November 2008 - Haskell-Cafe

pbkdf2 on hackage Re: Re[2]: [Haskell-cafe] Password hashing
by Thomas Hartman 07 Dec '08

07 Dec '08

http://hackage.haskell.org/cgi-bin/hackage-scripts/package/PBKDF2 Since no one took up my code review request I just did the best I could and uploaded to hackage. There were indeed some mistakes in my initial post, fixed now. (Code review is still wished, though!) Alas, documentation doesn't build with hackage, altough it does for me locally. (Seems like almost everything I do these days -- what am I doing wrong?!) Also I'm open to folding this into a more established crypto package if there are any takers... psst, dominic. Also, dominic, shouldn't your crypto package be added to category Cryptography (a cabal file change) so it lists aside the other crypto packages? thanks, thomas. 2008/11/26 Thomas Hartman <tphyahoo(a)gmail.com>: > Sorry about the hideous formatting above. Reattached as a text file. > > t. > > 2008/11/26 Thomas Hartman <tphyahoo(a)gmail.com>: >> OK, I went ahead and implemented pbkdf2, following the algorithm >> linked to by bulat and Michael. >> >> If there are any crypto gurus who can code-review this I would be much >> obliged, and when I'm confident enough that this does the right thing >> I'll put it up on hackage. >> >> I don't do much crypto so this *definitely* needs a review before it >> becomes a library? >> >> How's this looks, cafe? >> >> Thanks! >> >> Thomas. >> >> >> {-# LANGUAGE ScopedTypeVariables #-} >> module Crypto.PBKDF2 (pbkdf2, pbkdf2') where >> >> import qualified Data.ByteString.Char8 as B >> import qualified Data.ByteString.Lazy as L >> import GHC.Word >> import Control.Monad (foldM) >> import Random >> import Data.Digest.SHA512 (hash) >> import Data.Word >> import Data.Bits >> import Data.Binary >> >> newtype Password = Password [Word8] >> newtype Salt = Salt [Word8] >> newtype HashedPass = HashedPass [Word8] >> deriving Show >> {- | A reasonable default for rsa pbkdf2? Actually I'm not really >> sure, ask folk with more experience. >> >>> pbkdf2 = pbkdf2' prfSHA512 512 512 512 >> -} >> t = pbkdf2 ( Password . toWord8s $ "meh" ) ( Salt . toWord8s $ "moo" ) >> pbkdf2 :: Password -> Salt -> HashedPass >> pbkdf2 = pbkdf2' prfSHA512 512 512 512 >> >> {- | Password Based Key Derivation Function, from RSA labs. >> >>> pbkdf2' prf hlen cIters dklen (Password pass) (Salt salt) >> -} >> pbkdf2' :: ([Word8] -> [Word8] -> [Word8]) -> Integer -> Integer -> >> Integer -> Password -> Salt -> HashedPass >> pbkdf2' prf hlen cIters dklen (Password pass) (Salt salt) >> | dklen > ( (2^32-1) * hlen) = error $ "pbkdf2, (dklen,hlen) : " ++ >> (show (dklen,hlen)) >> | otherwise = >> let --l,r :: Int >> l = ceiling $ (fromIntegral dklen) / (fromIntegral hlen ) >> r = dklen - ( (l-1) * hlen) >> ustream :: [Word8] -> [Word8] -> [[Word8]] >> ustream p s = let x = prf p s >> in x : ustream p x >> --us :: Integer -> [[Word8]] >> us i = take (fromIntegral cIters) $ ustream pass ( salt `myor` >> ((intToFourWord8s i) )) >> --f :: [Word8] -> [Word8] -> Integer -> Integer -> [Word8] >> f pass salt cIters i = foldr1 myxor $ us i >> ts :: [[Word8]] >> ts = map (f pass salt cIters) ( [1..l] ) >> in HashedPass . take (fromIntegral dklen) . concat $ ts >> >> -- The spec says >> -- Here, INT (i) is a four-octet encoding of the integer i, most >> significant octet first. >> -- I'm reading from the right... is this the right thing? >> toWord8s x = L.unpack . encode $ x >> >> --intToFourWord8s :: Integer -> [Word8] >> intToFourWord8s i = let w8s = toWord8s $ i >> in drop (length w8s -4) w8s >> >> myxor :: [Word8] -> [Word8] -> [Word8] >> myxor = zipWith xor >> >> myor :: [Word8] -> [Word8] -> [Word8] >> myor = zipWith (.|.) >> >> prfSHA512 :: [Word8] -> [Word8] -> [Word8] >> prfSHA512 x y = hash $ x ++ y >> >> >> 2008/11/26 John Meacham <john(a)repetae.net>: >>> What you are using there is not a salt, but rather a secret key. The >>> important thing about a salt is that it is different for _every user_. >>> and you actually store the salt unhashed along with the hash. (it is not >>> secret information). A salt protects against a dictionary attack, for >>> instance, you might have a dictionary of hash's and the common passwords >>> they go to but if you add a 32 bit salt, you would need 2^32 entries for >>> each dictionary word, making such an attack unworkable. You can also >>> trivially tell if two users have the _same_ password just by comparing >>> the hashes without a salt. >>> >>> John >>> >>> -- >>> John Meacham - ⑆repetae.net⑆john⑈ >>> _______________________________________________ >>> Haskell-Cafe mailing list >>> Haskell-Cafe(a)haskell.org >>> http://www.haskell.org/mailman/listinfo/haskell-cafe >>> >> >

2 2

Trouble installing ghc-6.10.1 on linux
by Bit Connor 06 Dec '08

06 Dec '08

I'm trying to install ghc 6.10.1 on a machine with the crux distro. libc version 2.3.6 gcc 4.0.3 linux version 2.6.15.6 First I tried the binary version ghc-6.10.1-i386-unknown-linux.tar.bz2 and I very quickly get this error: $ ./configure checking build system type... i686-pc-linux-gnu checking host system type... i686-pc-linux-gnu checking target system type... i686-pc-linux-gnu Which we'll further canonicalise into: i386-unknown-linux checking for path to top of build tree... configure: error: cannot determine current directory $ Next I tried building the source version ghc-6.10.1-src.tar.bz2 using ghc 6.6 that is already installed. configure works but make eventually dies with: ... Configuring ghc-6.10.1... cabal-bin: At least the following dependencies are missing: Cabal -any, base <3, filepath >=1 && <1.2, haskell98 -any, hpc -any, template-haskell -any, unix -any make[2]: *** [boot.stage.2] Error 1 Any ideas? Thanks, Bit

3 2

Fun with type functions
by Simon Peyton-Jones 05 Dec '08

05 Dec '08

Friends GHC has embodied data type families since 6.8, and now type synonym families (aka type functions) in 6.10. However, apart from our initial papers there isn't much published material about how to *use* type families. But that hasn't stopped you: quite a few people are using them already, and of course there is a rich seam of work on using functional dependencies to express type-level computation. Ken Shan and Oleg Kiselyov and I are collaborating to write a paper for an upcoming workshop, under the general rubric of "Fun with type functions" (in homage to Thomas Hallgren's paper "Fun with functional dependencies" and Ralf Hinze's paper "Fun with phantom types"). So this message is to ask you: can you tell us about the most persuasive, fun application you've encountered, for type families or functional dependencies? Simple is good. It doesn't have to be elaborate: just something that does something useful you could not have done otherwise. Pointers to email threads are fine. Don't assume we already know about them (even if we participated in the thread :-) Part of what we're interested in is that *you* found the example compelling. Many thanks Simon, Ken, Oleg PS: I'm broadcasting this message to GHC-users and Haskell-cafe, but to avoid deluging ghc-users, please reply just to us and Haskell cafe. (Interested ghc-users can follow the threads there from the archives if they want.)

7 6

manipulating predicate formulae
by Ganesh Sittampalam 05 Dec '08

05 Dec '08

Hi, Are there any Haskell libraries around for manipulating predicate formulae? I had a look on hackage but couldn't spot anything. I am generating complex expressions that I'd like some programmatic help in simplifying. Cheers, Ganesh

4 7

ANN: "Real World Haskell", now shipping
by Bryan O'Sullivan 04 Dec '08

04 Dec '08

Good evening - John Goerzen, Don Stewart and I are delighted to announce the availability of our book, "Real World Haskell". It is 710 pages long, and published by O'Reilly Media. This is the first book to comprehensively cover modern Haskell programming. From an introduction to functional programming, it focuses on teaching through many worked examples. We discuss the "awkward squad" of I/O, concurrency, and exceptions. We cover network programming, databases, and system hacking. We motivate and work with monoids, applicative functors, monads, and monad transformers. We show you how to debug code, and how to ship well-tested software. Better yet, the book is available under a Creative Commons license, so you can read as much of it as you please before you buy: http://book.realworldhaskell.org/ We developed this book with the enthusiastic and voluble support of the Haskell community, and we are proud to share our work in a fashion that will help newcomers to our field. And best of all, if you order now (at least in North America), you can have a copy of the book in your hands in a matter of days. Thank you from all of us to our friends in the Haskell world who have been so generous with their feedback and kind words!

17 34

The Knight's Tour: solutions please
by Don Stewart 02 Dec '08

02 Dec '08

Lee Pike forwarded the following: "Solving the Knight's Tour Puzzle In 60 Lines of Python" http://developers.slashdot.org/article.pl?sid=08/11/30/1722203 Seems that perhaps (someone expert in) Haskell could do even better? Maybe even parallelize the problem? :) So, team, anyone want to implement a Knight's Tour solver in a list monad/list comprehension one liner? These little puzzles are made for fast languages with backtracking monads.... Post solutions to the wiki.. -- Don

5 9

GHC 6.10 and OpenGL
by Paul L 02 Dec '08

02 Dec '08

Hi everyone, It's sad to see the OpenGL binding being dropped from GHC binary installers starting from 6.10. Though this issue has been brought up and discussed before, I'm sure a lot of people who based their work on OpenGL would share the same sympathy. I'm not here to argue whether this decision by GHC dev team is right or wrong, but what's really causing the pain is that the OpenGL binding doesn't have its own binary installer for Windows, and compilation from source on this platform is non-trivial. I wouldn't recommend doing it for ordinary users. So my question is, are we going to see a binary installer for OpenGL binding provided separately from either HOpenGL site, or Hackage? Or even the GHC installation page? -- Regards, Paul Liu Yale Haskell Group http://www.haskell.org/yale

10 22

ANNOUNCE: Haskell Communities and Activities Report (15th ed., November 2008)
by Janis Voigtlaender 02 Dec '08

02 Dec '08

On behalf of the many, many contributors, I am pleased to announce that the Haskell Communities and Activities Report (15th edition, November 2008) http://www.haskell.org/communities/ is now available from the Haskell Communities home page in PDF and HTML formats. Many thanks go to all the people that contributed to this report, both directly, by sending in descriptions, and indirectly, by doing all the interesting things that are reported. I hope you will find it as interesting a read as I did. If you have not encountered the Haskell Communities and Activities Reports before, you may like to know that the first of these reports was published in November 2001. Their goal is to improve the communication between the increasingly diverse groups, projects, and individuals working on, with, or inspired by Haskell. The idea behind these reports is simple: Every six months, a call goes out to all of you enjoying Haskell to contribute brief summaries of your own area of work. Many of you respond (eagerly, unprompted, and sometimes in time for the actual deadline ;-) to the call. The editor collects all the contributions into a single report and feeds that back to the community. When I try for the next update, six months from now, you might want to report on your own work, project, research area or group as well. So, please put the following into your diaries now: ---------------------------------------- End of April 2009: target deadline for contributions to the May 2009 edition of the HC&A Report ---------------------------------------- Unfortunately, many Haskellers working on interesting projects are so busy with their work that they seem to have lost the time to follow the Haskell related mailing lists and newsgroups, and have trouble even finding time to report on their work. If you are a member, user or friend of a project so burdened, please find someone willing to make time to report and ask them to "register" with the editor for a simple e-mail reminder in April (you could point me to them as well, and I can then politely ask if they want to contribute, but it might work better if you do the initial asking). Of course, they will still have to find the ten to fifteen minutes to draw up their report, but maybe we can increase our coverage of all that is going on in the community. Feel free to circulate this announcement further in order to reach people who might otherwise not see it. Enjoy! Janis Voigtlaender <hcar at haskell.org> -- Dr. Janis Voigtlaender http://wwwtcs.inf.tu-dresden.de/~voigt/ mailto:voigt@tcs.inf.tu-dresden.de

3 2

'#' in literate haskell
by John MacFarlane 01 Dec '08

01 Dec '08

Can anyone explain why ghc does not treat the following as a valid literate haskell program? --------- test.lhs ---- # This is a test > foo = reverse . words ------------------------ When I try to load this in ghci (or compile it using ghc), I get: test.lhs:1:2: lexical error at character 'T' It seems that the problem is the '#' character in the first column. Replacing it with something else, or moving it to the right one space, solves the problem. The following literate haskell program, from http://notvincenz.blogspot.com/2008/01/literate-haskell-and-c.html, also fails to load for me, for the same reason (the leading '#' in line 8). ---- literate-haskell-and-c.lhs --- /* c and lhs file > > module Foo where > main = print "Haskell" > */ #include int main() { printf("C\n"); return 0; } ------------------------------------ I've reproduced this with ghc 6.10.1 and ghc 6.8.3 (linux binaries from haskell.org) and with ghc 6.8.2 (Ubuntu intrepid). Interestingly, hugs (September 2006 version) has no trouble with test.lhs. I haven't tried ghc 6.6. I care about this because I'd like to use markdown conventions to format the comment parts of literate haskell programs. Markdown supports atx-style headers, which begin with strings of '#' characters starting in the first column. I know that some people use markdown with literate haskell, so there must be something basic here that I'm missing! John

4 4

howto tuple fold to do n-ary cross product?
by Larry Evans 01 Dec '08

01 Dec '08

http://www.muitovar.com/monad/moncow.xhtml#list contains a cross function which calculates the cross product of two lists. That attached does the same but then used cross on 3 lists. Naturally, I thought use of fold could generalize that to n lists; however, I'm getting error: {-- cut here Compilation started at Sun Nov 23 13:15:24 make runghc -XMultiParamTypeClasses -XFunctionalDependencies -XFlexibleInstances cross.hs cross.hs:23:30: Occurs check: cannot construct the infinite type: a = (a, a) Expected type: [a] -> [a] -> [a] Inferred type: [a] -> [a] -> [(a, a)] In the first argument of `Data.Foldable.foldl1', namely `cross' In the first argument of `print', namely `(Data.Foldable.foldl1 cross (list2, list3, list1))' make: *** [run] Error 1 }-- cut here How do I apply fold to cross and n lists, for n>=0? TIA. -regards, Larry

11 24