gnu/packages/crypto.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2014 David Thompson <davet@gnu.org>
   3 ;;; Copyright © 2015, 2017, 2018, 2019 Ricardo Wurmus <rekado@elephly.net>
   4 ;;; Copyright © 2016, 2017, 2018, 2019 Leo Famulari <leo@famulari.name>
   5 ;;; Copyright © 2016 Lukas Gradl <lgradl@openmailbox>
   6 ;;; Copyright © 2016, 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
   7 ;;; Copyright © 2016, 2017 ng0 <ng0@n0.is>
   8 ;;; Copyright © 2016, 2017, 2019 Eric Bavier <bavier@member.fsf.org>
   9 ;;; Copyright © 2017 Pierre Langlois <pierre.langlois@gmx.com>
  10 ;;; Copyright © 2018 Efraim Flashner <efraim@flashner.co.il>
  11 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
  12 ;;; Copyright © 2018 Nicolas Goaziou <mail@nicolasgoaziou.fr>
  13 ;;; Copyright © 2018 Nicolò Balzarotti <nicolo@nixo.xyz>
  14 ;;; Copyright © 2018 Tim Gesthuizen <tim.gesthuizen@yahoo.de>
  15 ;;; Copyright © 2019 Pierre Neidhardt <mail@ambrevar.xyz>
  16 ;;;
  17 ;;; This file is part of GNU Guix.
  18 ;;;
  19 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  20 ;;; under the terms of the GNU General Public License as published by
  21 ;;; the Free Software Foundation; either version 3 of the License, or (at
  22 ;;; your option) any later version.
  23 ;;;
  24 ;;; GNU Guix is distributed in the hope that it will be useful, but
  25 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  26 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  27 ;;; GNU General Public License for more details.
  28 ;;;
  29 ;;; You should have received a copy of the GNU General Public License
  30 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  31
  32 (define-module (gnu packages crypto)
  33   #:use-module (gnu packages)
  34   #:use-module (gnu packages admin)
  35   #:use-module (gnu packages aidc)
  36   #:use-module (gnu packages attr)
  37   #:use-module (gnu packages autotools)
  38   #:use-module (gnu packages boost)
  39   #:use-module (gnu packages check)
  40   #:use-module (gnu packages compression)
  41   #:use-module (gnu packages cryptsetup)
  42   #:use-module (gnu packages gettext)
  43   #:use-module (gnu packages gnupg)
  44   #:use-module (gnu packages image)
  45   #:use-module (gnu packages kerberos)
  46   #:use-module (gnu packages libbsd)
  47   #:use-module (gnu packages libffi)
  48   #:use-module (gnu packages linux)
  49   #:use-module (gnu packages nettle)
  50   #:use-module (gnu packages password-utils)
  51   #:use-module (gnu packages perl)
  52   #:use-module (gnu packages perl-check)
  53   #:use-module (gnu packages pkg-config)
  54   #:use-module (gnu packages python)
  55   #:use-module (gnu packages python-xyz)
  56   #:use-module (gnu packages readline)
  57   #:use-module (gnu packages search)
  58   #:use-module (gnu packages serialization)
  59   #:use-module (gnu packages shells)
  60   #:use-module (gnu packages sqlite)
  61   #:use-module (gnu packages tcl)
  62   #:use-module (gnu packages tls)
  63   #:use-module (gnu packages xml)
  64   #:use-module ((guix licenses) #:prefix license:)
  65   #:use-module (guix packages)
  66   #:use-module (guix download)
  67   #:use-module (guix git-download)
  68   #:use-module (guix build-system cmake)
  69   #:use-module (guix build-system gnu)
  70   #:use-module (guix build-system perl)
  71   #:use-module (guix build utils)
  72   #:use-module (srfi srfi-1)
  73   #:use-module (srfi srfi-26))
  74
  75 (define-public libsodium
  76   (package
  77     (name "libsodium")
  78     (version "1.0.17")
  79     (source (origin
  80             (method url-fetch)
  81             (uri (list (string-append
  82                         "https://download.libsodium.org/libsodium/"
  83                         "releases/libsodium-" version ".tar.gz")
  84                        (string-append
  85                         "https://download.libsodium.org/libsodium/"
  86                         "releases/old/libsodium-" version ".tar.gz")))
  87             (sha256
  88              (base32
  89               "1cf2d9v1gylz1qcy2zappbf526qfmph6gd6fnn3w2b347vixmhqc"))))
  90     (build-system gnu-build-system)
  91     (synopsis "Portable NaCl-based crypto library")
  92     (description
  93      "Sodium is a new easy-to-use high-speed software library for network
  94 communication, encryption, decryption, signatures, etc.")
  95     (license license:isc)
  96     (home-page "https://libsodium.org")))
  97
  98 (define-public libmd
  99   (package
 100     (name "libmd")
 101     (version "1.0.1")
 102     (source (origin
 103             (method url-fetch)
 104             (uri
 105              (list
 106               (string-append "https://archive.hadrons.org/software/libmd/libmd-"
 107                              version ".tar.xz")
 108               (string-append "https://libbsd.freedesktop.org/releases/libmd-"
 109                              version ".tar.xz")))
 110             (sha256
 111              (base32
 112               "0waclg2d5qin3r26gy5jvy4584ik60njc8pqbzwk0lzq3j9ynkp1"))))
 113     (build-system gnu-build-system)
 114     (synopsis "Message Digest functions from BSD systems")
 115     (description
 116      "The currently provided message digest algorithms are:
 117 @itemize
 118 @item MD2
 119 @item MD4
 120 @item MD5
 121 @item RIPEMD-160
 122 @item SHA-1
 123 @item SHA-2 (SHA-256, SHA-384 and SHA-512)
 124 @end itemize")
 125     (license (list license:bsd-3
 126                    license:bsd-2
 127                    license:isc
 128                    license:public-domain))
 129     (home-page "https://www.hadrons.org/software/libmd/")))
 130
 131 (define-public signify
 132   (package
 133     (name "signify")
 134     (version "25")
 135     (home-page "https://github.com/aperezdc/signify")
 136     (source (origin
 137               (method git-fetch)
 138               (uri (git-reference (url home-page)
 139                                   (commit (string-append "v" version))))
 140               (file-name (git-file-name name version))
 141               (sha256
 142                (base32
 143                 "0zg0rffxwj2a71s1bllhrn491xsmirg9sshpq8f3vl25lv4c2cnq"))))
 144     (build-system gnu-build-system)
 145     ;; TODO Build with libwaive (described in README.md), to implement something
 146     ;; like OpenBSD's pledge().
 147     (arguments
 148      `(#:tests? #f ; no test suite
 149        #:make-flags
 150        (list "CC=gcc"
 151              (string-append "PREFIX=" (assoc-ref %outputs "out")))
 152        #:phases
 153        (modify-phases %standard-phases
 154          (delete 'configure))))
 155     (native-inputs
 156      `(("pkg-config" ,pkg-config)))
 157     (inputs
 158      `(("libbsd" ,libbsd)))
 159     (synopsis "Create and verify cryptographic signatures")
 160     (description "The signify utility creates and verifies cryptographic
 161 signatures using the elliptic curve Ed25519.  This is a Linux port of the
 162 OpenBSD tool of the same name.")
 163     ;; This package includes third-party code that was originally released under
 164     ;; various non-copyleft licenses. See the source files for clarification.
 165     (license (list license:bsd-3 license:bsd-4 license:expat license:isc
 166                    license:public-domain (license:non-copyleft
 167                                           "file://base64.c"
 168                                           "See base64.c in the distribution for
 169                                            the license from IBM.")))))
 170
 171 (define-public encfs
 172   (package
 173     (name "encfs")
 174     (version "1.9.5")
 175     (source
 176      (origin
 177        (method url-fetch)
 178        (uri
 179         (string-append "https://github.com/vgough/encfs/releases/download/v"
 180                        version "/encfs-" version ".tar.gz"))
 181        (sha256
 182         (base32
 183          "0qzxavvv20577bxvly8s7d3y7bqasqclc2mllp0ddfncjm9z02a7"))
 184        (modules '((guix build utils)))
 185        ;; Remove bundled dependencies in favour of proper inputs.
 186        (snippet '(begin
 187                    (for-each delete-file-recursively
 188                              '("vendor/github.com/leethomason/tinyxml2"
 189                                "vendor/github.com/google/googletest"))
 190                    #t))))
 191     (build-system cmake-build-system)
 192     (native-inputs
 193      `(("gettext" ,gettext-minimal)
 194
 195        ;; Test dependencies.
 196        ("expect" ,expect)
 197        ("googletest-source" ,(package-source googletest))
 198        ("perl" ,perl)))
 199     (inputs
 200      `(("attr" ,attr)
 201        ("fuse" ,fuse)
 202        ("openssl" ,openssl)
 203        ("tinyxml2" ,tinyxml2)))
 204     (arguments
 205      `(#:configure-flags (list "-DUSE_INTERNAL_TINYXML=OFF")
 206        #:phases
 207        (modify-phases %standard-phases
 208          (add-after 'unpack 'unpack-googletest
 209            (lambda* (#:key inputs #:allow-other-keys)
 210              (mkdir-p "vendor/github.com/google/googletest")
 211              (copy-recursively (assoc-ref inputs "googletest-source")
 212                                "vendor/github.com/google/googletest")
 213              #t))
 214          (add-before 'check 'make-unittests
 215            (lambda _
 216              (invoke "make" "unittests"))))))
 217     (home-page "https://vgough.github.io/encfs")
 218     (synopsis "Encrypted virtual file system")
 219     (description
 220      "EncFS creates a virtual encrypted file system in user-space.  Each file
 221 created under an EncFS mount point is stored as a separate encrypted file on
 222 the underlying file system.  Like most encrypted file systems, EncFS is meant
 223 to provide security against off-line attacks, such as a drive falling into
 224 the wrong hands.")
 225     (license (list license:expat                  ; internal/easylogging++.h
 226                    license:lgpl3+                 ; encfs library
 227                    license:gpl3+))))              ; command-line tools
 228
 229 (define-public keyutils
 230   (package
 231     (name "keyutils")
 232     (version "1.6")
 233     (source
 234      (origin
 235        (method url-fetch)
 236        (uri
 237         (string-append "https://people.redhat.com/dhowells/keyutils/keyutils-"
 238                        version ".tar.bz2"))
 239        (sha256
 240         (base32
 241          "05bi5ja6f3h3kdi7p9dihlqlfrsmi1wh1r2bdgxc0180xh6g5bnk"))
 242        (modules '((guix build utils)))
 243        ;; Create relative symbolic links instead of absolute ones to /lib/*.
 244        (snippet '(begin
 245                    (substitute* "Makefile" (("\\$\\(LNS\\) \\$\\(LIBDIR\\)/")
 246                                             "$(LNS) "))
 247                    #t))))
 248     (build-system gnu-build-system)
 249     (arguments
 250      `(#:phases (modify-phases %standard-phases
 251                   (delete 'configure))          ; no configure script
 252        #:make-flags (list "CC=gcc"
 253                           "RPATH=-Wl,-rpath,$(DESTDIR)$(LIBDIR)"
 254                           (string-append "DESTDIR="
 255                                          (assoc-ref %outputs "out"))
 256                           "INCLUDEDIR=/include"
 257                           "LIBDIR=/lib"
 258                           "MANDIR=/share/man"
 259                           "SHAREDIR=/share/keyutils")
 260        #:test-target "test"))
 261     (inputs
 262      `(("mit-krb5" ,mit-krb5)))
 263     (home-page "https://people.redhat.com/dhowells/keyutils/")
 264     (synopsis "Linux key management utilities")
 265     (description
 266      "Keyutils is a set of utilities for managing the key retention facility in
 267 the Linux kernel, which can be used by file systems, block devices, and more to
 268 gain and retain the authorization and encryption keys required to perform
 269 secure operations. ")
 270     (license (list license:lgpl2.1+             ; the files keyutils.*
 271                    license:gpl2+))))            ; the rest
 272
 273 ;; There is no release candidate but commits point out a version number,
 274 ;; furthermore no tarball exists.
 275 (define-public eschalot
 276   (let ((commit "0bf31d88a11898c19b1ed25ddd2aff7b35dbac44")
 277         (revision "1"))
 278     (package
 279       (name "eschalot")
 280       (version (string-append "1.2.0-" revision "." (string-take commit 7)))
 281       (source
 282        (origin
 283          (method git-fetch)
 284          (uri (git-reference
 285                (url "https://github.com/schnabear/eschalot")
 286                (commit commit)))
 287          (file-name (string-append name "-" version))
 288          (sha256
 289           (base32
 290            "0lj38ldh8vzi11wp4ghw4k0fkwp0s04zv8k8d473p1snmbh7mx98"))))
 291       (inputs
 292        `(("openssl" ,openssl))) ; It needs: openssl/{bn,pem,rsa,sha}.h
 293       (build-system gnu-build-system)
 294       (arguments
 295        `(#:make-flags (list "CC=gcc"
 296                             (string-append "PREFIX=" (assoc-ref %outputs "out"))
 297                             (string-append "INSTALL=" "install"))
 298          ;; XXX: make test would run a !VERY! long hashing of names with the use
 299          ;; of a wordlist, the amount of computing time this would waste on build
 300          ;; servers is in no relation to the size or importance of this small
 301          ;; application, therefore we run our own tests on eschalot and worgen.
 302          #:phases
 303          (modify-phases %standard-phases
 304            (delete 'configure)
 305            (replace 'check
 306              (lambda _
 307                (invoke "./worgen" "8-12" "top1000.txt" "3-10" "top400nouns.txt"
 308                        "3-6" "top150adjectives.txt" "3-6")
 309                (invoke "./eschalot" "-r" "^guix|^guixsd")
 310                (invoke "./eschalot" "-r" "^gnu|^free")
 311                (invoke "./eschalot" "-r" "^cyber|^hack")
 312                (invoke "./eschalot" "-r" "^troll")))
 313            ;; Make install can not create the bin dir, create it.
 314            (add-before 'install 'create-bin-dir
 315              (lambda* (#:key outputs #:allow-other-keys)
 316                (let* ((out (assoc-ref outputs "out"))
 317                       (bin (string-append out "/bin")))
 318                  (mkdir-p bin)
 319                  #t))))))
 320       (home-page "https://github.com/schnabear/eschalot")
 321       (synopsis "Tor hidden service name generator")
 322       (description
 323        "Eschalot is a tor hidden service name generator, it allows one to
 324 produce customized vanity .onion addresses using a brute-force method.  Searches
 325 for valid names can be run with regular expressions and wordlists.  For the
 326 generation of wordlists the included tool @code{worgen} can be used.  There is
 327 no man page, refer to the home page for usage details.")
 328       (license (list license:isc license:expat)))))
 329
 330 (define-public tomb
 331   (package
 332     (name "tomb")
 333     (version "2.5")
 334     (source (origin
 335               (method url-fetch)
 336               (uri (string-append "https://files.dyne.org/tomb/"
 337                                   "Tomb-" version ".tar.gz"))
 338               (sha256
 339                (base32
 340                 "12c6qldngaw520gvb02inzkhnxbl4k0dwmddrgnaf7xashy6j0wc"))))
 341     (build-system gnu-build-system)
 342     (native-inputs `(("sudo" ,sudo)))   ;presence needed for 'check' phase
 343     (inputs
 344      `(("zsh" ,zsh)
 345        ("gnupg" ,gnupg)
 346        ("cryptsetup" ,cryptsetup)
 347        ("e2fsprogs" ,e2fsprogs)         ;for mkfs.ext4
 348        ("gettext" ,gettext-minimal)     ;used at runtime
 349        ("mlocate" ,mlocate)
 350        ("pinentry" ,pinentry)
 351        ("qrencode" ,qrencode)
 352        ("steghide" ,steghide)
 353        ("util-linux" ,util-linux)))
 354     (arguments
 355      `(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out")))
 356        ;; TODO: Build and install gtk and qt trays
 357        #:phases
 358        (modify-phases %standard-phases
 359          (delete 'configure)   ;no configuration to be done
 360          (add-after 'install 'i18n
 361            (lambda* (#:key make-flags #:allow-other-keys)
 362              (apply invoke "make" "-C" "extras/translations"
 363                     "install" make-flags)
 364              #t))
 365          (add-after 'install 'wrap
 366            (lambda* (#:key inputs outputs #:allow-other-keys)
 367              (let ((out (assoc-ref outputs "out")))
 368                (wrap-program (string-append out "/bin/tomb")
 369                  `("PATH" ":" prefix
 370                    (,(string-append (assoc-ref inputs "mlocate") "/bin")
 371                     ,@(map (lambda (program)
 372                              (or (and=> (which program) dirname)
 373                                  (error "program not found:" program)))
 374                            '("seq" "mkfs.ext4" "pinentry" "sudo"
 375                              "gpg" "cryptsetup" "gettext"
 376                              "qrencode" "steghide" "findmnt")))))
 377                #t)))
 378          (delete 'check)
 379          (add-after 'wrap 'check
 380            (lambda* (#:key outputs #:allow-other-keys)
 381              ;; Running the full tests requires sudo/root access for
 382              ;; cryptsetup, which is not available in the build environment.
 383              ;; But we can run `tomb dig` without root, so make sure that
 384              ;; works.  TODO: It Would Be Nice to check the expected "index",
 385              ;; "search", "bury", and "exhume" features are available by
 386              ;; querying `tomb -h`.
 387              (let ((tomb (string-append (assoc-ref outputs "out")
 388                                         "/bin/tomb")))
 389                (invoke tomb "dig" "-s" "10" "secrets.tomb")
 390                #t))))))
 391     (home-page "https://www.dyne.org/software/tomb")
 392     (synopsis "File encryption for secret data")
 393     (description
 394      "Tomb is an application to manage the creation and access of encrypted
 395 storage files: it can be operated from commandline and it can integrate with a
 396 user's graphical desktop.")
 397     (license license:gpl3+)))
 398
 399 (define-public scrypt
 400   (package
 401     (name "scrypt")
 402     (version "1.2.1")
 403     (source
 404       (origin
 405         (method url-fetch)
 406         (uri (string-append "https://www.tarsnap.com/scrypt/scrypt-"
 407                             version ".tgz"))
 408         (sha256
 409          (base32
 410           "0xy5yhrwwv13skv9im9vm76rybh9f29j2dh4hlh2x01gvbkza8a6"))))
 411     (build-system gnu-build-system)
 412     (arguments
 413      `(#:phases (modify-phases %standard-phases
 414         (add-after 'unpack 'patch-command-invocations
 415           (lambda _
 416             (substitute* "Makefile.in"
 417               (("command -p") ""))
 418             #t))
 419         (add-after 'install 'install-docs
 420           (lambda* (#:key outputs #:allow-other-keys)
 421             (let* ((out (assoc-ref %outputs "out"))
 422                    (misc (string-append out "/share/doc/scrypt")))
 423               (install-file "FORMAT" misc)
 424               #t))))))
 425     (inputs
 426      `(("openssl" ,openssl)))
 427     (home-page "https://www.tarsnap.com/scrypt.html")
 428     (synopsis "Memory-hard encryption tool based on scrypt")
 429     (description "This package provides a simple password-based encryption
 430 utility as a demonstration of the @code{scrypt} key derivation function.
 431 @code{Scrypt} is designed to be far more resistant against hardware brute-force
 432 attacks than alternative functions such as @code{PBKDF2} or @code{bcrypt}.")
 433     (license license:bsd-2)))
 434
 435 (define-public libscrypt
 436   (package
 437     (name "libscrypt")
 438     (version "1.21")
 439     (source
 440      (origin
 441        (method git-fetch)
 442        (uri (git-reference
 443              (url "https://github.com/technion/libscrypt.git")
 444              (commit (string-append "v" version))))
 445        (file-name (git-file-name name version))
 446        (sha256
 447         (base32
 448          "1d76ys6cp7fi4ng1w3mz2l0p9dbr7ljbk33dcywyimzjz8bahdng"))))
 449     (build-system gnu-build-system)
 450     (arguments
 451      `(#:make-flags (list (string-append "PREFIX=" %output)
 452                           "CC=gcc")
 453        #:phases
 454        (modify-phases %standard-phases
 455          (delete 'configure))))
 456     (home-page "https://lolware.net/libscrypt.html")
 457     (synopsis "Password hashing library")
 458     (description "@code{libscrypt} implements @code{scrypt} key derivation
 459 function.  It is designed to be far more secure against hardware brute-force
 460 attacks than alternative functions such as @code{PBKDF2} or @code{bcrypt}.")
 461     (license license:bsd-3)))
 462
 463 (define-public perl-math-random-isaac-xs
 464   (package
 465     (name "perl-math-random-isaac-xs")
 466     (version "1.004")
 467     (source
 468      (origin
 469        (method url-fetch)
 470        (uri (string-append "mirror://cpan/authors/id/J/JA/JAWNSY/"
 471                            "Math-Random-ISAAC-XS-" version ".tar.gz"))
 472        (sha256
 473         (base32
 474          "0yxqqcqvj51fn7b7j5xqhz65v74arzgainn66c6k7inijbmr1xws"))))
 475     (build-system perl-build-system)
 476     (native-inputs
 477      `(("perl-module-build" ,perl-module-build)
 478        ("perl-test-nowarnings" ,perl-test-nowarnings)))
 479     (home-page "https://metacpan.org/release/Math-Random-ISAAC-XS")
 480     (synopsis "C implementation of the ISAAC PRNG algorithm")
 481     (description "ISAAC (Indirection, Shift, Accumulate, Add, and Count) is a
 482 fast pseudo-random number generator.  It is suitable for applications where a
 483 significant amount of random data needs to be produced quickly, such as
 484 solving using the Monte Carlo method or for games.  The results are uniformly
 485 distributed, unbiased, and unpredictable unless you know the seed.
 486
 487 This package implements the same interface as @code{Math::Random::ISAAC}.")
 488     (license license:public-domain)))
 489
 490 (define-public perl-math-random-isaac
 491   (package
 492     (name "perl-math-random-isaac")
 493     (version "1.004")
 494     (source
 495      (origin
 496        (method url-fetch)
 497        (uri (string-append "mirror://cpan/authors/id/J/JA/JAWNSY/"
 498                            "Math-Random-ISAAC-" version ".tar.gz"))
 499        (sha256
 500         (base32
 501          "0z1b3xbb3xz71h25fg6jgsccra7migq7s0vawx2rfzi0pwpz0wr7"))))
 502     (build-system perl-build-system)
 503     (native-inputs
 504      `(("perl-test-nowarnings" ,perl-test-nowarnings)))
 505     (propagated-inputs
 506      `(("perl-math-random-isaac-xs" ,perl-math-random-isaac-xs)))
 507     (home-page "https://metacpan.org/release/Math-Random-ISAAC")
 508     (synopsis "Perl interface to the ISAAC PRNG algorithm")
 509     (description "ISAAC (Indirection, Shift, Accumulate, Add, and Count) is a
 510 fast pseudo-random number generator.  It is suitable for applications where a
 511 significant amount of random data needs to be produced quickly, such as
 512 solving using the Monte Carlo method or for games.  The results are uniformly
 513 distributed, unbiased, and unpredictable unless you know the seed.
 514
 515 This package provides a Perl interface to the ISAAC pseudo random number
 516 generator.")
 517     (license license:public-domain)))
 518
 519 (define-public perl-crypt-random-source
 520   (package
 521     (name "perl-crypt-random-source")
 522     (version "0.12")
 523     (source
 524      (origin
 525        (method url-fetch)
 526        (uri (string-append "mirror://cpan/authors/id/E/ET/ETHER/"
 527                            "Crypt-Random-Source-" version ".tar.gz"))
 528        (sha256
 529         (base32
 530          "00mw5m52sbz9nqp3f6axyrgcrihqxn7k8gv0vi1kvm1j1nc9g29h"))))
 531     (build-system perl-build-system)
 532     (native-inputs
 533      `(("perl-module-build-tiny" ,perl-module-build-tiny)
 534        ("perl-test-exception" ,perl-test-exception)))
 535     (propagated-inputs
 536      `(("perl-capture-tiny" ,perl-capture-tiny)
 537        ("perl-module-find" ,perl-module-find)
 538        ("perl-module-runtime" ,perl-module-runtime)
 539        ("perl-moo" ,perl-moo)
 540        ("perl-namespace-clean" ,perl-namespace-clean)
 541        ("perl-sub-exporter" ,perl-sub-exporter)
 542        ("perl-type-tiny" ,perl-type-tiny)))
 543     (home-page "https://metacpan.org/release/Crypt-Random-Source")
 544     (synopsis "Get weak or strong random data from pluggable sources")
 545     (description "This module provides implementations for a number of
 546 byte-oriented sources of random data.")
 547     (license license:perl-license)))
 548
 549 (define-public perl-math-random-secure
 550   (package
 551     (name "perl-math-random-secure")
 552     (version "0.080001")
 553     (source
 554      (origin
 555        (method url-fetch)
 556        (uri (string-append "mirror://cpan/authors/id/F/FR/FREW/"
 557                            "Math-Random-Secure-" version ".tar.gz"))
 558        (sha256
 559         (base32
 560          "0dgbf4ncll4kmgkyb9fsaxn0vf2smc9dmwqzgh3259zc2zla995z"))))
 561     (build-system perl-build-system)
 562     (native-inputs
 563      `(("perl-list-moreutils" ,perl-list-moreutils)
 564        ("perl-test-leaktrace" ,perl-test-leaktrace)
 565        ("perl-test-sharedfork" ,perl-test-sharedfork)
 566        ("perl-test-warn" ,perl-test-warn)))
 567     (inputs
 568      `(("perl-crypt-random-source" ,perl-crypt-random-source)
 569        ("perl-math-random-isaac" ,perl-math-random-isaac)
 570        ("perl-math-random-isaac-xs" ,perl-math-random-isaac-xs)
 571        ("perl-moo" ,perl-moo)))
 572     (home-page "https://metacpan.org/release/Math-Random-Secure")
 573     (synopsis "Cryptographically secure replacement for rand()")
 574     (description "This module is intended to provide a
 575 cryptographically-secure replacement for Perl's built-in @code{rand} function.
 576 \"Crytographically secure\", in this case, means:
 577
 578 @enumerate
 579 @item No matter how many numbers you see generated by the random number
 580 generator, you cannot guess the future numbers, and you cannot guess the seed.
 581 @item There are so many possible seeds that it would take decades, centuries,
 582 or millennia for an attacker to try them all.
 583 @item The seed comes from a source that generates relatively strong random
 584 data on your platform, so the seed itself will be as random as possible.
 585 @end enumerate\n")
 586     (license license:artistic2.0)))
 587
 588 (define-public crypto++
 589   (package
 590     (name "crypto++")
 591     (version "8.0.0")
 592     (source (origin
 593               (method url-fetch/zipbomb)
 594               (uri (string-append "https://cryptopp.com/cryptopp"
 595                                   (string-join (string-split version #\.) "")
 596                                   ".zip"))
 597               (sha256
 598                (base32
 599                 "0b5qrsm4jhy4nzxgrm13nixhvbswr242plx1jw6r4sw492rqkzdv"))))
 600     (build-system gnu-build-system)
 601     (arguments
 602      `(#:make-flags
 603        (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 604              ;; Override "/sbin/ldconfig" with simply "echo" since
 605              ;; we don't need ldconfig(8).
 606              "LDCONF=echo")
 607        #:phases
 608        (modify-phases %standard-phases
 609          (add-after 'unpack 'disable-native-optimisation
 610            ;; This package installs more than just headers.  Ensure that the
 611            ;; cryptest.exe binary & static library aren't CPU model specific.
 612            (lambda _
 613              (substitute* "GNUmakefile"
 614                ((" -march=native") ""))
 615              #t))
 616          (delete 'configure)
 617          (add-after 'build 'build-shared
 618            (lambda _
 619              ;; By default, only the static library is built.
 620              (invoke "make" "shared")))
 621          (add-after 'install 'install-pkg-config
 622            (lambda* (#:key outputs #:allow-other-keys)
 623              (let* ((out (assoc-ref outputs "out"))
 624                     (pkg-dir (string-append out "/lib/pkgconfig")))
 625                (mkdir-p pkg-dir)
 626                (with-output-to-file (string-append pkg-dir "/libcrypto++.pc")
 627                  (lambda _
 628                    (display
 629                     (string-append
 630                      "prefix=" out "\n"
 631                      "libdir=" out "/lib\n"
 632                      "includedir=" out "/include\n\n"
 633                      "Name: libcrypto++-" ,version "\n"
 634                      "Description: Class library of cryptographic schemes"
 635                      "Version: " ,version "\n"
 636                      "Libs: -L${libdir} -lcryptopp\n"
 637                      "Cflags: -I${includedir}\n"))))))))))
 638     (native-inputs
 639      `(("unzip" ,unzip)))
 640     (home-page "https://cryptopp.com/")
 641     (synopsis "C++ class library of cryptographic schemes")
 642     (description "Crypto++ is a C++ class library of cryptographic schemes.")
 643     ;; The compilation is distributed under the Boost license; the individual
 644     ;; files in the compilation are in the public domain.
 645     (license (list license:boost1.0 license:public-domain))))
 646
 647 (define-public libb2
 648   (package
 649     (name "libb2")
 650     (version "0.98.1")
 651     (source (origin
 652               (method url-fetch)
 653               (uri (string-append
 654                     "https://github.com/BLAKE2/libb2/releases/download/v"
 655                     version "/libb2-" version ".tar.gz"))
 656               (sha256
 657                (base32
 658                 "0bn7yrzdixdvzm46shbhpkqbr6zyqyxiqn7a7x54ag3mrvfnyqjk"))))
 659     (build-system gnu-build-system)
 660     (arguments
 661      `(#:configure-flags
 662        (list
 663         ,@(if (any (cute string-prefix? <> (or (%current-system)
 664                                                (%current-target-system)))
 665                    '("x86_64" "i686"))
 666               ;; fat only checks for Intel optimisations
 667               '("--enable-fat")
 668               '())
 669         "--disable-native")))           ;don't optimise at build time
 670     (home-page "https://blake2.net/")
 671     (synopsis "Library implementing the BLAKE2 family of hash functions")
 672     (description
 673      "libb2 is a portable implementation of the BLAKE2 family of cryptographic
 674 hash functions.  It includes optimised implementations for IA-32 and AMD64
 675 processors, and an interface layer that automatically selects the best
 676 implementation for the processor it is run on.
 677
 678 @dfn{BLAKE2} (RFC 7693) is a family of high-speed cryptographic hash functions
 679 that are faster than MD5, SHA-1, SHA-2, and SHA-3, yet are at least as secure
 680 as the latest standard, SHA-3.  It is an improved version of the SHA-3 finalist
 681 BLAKE.")
 682     (license license:public-domain)))
 683
 684 (define-public rhash
 685   (package
 686     (name "rhash")
 687     (version "1.3.6")
 688     (source
 689      (origin
 690        (method url-fetch)
 691        (uri (string-append "https://github.com/rhash/RHash/archive/v"
 692                            version ".tar.gz"))
 693        (file-name (string-append name "-" version ".tar.gz"))
 694        (sha256
 695         (base32
 696          "14ngzfgmd1lfp7m78sn49x8ymf2s37nrr67c6p5vas85nrrgjkcn"))))
 697     (build-system gnu-build-system)
 698     (arguments
 699      `(#:make-flags
 700        ;; The binaries in /bin need some help finding librhash.so.0.
 701        (list (string-append "LDFLAGS=-Wl,-rpath=" %output "/lib"))
 702        #:test-target "test"             ; ‘make check’ just checks the sources
 703        #:phases
 704        (modify-phases %standard-phases
 705          (replace 'configure
 706            ;; ./configure is not GNU autotools' and doesn't gracefully handle
 707            ;; unrecognized options, so we must call it manually.
 708            (lambda* (#:key outputs #:allow-other-keys)
 709              (invoke "./configure"
 710                      (string-append "--prefix=" (assoc-ref outputs "out")))))
 711          (add-after 'install 'install-library-extras
 712            (lambda* (#:key make-flags #:allow-other-keys)
 713              (apply invoke
 714                     "make" "-C" "librhash"
 715                     "install-headers" "install-so-link"
 716                     make-flags))))))
 717     (home-page "https://sourceforge.net/projects/rhash/")
 718     (synopsis "Utility for computing hash sums")
 719     (description "RHash is a console utility for calculation and verification
 720 of magnet links and a wide range of hash sums like CRC32, MD4, MD5, SHA1,
 721 SHA256, SHA512, SHA3, AICH, ED2K, Tiger, DC++ TTH, BitTorrent BTIH, GOST R
 722 34.11-94, RIPEMD-160, HAS-160, EDON-R, Whirlpool and Snefru.")
 723     (license (license:non-copyleft "file://COPYING"))))
 724
 725 (define-public botan
 726   (package
 727     (name "botan")
 728     (version "2.7.0")
 729     (source (origin
 730               (method url-fetch)
 731               (uri (string-append "https://botan.randombit.net/releases/"
 732                                   "Botan-" version ".tgz"))
 733               (sha256
 734                (base32
 735                 "142aqabwc266jxn8wrp0f1ffrmcvdxwvyh8frb38hx9iaqazjbg4"))))
 736     (build-system gnu-build-system)
 737     (arguments
 738      '(#:phases
 739        (modify-phases %standard-phases
 740          (replace 'configure
 741            (lambda* (#:key inputs outputs #:allow-other-keys)
 742              (let* ((out (assoc-ref %outputs "out"))
 743                     (lib (string-append out "/lib")))
 744                (invoke "python" "./configure.py"
 745                        (string-append "--prefix=" out)
 746                        ;; Otherwise, the `botan` executable cannot find
 747                        ;; libbotan.
 748                        (string-append "--ldflags=-Wl,-rpath=" lib)
 749                        "--with-rst2man"
 750                        ;; Recommended by upstream
 751                        "--with-zlib" "--with-bzip2" "--with-sqlite3"))))
 752          (replace 'check
 753            (lambda _ (invoke "./botan-test"))))))
 754     (native-inputs
 755      `(("python" ,python-wrapper)
 756        ("python-docutils" ,python-docutils)))
 757     (inputs
 758      `(("sqlite" ,sqlite)
 759        ("bzip2" ,bzip2)
 760        ("zlib" ,zlib)))
 761     (synopsis "Cryptographic library in C++11")
 762     (description "Botan is a cryptography library, written in C++11, offering
 763 the tools necessary to implement a range of practical systems, such as TLS/DTLS,
 764 PKIX certificate handling, PKCS#11 and TPM hardware support, password hashing,
 765 and post-quantum crypto schemes.  In addition to the C++, botan has a C89 API
 766 specifically designed to be easy to call from other languages.  A Python binding
 767 using ctypes is included, and several other language bindings are available.")
 768     (home-page "https://botan.randombit.net")
 769     (license license:bsd-2)))
 770
 771 (define-public ccrypt
 772   (package
 773     (name "ccrypt")
 774     (version "1.11")
 775     (source (origin
 776               (method url-fetch)
 777               (uri (string-append "mirror://sourceforge/ccrypt/"
 778                                   version "/ccrypt-" version ".tar.gz"))
 779               (sha256
 780                (base32
 781                 "0kx4a5mhmp73ljknl2lcccmw9z3f5y8lqw0ghaymzvln1984g75i"))))
 782     (build-system gnu-build-system)
 783     (home-page "http://ccrypt.sourceforge.net")
 784     (synopsis "Command-line utility for encrypting and decrypting files and streams")
 785     (description "@command{ccrypt} is a utility for encrypting and decrypting
 786 files and streams.  It was designed as a replacement for the standard unix
 787 @command{crypt} utility, which is notorious for using a very weak encryption
 788 algorithm.  @command{ccrypt} is based on the Rijndael block cipher, a version of
 789 which is also used in the Advanced Encryption Standard (AES, see
 790 @url{http://www.nist.gov/aes}).  This cipher is believed to provide very strong
 791 security.")
 792     (license license:gpl2)))
 793
 794 (define-public asignify
 795   (let ((commit "f58e7977a599f040797975d649ed318e25cbd2d5")
 796         (revision "0"))
 797     (package
 798       (name "asignify")
 799       (version (git-version "1.1" revision commit))
 800       (source (origin
 801                 (method git-fetch)
 802                 (uri (git-reference
 803                        (url "https://github.com/vstakhov/asignify.git")
 804                        (commit commit)))
 805                 (file-name (git-file-name name version))
 806                 (sha256
 807                  (base32
 808                   "1zl68qq6js6fdahxzyhvhrpyrwlv8c2zhdplycnfxyr1ckkhq8dw"))))
 809       (build-system gnu-build-system)
 810       (arguments
 811        `(#:configure-flags
 812          (list "--enable-openssl"
 813                (string-append "--with-openssl="
 814                               (assoc-ref %build-inputs "openssl")))))
 815       (native-inputs
 816        `(("autoconf" ,autoconf)
 817          ("automake" ,automake)
 818          ("libtool" ,libtool)))
 819       (inputs
 820        `(("openssl" ,openssl-next)))
 821       (home-page "https://github.com/vstakhov/asignify")
 822       (synopsis "Cryptographic authentication and encryption tool and library")
 823       (description "Asignify offers public cryptographic signatures and
 824 encryption with a library or a command-line tool.  The tool is heavily inspired
 825 by signify as used in OpenBSD.  The main goal of this project is to define a
 826 high level API for signing files, validating signatures and encrypting using
 827 public-key cryptography.  Asignify is designed to be portable and self-contained
 828 with zero external dependencies.  Asignify can verify OpenBSD signatures, but it
 829 cannot sign messages in OpenBSD format yet.")
 830       (license license:bsd-2))))
 831
 832 (define-public enchive
 833   (package
 834     (name "enchive")
 835     (version "3.4")
 836     (source (origin
 837               (method url-fetch)
 838               (uri (string-append "https://github.com/skeeto/" name "/archive/"
 839                                   version ".tar.gz"))
 840               (sha256
 841                (base32
 842                 "17hrxpp4cpn10bk48sfvfjc8hghky34agsnypam1v9f36kbalqfk"))
 843               (file-name (string-append name "-" version ".tar.gz"))))
 844     (build-system gnu-build-system)
 845     (arguments
 846      '(#:tests? #f                      ; no check target         '
 847        #:make-flags (list "CC=gcc" "PREFIX=$(out)")
 848        #:phases (modify-phases %standard-phases
 849                   (delete 'configure)
 850                   (add-after 'install 'post-install
 851                     (lambda _
 852                       (let* ((out (assoc-ref %outputs "out"))
 853                              (lisp (string-append out "/share/emacs/site-lisp")))
 854                         (install-file "enchive-mode.el" lisp)
 855                         #t))))))
 856     (synopsis "Encrypted personal archives")
 857     (description
 858      "Enchive is a tool to encrypt files to yourself for long-term
 859 archival.  It's a focused, simple alternative to more complex solutions such as
 860 GnuPG or encrypted filesystems.  Enchive has no external dependencies and is
 861 trivial to build for local use.  Portability is emphasized over performance.")
 862     (home-page "https://github.com/skeeto/enchive")
 863     (license license:unlicense)))
 864
 865 (define-public libsecp256k1
 866   (let ((commit "e34ceb333b1c0e6f4115ecbb80c632ac1042fa49"))
 867     (package
 868       (name "libsecp256k1")
 869       (version (git-version "20181126" "1" commit))
 870       (source (origin
 871                 (method git-fetch)
 872                 (uri (git-reference
 873                       (url "https://github.com/bitcoin-core/secp256k1")
 874                       (commit commit)))
 875                 (sha256
 876                  (base32
 877                   "0as78s179hcr3ysk3fw98k5wzabgnwri7vkkc17wg31lyz6ids6c"))
 878                 (file-name (git-file-name name version))))
 879       (build-system gnu-build-system)
 880       (native-inputs
 881        `(("autoconf" ,autoconf)
 882          ("automake" ,automake)
 883          ("libtool" ,libtool)))
 884       ;; WARNING: This package might need additional configure flags to run properly.
 885       ;; See https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/libsecp256k1.
 886       (synopsis "C library for EC operations on curve secp256k1")
 887       (description
 888        "Optimized C library for EC operations on curve secp256k1.
 889
 890 This library is a work in progress and is being used to research best
 891 practices.  Use at your own risk.
 892
 893 Features:
 894
 895 @itemize
 896 @item secp256k1 ECDSA signing/verification and key generation.
 897 @item Adding/multiplying private/public keys.
 898 @item Serialization/parsing of private keys, public keys, signatures.
 899 @item Constant time, constant memory access signing and pubkey generation.
 900 @item Derandomized DSA (via RFC6979 or with a caller provided function.)
 901 @item Very efficient implementation.
 902 @end itemize\n")
 903       (home-page "https://github.com/bitcoin-core/secp256k1")
 904       (license license:unlicense))))
 905
 906 (define-public stoken
 907   (package
 908     (name "stoken")
 909     (version "0.92")
 910     (source (origin
 911               (method url-fetch)
 912               (uri (string-append "mirror://sourceforge/stoken/"
 913                                   "stoken-" version ".tar.gz"))
 914               (sha256
 915                (base32
 916                 "0npgr6y85gzwksy8jkwa4yzvqwjprwnplx3yiw3ayk4f0ldlhaxa"))))
 917     (build-system gnu-build-system)
 918     (native-inputs
 919      `(("pkg-config" ,pkg-config)))
 920     (inputs
 921      `(("nettle" ,nettle)
 922        ("libxml2" ,libxml2)))
 923     (home-page "http://stoken.sf.net")
 924     (synopsis "Software Token for cryptographic authentication")
 925     (description
 926      "@code{stoken} is a token code generator compatible with RSA SecurID
 927 128-bit (AES) tokens.  This package contains a standalone command-line program
 928 that allows for importing token seeds, generating token codes, and various
 929 utility/testing functions.")
 930     (license license:lgpl2.1+)))
 931
 932 (define-public hpenc
 933   (package
 934     (name "hpenc")
 935     (version "3.0")
 936     (source (origin
 937               (method git-fetch)
 938               (uri (git-reference
 939                      (url "https://github.com/vstakhov/hpenc")
 940                      (commit version)))
 941               (sha256
 942                (base32
 943                 "1fb5yi3d2k8kd4zm7liiqagpz610y168xrr1cvn7cbq314jm2my1"))))
 944     (build-system gnu-build-system)
 945     (arguments
 946      `(#:tests? #f ; No test suite
 947        #:make-flags
 948        (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
 949              ;; Build the program and the docs.
 950              "SUBDIRS=src doc")
 951        #:phases
 952        (modify-phases %standard-phases
 953          (delete 'configure) ; No ./configure script
 954          (add-after 'unpack 'patch-path
 955            (lambda _
 956              (substitute* '("src/Makefile" "doc/Makefile")
 957                (("/usr/bin/install")
 958                 "install"))))
 959          (add-before 'install 'make-output-directories
 960            (lambda* (#:key outputs #:allow-other-keys)
 961              (let* ((out (assoc-ref outputs "out"))
 962                     (bin (string-append out "/bin"))
 963                     (man1 (string-append out "/share/man/man1")))
 964                (mkdir-p bin)
 965                (mkdir-p man1)
 966                #t))))))
 967     (inputs
 968      `(("libsodium" ,libsodium)
 969        ("openssl" ,openssl)))
 970     (synopsis "High-performance command-line tool for stream encryption")
 971     (description "Hpenc is a command-line tool for performing authenticated
 972 encryption (AES-GCM and ChaCha20-Poly1305) of streaming data.  It does not
 973 perform an asymmetric key exchange, instead requiring the user to distribute
 974 pre-shared keys out of band.  It is designed to handle large amounts of data
 975 quickly by using all your CPU cores and hardware acceleration.")
 976     (home-page "https://github.com/vstakhov/hpenc")
 977     (license license:bsd-3)))