gleam-lang / crypto Goto Github PK

Hi there!
A hash_string function would be very nice to have, instead of being required to use BitString.

Let's say we want to hash a string composed of other strings without compromising performance (a very common operation with crypto-releated stuff).
With Elixir, we could do something like this:

  def hash_block(block) do
    :crypto.hash(:sha256, [block.id, block.data, Integer.to_string(block.timestamp])
  end

With Gleam this is a little bit more complicated, since crypto.hash method requires a BitString. The code above would probably look like something like this:

pub fn hash_block(block: Block) {
  bit_builder.from_string(block.id)
  |> bit_builder.append_string(block.data)
  |> bit_builder.append_string(int.to_string(block.timestamp))
  |> bit_builder.to_bit_string
  |> crypto.hash(crypto.Sha256, _)
  ...
}

This is obviously too much.

Instead, there could be a function that takes String as an input. The code above would look something like this:

pub fn hash_block(block: Block) {
  string_builder.from_strings([
    block.id,
    block.data,
    int.to_string(block.timestamp)
  ])
  |> string_builder.to_string
  |> crypto.hash_string(crypto.Sha256, _)
  ...
}

Much better!

NOTE: I tried adding the function and it works just fine, passes all tests + new ones I added for this purpose specifically. I don't think it will cause any problems since Gleam already uses UTF-8 binaries under the hood. If it sounds good to you guys I can create the pull request with everything.

The current implementation is this:

pub fn hash(a: HashAlgorithm, b: BitArray) -> BitArray

I can't imagine ever calling this function this way

get_dynamic_hash_algorithm()
|> crypto.hash(<<1,2,3,4>>)

it would be way more helpful if it had this signature

pub fn hash(a: BitArray, b: HashAlgorithm) -> BitArray

so it could be called like this instead

extract_bencode(info_field)
|> crypto.hash(crypto.Sha1)

I'm a little bit skeptical about how this would be implemented though, given that it's a pretty major breaking change. But hey a major release doesn't mean nothing can ever be broken right?

I was sent here by tynan on Discord

Should probably be a 0.1.0 because I don't think we've found a stable API yet,
Was previously depending on a git version of stdlib but features now exist in stdlib 0.10.0

NOTE gleam_bitwise depends on an uncompatible version of stdlib currently, can either post a new gleam_bitwise version to hex otherwise will require stdlib to be specified in the deps.

I suppose that evantually this library will have other algorithms like BCrypt and Argon2 (more suitable for password hashing).

But putting these in the Crypto module will be confusing. So it would make sense to have modules like Sha, Argon2, ... instead.

Consider renaming the current Crypto module to Sha or SecureHash
Thanks

Hi @lpil!

I want to contribute and add encryption support to the standard library. I am still new to gleam and would appreciate some guidance as it seems to be a pretty big undertaking. I will use this issue to track my progress and write down how I build this API.

Before I start, here are a few questions I had:

• One main issue, is there a proper way to handle algorithms that are supported by one platform (erlang crypto) and not by the other (WebCrypto)?
• Should we separate asymmetric and symmetric encrypt?