The `Sha384` class is a hashing class that implements the SHA-384 algorithm.

sha384-p
Hasher
Sha384
none

The `Sha384` constructor creates a default hashing object that implements the SHA-384 algorithm.

Sha384
Integer

The `Sha384` constructor creates a SHA-384 hashing object with a result length. The argument is the hasher result length that must be less or equal to the hasher length.

Sha512

The `Sha512` class is a hashing class that implements the SHA-512 algorithm.

sha512-p
Hasher
Sha512
none

The `Sha512` constructor creates a default hashing object that implements the SHA-512 algorithm.

Sha512
Integer

The `Sha512` constructor creates a SHA-512 hashing object with a result length. The argument is the hasher result length that must be less or equal to the hasher length.

Key

The `Key` class is an original class used to store a particular key or to generate one. A key is designed to operate with a variety of cipher that can be either symmetric or asymmetric. In the symmetric case, the key is generally an array of bytes. Asymmetric key are generally stored in the form of number list that can be computed or loaded by value. By default, a random 128 bit symmetric key is created.

key-p
Object
Key
none

The `Key` constructor creates a default cipher key. The key is generated with random bytes and is 128 bits long.

Key
String

The `Key` constructor creates a symmetric key from an octet string. The octet string argument determines the size of the key. The octet string argument is compatible with the string obtained from the `format` method.

Key
Item

The `Key` constructor creates a key by type. If the key type is `KSYM`, a symmetric 128 bytes random key is generated. If the key type is `KRSA`, a 1024 bits RSA random key is generated.

Key
Item Integer|String|Vector

The `Key` constructor creates a key by type. The first argument is the key type to generate. The second argument is either the key size, the key octet string or the key byte values. In the first form, an integer argument specifies the key size in bytes or bits depending on the key nature. In the second form, a string is used as octet string to represent the key. In the third form, a vector of byte values can be used to load the key.

KSYM

The `KSYM` constant indicates that the key is a symmetric key.

KRSA

The `KRSA` constant indicates that the key is a asymmetric RSA key.

KMAC

The `KMAC` constant indicates that the key is a message authentication (MAC) key.

RSA-MODULUS

The `RSA-MODULUS` constant corresponds to the RSA modulus value.

RSA-PUBLIC-EXPONENT

The `RSA-PUBLIC-EXPONENT` constant corresponds to the RSA public exponent value which is generally 65537.

RSA-SECRET-EXPONENT

The `RSA-SECRET-EXPONENT` constant corresponds to the RSA secret exponent value.

get-byte
Byte
Integer

The `get-byte` method returns a key byte value by index. The index must be in the key range or an exception is raised. This method is primarily used with symmetric key.

get-type
Item
none

The `get-type` method returns the key type in the form of an item object.

get-bits
Integer
none

The `get-bits` method returns the key size in bits.

get-size
Integer
none

The `get-size` method returns the key size in bytes.

format
String
none|Item

The `format` method returns a string representation of the key. In the first form, without argument, the key is returned as an octet string if possible. In the second form, the key value is returned as an octet string based on the key element to access.

get-relatif-key
Relatif
Item

The `get-relatif-key` method returns a relatif representation of a key element. This method is well suited for asymmetric key. The key value is returned as a relatif based on the key element to access.

Kdf

The `Kdf` class is an abstract class used to model key derivation function. The class provides only a byte buffer which can be accessed by index. In the key derivation functions land, there are numerous standards, such like PKCS 2.1, IEEE P1363-2000, ISO/IEC 18033-2. All of these standards have sometimes conflicting definitions.

kdf-p
Nameable
reset
none
none

The `reset` method reset the internal state of the kdf object.

get-size
Integer
none

The `get-size` method returns the kdf size in bytes.

get-byte
Byte
Integer

The `get-byte` method returns a kdf byte value by index. The index must be in the key range or an exception is raised.

format
String
none

The `format` method returns a string representation of the derived key.

derive
String
String

The `derive` method returns a string representation of a derived key computed from the octet string argument.

compute
String
String

The `compute` method returns a string representation of a derived key computed from the string argument.

Hkdf

The `Hkdf` class is an abstract class used to model key derivation function based on hash function. The class maintains a hasher object that is used to derive the key from an octet string.

hashed-kdf-p
Kdf
get-hasher
none
none

The `get-hasher` method returns the hasher object associated with the key derivation function object. object.

Kdf1

The `Kdf1` class is a hashed key derivation function class that implements the KDF1 specification as defined by ISO/IEC 18033-2. The class is strictly equivalent to the mask generation function (MGF1) defined in PKCS 2.1. On the other hand, this implementation does not conform to the KDF1 specification of IEEE 1363-2000 which is somehow rather bizarre. The class operates in theory with any type of hasher object as long as the octet string is not too long.

kdf1-p
Hkdf
Kdf1
Hasher Integer

The `Kdf1` constructor creates a KDF1 key derivation function object. The first argument is the hasher object to bind and the second argument is the kdf size.

Kdf2

The `Kdf2` class is a hashed key derivation function class that implements the KDF2 specification as defined by ISO/IEC 18033-2. The class is strictly equivalent to the key function derivation (KDF1) except that the internal counter runs from 1 to k instead of 0 to k-1. The class operates in theory with any type of hasher object as long as the octet string is not too long.

kdf2-p
Hkdf
Kdf2
Hasher Integer

The `Kdf2` constructor creates a KDF2 key derivation function object. The first argument is the hasher object to bind and the second argument is the kdf size.

Cipher

The `Cipher` class is a base class that is used to implement a cipher. A cipher is used to encrypt or decrypt a message. There are basically two types of ciphers, namely symmetric cipher and asymmetric cipher. For the base class operation, only the cipher name and key is needed. A reverse flag controls whether or not an encryption operation must be reversed. A reset method can also be used to reset the internal cipher state.

cipher-p
Nameable
reset
none
none

The `reset` method reset the cipher internal state.

stream
Integer
OutputStream InputStream

The `stream` method process an input stream and write into an output stream. The method returns the number of character processed. The first argument is the output stream used to write the coded characters. The second argument is the input stream used to read the characters.

set-key
none
Key

The `set-key` method sets the cipher key. The first argument is the key to set.

get-key
Key
none

The `get-key` method returns the cipher key.

set-reverse
none
Boolean

The `set-reverse` method sets the cipher reverse flag. The first argument is the flag to set. If the flag is true, the cipher operates in reverse mode. If the flag is false, the cipher operates in direct mode.

get-reverse
Boolean
none

The `get-reverse` method returns the cipher reverse flag. If the flag is true, the cipher operates in reverse mode. If the flag is false, the cipher operates in direct mode.

BlockCipher

The `BlockCipher` class is an abstract class that is used to implement a symmetric block cipher. By default the cipher operates in encryption mode. When the reverse flag is set, the decryption mode is activated. For a block cipher, a block size controls the cipher operations. The class also defines the constants that control the block padding with the associated methods.

block-cipher-p
Cipher
PAD-NONE

The `PAD-NONE` constant indicates that the block should not be padded.

PAD-BIT-MODE

The `PAD-BIT` constant indicates that the block should be padded in bit mode.

PAD-ANSI-X923

The `PAD-ANSI-X923` constant indicates that the block should be padded according to ANSI X 923 standard.

PAD-NIST-800

The `PAD-NIST-800` constant indicates that the block should be padded according to NIST 800-38A recommendations. This is the default mode.

get-block-size
Integer
none

The `get-block-size` method returns the cipher block size.

set-padding-mode
none
Item

The `set-padding-mode` method sets the cipher padding mode.

get-padding-mode
Item
none

The `get-padding-mode` method returns the cipher padding mode.

InputCipher

The `InputCipher` class is an stream interface that can stream out an input stream from a cipher. In other word, an input stream is read and block are encoded as long as the input stream read characters. If the cipher is nil, the input cipher simply read the input stream and is therefore transparent. The class acts like an input stream, read the character from the bounded input stream and encode or decode them from the bounded cipher. The `InputCipher` defines several modes of operations. In electronic codebook mode or ECB, the character are encoded in a block basis. In cipher block chaining mode, the block are encoded by doing an XOR operation with the previous block. Other modes such like cipher feedback mode and output feedback mode are also defined.

input-cipher-p
Input
InputCipher
Cipher

The `InputCipher` constructor creates an input cipher with a cipher object. The first argument is the cipher to used for processing.

InputCipher
Cipher Input

The `InputCipher` constructor creates an input cipher with a cipher object and an input stream. The first argument is the cipher to used for processing. The second argument is the input stream object used for the character reading.

InputCipher
Cipher InputStream Item

The `InputCipher` constructor creates an input cipher with a cipher object, an input stream and a mode. The first argument is the cipher to used for processing. The second argument is the input stream object used for the character reading. The third argument is the input cipher mode which can be either ECB, CBC, CFB or OFB.

ECB

The `ECB` constant indicates that the input cipher is to operate in electronic codebook mode. This mode is the default mode.

CBC

The `CBC` constant indicates that the input cipher is to operate in cipher chaining block mode.

CFB

The `CFB` constant indicates that the input cipher is to operate in cipher feedback block mode.

OFB

The `OFB` constant indicates that the input cipher is to operate in output feedback block mode.

reset
none
none

The `reset` method reset the input cipher object.

get-mode
Item
none

The `get-mode` method returns the input cipher operating mode.

set-iv
none
String|Buffer

The `set-iv` method sets the input cipher initial vector. In the first form, the initial vector is set from an octet string. In the second form, the initial vector is set from a buffer object.

get-iv
String
none

The `get-iv` method returns the input cipher initial vector as an octet string.

set-is
none
InputStream

The `set-is` method sets the input cipher input stream. This method can be used to chain multiple input streams in a unique coding session.

Aes

The `Aes` class is a block cipher class that implements the advanced encryption standard (AES), originally known as Rijndael. This is an original implementation that conforms to the standard FIPS PUB 197. It should be noted that the AES standard, unlike Rijndael, defines a fixed block size of 16 bytes (4 words) and 3 keys sizes (128, 192, 256).

aes-p
BlockCipher
Aes
Key

The `Aes` constructor creates a direct cipher with a key. The first argument is the key used by the cipher.

Aes
Key Boolean

The `Aes` constructor creates a cipher with a key and a reverse flag. The first argument is the key used by the cipher. The second argument is the reverse flag.

PublicCipher

The `PublicCipher` class is an abstract class that is used to implement an asymmetric cipher. An asymmetric cipher or public key cipher is designed to operate with a public key and a secret key. Depending on the use model, the public key might be used to crypt the data, and the secret key to decrypt. The basic assumption around a public cipher is that the secret key cannot be derived from the public key.

public-cipher-p
Cipher
get-message-size
Integer
none

The `get-message-size` method returns the cipher message size.

get-crypted-size
Integer
none

The `get-crypted-size` method returns the cipher crypted block size.

Rsa

The `Rsa` class is a public cipher class that implements the RSA algorithm as described by PKCS 2.1, RFC 2437 and ISO 18033-2. The class implements also some padding mechanism described in PKCS 1.5, 2.1 and ISO 18033-2. The RSA algorithm is a public cryptographic cipher based on a secret and public keys. The class operates in crypting mode by default and uses the public key to do the encryption while the secret key is used in reverse (decryption) mode. By default, the PKCS 1.5 type 2 padding is used. The ISO RSA-REM1 padding with a key derivation function (KDF1) is equivalent to PKCS 2.1 padding with the mask generation function (MGF1). The ISO RSA-REM1 padding with KDF2 is not described in the PKCS 2.1.

rsa-p
PublicCipher
Rsa
none

The `Rsa` constructor creates a default RSA public cipher by binding a 1024 bits random key.

Rsa
Key

The `Rsa` constructor creates a RSA public cipher by binding the key argument.

Rsa
Key Boolean

The `Rsa` constructor creates a RSA public cipher by binding the key argument and the reverse flag. The first argument is the key to bind. The second argument is the reverse flag to set.

Rsa
Key Hasher String

The `Rsa` constructor creates a RSA public cipher by binding the key argument and OAEP padding objects. The first argument is the key to bind. The second argument is hasher object to use with the OAEP padding mode. The third argument is an optional label to be used by the KDF object.

PAD-PKCS-11

The `PAD-PKCS-11` constant indicates that the PKCS 1.5 type 1 block should be used to pad the message.

PAD-PKCS-12

The `PAD-PKCS-12` constant indicates that the PKCS 1.5 type 3 block should be used to pad the message.

PAD-OAEP-K1

The `PAD-OAEP-K1` constant indicates that the ISO/IEC 18033-2 OAEP with KDF1 should be used to pad the message.

PAD-OAEP-K2

The `PAD-OAEP-K2` constant indicates that the ISO/IEC 18033-2 OAEP with KDF2 should be used to pad the message.

get-hasher
Hasher
none

The `get-hasher` method returns the hasher object used by the OAEP padding mode.

set-hasher
none
Hasher

The `set-hasher` method sets the hasher object used by the OAEP padding mode.

get-padding-mode
Item
none

The `get-padding-mode` method returns the cipher padding mode.

set-padding-mode
none
Item

The `set-padding-mode` method sets the cipher padding mode.

get-padding-label
String
none

The `get-padding-label` method returns the cipher padding label.

set-padding-label
none
String

The `set-padding-mode` method sets the cipher padding label.

get-padding-seed
String
none

The `get-padding-seed` method returns the cipher padding seed.

set-padding-seed
none
String

The `set-padding-seed` method sets the cipher padding seed.

pkcs-primitive
Relatif
Integer|Relatif

The `pkcs-primitive` method compute a relatif value from a relatif argument by either crypting or decrypting the argument. seed.

Signer

The `Signer` class is a base class that is used to build a message signature. The signature result is stored in a special signature object which is algorithm dependent.

signer-p
Nameable
reset
none
none

The `reset` method reset the signer object with its associated internal states.

compute
Signature
Literal|Buffer|InputStream

The `compute` method computes the signature from a string, a buffer or an input stream. The method returns a signature object. When the argument is a buffer object or an input stream, the characters are consumed from the object.

derive
Signature
String

The `derive` method computes the signature from an octet string which is converted before the signature computation. The method returns a signature object.

Signature

The `Signature` class is a container class designed to store a message signature. The signature object is produced by a signing process, implemented in the form of a digital signature algorithm such like RSA or DSA.

signature-p
Object
Signature
none

The `Signature` constructor creates an empty signature.

NIL

The `NIL` constant indicates that the signature is a null signature.

DSA

The `DSA` constant indicates that the signature is conforming to DSS.

DSA-S-COMPONENT

The `DSA-S-COMPONENT` constant corresponds to the DSA S component value.

DSA-R-COMPONENT

The `DSA-R-COMPONENT` constant corresponds to the DSA R component value.

reset
none
none

The `reset` method reset the signature object to a null signature.

format
String
Item

The `format` method returns a string representation of the signature component. The signature component is returned as an octet string based on the signature component to access.

get-relatif-component
Relatif
Item

The `get-relatif-component` method returns a relatif representation of a signature component.

Dsa

The `Dsa` class is an original implementation of the Digital Signature Standard (DSS) as published in FIPS PUB 186-3. This class implements the Digital Signature Algorithm (DSA) with an approved key length of 1024, 2048 and 3072 bits with a 160, 224 and 256 bits hash function which is part of the SHA family.

dsa-p
Signer
Dsa
none

The `Dsa` constructor creates a signer object with a default DSA key.

Dsa
Key

The `Dsa` constructor creates a signer object with a DSA key as its argument.

Dsa
Key Relatif

The `Dsa` constructor creates a signer object with a DSA key as its first argument and a fixed k argument as specified by DSS.