package mirage-crypto-rng

All checked builds pass
  1. Overview
  2. Docs
A cryptographically secure PRNG

Install 

dune-project
 Dependency

github.com Readme Changelog BSD-2-Clause License Edit opam file Versions (13)

Authors

  1. D
    David Kaloper <dk505@cam.ac.uk>
  2. H
    Hannes Mehnert <hannes@mehnert.org>

Maintainers

  1. H
    Hannes Mehnert <hannes@mehnert.org>

Sources

mirage-crypto-2.4.1.tbz
sha256=332886c365c6035077e3ce676a63da8f7500c15a1628b3c07e139b0e551f1f6f
sha512=cb8f4de93241cde0582bcd0283766c681a02dbcb9f3b4786eb0656c651f42ba2db467ff63bff79c5eacfd410e410d77dc31bfc51049c39e1e86685ec0a884c1f

Description

Mirage-crypto-rng provides a random number generator interface, and implementations: Fortuna, HMAC-DRBG, getrandom/getentropy based (in the unix sublibrary)

Added to opam-repository:

README

OCaml cryptographic primitives library

This repository contains a small cryptographic library that puts emphasis on the applicative style and ease of use. It includes basic ciphers (AES, 3DES, RC4, ChaCha20/Poly1305), AEAD primitives (AES-GCM, AES-CCM, ChaCha20/Poly1305), public-key primitives (RSA, DSA, DH), elliptic curves (NIST P-256, P-384, P-521, and curve 25519), and a strong RNG (Fortuna).

RSA timing attacks are countered by blinding. AES timing attacks are avoided by delegating to AES-NI.

Initially, this package was developed for MirageOS, but it is very well suitable in any OCaml application. It is a fork of the ocaml-nocrypto package developed by David Kaloper. It was forked with the permission of the original author in order to facilitate changes (e.g. build system) required by MirageOS that the upstream didn't have time to keep up with.

The following packages are provided in this repository, each installable via opam install package-name:

  • mirage-crypto - the base for symmetric ciphers (AES, 3DES, RC4, ChaCha20/Poly1305) - uses allocation-free and loop-free C code,
  • mirage-crypto-ec - elliptic curves (NIST P-256, P-384, P-521, curve 25519) - uses primitives exported from fiat-crypto,
  • mirage-crypto-pk - asymmetric cryptography (RSA, DSA, DH) - uses zarith with gmp,
  • mirage-crypto-rng - random number generators (Fortuna, HMAC-DRBG),
  • mirage-crypto-rng-mirage - seed and feed entropy for the RNG with MirageOS unikernels,
  • mirage-crypto-rng-mkernel - seed and feed entropy for the RNG with mkernel (using the miou scheduler).

On Unix, getrandom() (and getentropy()) or /dev/urandom are used for random number generation. On MirageOS, entropy harvesting and feeding uses non-deterministic execution time (whirlwind RNG), and hooks into the main event loop to get some bits of the timestamp of each event, rdrand and rdseed CPU instructions if available.

RNG seeding

If RNG fails with Fatal error: exception Unseeded_generator, you need to seed it.

let () = Mirage_crypto_rng_unix.use_default ()

LICENSE

Mostly ISC, the mirage-crypto-rng and mirage-crypto-rng-mirage packages are 2 clause BSD licensed, the mirage-crypto-ec package is MIT licensed.

Dependencies (7)

  1. digestif >= "1.1.4"
  2. mirage-crypto = version
  3. logs
  4. duration
  5. dune-configurator >= "2.0.0"
  6. dune >= "2.7"
  7. ocaml >= "4.14.0"

Dev Dependencies (3)

  1. ohex with-test & >= "0.2.0"
  2. randomconv with-test & >= "0.2.0"
  3. ounit2 with-test

Optional Dependencies

None

Used by (94)

  1. albatross = "2.1.0"
  2. anthropic
  3. arc >= "0.0.3"
  4. atproto
  5. awa >= "0.4.0"
  6. awskit-eio < "0.2.0"
  7. awso-eio
  8. azure-cosmos-db-eio
  9. builder-web >= "0.2.0"
  10. caldav >= "0.2.4"
  11. capnp-rpc-net >= "1.2.4"
  12. capnp-rpc-unix >= "2.1"
  13. caqti-eio >= "2.1.2"
  14. caqti-miou >= "3.1.0"
  15. chamelon >= "0.2.1"
  16. chamelon-unix >= "0.2.1"
  17. charrua-client >= "1.6.0"
  18. chatoyant
  19. cohttp-eio >= "6.1.0"
  20. conduit-mirage >= "8.0.0"
  21. conex-mirage-crypto >= "1.0.0"
  22. curve448
  23. dkim >= "0.8.0"
  24. dkim-mirage >= "0.8.0"
  25. dns-certify >= "10.1.0"
  26. dns-cli >= "9.1.0"
  27. dns-client >= "9.1.0"
  28. dns-client-lwt >= "10.1.0"
  29. dns-client-mirage >= "10.1.0"
  30. dns-resolver >= "10.1.0"
  31. dns-server >= "9.1.0"
  32. dns-stub >= "10.1.0"
  33. dream >= "1.0.0~alpha7"
  34. flux >= "0.0.1~beta6"
  35. git >= "3.17.0"
  36. git-net >= "0.2.4"
  37. git-unix >= "3.17.0"
  38. granary
  39. hpke
  40. http-mirage-client
  41. httpcats >= "0.3.1"
  42. https-eio
  43. hurl >= "0.0.1~beta3"
  44. irmin-cli >= "3.11.0"
  45. irmin-client >= "3.11.0"
  46. jose >= "0.10.0"
  47. jws
  48. kube
  49. letsencrypt >= "1.0.0" & < "2.0.0"
  50. letsencrypt-app >= "1.0.0"
  51. MlFront_Cache
  52. MlFront_Signify
  53. mfetch
  54. mhttp
  55. miou
  56. mirage-crypto-ec >= "2.4.1"
  57. mirage-crypto-pk >= "2.4.1"
  58. mirage-crypto-rng-mirage >= "2.4.1"
  59. mirage-crypto-rng-mkernel >= "2.4.1"
  60. mnet
  61. mnet-dhcp
  62. mrmime >= "0.7.0"
  63. neodriver_eio
  64. noise
  65. ocluster >= "0.4.0"
  66. ohttp
  67. ohttp-cohttp-eio
  68. ohttp-cohttp-lwt
  69. ohttp-piaf
  70. oidc
  71. opentelemetry-client-cohttp-eio >= "0.90"
  72. otr >= "1.0.0"
  73. paf >= "0.7.0"
  74. paf-cohttp >= "0.8.0"
  75. passe
  76. polymarket
  77. snf_mcp
  78. ssh-agent >= "0.5.0"
  79. starred_ml >= "0.0.8"
  80. tcpip >= "8.2.0"
  81. tls >= "1.0.4"
  82. tls-async >= "2.0.1"
  83. tls-eio >= "2.0.1"
  84. tls-liquidsoap
  85. tls-lwt >= "2.0.1"
  86. tls-miou-unix >= "2.1.2"
  87. utcp
  88. valkey
  89. verdict
  90. vif >= "0.0.1~beta4"
  91. webauthn >= "0.2.0"
  92. websocket >= "2.17"
  93. x509 >= "1.0.6"
  94. yocaml_git >= "2.2.0"

Conflicts (1)

  1. mirage-runtime < "3.8.0"

Build status

Results of building mirage-crypto-rng with each compiler on check.ci.ocaml.org, run of against opam-repository 8a77e58. All results for this package.

Each result links to its build log. To keep crawlers from overloading the site, build logs require a GitHub sign-in (see ocurrent/opam-health-check). On your first log, GitHub asks you to “Authorize opam-health-check”, the OCurrent app that runs these checks; it sees only your public profile, not your repositories. The sign-in lasts 30 days.

Version OCaml 4.11 OCaml 4.14 OCaml 5.2 OCaml 5.4 OCaml 5.5
2.4.1 (this version) n/a good good good good
0.11.3 good good good good good
  • good Package successfully built
  • partial One of the dependencies failed to build
  • bad Package failed to build
  • n/a Package is not available in this environment
  • internal Internal failure