This module provides a set of cryptographic functions.
Hash functions -
Hmac functions -
Cmac functions -
Block ciphers -
Digital signatures
gcm: Dworkin, M., "Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC", National Institute of Standards and Technology SP 800- 38D, November 2007.
key_value() = integer() | binary()
Always
rsa_public() = [key_value()] = [E, N]
Where E is the public exponent and N is public modulus.
rsa_private() = [key_value()] = [E, N, D] | [E, N, D, P1, P2, E1, E2, C]
Where E is the public exponent, N is public modulus and D is
the private exponent. The longer key format contains redundant
information that will make the calculation faster. P1,P2 are first
and second prime factors. E1,E2 are first and second exponents. C
is the CRT coefficient. Terminology is taken from
dss_public() = [key_value()] = [P, Q, G, Y]
Where P, Q and G are the dss parameters and Y is the public key.
dss_private() = [key_value()] = [P, Q, G, X]
Where P, Q and G are the dss parameters and X is the private key.
srp_public() = key_value()
Where is
srp_private() = key_value()
Where is
Where Verifier is
dh_public() = key_value()
dh_private() = key_value()
dh_params() = [key_value()] = [P, G] | [P, G, PrivateKeyBitLength]
ecdh_public() = key_value()
ecdh_private() = key_value()
ecdh_params() = ec_named_curve() | ec_explicit_curve()
ec_explicit_curve() =
{ec_field(), Prime :: key_value(), Point :: key_value(), Order :: integer(), CoFactor :: none | integer()}
ec_field() = {prime_field, Prime :: integer()} |
{characteristic_two_field, M :: integer(), Basis :: ec_basis()}
ec_basis() = {tpbasis, K :: non_neg_integer()} |
{ppbasis, K1 :: non_neg_integer(), K2 :: non_neg_integer(), K3 :: non_neg_integer()} |
onbasis
ec_named_curve() ->
sect571r1| sect571k1| sect409r1| sect409k1| secp521r1| secp384r1| secp224r1| secp224k1|
secp192k1| secp160r2| secp128r2| secp128r1| sect233r1| sect233k1| sect193r2| sect193r1|
sect131r2| sect131r1| sect283r1| sect283k1| sect163r2| secp256k1| secp160k1| secp160r1|
secp112r2| secp112r1| sect113r2| sect113r1| sect239k1| sect163r1| sect163k1| secp256r1|
secp192r1|
brainpoolP160r1| brainpoolP160t1| brainpoolP192r1| brainpoolP192t1| brainpoolP224r1|
brainpoolP224t1| brainpoolP256r1| brainpoolP256t1| brainpoolP320r1| brainpoolP320t1|
brainpoolP384r1| brainpoolP384t1| brainpoolP512r1| brainpoolP512t1
Note that the sect curves are GF2m (characteristic two) curves and are only supported if the
underlying OpenSSL has support for them.
See also
stream_cipher() = rc4 | aes_ctr
block_cipher() = aes_cbc | aes_cfb8 | aes_cfb128 | aes_ige256 | blowfish_cbc |
blowfish_cfb64 | des_cbc | des_cfb | des3_cbc | des3_cfb | des_ede3 | rc2_cbc
aead_cipher() = aes_gcm | chacha20_poly1305
stream_key() = aes_key() | rc4_key()
block_key() = aes_key() | blowfish_key() | des_key()| des3_key()
aes_key() = iodata()
Key length is 128, 192 or 256 bits
rc4_key() = iodata()
Variable key length from 8 bits up to 2048 bits (usually between 40 and 256)
blowfish_key() = iodata()
Variable key length from 32 bits up to 448 bits
des_key() = iodata()
Key length is 64 bits (in CBC mode only 8 bits are used)
des3_key() = [binary(), binary(), binary()]
Each key part is 64 bits (in CBC mode only 8 bits are used)
digest_type() = md5 | sha | sha224 | sha256 | sha384 | sha512
hash_algorithms() = md5 | ripemd160 | sha | sha224 | sha256 | sha384 | sha512
md4 is also supported for hash_init/1 and hash/2. Note that both md4 and md5 are recommended only for compatibility with existing applications.
cipher_algorithms() = aes_cbc | aes_cfb8 | aes_cfb128 | aes_ctr | aes_gcm |
aes_ige256 | blowfish_cbc | blowfish_cfb64 | chacha20_poly1305 | des_cbc | des_cfb |
des3_cbc | des3_cfb | des_ede3 | rc2_cbc | rc4
public_key_algorithms() = rsa |dss | ecdsa | dh | ecdh | ec_gf2m
Note that ec_gf2m is not strictly a public key algorithm, but a restriction on what curves are supported with ecdsa and ecdh.
Encrypt
May throw exception
Decrypt
May throw exception
Encrypt
In AEAD (Authenticated Encryption with Associated Data) mode, encrypt
May throw exception
Decrypt
In AEAD (Authenticated Encryption with Associated Data) mode, decrypt
May throw exception
Convert binary representation, of an integer, to an Erlang integer.
Computes the shared secret from the private key and the other party's public key.
See also
Performs bit-wise XOR (exclusive or) on the data supplied.
Generates a public key of type
RSA key generation is only available if the runtime was
built with dirty scheduler support. Otherwise, attempting to
generate an RSA key will throw exception
Computes a message digest of type
May throw exception
Initializes the context for streaming hash operations.
May throw exception
Updates the digest represented by
Finalizes the hash operation referenced by
Computes a HMAC of type
Initializes the context for streaming HMAC operations.
Updates the HMAC represented by
Do not use a
Finalizes the HMAC operation referenced by
Finalizes the HMAC operation referenced by
Computes a CMAC of type
Provides information about the FIPS operating status of
crypto and the underlying OpenSSL library. If crypto was built
with FIPS support this can be either
In FIPS mode all non-FIPS compliant algorithms are
disabled and throw exception
Provides the name and version of the libraries used by crypto.
> info_lib(). [{<<"OpenSSL">>,269484095,<<"OpenSSL 1.1.0c 10 Nov 2016"">>}]
From OTP R16 the numeric version represents the version of the OpenSSL
header files (
Computes the function
Returns the initialization vector to be used in the next
iteration of encrypt/decrypt of type
Decrypts the
Encrypts the
Decrypts the
Encrypts the
Set the seed for PRNG to the given binary. This calls the
RAND_seed function from openssl. Only use this if the system
you are running on does not have enough "randomness" built in.
Normally this is when
Generate a random number
Creates a digital signature.
Algorithm
See also
Equivalent to application:start(crypto).
Equivalent to application:stop(crypto).
Generates N bytes randomly uniform 0..255, and returns the
result in a binary. Uses a cryptographically secure prng seeded and
periodically mixed with operating system provided entropy. By default
this is the
May throw exception
Initializes the state for use in RC4 stream encryption
Initializes the state for use in streaming AES encryption using Counter mode (CTR).
Encrypts
Decrypts
Can be used to determine which crypto algorithms that are supported by the underlying OpenSSL library
Can be used to determine which named elliptic curves are supported.
Return the defining parameters of a elliptic curve.
Verifies a digital signature
Algorithm
See also