gnu/packages/crypto.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2014 David Thompson <davet@gnu.org>
   3 ;;; Copyright © 2015, 2017, 2018, 2019 Ricardo Wurmus <rekado@elephly.net>
   4 ;;; Copyright © 2016, 2017, 2018, 2019 Leo Famulari <leo@famulari.name>
   5 ;;; Copyright © 2016 Lukas Gradl <lgradl@openmailbox>
   6 ;;; Copyright © 2016, 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
   7 ;;; Copyright © 2016, 2017 Nikita <nikita@n0.is>
   8 ;;; Copyright © 2016, 2017, 2019 Eric Bavier <bavier@member.fsf.org>
   9 ;;; Copyright © 2017 Pierre Langlois <pierre.langlois@gmx.com>
  10 ;;; Copyright © 2018, 2020 Efraim Flashner <efraim@flashner.co.il>
  11 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
  12 ;;; Copyright © 2018 Nicolas Goaziou <mail@nicolasgoaziou.fr>
  13 ;;; Copyright © 2018, 2020 Nicolò Balzarotti <nicolo@nixo.xyz>
  14 ;;; Copyright © 2018 Tim Gesthuizen <tim.gesthuizen@yahoo.de>
  15 ;;; Copyright © 2019 Pierre Neidhardt <mail@ambrevar.xyz>
  16 ;;; Copyright © 2019 Tanguy Le Carrour <tanguy@bioneland.org>
  17 ;;; Copyright © 2020 Marius Bakke <mbakke@fastmail.com>
  18 ;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
  19 ;;;
  20 ;;; This file is part of GNU Guix.
  21 ;;;
  22 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  23 ;;; under the terms of the GNU General Public License as published by
  24 ;;; the Free Software Foundation; either version 3 of the License, or (at
  25 ;;; your option) any later version.
  26 ;;;
  27 ;;; GNU Guix is distributed in the hope that it will be useful, but
  28 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  29 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  30 ;;; GNU General Public License for more details.
  31 ;;;
  32 ;;; You should have received a copy of the GNU General Public License
  33 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  34
  35 (define-module (gnu packages crypto)
  36   #:use-module (gnu packages)
  37   #:use-module (gnu packages admin)
  38   #:use-module (gnu packages aidc)
  39   #:use-module (gnu packages attr)
  40   #:use-module (gnu packages autotools)
  41   #:use-module (gnu packages boost)
  42   #:use-module (gnu packages check)
  43   #:use-module (gnu packages compression)
  44   #:use-module (gnu packages crates-io)
  45   #:use-module (gnu packages cryptsetup)
  46   #:use-module (gnu packages gettext)
  47   #:use-module (gnu packages gnupg)
  48   #:use-module (gnu packages golang)
  49   #:use-module (gnu packages image)
  50   #:use-module (gnu packages kerberos)
  51   #:use-module (gnu packages libbsd)
  52   #:use-module (gnu packages libffi)
  53   #:use-module (gnu packages linux)
  54   #:use-module (gnu packages lsof)
  55   #:use-module (gnu packages nettle)
  56   #:use-module (gnu packages password-utils)
  57   #:use-module (gnu packages perl)
  58   #:use-module (gnu packages perl-check)
  59   #:use-module (gnu packages pkg-config)
  60   #:use-module (gnu packages python)
  61   #:use-module (gnu packages python-xyz)
  62   #:use-module (gnu packages readline)
  63   #:use-module (gnu packages search)
  64   #:use-module (gnu packages serialization)
  65   #:use-module (gnu packages shells)
  66   #:use-module (gnu packages sqlite)
  67   #:use-module (gnu packages tcl)
  68   #:use-module (gnu packages tls)
  69   #:use-module (gnu packages xml)
  70   #:use-module ((guix licenses) #:prefix license:)
  71   #:use-module (guix packages)
  72   #:use-module (guix download)
  73   #:use-module (guix git-download)
  74   #:use-module (guix build-system cargo)
  75   #:use-module (guix build-system cmake)
  76   #:use-module (guix build-system gnu)
  77   #:use-module (guix build-system go)
  78   #:use-module (guix build-system perl)
  79   #:use-module (guix utils)
  80   #:use-module (srfi srfi-1)
  81   #:use-module (srfi srfi-26))
  82
  83 (define-public libsodium
  84   (package
  85     (name "libsodium")
  86     (version "1.0.18")
  87     (source (origin
  88             (method url-fetch)
  89             (uri (list (string-append
  90                         "https://download.libsodium.org/libsodium/"
  91                         "releases/libsodium-" version ".tar.gz")
  92                        (string-append
  93                         "https://download.libsodium.org/libsodium/"
  94                         "releases/old/libsodium-" version ".tar.gz")))
  95             (sha256
  96              (base32
  97               "1h9ncvj23qbbni958knzsli8dvybcswcjbx0qjjgi922nf848l3g"))))
  98     (build-system gnu-build-system)
  99     (synopsis "Portable NaCl-based crypto library")
 100     (description
 101      "Sodium is a new easy-to-use high-speed software library for network
 102 communication, encryption, decryption, signatures, etc.")
 103     (license license:isc)
 104     (home-page "https://libsodium.org")))
 105
 106 (define-public libmd
 107   (package
 108     (name "libmd")
 109     (version "1.0.1")
 110     (source (origin
 111             (method url-fetch)
 112             (uri
 113              (list
 114               (string-append "https://archive.hadrons.org/software/libmd/libmd-"
 115                              version ".tar.xz")
 116               (string-append "https://libbsd.freedesktop.org/releases/libmd-"
 117                              version ".tar.xz")))
 118             (sha256
 119              (base32
 120               "0waclg2d5qin3r26gy5jvy4584ik60njc8pqbzwk0lzq3j9ynkp1"))))
 121     (build-system gnu-build-system)
 122     (synopsis "Message Digest functions from BSD systems")
 123     (description
 124      "The currently provided message digest algorithms are:
 125 @itemize
 126 @item MD2
 127 @item MD4
 128 @item MD5
 129 @item RIPEMD-160
 130 @item SHA-1
 131 @item SHA-2 (SHA-256, SHA-384 and SHA-512)
 132 @end itemize")
 133     (license (list license:bsd-3
 134                    license:bsd-2
 135                    license:isc
 136                    license:public-domain))
 137     (home-page "https://www.hadrons.org/software/libmd/")))
 138
 139 (define-public signify
 140   (package
 141     (name "signify")
 142     (version "29")
 143     (home-page "https://github.com/aperezdc/signify")
 144     (source (origin
 145               (method url-fetch)
 146               (uri (string-append "https://github.com/aperezdc/signify/releases"
 147                                   "/download/v" version "/signify-" version ".tar.xz"))
 148               (sha256
 149                (base32
 150                 "1bzcax5kb4lr0rmpmrdpq5q0iq6b2dxzpl56li8aanbkck1c7hd9"))))
 151     (build-system gnu-build-system)
 152     ;; TODO Build with libwaive (described in README.md), to implement something
 153     ;; like OpenBSD's pledge().
 154     (arguments
 155      `(#:make-flags
 156        (list "CC=gcc"
 157              (string-append "PREFIX=" (assoc-ref %outputs "out")))
 158        #:phases
 159        (modify-phases %standard-phases
 160          (delete 'configure))))
 161     (native-inputs
 162      `(("pkg-config" ,pkg-config)))
 163     (inputs
 164      `(("libbsd" ,libbsd)))
 165     (synopsis "Create and verify cryptographic signatures")
 166     (description "The signify utility creates and verifies cryptographic
 167 signatures using the elliptic curve Ed25519.  This is a Linux port of the
 168 OpenBSD tool of the same name.")
 169     ;; This package includes third-party code that was originally released under
 170     ;; various non-copyleft licenses. See the source files for clarification.
 171     (license (list license:bsd-3 license:bsd-4 license:expat license:isc
 172                    license:public-domain (license:non-copyleft
 173                                           "file://base64.c"
 174                                           "See base64.c in the distribution for
 175                                            the license from IBM.")))))
 176
 177 (define-public rust-minisign
 178   (package
 179     (name "rust-minisign")
 180     (version "0.5.20")
 181     (source
 182       (origin
 183         (method url-fetch)
 184         (uri (crate-uri "minisign" version))
 185         (file-name
 186          (string-append name "-" version ".tar.gz"))
 187         (sha256
 188          (base32
 189           "0xmcvh2snravghaar8igc6b9r3s1snnmf9qam9l3zyhm4987767y"))))
 190     (build-system cargo-build-system)
 191     (arguments
 192      `(#:cargo-inputs
 193        (("rust-getrandom" ,rust-getrandom-0.1)
 194         ("rust-rpassword" ,rust-rpassword-4)
 195         ("rust-scrypt" ,rust-scrypt-0.3))))
 196     (home-page "https://github.com/jedisct1/rust-minisign")
 197     (synopsis "Crate to sign files and verify signatures")
 198     (description
 199      "This package provides a crate to sign files and verify signatures.")
 200     (license license:expat)))
 201
 202 (define-public go-minisign
 203   (package
 204     (name "go-minisign")
 205     (version "0.1.0")
 206     (source
 207       (origin
 208         (method git-fetch)
 209         (uri (git-reference
 210                (url "https://github.com/jedisct1/go-minisign")
 211                (commit version)))
 212         (file-name (git-file-name name version))
 213         (sha256
 214          (base32
 215           "0wc0rk5m60yz52f0cncmbgq67yvb1rcx91gvzjg6jpc4mpw2db27"))
 216         (modules '((guix build utils)))
 217         (snippet
 218          '(begin (delete-file-recursively "vendor") #t))))
 219     (build-system go-build-system)
 220     (arguments
 221      '(#:import-path "github.com/jedisct1/go-minisign"))
 222     (propagated-inputs
 223      `(("go-golang-org-x-crypto" ,go-golang-org-x-crypto)))
 224     (home-page "https://github.com/jedisct1/go-minisign")
 225     (synopsis "Minisign verification library for Golang")
 226     (description "A Golang library to verify Minisign signatures.")
 227     (license license:expat)))
 228
 229 (define-public encfs
 230   (package
 231     (name "encfs")
 232     (version "1.9.5")
 233     (source
 234      (origin
 235        (method url-fetch)
 236        (uri
 237         (string-append "https://github.com/vgough/encfs/releases/download/v"
 238                        version "/encfs-" version ".tar.gz"))
 239        (sha256
 240         (base32
 241          "0qzxavvv20577bxvly8s7d3y7bqasqclc2mllp0ddfncjm9z02a7"))
 242        (modules '((guix build utils)))
 243        ;; Remove bundled dependencies in favour of proper inputs.
 244        (snippet '(begin
 245                    (for-each delete-file-recursively
 246                              '("vendor/github.com/leethomason/tinyxml2"
 247                                "vendor/github.com/google/googletest"))
 248                    #t))))
 249     (build-system cmake-build-system)
 250     (native-inputs
 251      `(("gettext" ,gettext-minimal)
 252
 253        ;; Test dependencies.
 254        ("expect" ,expect)
 255        ("googletest-source" ,(package-source googletest))
 256        ("perl" ,perl)))
 257     (inputs
 258      `(("attr" ,attr)
 259        ("fuse" ,fuse)
 260        ("openssl" ,openssl)
 261        ("tinyxml2" ,tinyxml2)))
 262     (arguments
 263      `(#:configure-flags (list "-DUSE_INTERNAL_TINYXML=OFF")
 264        #:phases
 265        (modify-phases %standard-phases
 266          (add-after 'unpack 'unpack-googletest
 267            (lambda* (#:key inputs #:allow-other-keys)
 268              (mkdir-p "vendor/github.com/google/googletest")
 269              (copy-recursively (assoc-ref inputs "googletest-source")
 270                                "vendor/github.com/google/googletest")
 271              #t))
 272          (add-before 'configure 'patch-CMakeLists.txt
 273            (lambda _
 274              ;; Prevent CMake from adding libc on the system include path.
 275              ;; Otherwise it will interfere with the libc used by GCC and
 276              ;; ultimately cause #include_next errors.
 277              (substitute* "CMakeLists.txt"
 278                (("include_directories \\(SYSTEM \\$\\{Intl_INCLUDE_DIRS\\}\\)")
 279                 ""))
 280              #t))
 281          (add-before 'check 'make-unittests
 282            (lambda _
 283              (invoke "make" "unittests"))))))
 284     (home-page "https://vgough.github.io/encfs")
 285     (synopsis "Encrypted virtual file system")
 286     (description
 287      "EncFS creates a virtual encrypted file system in user-space.  Each file
 288 created under an EncFS mount point is stored as a separate encrypted file on
 289 the underlying file system.  Like most encrypted file systems, EncFS is meant
 290 to provide security against off-line attacks, such as a drive falling into
 291 the wrong hands.")
 292     (license (list license:expat                  ; internal/easylogging++.h
 293                    license:lgpl3+                 ; encfs library
 294                    license:gpl3+))))              ; command-line tools
 295
 296 (define-public keyutils
 297   (package
 298     (name "keyutils")
 299     (version "1.6.1")
 300     (source
 301      (origin
 302        (method url-fetch)
 303        (uri
 304         (string-append "https://people.redhat.com/dhowells/keyutils/keyutils-"
 305                        version ".tar.bz2"))
 306        (sha256
 307         (base32 "1kk4pmyflgplkgxn2bzpc069ph9c9jdd9ikcsyd5pnaimqi5gcf8"))
 308        (modules '((guix build utils)))
 309        ;; Create relative symbolic links instead of absolute ones to /lib/*.
 310        (snippet '(begin
 311                    (substitute* "Makefile" (("\\$\\(LNS\\) \\$\\(LIBDIR\\)/")
 312                                             "$(LNS) "))
 313                    #t))))
 314     (build-system gnu-build-system)
 315     (arguments
 316      `(#:phases (modify-phases %standard-phases
 317                   (delete 'configure))          ; no configure script
 318        #:make-flags (list "CC=gcc"
 319                           "RPATH=-Wl,-rpath,$(DESTDIR)$(LIBDIR)"
 320                           (string-append "DESTDIR="
 321                                          (assoc-ref %outputs "out"))
 322                           "INCLUDEDIR=/include"
 323                           "LIBDIR=/lib"
 324                           "MANDIR=/share/man"
 325                           "SHAREDIR=/share/keyutils")
 326        #:test-target "test"))
 327     (inputs
 328      `(("mit-krb5" ,mit-krb5)))
 329     (home-page "https://people.redhat.com/dhowells/keyutils/")
 330     (synopsis "Linux key management utilities")
 331     (description
 332      "Keyutils is a set of utilities for managing the key retention facility in
 333 the Linux kernel, which can be used by file systems, block devices, and more to
 334 gain and retain the authorization and encryption keys required to perform
 335 secure operations. ")
 336     (license (list license:lgpl2.1+             ; the files keyutils.*
 337                    license:gpl2+))))            ; the rest
 338
 339 ;; There is no release candidate but commits point out a version number,
 340 ;; furthermore no tarball exists.
 341 (define-public eschalot
 342   (let ((commit "0bf31d88a11898c19b1ed25ddd2aff7b35dbac44")
 343         (revision "1"))
 344     (package
 345       (name "eschalot")
 346       (version (string-append "1.2.0-" revision "." (string-take commit 7)))
 347       (source
 348        (origin
 349          (method git-fetch)
 350          (uri (git-reference
 351                (url "https://github.com/schnabear/eschalot")
 352                (commit commit)))
 353          (file-name (string-append name "-" version))
 354          (sha256
 355           (base32
 356            "0lj38ldh8vzi11wp4ghw4k0fkwp0s04zv8k8d473p1snmbh7mx98"))))
 357       (inputs
 358        `(("openssl" ,openssl))) ; It needs: openssl/{bn,pem,rsa,sha}.h
 359       (build-system gnu-build-system)
 360       (arguments
 361        `(#:make-flags (list "CC=gcc"
 362                             (string-append "PREFIX=" (assoc-ref %outputs "out"))
 363                             (string-append "INSTALL=" "install"))
 364          ;; XXX: make test would run a !VERY! long hashing of names with the use
 365          ;; of a wordlist, the amount of computing time this would waste on build
 366          ;; servers is in no relation to the size or importance of this small
 367          ;; application, therefore we run our own tests on eschalot and worgen.
 368          #:phases
 369          (modify-phases %standard-phases
 370            (delete 'configure)
 371            (replace 'check
 372              (lambda _
 373                (invoke "./worgen" "8-12" "top1000.txt" "3-10" "top400nouns.txt"
 374                        "3-6" "top150adjectives.txt" "3-6")
 375                (invoke "./eschalot" "-r" "^guix|^guixsd")
 376                (invoke "./eschalot" "-r" "^gnu|^free")
 377                (invoke "./eschalot" "-r" "^cyber|^hack")
 378                (invoke "./eschalot" "-r" "^troll")))
 379            ;; Make install can not create the bin dir, create it.
 380            (add-before 'install 'create-bin-dir
 381              (lambda* (#:key outputs #:allow-other-keys)
 382                (let* ((out (assoc-ref outputs "out"))
 383                       (bin (string-append out "/bin")))
 384                  (mkdir-p bin)
 385                  #t))))))
 386       (home-page "https://github.com/schnabear/eschalot")
 387       (synopsis "Tor hidden service name generator")
 388       (description
 389        "Eschalot is a tor hidden service name generator, it allows one to
 390 produce customized vanity .onion addresses using a brute-force method.  Searches
 391 for valid names can be run with regular expressions and wordlists.  For the
 392 generation of wordlists the included tool @code{worgen} can be used.  There is
 393 no man page, refer to the home page for usage details.")
 394       (license (list license:isc license:expat)))))
 395
 396 (define-public tomb
 397   (package
 398     (name "tomb")
 399     (version "2.7")
 400     (source (origin
 401               (method url-fetch)
 402               (uri (string-append "https://files.dyne.org/tomb/"
 403                                   "Tomb-" version ".tar.gz"))
 404               (sha256
 405                (base32
 406                 "0x3al02796vx1cvy6y6h685c367qx70dwv471g0hmks2gr10f0cn"))
 407               (patches (search-patches "tomb-fix-errors-on-open.patch"))))
 408     (build-system gnu-build-system)
 409     (native-inputs `(("sudo" ,sudo)))   ;presence needed for 'check' phase
 410     (inputs
 411      `(("zsh" ,zsh)
 412        ("gnupg" ,gnupg)
 413        ("cryptsetup" ,cryptsetup)
 414        ("e2fsprogs" ,e2fsprogs)         ;for mkfs.ext4
 415        ("gettext" ,gettext-minimal)     ;used at runtime
 416        ("lsof" ,lsof)
 417        ("mlocate" ,mlocate)
 418        ("pinentry" ,pinentry)
 419        ("qrencode" ,qrencode)
 420        ("steghide" ,steghide)
 421        ("util-linux" ,util-linux)))
 422     (arguments
 423      `(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out")))
 424        ;; The "sudo" input is needed only to satisfy dependency checks in the
 425        ;; 'check' phase.  The "sudo" used at runtime should come from the
 426        ;; system's setuid-programs, so ensure no reference is kept.
 427        #:disallowed-references (,sudo)
 428        ;; TODO: Build and install gtk and qt trays
 429        #:phases
 430        (modify-phases %standard-phases
 431          (delete 'configure)            ;no configuration to be done
 432          (add-after 'install 'i18n
 433            (lambda* (#:key make-flags #:allow-other-keys)
 434              (apply invoke "make" "-C" "extras/translations"
 435                     "install" make-flags)
 436              #t))
 437          (add-after 'install 'wrap
 438            (lambda* (#:key inputs outputs #:allow-other-keys)
 439              (let ((out (assoc-ref outputs "out")))
 440                (wrap-program (string-append out "/bin/tomb")
 441                  `("PATH" ":" prefix
 442                    (,(string-append (assoc-ref inputs "mlocate") "/bin")
 443                     ,@(map (lambda (program)
 444                              (or (and=> (which program) dirname)
 445                                  (error "program not found:" program)))
 446                            '("seq" "mkfs.ext4" "pinentry"
 447                              "gpg" "cryptsetup" "gettext" "lsof"
 448                              "qrencode" "steghide" "findmnt")))))
 449                #t)))
 450          (delete 'check)
 451          (add-after 'wrap 'check
 452            (lambda* (#:key outputs #:allow-other-keys)
 453              ;; Running the full tests requires sudo/root access for
 454              ;; cryptsetup, which is not available in the build environment.
 455              ;; But we can run `tomb dig` without root, so make sure that
 456              ;; works.  TODO: It Would Be Nice to check the expected "index",
 457              ;; "search", "bury", and "exhume" features are available by
 458              ;; querying `tomb -h`.
 459              (let ((tomb (string-append (assoc-ref outputs "out")
 460                                         "/bin/tomb")))
 461                (invoke tomb "dig" "-s" "10" "secrets.tomb")
 462                #t))))))
 463     (home-page "https://www.dyne.org/software/tomb")
 464     (synopsis "File encryption for secret data")
 465     (description
 466      "Tomb is an application to manage the creation and access of encrypted
 467 storage files: it can be operated from commandline and it can integrate with a
 468 user's graphical desktop.")
 469     (license license:gpl3+)))
 470
 471 (define-public scrypt
 472   (package
 473     (name "scrypt")
 474     (version "1.2.1")
 475     (source
 476       (origin
 477         (method url-fetch)
 478         (uri (string-append "https://www.tarsnap.com/scrypt/scrypt-"
 479                             version ".tgz"))
 480         (sha256
 481          (base32
 482           "0xy5yhrwwv13skv9im9vm76rybh9f29j2dh4hlh2x01gvbkza8a6"))))
 483     (build-system gnu-build-system)
 484     (arguments
 485      `(#:phases (modify-phases %standard-phases
 486         (add-after 'unpack 'patch-command-invocations
 487           (lambda _
 488             (substitute* "Makefile.in"
 489               (("command -p") ""))
 490             #t))
 491         (add-after 'install 'install-docs
 492           (lambda* (#:key outputs #:allow-other-keys)
 493             (let* ((out (assoc-ref %outputs "out"))
 494                    (misc (string-append out "/share/doc/scrypt")))
 495               (install-file "FORMAT" misc)
 496               #t))))))
 497     (inputs
 498      `(("openssl" ,openssl)))
 499     (home-page "https://www.tarsnap.com/scrypt.html")
 500     (synopsis "Memory-hard encryption tool based on scrypt")
 501     (description "This package provides a simple password-based encryption
 502 utility as a demonstration of the @code{scrypt} key derivation function.
 503 @code{Scrypt} is designed to be far more resistant against hardware brute-force
 504 attacks than alternative functions such as @code{PBKDF2} or @code{bcrypt}.")
 505     (license license:bsd-2)))
 506
 507 (define-public libscrypt
 508   (package
 509     (name "libscrypt")
 510     (version "1.21")
 511     (source
 512      (origin
 513        (method git-fetch)
 514        (uri (git-reference
 515              (url "https://github.com/technion/libscrypt.git")
 516              (commit (string-append "v" version))))
 517        (file-name (git-file-name name version))
 518        (sha256
 519         (base32
 520          "1d76ys6cp7fi4ng1w3mz2l0p9dbr7ljbk33dcywyimzjz8bahdng"))))
 521     (build-system gnu-build-system)
 522     (arguments
 523      `(#:make-flags (list (string-append "PREFIX=" %output)
 524                           "CC=gcc")
 525        #:phases
 526        (modify-phases %standard-phases
 527          (delete 'configure))))
 528     (home-page "https://lolware.net/libscrypt.html")
 529     (synopsis "Password hashing library")
 530     (description "@code{libscrypt} implements @code{scrypt} key derivation
 531 function.  It is designed to be far more secure against hardware brute-force
 532 attacks than alternative functions such as @code{PBKDF2} or @code{bcrypt}.")
 533     (license license:bsd-3)))
 534
 535 (define-public perl-math-random-isaac-xs
 536   (package
 537     (name "perl-math-random-isaac-xs")
 538     (version "1.004")
 539     (source
 540      (origin
 541        (method url-fetch)
 542        (uri (string-append "mirror://cpan/authors/id/J/JA/JAWNSY/"
 543                            "Math-Random-ISAAC-XS-" version ".tar.gz"))
 544        (sha256
 545         (base32
 546          "0yxqqcqvj51fn7b7j5xqhz65v74arzgainn66c6k7inijbmr1xws"))))
 547     (build-system perl-build-system)
 548     (native-inputs
 549      `(("perl-module-build" ,perl-module-build)
 550        ("perl-test-nowarnings" ,perl-test-nowarnings)))
 551     (home-page "https://metacpan.org/release/Math-Random-ISAAC-XS")
 552     (synopsis "C implementation of the ISAAC PRNG algorithm")
 553     (description "ISAAC (Indirection, Shift, Accumulate, Add, and Count) is a
 554 fast pseudo-random number generator.  It is suitable for applications where a
 555 significant amount of random data needs to be produced quickly, such as
 556 solving using the Monte Carlo method or for games.  The results are uniformly
 557 distributed, unbiased, and unpredictable unless you know the seed.
 558
 559 This package implements the same interface as @code{Math::Random::ISAAC}.")
 560     (license license:public-domain)))
 561
 562 (define-public perl-math-random-isaac
 563   (package
 564     (name "perl-math-random-isaac")
 565     (version "1.004")
 566     (source
 567      (origin
 568        (method url-fetch)
 569        (uri (string-append "mirror://cpan/authors/id/J/JA/JAWNSY/"
 570                            "Math-Random-ISAAC-" version ".tar.gz"))
 571        (sha256
 572         (base32
 573          "0z1b3xbb3xz71h25fg6jgsccra7migq7s0vawx2rfzi0pwpz0wr7"))))
 574     (build-system perl-build-system)
 575     (native-inputs
 576      `(("perl-test-nowarnings" ,perl-test-nowarnings)))
 577     (propagated-inputs
 578      `(("perl-math-random-isaac-xs" ,perl-math-random-isaac-xs)))
 579     (home-page "https://metacpan.org/release/Math-Random-ISAAC")
 580     (synopsis "Perl interface to the ISAAC PRNG algorithm")
 581     (description "ISAAC (Indirection, Shift, Accumulate, Add, and Count) is a
 582 fast pseudo-random number generator.  It is suitable for applications where a
 583 significant amount of random data needs to be produced quickly, such as
 584 solving using the Monte Carlo method or for games.  The results are uniformly
 585 distributed, unbiased, and unpredictable unless you know the seed.
 586
 587 This package provides a Perl interface to the ISAAC pseudo random number
 588 generator.")
 589     (license license:public-domain)))
 590
 591 (define-public perl-crypt-random-source
 592   (package
 593     (name "perl-crypt-random-source")
 594     (version "0.14")
 595     (source
 596      (origin
 597        (method url-fetch)
 598        (uri (string-append "mirror://cpan/authors/id/E/ET/ETHER/"
 599                            "Crypt-Random-Source-" version ".tar.gz"))
 600        (sha256
 601         (base32 "1rpdds3sy5l1fhngnkrsgwsmwd54wpicx3i9ds69blcskwkcwkpc"))))
 602     (build-system perl-build-system)
 603     (native-inputs
 604      `(("perl-module-build-tiny" ,perl-module-build-tiny)
 605        ("perl-test-fatal" ,perl-test-fatal)))
 606     (propagated-inputs
 607      `(("perl-capture-tiny" ,perl-capture-tiny)
 608        ("perl-module-find" ,perl-module-find)
 609        ("perl-module-runtime" ,perl-module-runtime)
 610        ("perl-moo" ,perl-moo)
 611        ("perl-namespace-clean" ,perl-namespace-clean)
 612        ("perl-sub-exporter" ,perl-sub-exporter)
 613        ("perl-type-tiny" ,perl-type-tiny)))
 614     (home-page "https://metacpan.org/release/Crypt-Random-Source")
 615     (synopsis "Get weak or strong random data from pluggable sources")
 616     (description "This module provides implementations for a number of
 617 byte-oriented sources of random data.")
 618     (license license:perl-license)))
 619
 620 (define-public perl-math-random-secure
 621   (package
 622     (name "perl-math-random-secure")
 623     (version "0.080001")
 624     (source
 625      (origin
 626        (method url-fetch)
 627        (uri (string-append "mirror://cpan/authors/id/F/FR/FREW/"
 628                            "Math-Random-Secure-" version ".tar.gz"))
 629        (sha256
 630         (base32
 631          "0dgbf4ncll4kmgkyb9fsaxn0vf2smc9dmwqzgh3259zc2zla995z"))))
 632     (build-system perl-build-system)
 633     (native-inputs
 634      `(("perl-list-moreutils" ,perl-list-moreutils)
 635        ("perl-test-leaktrace" ,perl-test-leaktrace)
 636        ("perl-test-sharedfork" ,perl-test-sharedfork)
 637        ("perl-test-warn" ,perl-test-warn)))
 638     (inputs
 639      `(("perl-crypt-random-source" ,perl-crypt-random-source)
 640        ("perl-math-random-isaac" ,perl-math-random-isaac)
 641        ("perl-math-random-isaac-xs" ,perl-math-random-isaac-xs)
 642        ("perl-moo" ,perl-moo)))
 643     (home-page "https://metacpan.org/release/Math-Random-Secure")
 644     (synopsis "Cryptographically secure replacement for rand()")
 645     (description "This module is intended to provide a
 646 cryptographically-secure replacement for Perl's built-in @code{rand} function.
 647 \"Crytographically secure\", in this case, means:
 648
 649 @enumerate
 650 @item No matter how many numbers you see generated by the random number
 651 generator, you cannot guess the future numbers, and you cannot guess the seed.
 652 @item There are so many possible seeds that it would take decades, centuries,
 653 or millennia for an attacker to try them all.
 654 @item The seed comes from a source that generates relatively strong random
 655 data on your platform, so the seed itself will be as random as possible.
 656 @end enumerate\n")
 657     (license license:artistic2.0)))
 658
 659 (define-public crypto++
 660   (package
 661     (name "crypto++")
 662     (version "8.2.0")
 663     (source (origin
 664               (method url-fetch/zipbomb)
 665               (uri (string-append "https://cryptopp.com/cryptopp"
 666                                   (string-join (string-split version #\.) "")
 667                                   ".zip"))
 668               (sha256
 669                (base32
 670                 "0n40hlz5jkvlcp9vxrj0fsrcfp7dm0zmmv6h52dx3f8i5qjf5w03"))))
 671     (build-system gnu-build-system)
 672     (arguments
 673      `(#:make-flags
 674        (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 675              ;; Override "/sbin/ldconfig" with simply "echo" since
 676              ;; we don't need ldconfig(8).
 677              "LDCONF=echo")
 678        #:phases
 679        (modify-phases %standard-phases
 680          (add-after 'unpack 'disable-native-optimisation
 681            ;; This package installs more than just headers.  Ensure that the
 682            ;; cryptest.exe binary & static library aren't CPU model specific.
 683            (lambda _
 684              (substitute* "GNUmakefile"
 685                ((" -march=native") ""))
 686              #t))
 687          (delete 'configure)
 688          (replace 'build
 689            ;; By default, only the static library is built.
 690            (lambda* (#:key (make-flags '()) #:allow-other-keys)
 691              (apply invoke "make" "shared"
 692                     "-j" (number->string (parallel-job-count))
 693                     make-flags)))
 694          (add-after 'install 'install-shared-library-links
 695            ;; By default, only .so and .so.x.y.z are installed.
 696            ;; Create all the ‘intermediates’ expected by dependent packages.
 697            (lambda* (#:key outputs #:allow-other-keys)
 698              (let* ((out (assoc-ref outputs "out"))
 699                     (lib (string-append out "/lib"))
 700                     (prefix "libcryptopp.so.")
 701                     (target (string-append prefix ,version)))
 702                (with-directory-excursion lib
 703                  (symlink target
 704                           (string-append prefix ,(version-major+minor version)))
 705                  (symlink target
 706                           (string-append prefix ,(version-major version)))
 707                  #t))))
 708          (add-after 'install 'install-pkg-config
 709            (lambda* (#:key outputs #:allow-other-keys)
 710              (let* ((out (assoc-ref outputs "out"))
 711                     (pkg-dir (string-append out "/lib/pkgconfig")))
 712                (mkdir-p pkg-dir)
 713                (with-output-to-file (string-append pkg-dir "/libcrypto++.pc")
 714                  (lambda _
 715                    (display
 716                     (string-append
 717                      "prefix=" out "\n"
 718                      "libdir=" out "/lib\n"
 719                      "includedir=" out "/include\n\n"
 720                      "Name: libcrypto++-" ,version "\n"
 721                      "Description: Class library of cryptographic schemes"
 722                      "Version: " ,version "\n"
 723                      "Libs: -L${libdir} -lcryptopp\n"
 724                      "Cflags: -I${includedir}\n"))
 725                    #t))))))))
 726     (native-inputs
 727      `(("unzip" ,unzip)))
 728     (home-page "https://cryptopp.com/")
 729     (synopsis "C++ class library of cryptographic schemes")
 730     (description "Crypto++ is a C++ class library of cryptographic schemes.")
 731     ;; The compilation is distributed under the Boost license; the individual
 732     ;; files in the compilation are in the public domain.
 733     (license (list license:boost1.0 license:public-domain))))
 734
 735 (define-public libb2
 736   (package
 737     (name "libb2")
 738     (version "0.98.1")
 739     (source (origin
 740               (method url-fetch)
 741               (uri (string-append
 742                     "https://github.com/BLAKE2/libb2/releases/download/v"
 743                     version "/libb2-" version ".tar.gz"))
 744               (sha256
 745                (base32
 746                 "0bn7yrzdixdvzm46shbhpkqbr6zyqyxiqn7a7x54ag3mrvfnyqjk"))))
 747     (build-system gnu-build-system)
 748     (arguments
 749      `(#:configure-flags
 750        (list
 751         ,@(if (any (cute string-prefix? <> (or (%current-system)
 752                                                (%current-target-system)))
 753                    '("x86_64" "i686"))
 754               ;; fat only checks for Intel optimisations
 755               '("--enable-fat")
 756               '())
 757         "--disable-native")))           ;don't optimise at build time
 758     (home-page "https://blake2.net/")
 759     (synopsis "Library implementing the BLAKE2 family of hash functions")
 760     (description
 761      "libb2 is a portable implementation of the BLAKE2 family of cryptographic
 762 hash functions.  It includes optimised implementations for IA-32 and AMD64
 763 processors, and an interface layer that automatically selects the best
 764 implementation for the processor it is run on.
 765
 766 @dfn{BLAKE2} (RFC 7693) is a family of high-speed cryptographic hash functions
 767 that are faster than MD5, SHA-1, SHA-2, and SHA-3, yet are at least as secure
 768 as the latest standard, SHA-3.  It is an improved version of the SHA-3 finalist
 769 BLAKE.")
 770     (license license:public-domain)))
 771
 772 (define-public rhash
 773   (package
 774     (name "rhash")
 775     (version "1.3.9")
 776     (source
 777      (origin
 778        (method url-fetch)
 779        (uri (string-append "mirror://sourceforge/rhash/rhash/" version
 780                            "/rhash-" version "-src.tar.gz"))
 781        (file-name (string-append "rhash-" version ".tar.gz"))
 782        (sha256
 783         (base32
 784          "1xn9fqa6rlnhsbgami45g82dlw9i1skg2sri3ydiinwak5ph1ca2"))))
 785     (build-system gnu-build-system)
 786     (arguments
 787      `(#:configure-flags
 788        (list (string-append "--prefix=" (assoc-ref %outputs "out"))
 789              ,@(let ((target (%current-target-system)))
 790                  (if target
 791                      `((string-append "--target=" ,target)
 792                        (string-append "--cc="
 793                                       (assoc-ref %build-inputs "cross-gcc")
 794                                       "/bin/" ,target "-gcc"))
 795                      '())))
 796        #:make-flags
 797        ;; The binaries in /bin need some help finding librhash.so.0.
 798        (list (string-append "LDFLAGS=-Wl,-rpath=" %output "/lib"))
 799        #:test-target "test"             ; ‘make check’ just checks the sources
 800        #:phases
 801        (modify-phases %standard-phases
 802          (replace 'configure
 803            ;; ./configure is not GNU autotools' and doesn't gracefully handle
 804            ;; unrecognized options, so we must call it manually.
 805            (lambda* (#:key configure-flags #:allow-other-keys)
 806              (apply invoke "./configure" configure-flags)))
 807          (add-before 'check 'patch-/bin/sh
 808            (lambda _
 809              (substitute* "Makefile"
 810                (("/bin/sh") (which "sh")))
 811              #t))
 812          (add-after 'install 'install-library-extras
 813            (lambda* (#:key make-flags #:allow-other-keys)
 814              (apply invoke
 815                     "make" "-C" "librhash"
 816                     "install-lib-headers" "install-so-link"
 817                     make-flags))))))
 818     (home-page "https://sourceforge.net/projects/rhash/")
 819     (synopsis "Utility for computing hash sums")
 820     (description "RHash is a console utility for calculation and verification
 821 of magnet links and a wide range of hash sums like CRC32, MD4, MD5, SHA1,
 822 SHA256, SHA512, SHA3, AICH, ED2K, Tiger, DC++ TTH, BitTorrent BTIH, GOST R
 823 34.11-94, RIPEMD-160, HAS-160, EDON-R, Whirlpool and Snefru.")
 824     (license (license:non-copyleft "file://COPYING"))))
 825
 826 (define-public botan
 827   (package
 828     (name "botan")
 829     (version "2.12.1")
 830     (source (origin
 831               (method url-fetch)
 832               (uri (string-append "https://botan.randombit.net/releases/"
 833                                   "Botan-" version ".tar.xz"))
 834               (sha256
 835                (base32
 836                 "1ada3ga7b0z4m0vjmxlvfi4nsic2l8kjcy85jwss3z2i58a5y0vy"))))
 837     (build-system gnu-build-system)
 838     (arguments
 839      '(#:phases
 840        (modify-phases %standard-phases
 841          (replace 'configure
 842            (lambda* (#:key inputs outputs #:allow-other-keys)
 843              (let* ((out (assoc-ref %outputs "out"))
 844                     (lib (string-append out "/lib")))
 845                ;; Upstream tests and benchmarks with -O3.
 846                (setenv "CXXFLAGS" "-O3")
 847                (invoke "python" "./configure.py"
 848                        (string-append "--prefix=" out)
 849                        ;; Otherwise, the `botan` executable cannot find
 850                        ;; libbotan.
 851                        (string-append "--ldflags=-Wl,-rpath=" lib)
 852
 853                        "--with-os-feature=getentropy"
 854                        "--with-rst2man"
 855
 856                        ;; Recommended by upstream
 857                        "--with-zlib" "--with-bzip2" "--with-sqlite3"))))
 858          (replace 'check
 859            (lambda _ (invoke "./botan-test"))))))
 860     (native-inputs
 861      `(("python" ,python-wrapper)
 862        ("python-docutils" ,python-docutils)))
 863     (inputs
 864      `(("sqlite" ,sqlite)
 865        ("bzip2" ,bzip2)
 866        ("zlib" ,zlib)))
 867     (synopsis "Cryptographic library in C++11")
 868     (description "Botan is a cryptography library, written in C++11, offering
 869 the tools necessary to implement a range of practical systems, such as TLS/DTLS,
 870 PKIX certificate handling, PKCS#11 and TPM hardware support, password hashing,
 871 and post-quantum crypto schemes.  In addition to the C++, botan has a C89 API
 872 specifically designed to be easy to call from other languages.  A Python binding
 873 using ctypes is included, and several other language bindings are available.")
 874     (home-page "https://botan.randombit.net")
 875     (license license:bsd-2)))
 876
 877 (define-public ccrypt
 878   (package
 879     (name "ccrypt")
 880     (version "1.11")
 881     (source (origin
 882               (method url-fetch)
 883               (uri (string-append "mirror://sourceforge/ccrypt/"
 884                                   version "/ccrypt-" version ".tar.gz"))
 885               (sha256
 886                (base32
 887                 "0kx4a5mhmp73ljknl2lcccmw9z3f5y8lqw0ghaymzvln1984g75i"))))
 888     (build-system gnu-build-system)
 889     (home-page "http://ccrypt.sourceforge.net")
 890     (synopsis "Command-line utility for encrypting and decrypting files and streams")
 891     (description "@command{ccrypt} is a utility for encrypting and decrypting
 892 files and streams.  It was designed as a replacement for the standard unix
 893 @command{crypt} utility, which is notorious for using a very weak encryption
 894 algorithm.  @command{ccrypt} is based on the Rijndael block cipher, a version of
 895 which is also used in the Advanced Encryption Standard (AES, see
 896 @url{http://www.nist.gov/aes}).  This cipher is believed to provide very strong
 897 security.")
 898     (license license:gpl2)))
 899
 900 (define-public asignify
 901   (let ((commit "f58e7977a599f040797975d649ed318e25cbd2d5")
 902         (revision "0"))
 903     (package
 904       (name "asignify")
 905       (version (git-version "1.1" revision commit))
 906       (source (origin
 907                 (method git-fetch)
 908                 (uri (git-reference
 909                        (url "https://github.com/vstakhov/asignify.git")
 910                        (commit commit)))
 911                 (file-name (git-file-name name version))
 912                 (sha256
 913                  (base32
 914                   "1zl68qq6js6fdahxzyhvhrpyrwlv8c2zhdplycnfxyr1ckkhq8dw"))))
 915       (build-system gnu-build-system)
 916       (arguments
 917        `(#:configure-flags
 918          (list "--enable-openssl"
 919                (string-append "--with-openssl="
 920                               (assoc-ref %build-inputs "openssl")))))
 921       (native-inputs
 922        `(("autoconf" ,autoconf)
 923          ("automake" ,automake)
 924          ("libtool" ,libtool)))
 925       (inputs
 926        `(("openssl" ,openssl)))
 927       (home-page "https://github.com/vstakhov/asignify")
 928       (synopsis "Cryptographic authentication and encryption tool and library")
 929       (description "Asignify offers public cryptographic signatures and
 930 encryption with a library or a command-line tool.  The tool is heavily inspired
 931 by signify as used in OpenBSD.  The main goal of this project is to define a
 932 high level API for signing files, validating signatures and encrypting using
 933 public-key cryptography.  Asignify is designed to be portable and self-contained
 934 with zero external dependencies.  Asignify can verify OpenBSD signatures, but it
 935 cannot sign messages in OpenBSD format yet.")
 936       (license license:bsd-2))))
 937
 938 (define-public enchive
 939   (package
 940     (name "enchive")
 941     (version "3.5")
 942     (source (origin
 943                 (method git-fetch)
 944                 (uri (git-reference
 945                       (url "https://github.com/skeeto/enchive")
 946                       (commit version)))
 947                 (sha256
 948                  (base32
 949                   "0fdrfc5l42lj2bvmv9dmkmhmm7qiszwk7cmdvnqad3fs7652g0qa"))
 950                 (file-name (git-file-name name version))))
 951     (build-system gnu-build-system)
 952     (arguments
 953      '(#:tests? #f                      ; no check target         '
 954        #:make-flags (list "CC=gcc" "PREFIX=$(out)")
 955        #:phases (modify-phases %standard-phases
 956                   (delete 'configure)
 957                   (add-after 'install 'post-install
 958                     (lambda _
 959                       (let* ((out (assoc-ref %outputs "out"))
 960                              (lisp (string-append out "/share/emacs/site-lisp")))
 961                         (install-file "enchive-mode.el" lisp)
 962                         #t))))))
 963     (synopsis "Encrypted personal archives")
 964     (description
 965      "Enchive is a tool to encrypt files to yourself for long-term
 966 archival.  It's a focused, simple alternative to more complex solutions such as
 967 GnuPG or encrypted filesystems.  Enchive has no external dependencies and is
 968 trivial to build for local use.  Portability is emphasized over performance.")
 969     (home-page "https://github.com/skeeto/enchive")
 970     (license license:unlicense)))
 971
 972 (define-public libsecp256k1
 973   (let ((commit "d644dda5c9dbdecee52d1aa259235510fdc2d4ee"))
 974     (package
 975       (name "libsecp256k1")
 976       (version (git-version "20191213" "1" commit))
 977       (source (origin
 978                 (method git-fetch)
 979                 (uri (git-reference
 980                       (url "https://github.com/bitcoin-core/secp256k1")
 981                       (commit commit)))
 982                 (sha256
 983                  (base32
 984                   "0zmx32746khsm2cx0p3pdy3j2vkwmafvf7axiixijhgcg0xjv93i"))
 985                 (file-name (git-file-name name version))))
 986       (build-system gnu-build-system)
 987       (native-inputs
 988        `(("autoconf" ,autoconf)
 989          ("automake" ,automake)
 990          ("libtool" ,libtool)))
 991       ;; WARNING: This package might need additional configure flags to run properly.
 992       ;; See https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/libsecp256k1.
 993       (synopsis "C library for EC operations on curve secp256k1")
 994       (description
 995        "Optimized C library for EC operations on curve secp256k1.
 996
 997 This library is a work in progress and is being used to research best
 998 practices.  Use at your own risk.
 999
1000 Features:
1001
1002 @itemize
1003 @item secp256k1 ECDSA signing/verification and key generation.
1004 @item Adding/multiplying private/public keys.
1005 @item Serialization/parsing of private keys, public keys, signatures.
1006 @item Constant time, constant memory access signing and pubkey generation.
1007 @item Derandomized DSA (via RFC6979 or with a caller provided function.)
1008 @item Very efficient implementation.
1009 @end itemize\n")
1010       (home-page "https://github.com/bitcoin-core/secp256k1")
1011       (license license:unlicense))))
1012
1013 (define-public stoken
1014   (package
1015     (name "stoken")
1016     (version "0.92")
1017     (source (origin
1018               (method url-fetch)
1019               (uri (string-append "mirror://sourceforge/stoken/"
1020                                   "stoken-" version ".tar.gz"))
1021               (sha256
1022                (base32
1023                 "0npgr6y85gzwksy8jkwa4yzvqwjprwnplx3yiw3ayk4f0ldlhaxa"))))
1024     (build-system gnu-build-system)
1025     (native-inputs
1026      `(("pkg-config" ,pkg-config)))
1027     (inputs
1028      `(("nettle" ,nettle)
1029        ("libxml2" ,libxml2)))
1030     (home-page "http://stoken.sf.net")
1031     (synopsis "Software Token for cryptographic authentication")
1032     (description
1033      "@code{stoken} is a token code generator compatible with RSA SecurID
1034 128-bit (AES) tokens.  This package contains a standalone command-line program
1035 that allows for importing token seeds, generating token codes, and various
1036 utility/testing functions.")
1037     (license license:lgpl2.1+)))
1038
1039 (define-public hpenc
1040   (package
1041     (name "hpenc")
1042     (version "3.0")
1043     (source (origin
1044               (method git-fetch)
1045               (uri (git-reference
1046                      (url "https://github.com/vstakhov/hpenc")
1047                      (commit version)))
1048               (file-name (git-file-name name version))
1049               (sha256
1050                (base32
1051                 "1fb5yi3d2k8kd4zm7liiqagpz610y168xrr1cvn7cbq314jm2my1"))))
1052     (build-system gnu-build-system)
1053     (arguments
1054      `(#:tests? #f ; No test suite
1055        #:make-flags
1056        (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
1057              ;; Build the program and the docs.
1058              "SUBDIRS=src doc")
1059        #:phases
1060        (modify-phases %standard-phases
1061          (delete 'configure) ; No ./configure script
1062          (add-after 'unpack 'patch-path
1063            (lambda _
1064              (substitute* '("src/Makefile" "doc/Makefile")
1065                (("/usr/bin/install")
1066                 "install"))))
1067          (add-before 'install 'make-output-directories
1068            (lambda* (#:key outputs #:allow-other-keys)
1069              (let* ((out (assoc-ref outputs "out"))
1070                     (bin (string-append out "/bin"))
1071                     (man1 (string-append out "/share/man/man1")))
1072                (mkdir-p bin)
1073                (mkdir-p man1)
1074                #t))))))
1075     (inputs
1076      `(("libsodium" ,libsodium)
1077        ("openssl" ,openssl)))
1078     (synopsis "High-performance command-line tool for stream encryption")
1079     (description "Hpenc is a command-line tool for performing authenticated
1080 encryption (AES-GCM and ChaCha20-Poly1305) of streaming data.  It does not
1081 perform an asymmetric key exchange, instead requiring the user to distribute
1082 pre-shared keys out of band.  It is designed to handle large amounts of data
1083 quickly by using all your CPU cores and hardware acceleration.")
1084     (home-page "https://github.com/vstakhov/hpenc")
1085     (license license:bsd-3)))
1086
1087 (define-public minisign
1088   (package
1089     (name "minisign")
1090     (version "0.9")
1091     (source
1092      (origin
1093        (method url-fetch)
1094        (uri
1095         (string-append "https://github.com/jedisct1/minisign/releases/download/"
1096                        version "/minisign-" version ".tar.gz"))
1097        (sha256
1098         (base32 "1h9cfvvm6lqq33b2wdar1x3w4k7zyrscavllyb0l5dmcdabq60r2"))))
1099     (build-system cmake-build-system)
1100     (arguments
1101      ; No test suite
1102      `(#:tests? #f))
1103     (native-inputs
1104      `(("pkg-config" ,pkg-config)))
1105     (inputs
1106      `(("libsodium" ,libsodium)))
1107     (home-page "https://jedisct1.github.io/minisign")
1108     (synopsis "Tool to sign files and verify signatures")
1109     (description
1110      "Minisign is a dead simple tool to sign files and verify signatures.  It is
1111 portable, lightweight, and uses the highly secure Ed25519 public-key signature
1112 system.  Signature written by minisign can be verified using OpenBSD's
1113 signify tool: public key files and signature files are compatible.  However,
1114 minisign uses a slightly different format to store secret keys.  Minisign
1115 signatures include trusted comments in addition to untrusted comments.
1116 Trusted comments are signed, thus verified, before being displayed.")
1117     (license license:isc)))
1118
1119 (define-public libolm
1120   (package
1121     (name "libolm")
1122     (version "3.1.5")
1123     (source (origin
1124               (method git-fetch)
1125               (uri (git-reference
1126                     (url "https://git.matrix.org/git/olm")
1127                     (commit version)))
1128               (sha256
1129                (base32
1130                 "030g0jmmvhx2dh32k708sz6cdd5q1wz48i4gigh6dclqk10w28lm"))
1131               (file-name (git-file-name name version))))
1132     (arguments
1133      `(#:phases
1134        (modify-phases %standard-phases
1135          (replace 'check
1136            (lambda _
1137              (invoke "ctest" "build/tests"))))))
1138     (build-system cmake-build-system)
1139     (synopsis "Implementation of the olm and megolm cryptographic ratchets")
1140     (description "The libolm library implements the Double Ratchet
1141 cryptographic ratchet.  It is written in C and C++11, and exposed as a C
1142 API.")
1143     (home-page "https://matrix.org/docs/projects/other/olm/")
1144     (license license:asl2.0)))
1145
1146 (define-public hash-extender
1147   (let ((commit "cb8aaee49f93e9c0d2f03eb3cafb429c9eed723d")
1148         (revision "2"))
1149     (package
1150       (name "hash-extender")
1151       (version (git-version "0.0" revision commit))
1152       (source (origin
1153                 (method git-fetch)
1154                 (uri (git-reference
1155                       (url "https://github.com/iagox86/hash_extender")
1156                       (commit commit)))
1157                 (sha256
1158                  (base32
1159                   "1fj118566hr1wv03az2w0iqknazsqqkak0mvlcvwpgr6midjqi9b"))
1160                 (file-name (git-file-name name version))))
1161       (build-system gnu-build-system)
1162       (arguments
1163        `(#:phases
1164          (modify-phases %standard-phases
1165            (delete 'configure)
1166            (replace 'check
1167              (lambda _
1168                (invoke "./hash_extender_test")))
1169            (replace 'install
1170              (lambda* (#:key outputs #:allow-other-keys)
1171                (let* ((outdir (assoc-ref outputs "out"))
1172                       (bindir (string-append outdir "/bin"))
1173                       (docdir (string-append outdir
1174                                              "/share/doc/hash-extender-"
1175                                              ,version)))
1176                  (install-file "hash_extender" bindir)
1177                  (install-file "README.md" docdir)
1178                  #t))))))
1179       (inputs
1180        `(("openssl" ,openssl)))
1181       (synopsis "Tool for hash length extension attacks")
1182       (description "@command{hash_extender} is a utility for performing hash
1183 length extension attacks supporting MD4, MD5, RIPEMD-160, SHA-0, SHA-1,
1184 SHA-256, SHA-512, and WHIRLPOOL hashes.")
1185       (home-page "https://github.com/iagox86/hash_extender")
1186       (license license:bsd-3))))