gnu/packages/crypto.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2014 David Thompson <davet@gnu.org>
   3 ;;; Copyright © 2015, 2017 Ricardo Wurmus <rekado@elephly.net>
   4 ;;; Copyright © 2016, 2017 Leo Famulari <leo@famulari.name>
   5 ;;; Copyright © 2016 Lukas Gradl <lgradl@openmailbox>
   6 ;;; Copyright © 2016 Tobias Geerinckx-Rice <me@tobias.gr>
   7 ;;; Copyright © 2016, 2017 ng0 <ng0@infotropique.org>
   8 ;;; Copyright © 2016, 2017 Eric Bavier <bavier@member.fsf.org>
   9 ;;; Copyright © 2017 Pierre Langlois <pierre.langlois@gmx.com>
  10 ;;;
  11 ;;; This file is part of GNU Guix.
  12 ;;;
  13 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  14 ;;; under the terms of the GNU General Public License as published by
  15 ;;; the Free Software Foundation; either version 3 of the License, or (at
  16 ;;; your option) any later version.
  17 ;;;
  18 ;;; GNU Guix is distributed in the hope that it will be useful, but
  19 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  20 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21 ;;; GNU General Public License for more details.
  22 ;;;
  23 ;;; You should have received a copy of the GNU General Public License
  24 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  25
  26 (define-module (gnu packages crypto)
  27   #:use-module (gnu packages)
  28   #:use-module (gnu packages admin)
  29   #:use-module (gnu packages aidc)
  30   #:use-module (gnu packages attr)
  31   #:use-module (gnu packages autotools)
  32   #:use-module (gnu packages boost)
  33   #:use-module (gnu packages compression)
  34   #:use-module (gnu packages cryptsetup)
  35   #:use-module (gnu packages gettext)
  36   #:use-module (gnu packages gnupg)
  37   #:use-module (gnu packages image)
  38   #:use-module (gnu packages pkg-config)
  39   #:use-module (gnu packages libbsd)
  40   #:use-module (gnu packages libffi)
  41   #:use-module (gnu packages linux)
  42   #:use-module (gnu packages nettle)
  43   #:use-module (gnu packages password-utils)
  44   #:use-module (gnu packages perl)
  45   #:use-module (gnu packages python)
  46   #:use-module (gnu packages readline)
  47   #:use-module (gnu packages search)
  48   #:use-module (gnu packages serialization)
  49   #:use-module (gnu packages shells)
  50   #:use-module (gnu packages tcl)
  51   #:use-module (gnu packages tls)
  52   #:use-module (gnu packages xml)
  53   #:use-module ((guix licenses) #:prefix license:)
  54   #:use-module (guix packages)
  55   #:use-module (guix download)
  56   #:use-module (guix git-download)
  57   #:use-module (guix build-system cmake)
  58   #:use-module (guix build-system gnu)
  59   #:use-module (guix build-system perl)
  60   #:use-module (guix build-system python))
  61
  62 (define-public libsodium
  63   (package
  64     (name "libsodium")
  65     (version "1.0.15")
  66     (source (origin
  67             (method url-fetch)
  68             (uri (list (string-append
  69                         "https://download.libsodium.org/libsodium/"
  70                         "releases/libsodium-" version ".tar.gz")
  71                        (string-append
  72                         "https://download.libsodium.org/libsodium/"
  73                         "releases/old/libsodium-" version ".tar.gz")))
  74             (sha256
  75              (base32
  76               "1x3qw7lsz44vcxpcn1dvwig410phg6gmv31jwj94arrgka3rwspv"))))
  77     (build-system gnu-build-system)
  78     (synopsis "Portable NaCl-based crypto library")
  79     (description
  80      "Sodium is a new easy-to-use high-speed software library for network
  81 communication, encryption, decryption, signatures, etc.")
  82     (license license:isc)
  83     (home-page "https://libsodium.org")))
  84
  85 (define-public libmd
  86   (package
  87     (name "libmd")
  88     (version "0.0.0")
  89     (source (origin
  90             (method url-fetch)
  91             (uri (string-append
  92                   "https://archive.hadrons.org/software/libmd/libmd-"
  93                   version
  94                   ".tar.xz"))
  95             (sha256
  96              (base32
  97               "121s73pgbqsnmy6xblbrkj9y44c5zzzpf2hcmh6zvcvg4dk26gzx"))))
  98     (build-system gnu-build-system)
  99     (synopsis "Message Digest functions from BSD systems")
 100     (description
 101      "The currently provided message digest algorithms are:
 102 @itemize
 103 @item MD2
 104 @item MD4
 105 @item MD5
 106 @item RIPEMD-160
 107 @item SHA-1
 108 @item SHA-2 (SHA-256, SHA-384 and SHA-512)
 109 @end itemize")
 110     (license (list license:bsd-3
 111                    license:bsd-2
 112                    license:isc
 113                    license:public-domain))
 114     (home-page "https://www.hadrons.org/software/libmd/")))
 115
 116 (define-public signify
 117   (package
 118     (name "signify")
 119     (version "22")
 120     (source (origin
 121               (method url-fetch)
 122               (uri (string-append "https://github.com/aperezdc/signify/"
 123                                   "archive/v" version ".tar.gz"))
 124               (file-name (string-append name "-" version ".tar.gz"))
 125               (sha256
 126                (base32
 127                 "0iv5bjaas70ymqchxasapin4c32c41kqzkfhc3kcjzd7rxy78msy"))))
 128     (build-system gnu-build-system)
 129     ;; TODO Build with libwaive (described in README.md), to implement something
 130     ;; like OpenBSD's pledge().
 131     (arguments
 132      `(#:tests? #f ; no test suite
 133        #:make-flags
 134        (list "CC=gcc"
 135              (string-append "PREFIX=" (assoc-ref %outputs "out")))
 136        #:phases
 137        (modify-phases %standard-phases
 138          (delete 'configure))))
 139     (native-inputs
 140      `(("pkg-config" ,pkg-config)))
 141     (inputs
 142      `(("libbsd" ,libbsd)))
 143     (synopsis "Create and verify cryptographic signatures")
 144     (description "The signify utility creates and verifies cryptographic
 145 signatures using the elliptic curve Ed25519.  This is a Linux port of the
 146 OpenBSD tool of the same name.")
 147     (home-page "https://github.com/aperezdc/signify")
 148     ;; This package includes third-party code that was originally released under
 149     ;; various non-copyleft licenses. See the source files for clarification.
 150     (license (list license:bsd-3 license:bsd-4 license:expat license:isc
 151                    license:public-domain (license:non-copyleft
 152                                           "file://base64.c"
 153                                           "See base64.c in the distribution for
 154                                            the license from IBM.")))))
 155
 156
 157 (define-public opendht
 158   (package
 159     (name "opendht")
 160     (version "0.6.1")
 161     (source
 162      (origin
 163        (method url-fetch)
 164        (uri
 165         (string-append
 166          "https://github.com/savoirfairelinux/" name
 167          "/archive/" version ".tar.gz"))
 168        (file-name (string-append name "-" version ".tar.gz"))
 169        (modules '((guix build utils)))
 170        (snippet
 171         '(begin
 172            (delete-file-recursively "src/argon2")
 173            (substitute* "src/Makefile.am"
 174              (("./argon2/libargon2.la") "")
 175              (("SUBDIRS = argon2") ""))
 176            (substitute* "src/crypto.cpp"
 177              (("argon2/argon2.h") "argon2.h"))
 178            (substitute* "configure.ac"
 179              (("src/argon2/Makefile") ""))))
 180        (sha256
 181         (base32
 182          "09yvkmbqbym3b5md4n96qc1s9sf2n8ji404hagih45rmsj49599x"))))
 183     (build-system gnu-build-system)
 184     (inputs
 185      `(("gnutls" ,gnutls)
 186        ("nettle" ,nettle)
 187        ("readline" ,readline)
 188        ("argon2" ,argon2)))
 189     (propagated-inputs
 190      `(("msgpack" ,msgpack)))           ;included in several installed headers
 191     (native-inputs
 192      `(("autoconf" ,autoconf)
 193        ("pkg-config" ,pkg-config)
 194        ("automake" ,automake)
 195        ("libtool" ,libtool)))
 196     (arguments
 197      `(#:configure-flags '("--disable-tools" "--disable-python")
 198        #:phases (modify-phases %standard-phases
 199                   (add-after 'unpack 'autoconf
 200                     (lambda _
 201                       (zero? (system* "autoreconf" "-vfi")))))))
 202     (home-page "https://github.com/savoirfairelinux/opendht/")
 203     (synopsis "Distributed Hash Table (DHT) library")
 204     (description "OpenDHT is a Distributed Hash Table (DHT) library.  It may
 205 be used to manage peer-to-peer network connections as needed for real time
 206 communication.")
 207     (license license:gpl3)))
 208
 209 (define-public encfs
 210   (package
 211     (name "encfs")
 212     (version "1.9.1")
 213     (source
 214      (origin
 215        (method url-fetch)
 216        (uri
 217         (string-append "https://github.com/vgough/encfs/releases/download/v"
 218                        version "/encfs-" version ".tar.gz"))
 219        (sha256
 220         (base32
 221          "1906254dg5hwljh0h4gyrw09ms3b57dlhjfzhfzffv50yzpkl837"))
 222        (modules '((guix build utils)))
 223        ;; Remove bundled dependencies in favour of proper inputs.
 224        (snippet '(for-each delete-file-recursively
 225                            (find-files "internal" "^tinyxml2-[0-9]"
 226                                        #:directories? #t)))))
 227     (build-system cmake-build-system)
 228     (native-inputs
 229      `(("gettext" ,gettext-minimal)
 230
 231        ;; Test dependencies.
 232        ("expect" ,expect)
 233        ("perl" ,perl)))
 234     (inputs
 235      `(("attr" ,attr)
 236        ("fuse" ,fuse)
 237        ("openssl" ,openssl)
 238        ("tinyxml2" ,tinyxml2)))
 239     (arguments
 240      `(#:configure-flags (list "-DUSE_INTERNAL_TINYXML=OFF")))
 241     (home-page "https://vgough.github.io/encfs")
 242     (synopsis "Encrypted virtual file system")
 243     (description
 244      "EncFS creates a virtual encrypted file system in user-space.  Each file
 245 created under an EncFS mount point is stored as a separate encrypted file on
 246 the underlying file system.  Like most encrypted file systems, EncFS is meant
 247 to provide security against off-line attacks, such as a drive falling into
 248 the wrong hands.")
 249     (license (list license:expat                  ; internal/easylogging++.h
 250                    license:lgpl3+                 ; encfs library
 251                    license:gpl3+))))              ; command-line tools
 252
 253 (define-public keyutils
 254   (package
 255     (name "keyutils")
 256     (version "1.5.9")
 257     (source
 258      (origin
 259        (method url-fetch)
 260        (uri
 261         (string-append "https://people.redhat.com/dhowells/keyutils/keyutils-"
 262                        version ".tar.bz2"))
 263        (sha256
 264         (base32
 265          "1bl3w03ygxhc0hz69klfdlwqn33jvzxl1zfl2jmnb2v85iawb8jd"))
 266        (modules '((guix build utils)))
 267        ;; Create relative symbolic links instead of absolute ones to /lib/*
 268        (snippet '(substitute* "Makefile" (("\\$\\(LNS\\) \\$\\(LIBDIR\\)/")
 269                                           "$(LNS) ")))))
 270     (build-system gnu-build-system)
 271     (arguments
 272      `(#:phases (modify-phases %standard-phases
 273                   (delete 'configure))          ; no configure script
 274        #:make-flags (list "CC=gcc"
 275                           "RPATH=-Wl,-rpath,$(DESTDIR)$(LIBDIR)"
 276                           (string-append "DESTDIR="
 277                                          (assoc-ref %outputs "out"))
 278                           "INCLUDEDIR=/include"
 279                           "LIBDIR=/lib"
 280                           "MANDIR=/share/man"
 281                           "SHAREDIR=/share/keyutils")
 282        #:test-target "test"))
 283     (home-page "https://people.redhat.com/dhowells/keyutils/")
 284     (synopsis "Linux key management utilities")
 285     (description
 286      "Keyutils is a set of utilities for managing the key retention facility in
 287 the Linux kernel, which can be used by file systems, block devices, and more to
 288 gain and retain the authorization and encryption keys required to perform
 289 secure operations. ")
 290     (license (list license:lgpl2.1+             ; the files keyutils.*
 291                    license:gpl2+))))            ; the rest
 292
 293 ;; There is no release candidate but commits point out a version number,
 294 ;; furthermore no tarball exists.
 295 (define-public eschalot
 296   (let ((commit "0bf31d88a11898c19b1ed25ddd2aff7b35dbac44")
 297         (revision "1"))
 298     (package
 299       (name "eschalot")
 300       (version (string-append "1.2.0-" revision "." (string-take commit 7)))
 301       (source
 302        (origin
 303          (method git-fetch)
 304          (uri (git-reference
 305                (url "https://github.com/schnabear/eschalot")
 306                (commit commit)))
 307          (file-name (string-append name "-" version))
 308          (sha256
 309           (base32
 310            "0lj38ldh8vzi11wp4ghw4k0fkwp0s04zv8k8d473p1snmbh7mx98"))))
 311       (inputs
 312        `(("openssl" ,openssl))) ; It needs: openssl/{bn,pem,rsa,sha}.h
 313       (build-system gnu-build-system)
 314       (arguments
 315        `(#:make-flags (list "CC=gcc"
 316                             (string-append "PREFIX=" (assoc-ref %outputs "out"))
 317                             (string-append "INSTALL=" "install"))
 318          ;; XXX: make test would run a !VERY! long hashing of names with the use
 319          ;; of a wordlist, the amount of computing time this would waste on build
 320          ;; servers is in no relation to the size or importance of this small
 321          ;; application, therefore we run our own tests on eschalot and worgen.
 322          #:phases
 323          (modify-phases %standard-phases
 324            (delete 'configure)
 325            (replace 'check
 326              (lambda _
 327                (and
 328                  (zero? (system* "./worgen" "8-12" "top1000.txt" "3-10" "top400nouns.txt"
 329                                  "3-6" "top150adjectives.txt" "3-6"))
 330                  (zero? (system* "./eschalot" "-r" "^guix|^guixsd"))
 331                  (zero? (system* "./eschalot" "-r" "^gnu|^free"))
 332                  (zero? (system* "./eschalot" "-r" "^cyber|^hack"))
 333                  (zero? (system* "./eschalot" "-r" "^troll")))))
 334            ;; Make install can not create the bin dir, create it.
 335            (add-before 'install 'create-bin-dir
 336              (lambda* (#:key outputs #:allow-other-keys)
 337                (let* ((out (assoc-ref outputs "out"))
 338                       (bin (string-append out "/bin")))
 339                  (mkdir-p bin)
 340                  #t))))))
 341       (home-page "https://github.com/schnabear/eschalot")
 342       (synopsis "Tor hidden service name generator")
 343       (description
 344        "Eschalot is a tor hidden service name generator, it allows one to
 345 produce customized vanity .onion addresses using a brute-force method.  Searches
 346 for valid names can be run with regular expressions and wordlists.  For the
 347 generation of wordlists the included tool @code{worgen} can be used.  There is
 348 no man page, refer to the home page for usage details.")
 349       (license (list license:isc license:expat)))))
 350
 351 (define-public tomb
 352   (package
 353     (name "tomb")
 354     (version "2.4")
 355     (source (origin
 356               (method url-fetch)
 357               (uri (string-append "https://files.dyne.org/tomb/"
 358                                   "Tomb-" version ".tar.gz"))
 359               (sha256
 360                (base32
 361                 "1hv1w79as7swqj0n137vz8n8mwvcgwlvd91sdyssz41jarg7f1vr"))))
 362     (build-system gnu-build-system)
 363     (native-inputs `(("sudo" ,sudo)))   ;presence needed for 'check' phase
 364     (inputs
 365      `(("zsh" ,zsh)
 366        ("gnupg" ,gnupg)
 367        ("cryptsetup" ,cryptsetup)
 368        ("e2fsprogs" ,e2fsprogs)         ;for mkfs.ext4
 369        ("gettext" ,gettext-minimal)     ;used at runtime
 370        ("mlocate" ,mlocate)
 371        ("pinentry" ,pinentry)
 372        ("qrencode" ,qrencode)
 373        ("steghide" ,steghide)))
 374     (arguments
 375      `(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out")))
 376        ;; TODO: Build and install gtk and qt trays
 377        #:phases
 378        (modify-phases %standard-phases
 379          (delete 'configure)   ;no configuration to be done
 380          (add-after 'install 'i18n
 381            (lambda* (#:key make-flags #:allow-other-keys)
 382              (zero? (apply system*
 383                            "make" "-C" "extras/translations"
 384                            "install" make-flags))))
 385          (add-after 'install 'wrap
 386            (lambda* (#:key inputs outputs #:allow-other-keys)
 387              (let ((out (assoc-ref outputs "out")))
 388                (wrap-program (string-append out "/bin/tomb")
 389                  `("PATH" ":" prefix
 390                    (,(string-append (assoc-ref inputs "mlocate") "/bin")
 391                     ,@(map (lambda (program)
 392                              (or (and=> (which program) dirname)
 393                                  (error "program not found:" program)))
 394                            '("seq" "mkfs.ext4" "pinentry" "sudo"
 395                              "gpg" "cryptsetup" "gettext"
 396                              "qrencode" "steghide")))))
 397                #t)))
 398          (delete 'check)
 399          (add-after 'wrap 'check
 400            (lambda* (#:key outputs #:allow-other-keys)
 401              ;; Running the full tests requires sudo/root access for
 402              ;; cryptsetup, which is not available in the build environment.
 403              ;; But we can run `tomb dig` without root, so make sure that
 404              ;; works.  TODO: It Would Be Nice to check the expected "index",
 405              ;; "search", "bury", and "exhume" features are available by
 406              ;; querying `tomb -h`.
 407              (let ((tomb (string-append (assoc-ref outputs "out")
 408                                         "/bin/tomb")))
 409                (zero? (system* tomb "dig" "-s" "10" "secrets.tomb"))))))))
 410     (home-page "http://www.dyne.org/software/tomb")
 411     (synopsis "File encryption for secret data")
 412     (description
 413      "Tomb is an application to manage the creation and access of encrypted
 414 storage files: it can be operated from commandline and it can integrate with a
 415 user's graphical desktop.")
 416     (license license:gpl3+)))
 417
 418 (define-public scrypt
 419   (package
 420     (name "scrypt")
 421     (version "1.2.1")
 422     (source
 423       (origin
 424         (method url-fetch)
 425         (uri (string-append "https://www.tarsnap.com/scrypt/scrypt-"
 426                             version ".tgz"))
 427         (sha256
 428          (base32
 429           "0xy5yhrwwv13skv9im9vm76rybh9f29j2dh4hlh2x01gvbkza8a6"))))
 430     (build-system gnu-build-system)
 431     (arguments
 432      `(#:phases (modify-phases %standard-phases
 433         (add-after 'unpack 'patch-command-invocations
 434           (lambda _
 435             (substitute* "Makefile.in"
 436               (("command -p") ""))
 437             #t))
 438         (add-after 'install 'install-docs
 439           (lambda* (#:key outputs #:allow-other-keys)
 440             (let* ((out (assoc-ref %outputs "out"))
 441                    (misc (string-append out "/share/doc/scrypt")))
 442               (install-file "FORMAT" misc)
 443               #t))))))
 444     (inputs
 445      `(("openssl" ,openssl)))
 446     (home-page "https://www.tarsnap.com/scrypt.html")
 447     (synopsis "Memory-hard encryption tool based on scrypt")
 448     (description "This packages provides a simple password-based encryption
 449 utility as a demonstration of the @code{scrypt} key derivation function.
 450 @code{Scrypt} is designed to be far more resistant against hardware brute-force
 451 attacks than alternative functions such as @code{PBKDF2} or @code{bcrypt}.")
 452     (license license:bsd-2)))
 453
 454 (define-public python-asn1crypto
 455   (package
 456     (name "python-asn1crypto")
 457     (version "0.22.0")
 458     (source
 459       (origin
 460         (method url-fetch)
 461         (uri (string-append "https://github.com/wbond/asn1crypto/archive/"
 462                             version ".tar.gz"))
 463         (sha256
 464          (base32
 465           "1kn910896l3knmilla1c9ly20q181s43w1ah08lzkbm1h3j6pcz0"))))
 466     (build-system python-build-system)
 467     (home-page "https://github.com/wbond/asn1crypto")
 468     (synopsis "ASN.1 parser and serializer in Python")
 469     (description "asn1crypto is an ASN.1 parser and serializer with definitions
 470 for private keys, public keys, certificates, CRL, OCSP, CMS, PKCS#3, PKCS#7,
 471 PKCS#8, PKCS#12, PKCS#5, X.509 and TSP.")
 472     (license license:expat)))
 473
 474 (define-public python2-asn1crypto
 475   (package-with-python2 python-asn1crypto))
 476
 477 (define-public perl-math-random-isaac-xs
 478   (package
 479     (name "perl-math-random-isaac-xs")
 480     (version "1.004")
 481     (source
 482      (origin
 483        (method url-fetch)
 484        (uri (string-append "mirror://cpan/authors/id/J/JA/JAWNSY/"
 485                            "Math-Random-ISAAC-XS-" version ".tar.gz"))
 486        (sha256
 487         (base32
 488          "0yxqqcqvj51fn7b7j5xqhz65v74arzgainn66c6k7inijbmr1xws"))))
 489     (build-system perl-build-system)
 490     (native-inputs
 491      `(("perl-module-build" ,perl-module-build)
 492        ("perl-test-nowarnings" ,perl-test-nowarnings)))
 493     (home-page "http://search.cpan.org/dist/Math-Random-ISAAC-XS")
 494     (synopsis "C implementation of the ISAAC PRNG algorithm")
 495     (description "ISAAC (Indirection, Shift, Accumulate, Add, and Count) is a
 496 fast pseudo-random number generator.  It is suitable for applications where a
 497 significant amount of random data needs to be produced quickly, such as
 498 solving using the Monte Carlo method or for games.  The results are uniformly
 499 distributed, unbiased, and unpredictable unless you know the seed.
 500
 501 This package implements the same interface as @code{Math::Random::ISAAC}.")
 502     (license license:public-domain)))
 503
 504 (define-public perl-math-random-isaac
 505   (package
 506     (name "perl-math-random-isaac")
 507     (version "1.004")
 508     (source
 509      (origin
 510        (method url-fetch)
 511        (uri (string-append "mirror://cpan/authors/id/J/JA/JAWNSY/"
 512                            "Math-Random-ISAAC-" version ".tar.gz"))
 513        (sha256
 514         (base32
 515          "0z1b3xbb3xz71h25fg6jgsccra7migq7s0vawx2rfzi0pwpz0wr7"))))
 516     (build-system perl-build-system)
 517     (native-inputs
 518      `(("perl-test-nowarnings" ,perl-test-nowarnings)))
 519     (propagated-inputs
 520      `(("perl-math-random-isaac-xs" ,perl-math-random-isaac-xs)))
 521     (home-page "http://search.cpan.org/dist/Math-Random-ISAAC")
 522     (synopsis "Perl interface to the ISAAC PRNG algorithm")
 523     (description "ISAAC (Indirection, Shift, Accumulate, Add, and Count) is a
 524 fast pseudo-random number generator.  It is suitable for applications where a
 525 significant amount of random data needs to be produced quickly, such as
 526 solving using the Monte Carlo method or for games.  The results are uniformly
 527 distributed, unbiased, and unpredictable unless you know the seed.
 528
 529 This package provides a Perl interface to the ISAAC pseudo random number
 530 generator.")
 531     (license license:public-domain)))
 532
 533 (define-public perl-crypt-random-source
 534   (package
 535     (name "perl-crypt-random-source")
 536     (version "0.12")
 537     (source
 538      (origin
 539        (method url-fetch)
 540        (uri (string-append "mirror://cpan/authors/id/E/ET/ETHER/"
 541                            "Crypt-Random-Source-" version ".tar.gz"))
 542        (sha256
 543         (base32
 544          "00mw5m52sbz9nqp3f6axyrgcrihqxn7k8gv0vi1kvm1j1nc9g29h"))))
 545     (build-system perl-build-system)
 546     (native-inputs
 547      `(("perl-module-build-tiny" ,perl-module-build-tiny)
 548        ("perl-test-exception" ,perl-test-exception)))
 549     (propagated-inputs
 550      `(("perl-capture-tiny" ,perl-capture-tiny)
 551        ("perl-module-find" ,perl-module-find)
 552        ("perl-module-runtime" ,perl-module-runtime)
 553        ("perl-moo" ,perl-moo)
 554        ("perl-namespace-clean" ,perl-namespace-clean)
 555        ("perl-sub-exporter" ,perl-sub-exporter)
 556        ("perl-type-tiny" ,perl-type-tiny)))
 557     (home-page "http://search.cpan.org/dist/Crypt-Random-Source")
 558     (synopsis "Get weak or strong random data from pluggable sources")
 559     (description "This module provides implementations for a number of
 560 byte-oriented sources of random data.")
 561     (license license:perl-license)))
 562
 563 (define-public perl-math-random-secure
 564   (package
 565     (name "perl-math-random-secure")
 566     (version "0.080001")
 567     (source
 568      (origin
 569        (method url-fetch)
 570        (uri (string-append "mirror://cpan/authors/id/F/FR/FREW/"
 571                            "Math-Random-Secure-" version ".tar.gz"))
 572        (sha256
 573         (base32
 574          "0dgbf4ncll4kmgkyb9fsaxn0vf2smc9dmwqzgh3259zc2zla995z"))))
 575     (build-system perl-build-system)
 576     (native-inputs
 577      `(("perl-list-moreutils" ,perl-list-moreutils)
 578        ("perl-test-leaktrace" ,perl-test-leaktrace)
 579        ("perl-test-sharedfork" ,perl-test-sharedfork)
 580        ("perl-test-warn" ,perl-test-warn)))
 581     (inputs
 582      `(("perl-crypt-random-source" ,perl-crypt-random-source)
 583        ("perl-math-random-isaac" ,perl-math-random-isaac)
 584        ("perl-math-random-isaac-xs" ,perl-math-random-isaac-xs)
 585        ("perl-moo" ,perl-moo)))
 586     (home-page "http://search.cpan.org/dist/Math-Random-Secure")
 587     (synopsis "Cryptographically secure replacement for rand()")
 588     (description "This module is intended to provide a
 589 cryptographically-secure replacement for Perl's built-in @code{rand} function.
 590 \"Crytographically secure\", in this case, means:
 591
 592 @enumerate
 593 @item No matter how many numbers you see generated by the random number
 594 generator, you cannot guess the future numbers, and you cannot guess the seed.
 595 @item There are so many possible seeds that it would take decades, centuries,
 596 or millenia for an attacker to try them all.
 597 @item The seed comes from a source that generates relatively strong random
 598 data on your platform, so the seed itself will be as random as possible.
 599 @end enumerate\n")
 600     (license license:artistic2.0)))
 601
 602 (define-public python-pynacl
 603   (package
 604     (name "python-pynacl")
 605     (version "1.1.2")
 606     (source
 607      (origin
 608        (method url-fetch)
 609        (uri (pypi-uri "PyNaCl" version))
 610        (modules '((guix build utils)))
 611        ;; Remove bundled libsodium
 612        (snippet '(delete-file-recursively "src/libsodium"))
 613        (sha256
 614         (base32
 615          "135gz0020fqx8fbr9izpwyq49aww202nkqacq0cw61xz99sjpx9j"))))
 616     (build-system python-build-system)
 617     (arguments
 618      `(#:phases
 619        (modify-phases %standard-phases
 620          (add-before 'build 'use-system-sodium
 621            (lambda _
 622              (setenv "SODIUM_INSTALL" "system")
 623              #t)))))
 624     (native-inputs
 625      `(("python-pytest" ,python-pytest)))
 626     (propagated-inputs
 627      `(("python-cffi" ,python-cffi)
 628        ("python-six" ,python-six)
 629        ("libsodium" ,libsodium)))
 630     (home-page "https://github.com/pyca/pynacl/")
 631     (synopsis "Python bindings to libsodium")
 632     (description
 633      "PyNaCl is a Python binding to libsodium, which is a fork of the
 634 Networking and Cryptography library.  These libraries have a stated goal
 635 of improving usability, security and speed.")
 636     (license license:asl2.0)))
 637
 638 (define-public crypto++
 639   (package
 640     (name "crypto++")
 641     (version "5.6.5")
 642     (source (origin
 643               (method url-fetch/zipbomb)
 644               (uri (string-append "https://cryptopp.com/cryptopp"
 645                                   (string-join (string-split version #\.) "")
 646                                   ".zip"))
 647               (sha256
 648                (base32
 649                 "0d1cqdz369ivi082k59025wvxzywvkizw7i0pf5h0a1izs3g8pm7"))
 650               (patches
 651                (search-patches "crypto++-fix-dos-in-asn.1-decoders.patch"))))
 652     (build-system gnu-build-system)
 653     (arguments
 654      `(#:make-flags
 655        (list (string-append "PREFIX=" (assoc-ref %outputs "out")))
 656        #:phases
 657        (modify-phases %standard-phases
 658          (delete 'configure))))
 659     (native-inputs
 660      `(("unzip" ,unzip)))
 661     (home-page "https://cryptopp.com/")
 662     (synopsis "C++ class library of cryptographic schemes")
 663     (description "Crypto++ is a C++ class library of cryptographic schemes.")
 664     ;; The compilation is distributed under the Boost license; the individual
 665     ;; files in the compilation are in the public domain.
 666     (license (list license:boost1.0 license:public-domain))))