gnu/packages/crypto.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2014 David Thompson <davet@gnu.org>
   3 ;;; Copyright © 2015, 2017, 2018, 2019 Ricardo Wurmus <rekado@elephly.net>
   4 ;;; Copyright © 2016, 2017, 2018, 2019 Leo Famulari <leo@famulari.name>
   5 ;;; Copyright © 2016 Lukas Gradl <lgradl@openmailbox>
   6 ;;; Copyright © 2016, 2017, 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
   7 ;;; Copyright © 2016, 2017 ng0 <ng0@n0.is>
   8 ;;; Copyright © 2016, 2017, 2019 Eric Bavier <bavier@member.fsf.org>
   9 ;;; Copyright © 2017 Pierre Langlois <pierre.langlois@gmx.com>
  10 ;;; Copyright © 2018 Efraim Flashner <efraim@flashner.co.il>
  11 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
  12 ;;; Copyright © 2018 Nicolas Goaziou <mail@nicolasgoaziou.fr>
  13 ;;; Copyright © 2018 Nicolò Balzarotti <nicolo@nixo.xyz>
  14 ;;; Copyright © 2018 Tim Gesthuizen <tim.gesthuizen@yahoo.de>
  15 ;;; Copyright © 2019 Pierre Neidhardt <mail@ambrevar.xyz>
  16 ;;;
  17 ;;; This file is part of GNU Guix.
  18 ;;;
  19 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  20 ;;; under the terms of the GNU General Public License as published by
  21 ;;; the Free Software Foundation; either version 3 of the License, or (at
  22 ;;; your option) any later version.
  23 ;;;
  24 ;;; GNU Guix is distributed in the hope that it will be useful, but
  25 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  26 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27 ;;; GNU General Public License for more details.
  28 ;;;
  29 ;;; You should have received a copy of the GNU General Public License
  30 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  31
  32 (define-module (gnu packages crypto)
  33   #:use-module (gnu packages)
  34   #:use-module (gnu packages admin)
  35   #:use-module (gnu packages aidc)
  36   #:use-module (gnu packages attr)
  37   #:use-module (gnu packages autotools)
  38   #:use-module (gnu packages boost)
  39   #:use-module (gnu packages check)
  40   #:use-module (gnu packages compression)
  41   #:use-module (gnu packages cryptsetup)
  42   #:use-module (gnu packages gettext)
  43   #:use-module (gnu packages gnupg)
  44   #:use-module (gnu packages image)
  45   #:use-module (gnu packages kerberos)
  46   #:use-module (gnu packages libbsd)
  47   #:use-module (gnu packages libffi)
  48   #:use-module (gnu packages linux)
  49   #:use-module (gnu packages nettle)
  50   #:use-module (gnu packages password-utils)
  51   #:use-module (gnu packages perl)
  52   #:use-module (gnu packages perl-check)
  53   #:use-module (gnu packages pkg-config)
  54   #:use-module (gnu packages python)
  55   #:use-module (gnu packages python-xyz)
  56   #:use-module (gnu packages readline)
  57   #:use-module (gnu packages search)
  58   #:use-module (gnu packages serialization)
  59   #:use-module (gnu packages shells)
  60   #:use-module (gnu packages sqlite)
  61   #:use-module (gnu packages tcl)
  62   #:use-module (gnu packages tls)
  63   #:use-module (gnu packages xml)
  64   #:use-module ((guix licenses) #:prefix license:)
  65   #:use-module (guix packages)
  66   #:use-module (guix download)
  67   #:use-module (guix git-download)
  68   #:use-module (guix build-system cmake)
  69   #:use-module (guix build-system gnu)
  70   #:use-module (guix build-system perl)
  71   #:use-module (guix build utils)
  72   #:use-module (srfi srfi-1)
  73   #:use-module (srfi srfi-26))
  74
  75 (define-public libsodium
  76   (package
  77     (name "libsodium")
  78     (version "1.0.18")
  79     (source (origin
  80             (method url-fetch)
  81             (uri (list (string-append
  82                         "https://download.libsodium.org/libsodium/"
  83                         "releases/libsodium-" version ".tar.gz")
  84                        (string-append
  85                         "https://download.libsodium.org/libsodium/"
  86                         "releases/old/libsodium-" version ".tar.gz")))
  87             (sha256
  88              (base32
  89               "1h9ncvj23qbbni958knzsli8dvybcswcjbx0qjjgi922nf848l3g"))))
  90     (build-system gnu-build-system)
  91     (synopsis "Portable NaCl-based crypto library")
  92     (description
  93      "Sodium is a new easy-to-use high-speed software library for network
  94 communication, encryption, decryption, signatures, etc.")
  95     (license license:isc)
  96     (home-page "https://libsodium.org")))
  97
  98 (define-public libmd
  99   (package
 100     (name "libmd")
 101     (version "1.0.1")
 102     (source (origin
 103             (method url-fetch)
 104             (uri
 105              (list
 106               (string-append "https://archive.hadrons.org/software/libmd/libmd-"
 107                              version ".tar.xz")
 108               (string-append "https://libbsd.freedesktop.org/releases/libmd-"
 109                              version ".tar.xz")))
 110             (sha256
 111              (base32
 112               "0waclg2d5qin3r26gy5jvy4584ik60njc8pqbzwk0lzq3j9ynkp1"))))
 113     (build-system gnu-build-system)
 114     (synopsis "Message Digest functions from BSD systems")
 115     (description
 116      "The currently provided message digest algorithms are:
 117 @itemize
 118 @item MD2
 119 @item MD4
 120 @item MD5
 121 @item RIPEMD-160
 122 @item SHA-1
 123 @item SHA-2 (SHA-256, SHA-384 and SHA-512)
 124 @end itemize")
 125     (license (list license:bsd-3
 126                    license:bsd-2
 127                    license:isc
 128                    license:public-domain))
 129     (home-page "https://www.hadrons.org/software/libmd/")))
 130
 131 (define-public signify
 132   (package
 133     (name "signify")
 134     (version "26")
 135     (home-page "https://github.com/aperezdc/signify")
 136     (source (origin
 137               (method url-fetch)
 138               (uri (string-append "https://github.com/aperezdc/signify/releases"
 139                                   "/download/v" version "/signify-" version ".tar.xz"))
 140               (sha256
 141                (base32
 142                 "16sl1yq5bbsads5q4a0fbrf31b0x8r1hi4wagl90nbrhrca98baw"))))
 143     (build-system gnu-build-system)
 144     ;; TODO Build with libwaive (described in README.md), to implement something
 145     ;; like OpenBSD's pledge().
 146     (arguments
 147      `(#:tests? #f ; no test suite
 148        #:make-flags
 149        (list "CC=gcc"
 150              (string-append "PREFIX=" (assoc-ref %outputs "out")))
 151        #:phases
 152        (modify-phases %standard-phases
 153          (delete 'configure))))
 154     (native-inputs
 155      `(("pkg-config" ,pkg-config)))
 156     (inputs
 157      `(("libbsd" ,libbsd)))
 158     (synopsis "Create and verify cryptographic signatures")
 159     (description "The signify utility creates and verifies cryptographic
 160 signatures using the elliptic curve Ed25519.  This is a Linux port of the
 161 OpenBSD tool of the same name.")
 162     ;; This package includes third-party code that was originally released under
 163     ;; various non-copyleft licenses. See the source files for clarification.
 164     (license (list license:bsd-3 license:bsd-4 license:expat license:isc
 165                    license:public-domain (license:non-copyleft
 166                                           "file://base64.c"
 167                                           "See base64.c in the distribution for
 168                                            the license from IBM.")))))
 169
 170 (define-public encfs
 171   (package
 172     (name "encfs")
 173     (version "1.9.5")
 174     (source
 175      (origin
 176        (method url-fetch)
 177        (uri
 178         (string-append "https://github.com/vgough/encfs/releases/download/v"
 179                        version "/encfs-" version ".tar.gz"))
 180        (sha256
 181         (base32
 182          "0qzxavvv20577bxvly8s7d3y7bqasqclc2mllp0ddfncjm9z02a7"))
 183        (modules '((guix build utils)))
 184        ;; Remove bundled dependencies in favour of proper inputs.
 185        (snippet '(begin
 186                    (for-each delete-file-recursively
 187                              '("vendor/github.com/leethomason/tinyxml2"
 188                                "vendor/github.com/google/googletest"))
 189                    #t))))
 190     (build-system cmake-build-system)
 191     (native-inputs
 192      `(("gettext" ,gettext-minimal)
 193
 194        ;; Test dependencies.
 195        ("expect" ,expect)
 196        ("googletest-source" ,(package-source googletest))
 197        ("perl" ,perl)))
 198     (inputs
 199      `(("attr" ,attr)
 200        ("fuse" ,fuse)
 201        ("openssl" ,openssl)
 202        ("tinyxml2" ,tinyxml2)))
 203     (arguments
 204      `(#:configure-flags (list "-DUSE_INTERNAL_TINYXML=OFF")
 205        #:phases
 206        (modify-phases %standard-phases
 207          (add-after 'unpack 'unpack-googletest
 208            (lambda* (#:key inputs #:allow-other-keys)
 209              (mkdir-p "vendor/github.com/google/googletest")
 210              (copy-recursively (assoc-ref inputs "googletest-source")
 211                                "vendor/github.com/google/googletest")
 212              #t))
 213          (add-before 'check 'make-unittests
 214            (lambda _
 215              (invoke "make" "unittests"))))))
 216     (home-page "https://vgough.github.io/encfs")
 217     (synopsis "Encrypted virtual file system")
 218     (description
 219      "EncFS creates a virtual encrypted file system in user-space.  Each file
 220 created under an EncFS mount point is stored as a separate encrypted file on
 221 the underlying file system.  Like most encrypted file systems, EncFS is meant
 222 to provide security against off-line attacks, such as a drive falling into
 223 the wrong hands.")
 224     (license (list license:expat                  ; internal/easylogging++.h
 225                    license:lgpl3+                 ; encfs library
 226                    license:gpl3+))))              ; command-line tools
 227
 228 (define-public keyutils
 229   (package
 230     (name "keyutils")
 231     (version "1.6")
 232     (source
 233      (origin
 234        (method url-fetch)
 235        (uri
 236         (string-append "https://people.redhat.com/dhowells/keyutils/keyutils-"
 237                        version ".tar.bz2"))
 238        (sha256
 239         (base32
 240          "05bi5ja6f3h3kdi7p9dihlqlfrsmi1wh1r2bdgxc0180xh6g5bnk"))
 241        (modules '((guix build utils)))
 242        ;; Create relative symbolic links instead of absolute ones to /lib/*.
 243        (snippet '(begin
 244                    (substitute* "Makefile" (("\\$\\(LNS\\) \\$\\(LIBDIR\\)/")
 245                                             "$(LNS) "))
 246                    #t))))
 247     (build-system gnu-build-system)
 248     (arguments
 249      `(#:phases (modify-phases %standard-phases
 250                   (delete 'configure))          ; no configure script
 251        #:make-flags (list "CC=gcc"
 252                           "RPATH=-Wl,-rpath,$(DESTDIR)$(LIBDIR)"
 253                           (string-append "DESTDIR="
 254                                          (assoc-ref %outputs "out"))
 255                           "INCLUDEDIR=/include"
 256                           "LIBDIR=/lib"
 257                           "MANDIR=/share/man"
 258                           "SHAREDIR=/share/keyutils")
 259        #:test-target "test"))
 260     (inputs
 261      `(("mit-krb5" ,mit-krb5)))
 262     (home-page "https://people.redhat.com/dhowells/keyutils/")
 263     (synopsis "Linux key management utilities")
 264     (description
 265      "Keyutils is a set of utilities for managing the key retention facility in
 266 the Linux kernel, which can be used by file systems, block devices, and more to
 267 gain and retain the authorization and encryption keys required to perform
 268 secure operations. ")
 269     (license (list license:lgpl2.1+             ; the files keyutils.*
 270                    license:gpl2+))))            ; the rest
 271
 272 ;; There is no release candidate but commits point out a version number,
 273 ;; furthermore no tarball exists.
 274 (define-public eschalot
 275   (let ((commit "0bf31d88a11898c19b1ed25ddd2aff7b35dbac44")
 276         (revision "1"))
 277     (package
 278       (name "eschalot")
 279       (version (string-append "1.2.0-" revision "." (string-take commit 7)))
 280       (source
 281        (origin
 282          (method git-fetch)
 283          (uri (git-reference
 284                (url "https://github.com/schnabear/eschalot")
 285                (commit commit)))
 286          (file-name (string-append name "-" version))
 287          (sha256
 288           (base32
 289            "0lj38ldh8vzi11wp4ghw4k0fkwp0s04zv8k8d473p1snmbh7mx98"))))
 290       (inputs
 291        `(("openssl" ,openssl))) ; It needs: openssl/{bn,pem,rsa,sha}.h
 292       (build-system gnu-build-system)
 293       (arguments
 294        `(#:make-flags (list "CC=gcc"
 295                             (string-append "PREFIX=" (assoc-ref %outputs "out"))
 296                             (string-append "INSTALL=" "install"))
 297          ;; XXX: make test would run a !VERY! long hashing of names with the use
 298          ;; of a wordlist, the amount of computing time this would waste on build
 299          ;; servers is in no relation to the size or importance of this small
 300          ;; application, therefore we run our own tests on eschalot and worgen.
 301          #:phases
 302          (modify-phases %standard-phases
 303            (delete 'configure)
 304            (replace 'check
 305              (lambda _
 306                (invoke "./worgen" "8-12" "top1000.txt" "3-10" "top400nouns.txt"
 307                        "3-6" "top150adjectives.txt" "3-6")
 308                (invoke "./eschalot" "-r" "^guix|^guixsd")
 309                (invoke "./eschalot" "-r" "^gnu|^free")
 310                (invoke "./eschalot" "-r" "^cyber|^hack")
 311                (invoke "./eschalot" "-r" "^troll")))
 312            ;; Make install can not create the bin dir, create it.
 313            (add-before 'install 'create-bin-dir
 314              (lambda* (#:key outputs #:allow-other-keys)
 315                (let* ((out (assoc-ref outputs "out"))
 316                       (bin (string-append out "/bin")))
 317                  (mkdir-p bin)
 318                  #t))))))
 319       (home-page "https://github.com/schnabear/eschalot")
 320       (synopsis "Tor hidden service name generator")
 321       (description
 322        "Eschalot is a tor hidden service name generator, it allows one to
 323 produce customized vanity .onion addresses using a brute-force method.  Searches
 324 for valid names can be run with regular expressions and wordlists.  For the
 325 generation of wordlists the included tool @code{worgen} can be used.  There is
 326 no man page, refer to the home page for usage details.")
 327       (license (list license:isc license:expat)))))
 328
 329 (define-public tomb
 330   (package
 331     (name "tomb")
 332     (version "2.6")
 333     (source (origin
 334               (method url-fetch)
 335               (uri (string-append "https://files.dyne.org/tomb/"
 336                                   "Tomb-" version ".tar.gz"))
 337               (sha256
 338                (base32
 339                 "1sr3jcn96mciyn8xd0amd1jzamxxzpybakf8an7laf26gjim1dh2"))))
 340     (build-system gnu-build-system)
 341     (native-inputs `(("sudo" ,sudo)))   ;presence needed for 'check' phase
 342     (inputs
 343      `(("zsh" ,zsh)
 344        ("gnupg" ,gnupg)
 345        ("cryptsetup" ,cryptsetup)
 346        ("e2fsprogs" ,e2fsprogs)         ;for mkfs.ext4
 347        ("gettext" ,gettext-minimal)     ;used at runtime
 348        ("mlocate" ,mlocate)
 349        ("pinentry" ,pinentry)
 350        ("qrencode" ,qrencode)
 351        ("steghide" ,steghide)
 352        ("util-linux" ,util-linux)))
 353     (arguments
 354      `(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out")))
 355        ;; TODO: Build and install gtk and qt trays
 356        #:phases
 357        (modify-phases %standard-phases
 358          (delete 'configure)            ;no configuration to be done
 359          (add-after 'install 'i18n
 360            (lambda* (#:key make-flags #:allow-other-keys)
 361              (apply invoke "make" "-C" "extras/translations"
 362                     "install" make-flags)
 363              #t))
 364          (add-after 'install 'wrap
 365            (lambda* (#:key inputs outputs #:allow-other-keys)
 366              (let ((out (assoc-ref outputs "out")))
 367                (wrap-program (string-append out "/bin/tomb")
 368                  `("PATH" ":" prefix
 369                    (,(string-append (assoc-ref inputs "mlocate") "/bin")
 370                     ,@(map (lambda (program)
 371                              (or (and=> (which program) dirname)
 372                                  (error "program not found:" program)))
 373                            '("seq" "mkfs.ext4" "pinentry" "sudo"
 374                              "gpg" "cryptsetup" "gettext"
 375                              "qrencode" "steghide" "findmnt")))))
 376                #t)))
 377          (delete 'check)
 378          (add-after 'wrap 'check
 379            (lambda* (#:key outputs #:allow-other-keys)
 380              ;; Running the full tests requires sudo/root access for
 381              ;; cryptsetup, which is not available in the build environment.
 382              ;; But we can run `tomb dig` without root, so make sure that
 383              ;; works.  TODO: It Would Be Nice to check the expected "index",
 384              ;; "search", "bury", and "exhume" features are available by
 385              ;; querying `tomb -h`.
 386              (let ((tomb (string-append (assoc-ref outputs "out")
 387                                         "/bin/tomb")))
 388                (invoke tomb "dig" "-s" "10" "secrets.tomb")
 389                #t))))))
 390     (home-page "https://www.dyne.org/software/tomb")
 391     (synopsis "File encryption for secret data")
 392     (description
 393      "Tomb is an application to manage the creation and access of encrypted
 394 storage files: it can be operated from commandline and it can integrate with a
 395 user's graphical desktop.")
 396     (license license:gpl3+)))
 397
 398 (define-public scrypt
 399   (package
 400     (name "scrypt")
 401     (version "1.2.1")
 402     (source
 403       (origin
 404         (method url-fetch)
 405         (uri (string-append "https://www.tarsnap.com/scrypt/scrypt-"
 406                             version ".tgz"))
 407         (sha256
 408          (base32
 409           "0xy5yhrwwv13skv9im9vm76rybh9f29j2dh4hlh2x01gvbkza8a6"))))
 410     (build-system gnu-build-system)
 411     (arguments
 412      `(#:phases (modify-phases %standard-phases
 413         (add-after 'unpack 'patch-command-invocations
 414           (lambda _
 415             (substitute* "Makefile.in"
 416               (("command -p") ""))
 417             #t))
 418         (add-after 'install 'install-docs
 419           (lambda* (#:key outputs #:allow-other-keys)
 420             (let* ((out (assoc-ref %outputs "out"))
 421                    (misc (string-append out "/share/doc/scrypt")))
 422               (install-file "FORMAT" misc)
 423               #t))))))
 424     (inputs
 425      `(("openssl" ,openssl)))
 426     (home-page "https://www.tarsnap.com/scrypt.html")
 427     (synopsis "Memory-hard encryption tool based on scrypt")
 428     (description "This package provides a simple password-based encryption
 429 utility as a demonstration of the @code{scrypt} key derivation function.
 430 @code{Scrypt} is designed to be far more resistant against hardware brute-force
 431 attacks than alternative functions such as @code{PBKDF2} or @code{bcrypt}.")
 432     (license license:bsd-2)))
 433
 434 (define-public libscrypt
 435   (package
 436     (name "libscrypt")
 437     (version "1.21")
 438     (source
 439      (origin
 440        (method git-fetch)
 441        (uri (git-reference
 442              (url "https://github.com/technion/libscrypt.git")
 443              (commit (string-append "v" version))))
 444        (file-name (git-file-name name version))
 445        (sha256
 446         (base32
 447          "1d76ys6cp7fi4ng1w3mz2l0p9dbr7ljbk33dcywyimzjz8bahdng"))))
 448     (build-system gnu-build-system)
 449     (arguments
 450      `(#:make-flags (list (string-append "PREFIX=" %output)
 451                           "CC=gcc")
 452        #:phases
 453        (modify-phases %standard-phases
 454          (delete 'configure))))
 455     (home-page "https://lolware.net/libscrypt.html")
 456     (synopsis "Password hashing library")
 457     (description "@code{libscrypt} implements @code{scrypt} key derivation
 458 function.  It is designed to be far more secure against hardware brute-force
 459 attacks than alternative functions such as @code{PBKDF2} or @code{bcrypt}.")
 460     (license license:bsd-3)))
 461
 462 (define-public perl-math-random-isaac-xs
 463   (package
 464     (name "perl-math-random-isaac-xs")
 465     (version "1.004")
 466     (source
 467      (origin
 468        (method url-fetch)
 469        (uri (string-append "mirror://cpan/authors/id/J/JA/JAWNSY/"
 470                            "Math-Random-ISAAC-XS-" version ".tar.gz"))
 471        (sha256
 472         (base32
 473          "0yxqqcqvj51fn7b7j5xqhz65v74arzgainn66c6k7inijbmr1xws"))))
 474     (build-system perl-build-system)
 475     (native-inputs
 476      `(("perl-module-build" ,perl-module-build)
 477        ("perl-test-nowarnings" ,perl-test-nowarnings)))
 478     (home-page "https://metacpan.org/release/Math-Random-ISAAC-XS")
 479     (synopsis "C implementation of the ISAAC PRNG algorithm")
 480     (description "ISAAC (Indirection, Shift, Accumulate, Add, and Count) is a
 481 fast pseudo-random number generator.  It is suitable for applications where a
 482 significant amount of random data needs to be produced quickly, such as
 483 solving using the Monte Carlo method or for games.  The results are uniformly
 484 distributed, unbiased, and unpredictable unless you know the seed.
 485
 486 This package implements the same interface as @code{Math::Random::ISAAC}.")
 487     (license license:public-domain)))
 488
 489 (define-public perl-math-random-isaac
 490   (package
 491     (name "perl-math-random-isaac")
 492     (version "1.004")
 493     (source
 494      (origin
 495        (method url-fetch)
 496        (uri (string-append "mirror://cpan/authors/id/J/JA/JAWNSY/"
 497                            "Math-Random-ISAAC-" version ".tar.gz"))
 498        (sha256
 499         (base32
 500          "0z1b3xbb3xz71h25fg6jgsccra7migq7s0vawx2rfzi0pwpz0wr7"))))
 501     (build-system perl-build-system)
 502     (native-inputs
 503      `(("perl-test-nowarnings" ,perl-test-nowarnings)))
 504     (propagated-inputs
 505      `(("perl-math-random-isaac-xs" ,perl-math-random-isaac-xs)))
 506     (home-page "https://metacpan.org/release/Math-Random-ISAAC")
 507     (synopsis "Perl interface to the ISAAC PRNG algorithm")
 508     (description "ISAAC (Indirection, Shift, Accumulate, Add, and Count) is a
 509 fast pseudo-random number generator.  It is suitable for applications where a
 510 significant amount of random data needs to be produced quickly, such as
 511 solving using the Monte Carlo method or for games.  The results are uniformly
 512 distributed, unbiased, and unpredictable unless you know the seed.
 513
 514 This package provides a Perl interface to the ISAAC pseudo random number
 515 generator.")
 516     (license license:public-domain)))
 517
 518 (define-public perl-crypt-random-source
 519   (package
 520     (name "perl-crypt-random-source")
 521     (version "0.12")
 522     (source
 523      (origin
 524        (method url-fetch)
 525        (uri (string-append "mirror://cpan/authors/id/E/ET/ETHER/"
 526                            "Crypt-Random-Source-" version ".tar.gz"))
 527        (sha256
 528         (base32
 529          "00mw5m52sbz9nqp3f6axyrgcrihqxn7k8gv0vi1kvm1j1nc9g29h"))))
 530     (build-system perl-build-system)
 531     (native-inputs
 532      `(("perl-module-build-tiny" ,perl-module-build-tiny)
 533        ("perl-test-exception" ,perl-test-exception)))
 534     (propagated-inputs
 535      `(("perl-capture-tiny" ,perl-capture-tiny)
 536        ("perl-module-find" ,perl-module-find)
 537        ("perl-module-runtime" ,perl-module-runtime)
 538        ("perl-moo" ,perl-moo)
 539        ("perl-namespace-clean" ,perl-namespace-clean)
 540        ("perl-sub-exporter" ,perl-sub-exporter)
 541        ("perl-type-tiny" ,perl-type-tiny)))
 542     (home-page "https://metacpan.org/release/Crypt-Random-Source")
 543     (synopsis "Get weak or strong random data from pluggable sources")
 544     (description "This module provides implementations for a number of
 545 byte-oriented sources of random data.")
 546     (license license:perl-license)))
 547
 548 (define-public perl-math-random-secure
 549   (package
 550     (name "perl-math-random-secure")
 551     (version "0.080001")
 552     (source
 553      (origin
 554        (method url-fetch)
 555        (uri (string-append "mirror://cpan/authors/id/F/FR/FREW/"
 556                            "Math-Random-Secure-" version ".tar.gz"))
 557        (sha256
 558         (base32
 559          "0dgbf4ncll4kmgkyb9fsaxn0vf2smc9dmwqzgh3259zc2zla995z"))))
 560     (build-system perl-build-system)
 561     (native-inputs
 562      `(("perl-list-moreutils" ,perl-list-moreutils)
 563        ("perl-test-leaktrace" ,perl-test-leaktrace)
 564        ("perl-test-sharedfork" ,perl-test-sharedfork)
 565        ("perl-test-warn" ,perl-test-warn)))
 566     (inputs
 567      `(("perl-crypt-random-source" ,perl-crypt-random-source)
 568        ("perl-math-random-isaac" ,perl-math-random-isaac)
 569        ("perl-math-random-isaac-xs" ,perl-math-random-isaac-xs)
 570        ("perl-moo" ,perl-moo)))
 571     (home-page "https://metacpan.org/release/Math-Random-Secure")
 572     (synopsis "Cryptographically secure replacement for rand()")
 573     (description "This module is intended to provide a
 574 cryptographically-secure replacement for Perl's built-in @code{rand} function.
 575 \"Crytographically secure\", in this case, means:
 576
 577 @enumerate
 578 @item No matter how many numbers you see generated by the random number
 579 generator, you cannot guess the future numbers, and you cannot guess the seed.
 580 @item There are so many possible seeds that it would take decades, centuries,
 581 or millennia for an attacker to try them all.
 582 @item The seed comes from a source that generates relatively strong random
 583 data on your platform, so the seed itself will be as random as possible.
 584 @end enumerate\n")
 585     (license license:artistic2.0)))
 586
 587 (define-public crypto++
 588   (package
 589     (name "crypto++")
 590     (version "8.0.0")
 591     (source (origin
 592               (method url-fetch/zipbomb)
 593               (uri (string-append "https://cryptopp.com/cryptopp"
 594                                   (string-join (string-split version #\.) "")
 595                                   ".zip"))
 596               (sha256
 597                (base32
 598                 "0b5qrsm4jhy4nzxgrm13nixhvbswr242plx1jw6r4sw492rqkzdv"))))
 599     (build-system gnu-build-system)
 600     (arguments
 601      `(#:make-flags
 602        (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 603              ;; Override "/sbin/ldconfig" with simply "echo" since
 604              ;; we don't need ldconfig(8).
 605              "LDCONF=echo")
 606        #:phases
 607        (modify-phases %standard-phases
 608          (add-after 'unpack 'disable-native-optimisation
 609            ;; This package installs more than just headers.  Ensure that the
 610            ;; cryptest.exe binary & static library aren't CPU model specific.
 611            (lambda _
 612              (substitute* "GNUmakefile"
 613                ((" -march=native") ""))
 614              #t))
 615          (delete 'configure)
 616          (add-after 'build 'build-shared
 617            (lambda _
 618              ;; By default, only the static library is built.
 619              (invoke "make" "shared")))
 620          (add-after 'install 'install-pkg-config
 621            (lambda* (#:key outputs #:allow-other-keys)
 622              (let* ((out (assoc-ref outputs "out"))
 623                     (pkg-dir (string-append out "/lib/pkgconfig")))
 624                (mkdir-p pkg-dir)
 625                (with-output-to-file (string-append pkg-dir "/libcrypto++.pc")
 626                  (lambda _
 627                    (display
 628                     (string-append
 629                      "prefix=" out "\n"
 630                      "libdir=" out "/lib\n"
 631                      "includedir=" out "/include\n\n"
 632                      "Name: libcrypto++-" ,version "\n"
 633                      "Description: Class library of cryptographic schemes"
 634                      "Version: " ,version "\n"
 635                      "Libs: -L${libdir} -lcryptopp\n"
 636                      "Cflags: -I${includedir}\n"))))))))))
 637     (native-inputs
 638      `(("unzip" ,unzip)))
 639     (home-page "https://cryptopp.com/")
 640     (synopsis "C++ class library of cryptographic schemes")
 641     (description "Crypto++ is a C++ class library of cryptographic schemes.")
 642     ;; The compilation is distributed under the Boost license; the individual
 643     ;; files in the compilation are in the public domain.
 644     (license (list license:boost1.0 license:public-domain))))
 645
 646 (define-public libb2
 647   (package
 648     (name "libb2")
 649     (version "0.98.1")
 650     (source (origin
 651               (method url-fetch)
 652               (uri (string-append
 653                     "https://github.com/BLAKE2/libb2/releases/download/v"
 654                     version "/libb2-" version ".tar.gz"))
 655               (sha256
 656                (base32
 657                 "0bn7yrzdixdvzm46shbhpkqbr6zyqyxiqn7a7x54ag3mrvfnyqjk"))))
 658     (build-system gnu-build-system)
 659     (arguments
 660      `(#:configure-flags
 661        (list
 662         ,@(if (any (cute string-prefix? <> (or (%current-system)
 663                                                (%current-target-system)))
 664                    '("x86_64" "i686"))
 665               ;; fat only checks for Intel optimisations
 666               '("--enable-fat")
 667               '())
 668         "--disable-native")))           ;don't optimise at build time
 669     (home-page "https://blake2.net/")
 670     (synopsis "Library implementing the BLAKE2 family of hash functions")
 671     (description
 672      "libb2 is a portable implementation of the BLAKE2 family of cryptographic
 673 hash functions.  It includes optimised implementations for IA-32 and AMD64
 674 processors, and an interface layer that automatically selects the best
 675 implementation for the processor it is run on.
 676
 677 @dfn{BLAKE2} (RFC 7693) is a family of high-speed cryptographic hash functions
 678 that are faster than MD5, SHA-1, SHA-2, and SHA-3, yet are at least as secure
 679 as the latest standard, SHA-3.  It is an improved version of the SHA-3 finalist
 680 BLAKE.")
 681     (license license:public-domain)))
 682
 683 (define-public rhash
 684   (package
 685     (name "rhash")
 686     (version "1.3.8")
 687     (source
 688      (origin
 689        (method url-fetch)
 690        (uri (string-append "https://github.com/rhash/RHash/archive/v"
 691                            version ".tar.gz"))
 692        (file-name (string-append name "-" version ".tar.gz"))
 693        (sha256
 694         (base32
 695          "0k60ywyhwqwqxa2q2l85vwgf884hcgy31nxir3dqgz7ymib6llxy"))))
 696     (build-system gnu-build-system)
 697     (arguments
 698      `(#:make-flags
 699        ;; The binaries in /bin need some help finding librhash.so.0.
 700        (list (string-append "LDFLAGS=-Wl,-rpath=" %output "/lib"))
 701        #:test-target "test"             ; ‘make check’ just checks the sources
 702        #:phases
 703        (modify-phases %standard-phases
 704          (replace 'configure
 705            ;; ./configure is not GNU autotools' and doesn't gracefully handle
 706            ;; unrecognized options, so we must call it manually.
 707            (lambda* (#:key outputs #:allow-other-keys)
 708              (invoke "./configure"
 709                      (string-append "--prefix=" (assoc-ref outputs "out")))))
 710          (add-after 'install 'install-library-extras
 711            (lambda* (#:key make-flags #:allow-other-keys)
 712              (apply invoke
 713                     "make" "-C" "librhash"
 714                     "install-lib-headers" "install-so-link"
 715                     make-flags))))))
 716     (home-page "https://sourceforge.net/projects/rhash/")
 717     (synopsis "Utility for computing hash sums")
 718     (description "RHash is a console utility for calculation and verification
 719 of magnet links and a wide range of hash sums like CRC32, MD4, MD5, SHA1,
 720 SHA256, SHA512, SHA3, AICH, ED2K, Tiger, DC++ TTH, BitTorrent BTIH, GOST R
 721 34.11-94, RIPEMD-160, HAS-160, EDON-R, Whirlpool and Snefru.")
 722     (license (license:non-copyleft "file://COPYING"))))
 723
 724 (define-public botan
 725   (package
 726     (name "botan")
 727     (version "2.7.0")
 728     (source (origin
 729               (method url-fetch)
 730               (uri (string-append "https://botan.randombit.net/releases/"
 731                                   "Botan-" version ".tgz"))
 732               (sha256
 733                (base32
 734                 "142aqabwc266jxn8wrp0f1ffrmcvdxwvyh8frb38hx9iaqazjbg4"))))
 735     (build-system gnu-build-system)
 736     (arguments
 737      '(#:phases
 738        (modify-phases %standard-phases
 739          (replace 'configure
 740            (lambda* (#:key inputs outputs #:allow-other-keys)
 741              (let* ((out (assoc-ref %outputs "out"))
 742                     (lib (string-append out "/lib")))
 743                (invoke "python" "./configure.py"
 744                        (string-append "--prefix=" out)
 745                        ;; Otherwise, the `botan` executable cannot find
 746                        ;; libbotan.
 747                        (string-append "--ldflags=-Wl,-rpath=" lib)
 748                        "--with-rst2man"
 749                        ;; Recommended by upstream
 750                        "--with-zlib" "--with-bzip2" "--with-sqlite3"))))
 751          (replace 'check
 752            (lambda _ (invoke "./botan-test"))))))
 753     (native-inputs
 754      `(("python" ,python-wrapper)
 755        ("python-docutils" ,python-docutils)))
 756     (inputs
 757      `(("sqlite" ,sqlite)
 758        ("bzip2" ,bzip2)
 759        ("zlib" ,zlib)))
 760     (synopsis "Cryptographic library in C++11")
 761     (description "Botan is a cryptography library, written in C++11, offering
 762 the tools necessary to implement a range of practical systems, such as TLS/DTLS,
 763 PKIX certificate handling, PKCS#11 and TPM hardware support, password hashing,
 764 and post-quantum crypto schemes.  In addition to the C++, botan has a C89 API
 765 specifically designed to be easy to call from other languages.  A Python binding
 766 using ctypes is included, and several other language bindings are available.")
 767     (home-page "https://botan.randombit.net")
 768     (license license:bsd-2)))
 769
 770 (define-public ccrypt
 771   (package
 772     (name "ccrypt")
 773     (version "1.11")
 774     (source (origin
 775               (method url-fetch)
 776               (uri (string-append "mirror://sourceforge/ccrypt/"
 777                                   version "/ccrypt-" version ".tar.gz"))
 778               (sha256
 779                (base32
 780                 "0kx4a5mhmp73ljknl2lcccmw9z3f5y8lqw0ghaymzvln1984g75i"))))
 781     (build-system gnu-build-system)
 782     (home-page "http://ccrypt.sourceforge.net")
 783     (synopsis "Command-line utility for encrypting and decrypting files and streams")
 784     (description "@command{ccrypt} is a utility for encrypting and decrypting
 785 files and streams.  It was designed as a replacement for the standard unix
 786 @command{crypt} utility, which is notorious for using a very weak encryption
 787 algorithm.  @command{ccrypt} is based on the Rijndael block cipher, a version of
 788 which is also used in the Advanced Encryption Standard (AES, see
 789 @url{http://www.nist.gov/aes}).  This cipher is believed to provide very strong
 790 security.")
 791     (license license:gpl2)))
 792
 793 (define-public asignify
 794   (let ((commit "f58e7977a599f040797975d649ed318e25cbd2d5")
 795         (revision "0"))
 796     (package
 797       (name "asignify")
 798       (version (git-version "1.1" revision commit))
 799       (source (origin
 800                 (method git-fetch)
 801                 (uri (git-reference
 802                        (url "https://github.com/vstakhov/asignify.git")
 803                        (commit commit)))
 804                 (file-name (git-file-name name version))
 805                 (sha256
 806                  (base32
 807                   "1zl68qq6js6fdahxzyhvhrpyrwlv8c2zhdplycnfxyr1ckkhq8dw"))))
 808       (build-system gnu-build-system)
 809       (arguments
 810        `(#:configure-flags
 811          (list "--enable-openssl"
 812                (string-append "--with-openssl="
 813                               (assoc-ref %build-inputs "openssl")))))
 814       (native-inputs
 815        `(("autoconf" ,autoconf)
 816          ("automake" ,automake)
 817          ("libtool" ,libtool)))
 818       (inputs
 819        `(("openssl" ,openssl)))
 820       (home-page "https://github.com/vstakhov/asignify")
 821       (synopsis "Cryptographic authentication and encryption tool and library")
 822       (description "Asignify offers public cryptographic signatures and
 823 encryption with a library or a command-line tool.  The tool is heavily inspired
 824 by signify as used in OpenBSD.  The main goal of this project is to define a
 825 high level API for signing files, validating signatures and encrypting using
 826 public-key cryptography.  Asignify is designed to be portable and self-contained
 827 with zero external dependencies.  Asignify can verify OpenBSD signatures, but it
 828 cannot sign messages in OpenBSD format yet.")
 829       (license license:bsd-2))))
 830
 831 (define-public enchive
 832   (package
 833     (name "enchive")
 834     (version "3.4")
 835     (source (origin
 836               (method url-fetch)
 837               (uri (string-append "https://github.com/skeeto/" name "/archive/"
 838                                   version ".tar.gz"))
 839               (sha256
 840                (base32
 841                 "17hrxpp4cpn10bk48sfvfjc8hghky34agsnypam1v9f36kbalqfk"))
 842               (file-name (string-append name "-" version ".tar.gz"))))
 843     (build-system gnu-build-system)
 844     (arguments
 845      '(#:tests? #f                      ; no check target         '
 846        #:make-flags (list "CC=gcc" "PREFIX=$(out)")
 847        #:phases (modify-phases %standard-phases
 848                   (delete 'configure)
 849                   (add-after 'install 'post-install
 850                     (lambda _
 851                       (let* ((out (assoc-ref %outputs "out"))
 852                              (lisp (string-append out "/share/emacs/site-lisp")))
 853                         (install-file "enchive-mode.el" lisp)
 854                         #t))))))
 855     (synopsis "Encrypted personal archives")
 856     (description
 857      "Enchive is a tool to encrypt files to yourself for long-term
 858 archival.  It's a focused, simple alternative to more complex solutions such as
 859 GnuPG or encrypted filesystems.  Enchive has no external dependencies and is
 860 trivial to build for local use.  Portability is emphasized over performance.")
 861     (home-page "https://github.com/skeeto/enchive")
 862     (license license:unlicense)))
 863
 864 (define-public libsecp256k1
 865   (let ((commit "e34ceb333b1c0e6f4115ecbb80c632ac1042fa49"))
 866     (package
 867       (name "libsecp256k1")
 868       (version (git-version "20181126" "1" commit))
 869       (source (origin
 870                 (method git-fetch)
 871                 (uri (git-reference
 872                       (url "https://github.com/bitcoin-core/secp256k1")
 873                       (commit commit)))
 874                 (sha256
 875                  (base32
 876                   "0as78s179hcr3ysk3fw98k5wzabgnwri7vkkc17wg31lyz6ids6c"))
 877                 (file-name (git-file-name name version))))
 878       (build-system gnu-build-system)
 879       (native-inputs
 880        `(("autoconf" ,autoconf)
 881          ("automake" ,automake)
 882          ("libtool" ,libtool)))
 883       ;; WARNING: This package might need additional configure flags to run properly.
 884       ;; See https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/libsecp256k1.
 885       (synopsis "C library for EC operations on curve secp256k1")
 886       (description
 887        "Optimized C library for EC operations on curve secp256k1.
 888
 889 This library is a work in progress and is being used to research best
 890 practices.  Use at your own risk.
 891
 892 Features:
 893
 894 @itemize
 895 @item secp256k1 ECDSA signing/verification and key generation.
 896 @item Adding/multiplying private/public keys.
 897 @item Serialization/parsing of private keys, public keys, signatures.
 898 @item Constant time, constant memory access signing and pubkey generation.
 899 @item Derandomized DSA (via RFC6979 or with a caller provided function.)
 900 @item Very efficient implementation.
 901 @end itemize\n")
 902       (home-page "https://github.com/bitcoin-core/secp256k1")
 903       (license license:unlicense))))
 904
 905 (define-public stoken
 906   (package
 907     (name "stoken")
 908     (version "0.92")
 909     (source (origin
 910               (method url-fetch)
 911               (uri (string-append "mirror://sourceforge/stoken/"
 912                                   "stoken-" version ".tar.gz"))
 913               (sha256
 914                (base32
 915                 "0npgr6y85gzwksy8jkwa4yzvqwjprwnplx3yiw3ayk4f0ldlhaxa"))))
 916     (build-system gnu-build-system)
 917     (native-inputs
 918      `(("pkg-config" ,pkg-config)))
 919     (inputs
 920      `(("nettle" ,nettle)
 921        ("libxml2" ,libxml2)))
 922     (home-page "http://stoken.sf.net")
 923     (synopsis "Software Token for cryptographic authentication")
 924     (description
 925      "@code{stoken} is a token code generator compatible with RSA SecurID
 926 128-bit (AES) tokens.  This package contains a standalone command-line program
 927 that allows for importing token seeds, generating token codes, and various
 928 utility/testing functions.")
 929     (license license:lgpl2.1+)))
 930
 931 (define-public hpenc
 932   (package
 933     (name "hpenc")
 934     (version "3.0")
 935     (source (origin
 936               (method git-fetch)
 937               (uri (git-reference
 938                      (url "https://github.com/vstakhov/hpenc")
 939                      (commit version)))
 940               (sha256
 941                (base32
 942                 "1fb5yi3d2k8kd4zm7liiqagpz610y168xrr1cvn7cbq314jm2my1"))))
 943     (build-system gnu-build-system)
 944     (arguments
 945      `(#:tests? #f ; No test suite
 946        #:make-flags
 947        (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 948              ;; Build the program and the docs.
 949              "SUBDIRS=src doc")
 950        #:phases
 951        (modify-phases %standard-phases
 952          (delete 'configure) ; No ./configure script
 953          (add-after 'unpack 'patch-path
 954            (lambda _
 955              (substitute* '("src/Makefile" "doc/Makefile")
 956                (("/usr/bin/install")
 957                 "install"))))
 958          (add-before 'install 'make-output-directories
 959            (lambda* (#:key outputs #:allow-other-keys)
 960              (let* ((out (assoc-ref outputs "out"))
 961                     (bin (string-append out "/bin"))
 962                     (man1 (string-append out "/share/man/man1")))
 963                (mkdir-p bin)
 964                (mkdir-p man1)
 965                #t))))))
 966     (inputs
 967      `(("libsodium" ,libsodium)
 968        ("openssl" ,openssl)))
 969     (synopsis "High-performance command-line tool for stream encryption")
 970     (description "Hpenc is a command-line tool for performing authenticated
 971 encryption (AES-GCM and ChaCha20-Poly1305) of streaming data.  It does not
 972 perform an asymmetric key exchange, instead requiring the user to distribute
 973 pre-shared keys out of band.  It is designed to handle large amounts of data
 974 quickly by using all your CPU cores and hardware acceleration.")
 975     (home-page "https://github.com/vstakhov/hpenc")
 976     (license license:bsd-3)))