The rand_bytes function binds to RAND_bytes in OpenSSL to generate cryptographically strong pseudo-random bytes. See the OpenSSL documentation for what this means.
rnd <- rand_bytes(10)
print(rnd)
[1] 0a 10 91 01 64 e4 39 ff e4 0b
Bytes are 8 bit and hence can have 2^8 = 256 possible values.
as.numeric(rnd)
[1] 10 16 145 1 100 228 57 255 228 11
Each random byte can be decomposed into 8 random bits (booleans)
x <- rand_bytes(1)
as.logical(rawToBits(x))
[1] TRUE FALSE TRUE FALSE FALSE FALSE TRUE TRUE
Secure Random Numbers
rand_num is a simple (2 lines) wrapper to rand_bytes to generate random numbers (doubles) between 0 and 1.
rand_num(10)
[1] 0.51264049 0.26298265 0.52894224 0.45853923 0.91369995 0.06634984
[7] 0.34697549 0.77925962 0.32352883 0.36852364
To map random draws from [0,1] into a probability density, we can use a Cumulative Distribution Function. For example we can combine qnorm and rand_num to simulate rnorm:
# Secure rnorm
x <- qnorm(rand_num(1000), mean = 100, sd = 15)
hist(x)
Same for discrete distributions:
# Secure rbinom
y <- qbinom(rand_num(1000), size = 20, prob = 0.1)
hist(y, breaks = -.5:(max(y)+1))
openssl/inst/doc/secure_rng.R 0000644 0001762 0000144 00000001545 13031550354 015742 0 ustar ligges users ## ---- echo = FALSE, message = FALSE--------------------------------------
knitr::opts_chunk$set(comment = "")
library(openssl)
## ------------------------------------------------------------------------
rnd <- rand_bytes(10)
print(rnd)
## ------------------------------------------------------------------------
as.numeric(rnd)
## ------------------------------------------------------------------------
x <- rand_bytes(1)
as.logical(rawToBits(x))
## ------------------------------------------------------------------------
rand_num(10)
## ------------------------------------------------------------------------
# Secure rnorm
x <- qnorm(rand_num(1000), mean = 100, sd = 15)
hist(x)
## ------------------------------------------------------------------------
# Secure rbinom
y <- qbinom(rand_num(1000), size = 20, prob = 0.1)
hist(y, breaks = -.5:(max(y)+1))
openssl/inst/doc/crypto_hashing.R 0000644 0001762 0000144 00000001666 13031550354 016633 0 ustar ligges users ## ---- echo = FALSE, message = FALSE--------------------------------------
knitr::opts_chunk$set(comment = "")
library(openssl)
## ------------------------------------------------------------------------
md5("foo")
md5(charToRaw("foo"))
## ------------------------------------------------------------------------
# Vectorized for strings
md5(c("foo", "bar", "baz"))
## ------------------------------------------------------------------------
# Stream-hash a file
myfile <- system.file("CITATION")
md5(file(myfile))
## ----eval=FALSE----------------------------------------------------------
# # Stream-hash from a network connection
# md5(url("http://cran.us.r-project.org/bin/windows/base/old/3.1.1/R-3.1.1-win.exe"))
## ------------------------------------------------------------------------
# Compare to digest
library(digest)
digest("foo", "md5", serialize = FALSE)
# Other way around
digest(cars, skip = 0)
md5(serialize(cars, NULL))
openssl/inst/doc/crypto_hashing.html 0000644 0001762 0000144 00002555462 13031550354 017410 0 ustar ligges users
The functions sha1, sha256, sha512, md4, md5 and ripemd160 bind to the respective digest functions in OpenSSL’s libcrypto. Both binary and string inputs are supported and the output type will match the input type.
md5("foo")
[1] "acbd18db4cc2f85cedef654fccc4a4d8"
md5(charToRaw("foo"))
md5 ac:bd:18:db:4c:c2:f8:5c:ed:ef:65:4f:cc:c4:a4:d8
Functions are fully vectorized for the case of character vectors: a vector with n strings will return n hashes.
# Vectorized for strings
md5(c("foo", "bar", "baz"))
[1] "acbd18db4cc2f85cedef654fccc4a4d8" "37b51d194a7513e45b56f6524f2d51f2"
[3] "73feffa4b7f6bb68e44cf984c85f6e88"
Besides character and raw vectors we can pass a connection object (e.g. a file, socket or url). In this case the function will stream-hash the binary contents of the conection.
# Stream-hash a file
myfile <- system.file("CITATION")
md5(file(myfile))
md5 16:a3:1a:bf:39:26:86:31:f2:0e:14:78:bf:64:d6:59
Same for URLs. The hash of the R-3.1.1-win.exe below should match the one in md5sum.txt
# Stream-hash from a network connection
md5(url("http://cran.us.r-project.org/bin/windows/base/old/3.1.1/R-3.1.1-win.exe"))
Compare to digest
Similar functionality is also available in the digest package, but with a slightly different interface:
# Compare to digest
library(digest)
Attaching package: 'digest'
The following object is masked from 'package:openssl':
sha1
digest("foo", "md5", serialize = FALSE)
[1] "acbd18db4cc2f85cedef654fccc4a4d8"
# Other way around
digest(cars, skip = 0)
[1] "ceb7f0b7e120fe0f6e6141ea36b67dcb"
md5(serialize(cars, NULL))
md5 ce:b7:f0:b7:e1:20:fe:0f:6e:61:41:ea:36:b6:7d:cb
openssl/inst/doc/keys.html 0000644 0001762 0000144 00002564402 13031550354 015334 0 ustar ligges users
The openssl package implements a modern interface to libssl and libcrypto for R. It builds on the new EVP api which was introduced in OpenSSL 1.0 and provides a unified API to the various methods and formats. OpenSSL supports three major public key crypto systems:
- RSA : Most popular method. Supports both encryption and signatures.
- DSA : Digital Signature Algorithm. Mostly for signatures, not very popular anymore.
- ECDSA : Elliptic Curve DSA. Supports signatures and encryption via Diffie Hellman. Gaining popularity.
For each type there are several common formats for storing keys and certificates:
- DER: binary format, serialized ASN.1 structure
- PEM: base64 encoded DER + header wrapped in
===
- SSH: single line of base64 with a header. Only for pubkeys.
- JWK: JSON Web key. Stores key data in a JSON object
The openssl package automatically detects the format when possible. However being able to recognize the various formats can be useful.
openssl/inst/doc/bignum.html 0000644 0001762 0000144 00002565606 13031550354 015651 0 ustar ligges users
Primitive types such as int or double store numbers in exactly one or two bytes, with finite precision. This suffices for most applications, but cryptographic methods require arithmetic on much larger numbers and without loss of precision. Therefore OpenSSL provides a bignum data type which holds arbitrary sized integers and implements all basic arithmetic and comparison operators such as +, -, *, ^, %%, %/%, ==, !=, <, <=, > and >=.
One special case, the modular exponenent a^b %% m can be calculated using bignum_mod_exp when b is too large for calculating a^b.
# create a bignum
y <- bignum("123456789123456789")
z <- bignum("D41D8CD98F00B204E9800998ECF8427E", hex = TRUE)
# size grows
print(y * z)
## [b] 34808613111804879213872650915812112647840354642904626774
# Basic arithmetic
div <- z %/% y
mod <- z %% y
z2 <- div * y + mod
stopifnot(z2 == z)
stopifnot(div < z)
RSA involves a public key and a private key. The public key should be known by everyone and is used for encrypting messages. Messages encrypted with the public key can only be decrypted in a reasonable amount of time using the private key. In RSA, this asymmetry is based on the practical difficulty of factoring the product of two large prime numbers.
RSA key generation
An RSA key-pair is generated as follows (adapted from wikipedia):
- Choose two distinct prime numbers \(p\) and \(q\). Keep these secret.
- Compute the product \(n = p*q\). This \(n\) value is public and used as the modulus.
- Compute \(\phi(n) = (p − 1)(q − 1)\).
- Choose an integer \(e\) smaller than \(\phi(n)\) such that \(e\) and \(\phi(n)\) are coprime. OpenSSL always uses \(65537\).
- Compute a value for \(d\) such that \((d * e)\pmod{\phi(n)} = 1\).
OpenSSL has a key generator that does these things for us.
(key <- rsa_keygen(512))
## [512-bit rsa private key]
## md5: c4c39ba29f28517eec49c6b2755be69c
(pubkey <- key$pubkey)
## [512-bit rsa public key]
## md5: c4c39ba29f28517eec49c6b2755be69c
Usually we would use rsa_encrypt and rsa_decrypt to perform the encryption:
msg <- charToRaw("hello world")
ciphertext <- rsa_encrypt(msg, pubkey)
rawToChar(rsa_decrypt(ciphertext, key))
## [1] "hello world"
Let’s look at how this works under the hood.
How RSA encryption works
The data field of the private key extracts the underlying bignum integers:
key$data
## $e
## [b] 65537
## $n
## [b] 10569026565286155820720744523231748863822088228516641890189557970400740945053483041322691870588364647828869510740348759232483548879935360746654051791408149
## $p
## [b] 104561422052657818321305572918830068873573672192479059216414484631900340164947
## $q
## [b] 101079598553695307281587615375424174526793348449800289774735773171041152946167
## $d
## [b] 9722046576564015802556572372599081133642287392711380691061194474046853958413366923679924705437273484878878791185414862207468314595922482404144058842071453
## $dp
## [b] 18054183925841522683734285413575248476026666990098616569158586876033145388201
## $dq
## [b] 87431531544194570687987529798465685117946523901342429875493561034529820989857
## $qi
## [b] 35189962504388150911189634866142836821114269709182565183863384271658676836525
You can verify that the equations above hold for this key. The public key is simply a subset of the key which only contains \(n\) and \(e\):
pubkey$data
## $e
## [b] 65537
## $n
## [b] 10569026565286155820720744523231748863822088228516641890189557970400740945053483041322691870588364647828869510740348759232483548879935360746654051791408149
In order to encrypt a message into ciphertext we have to treat the message data as an integer. The message cannot be larger than the key size. For example convert the text hello world into an integer:
m <- bignum(charToRaw("hello world"))
print(m)
## [b] 126207244316550804821666916
To encrypt this message \(m\) into ciphertext \(c\) we calculate \(c = m^e\pmod n\). Using the public key from above:
e <- pubkey$data$e
n <- pubkey$data$n
c <- (m ^ e) %% n
print(c)
## [b] 3325659323980215257106509330346053668176374408427813427001691391003696397464298082936759956359781182102881980395262788263285765465327517193833561164790947
This is number represents out encrypted message! It is usually exchanged using base64 notation for human readability:
base64_encode(c)
## [1] "P3978g+Eg158DwmcpWl5VcPbXKv790cz5p/ozD5uNTGnMd21igOnEhOhaKGveZIAvKXwTVkaNYVefdobMxq8ow=="
The ciphertext can be decrypted using \(d\) from the corresponding private key via \(m = c^d \pmod{n}\). Note that c^d is too large to calculate directly so we need to use bignum_mod_exp instead.
d <- key$data$d
out <- bignum_mod_exp(c, d, n)
rawToChar(out)
## [1] "hello world"
The only difference with the actual rsa_encrypt and rsa_decrypt functions is that these add some additional padding to the data.
openssl/inst/doc/crypto_hashing.Rmd 0000644 0001762 0000144 00000003344 13031550354 017147 0 ustar ligges users ---
title: "Cryptographic Hashing in R"
date: "`r Sys.Date()`"
vignette: >
%\VignetteEngine{knitr::rmarkdown}
%\VignetteIndexEntry{Cryptographic Hashing in R}
\usepackage[utf8]{inputenc}
output:
html_document
---
```{r, echo = FALSE, message = FALSE}
knitr::opts_chunk$set(comment = "")
library(openssl)
```
The functions `sha1`, `sha256`, `sha512`, `md4`, `md5` and `ripemd160` bind to the respective [digest functions](https://www.openssl.org/docs/manmaster/man1/dgst.html) in OpenSSL's libcrypto. Both binary and string inputs are supported and the output type will match the input type.
```{r}
md5("foo")
md5(charToRaw("foo"))
```
Functions are fully vectorized for the case of character vectors: a vector with n strings will return n hashes.
```{r}
# Vectorized for strings
md5(c("foo", "bar", "baz"))
```
Besides character and raw vectors we can pass a connection object (e.g. a file, socket or url). In this case the function will stream-hash the binary contents of the conection.
```{r}
# Stream-hash a file
myfile <- system.file("CITATION")
md5(file(myfile))
```
Same for URLs. The hash of the [`R-3.1.1-win.exe`](http://cran.us.r-project.org/bin/windows/base/old/3.1.1/R-3.1.1-win.exe) below should match the one in [`md5sum.txt`](http://cran.us.r-project.org/bin/windows/base/old/3.1.1/md5sum.txt)
```{r eval=FALSE}
# Stream-hash from a network connection
md5(url("http://cran.us.r-project.org/bin/windows/base/old/3.1.1/R-3.1.1-win.exe"))
```
## Compare to digest
Similar functionality is also available in the **digest** package, but with a slightly different interface:
```{r}
# Compare to digest
library(digest)
digest("foo", "md5", serialize = FALSE)
# Other way around
digest(cars, skip = 0)
md5(serialize(cars, NULL))
```
openssl/inst/doc/bignum.Rmd 0000644 0001762 0000144 00000007347 13031550354 015416 0 ustar ligges users ---
title: "Fun with bignum: how RSA encryption works"
date: "`r Sys.Date()`"
vignette: >
%\VignetteEngine{knitr::rmarkdown}
%\VignetteIndexEntry{Fun with bignum: how RSA encryption works}
\usepackage[utf8]{inputenc}
output:
html_document
---
```{r setup, include=FALSE}
library(openssl)
knitr::opts_chunk$set(echo = TRUE)
```
Primitive types such as `int` or `double` store numbers in exactly one or two bytes, with finite precision. This suffices for most applications, but cryptographic methods require arithmetic on much larger numbers and without loss of precision. Therefore OpenSSL provides a __bignum__ data type which holds arbitrary sized integers and implements all basic arithmetic and comparison operators such as `+`, `-`, `*`, `^`, `%%`, `%/%`, `==`, `!=`, `<`, `<=`, `>` and `>=`.
One special case, the [__modular exponenent__](https://en.wikipedia.org/wiki/Modular_exponentiation) `a^b %% m` can be calculated using `bignum_mod_exp` when `b` is too large for calculating `a^b`.
```{r}
# create a bignum
y <- bignum("123456789123456789")
z <- bignum("D41D8CD98F00B204E9800998ECF8427E", hex = TRUE)
# size grows
print(y * z)
# Basic arithmetic
div <- z %/% y
mod <- z %% y
z2 <- div * y + mod
stopifnot(z2 == z)
stopifnot(div < z)
```
RSA involves a public key and a private key. The public key should be known by everyone and is used for encrypting messages. Messages encrypted with the public key can only be decrypted in a reasonable amount of time using the private key. In RSA, this asymmetry is based on the practical difficulty of factoring the product of two large prime numbers.
### RSA key generation
An RSA key-pair is generated as follows (adapted from [wikipedia](https://en.wikipedia.org/wiki/RSA_(cryptosystem))):
- Choose two distinct prime numbers $p$ and $q$. Keep these secret.
- Compute the product $n = p*q$. This $n$ value is public and used as the modulus.
- Compute $\phi(n) = (p − 1)(q − 1)$.
- Choose an integer $e$ smaller than $\phi(n)$ such that $e$ and $\phi(n)$ are coprime. OpenSSL always uses $65537$.
- Compute a value for $d$ such that $(d * e)\pmod{\phi(n)} = 1$.
OpenSSL has a key generator that does these things for us.
```{r}
(key <- rsa_keygen(512))
(pubkey <- key$pubkey)
```
Usually we would use `rsa_encrypt` and `rsa_decrypt` to perform the encryption:
```{r}
msg <- charToRaw("hello world")
ciphertext <- rsa_encrypt(msg, pubkey)
rawToChar(rsa_decrypt(ciphertext, key))
```
Let's look at how this works under the hood.
### How RSA encryption works
The `data` field of the private key extracts the underlying bignum integers:
```{r}
key$data
```
You can verify that the equations above hold for this key. The public key is simply a subset of the key which only contains $n$ and $e$:
```{r}
pubkey$data
```
In order to encrypt a message into ciphertext we have to treat the message data as an integer. The message cannot be larger than the key size. For example convert the text `hello world` into an integer:
```{r}
m <- bignum(charToRaw("hello world"))
print(m)
```
To encrypt this message $m$ into ciphertext $c$ we calculate $c = m^e\pmod n$. Using the public key from above:
```{r}
e <- pubkey$data$e
n <- pubkey$data$n
c <- (m ^ e) %% n
print(c)
```
This is number represents out encrypted message! It is usually exchanged using base64 notation for human readability:
```{r}
base64_encode(c)
```
The ciphertext can be decrypted using $d$ from the corresponding private key via $m = c^d \pmod{n}$. Note that `c^d` is too large to calculate directly so we need to use `bignum_mod_exp` instead.
```{r}
d <- key$data$d
out <- bignum_mod_exp(c, d, n)
rawToChar(out)
```
The only difference with the actual `rsa_encrypt` and `rsa_decrypt` functions is that these add some additional padding to the data.
openssl/tests/ 0000755 0001762 0000144 00000000000 13004154271 013074 5 ustar ligges users openssl/tests/keys/ 0000755 0001762 0000144 00000000000 12771051061 014052 5 ustar ligges users openssl/tests/keys/id_dsa.pem 0000755 0001762 0000144 00000001216 12771051061 016003 0 ustar ligges users -----BEGIN PUBLIC KEY-----
MIIBtzCCASwGByqGSM44BAEwggEfAoGBANpkYqVCRd2VhGthYvNOgLRkbRJ3ddps
n2bwQ2e3IgPyOt7NzmPU6QBAtNwz8vdKDZ9lK3AkOLlASCkbEcJn4g36M17cKqIr
I5LiM3WUWJ2sfnumXR7l9rm9rTR0Gt1aoLxCGGY/j8ZyszjbgqL6pj7g/8DKQRif
ME1BIxc6QpzfAhUAkygzc96mj6c9DUkA7L3Cxu39FT0CgYEApH3XdJ9ZA+dUJe1P
yBCmMXTzvIcWPuyni5/2Tj3/YmufHfkj/hl/ie2G6QvsNP0lL4HYJ3k14T1V3BHV
zzHawePbIHOHybexeccNFkvUeKUYi4xsEQ2j8fiJ5cX+x8OAMX3z7O2mjyIss8zl
XSl3r51CvJprZdinen8LidNdJrADgYQAAoGATeeFTetXwuvzPZTwjAF016a083d6
7SKRnRy7W7rMHXAP+hG9leBS/rlrvt7Rei17N7cb8jMr91PUgzbWxVvzS4NPsuOa
OUvpS5Gga/96OV5fJf0XV4vpI16kJxF+bY+nZwlbieGSY2ckjYkOtDslII+zCIXL
tydhLikbQ49A/y8=
-----END PUBLIC KEY-----
openssl/tests/keys/id_ecdsa384 0000644 0001762 0000144 00000000440 12771051061 015765 0 ustar ligges users -----BEGIN EC PRIVATE KEY-----
MIGkAgEBBDDsZOO1hvwae0x40zEy5VXU2hoMa+A1dR71QHeuX8x27Pp/7gQ8vHKF
V27dTNP496OgBwYFK4EEACKhZANiAAQ9RyeJz+PEgO7621HyNOdGBSNWnmas0YlT
Fz67bAJIMvUKaSsz28L98O6fpX0idzqRJiFxb9FCKtnwxGufUWuN4/WaPVb8R6EH
Z8oHEqfHk547tzTXKnu1dtPOs3GFIfk=
-----END EC PRIVATE KEY-----
openssl/tests/keys/signatures.txt 0000644 0001762 0000144 00000003363 12771051061 017004 0 ustar ligges users # From http://stackoverflow.com/a/18359743/318752
openssl dgst -md5 -sign id_rsa -out message.sig.rsa.md5 message
openssl dgst -md5 -verify id_rsa.pem -signature message.sig.rsa.md5 message
openssl dgst -sha1 -sign id_rsa -out message.sig.rsa.sha1 message
openssl dgst -sha1 -verify id_rsa.pem -signature message.sig.rsa.sha1 message
openssl dgst -sha1 -sign id_dsa -out message.sig.dsa.sha1 message
openssl dgst -sha1 -verify id_dsa.pem -signature message.sig.dsa.sha1 message
openssl dgst -sha1 -sign id_ecdsa -out message.sig.ecdsa.sha1 message
openssl dgst -sha1 -verify id_ecdsa.pem -signature message.sig.ecdsa.sha1 message
openssl dgst -sha1 -sign id_ecdsa384 -out message.sig.ecdsa384.sha1 message
openssl dgst -sha1 -verify id_ecdsa384.pem -signature message.sig.ecdsa384.sha1 message
openssl dgst -sha1 -sign id_ecdsa521 -out message.sig.ecdsa521.sha1 message
openssl dgst -sha1 -verify id_ecdsa521.pem -signature message.sig.ecdsa521.sha1 message
openssl dgst -sha256 -sign id_rsa -out message.sig.rsa.sha256 message
openssl dgst -sha256 -verify id_rsa.pem -signature message.sig.rsa.sha256 message
openssl dgst -sha256 -sign id_dsa -out message.sig.dsa.sha256 message
openssl dgst -sha256 -verify id_dsa.pem -signature message.sig.dsa.sha256 message
openssl dgst -sha256 -sign id_ecdsa -out message.sig.ecdsa.sha256 message
openssl dgst -sha256 -verify id_ecdsa.pem -signature message.sig.ecdsa.sha256 message
openssl dgst -sha256 -sign id_ecdsa384 -out message.sig.ecdsa384.sha256 message
openssl dgst -sha256 -verify id_ecdsa384.pem -signature message.sig.ecdsa384.sha256 message
openssl dgst -sha256 -sign id_ecdsa521 -out message.sig.ecdsa521.sha256 message
openssl dgst -sha256 -verify id_ecdsa521.pem -signature message.sig.ecdsa521.sha256 message
openssl/tests/keys/id_ecdsa521.pw 0000644 0001762 0000144 00000000655 12771051061 016413 0 ustar ligges users -----BEGIN EC PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,BD8E2ACC5CED7A39
JuBN1vD5jjjRpz4ngBrnTVYI+bqvn9DvKONweO7vSYcHUpdf6YwqX8EGo1xKLMgs
nEUC+bKp6xnN2v0J93uDfn0ctAHqRU5fINbpgZbT8R1xPj9EN9ILKmEm/j79GAdM
AW+L8sxFwBnFRZBYlnviW7rn2xF0ewEqREU9ihxZvWORldiorR21um7By084x3Zp
Gk4mR9CBK4bsc4+2wOzWzBRKxUXwuC8vcm0L3UZpB0nAWw2OtZpLLwjS/Js8otzw
D0jknaOpCG0UkwQkuqcBq7dGYQ+5bznV2J2PI9IRcMA=
-----END EC PRIVATE KEY-----
openssl/tests/keys/message.sig.rsa.sha1 0000644 0001762 0000144 00000000400 12771051061 017613 0 ustar ligges users hSVp 'S+ ״= SBV=okoB^;71)OJdf-,ԨOBlO^`3
qvh0ZXHjpCpHd_:ɚ_ &lxk"XV1 yltyV