ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2025-01-25 20:19:18 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

pk-crypto: Rename 'gcry-sexp' to 'canonical-sexp'.

Browse source 
* guix/pk-crypto.scm: Rename procedures, variables, etc. from
  'gcry-sexp' to 'canonical-sexp'.  Add comment with references.
* guix/scripts/authenticate.scm, tests/pk-crypto.scm: Adjust
  accordingly.
This commit is contained in:
Ludovic Courtès 2013-12-27 23:32:26 +01:00
parent 557813760d
commit b0a33ac157
3 changed files with 91 additions and 87 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

114
guix/pk-crypto.scm
View file

@ -24,14 +24,14 @@ (define-module (guix pk-crypto)
#:use-module (system foreign) #:use-module (system foreign)
#:use-module (rnrs bytevectors) #:use-module (rnrs bytevectors)
#:use-module (ice-9 match) #:use-module (ice-9 match)
#:export (gcry-sexp? #:export (canonical-sexp?
string->gcry-sexp string->canonical-sexp
gcry-sexp->string canonical-sexp->string
number->gcry-sexp number->canonical-sexp
gcry-sexp-car canonical-sexp-car
gcry-sexp-cdr canonical-sexp-cdr
gcry-sexp-nth canonical-sexp-nth
gcry-sexp-nth-data canonical-sexp-nth-data
bytevector->hash-data bytevector->hash-data
hash-data->bytevector hash-data->bytevector
sign sign
@ -44,24 +44,28 @@ (define-module (guix pk-crypto)
;;; ;;;
;;; Public key cryptographic routines from GNU Libgcrypt. ;;; Public key cryptographic routines from GNU Libgcrypt.
;;;; ;;;;
;;; Libgcrypt uses s-expressions to represent key material, parameters, and ;;; Libgcrypt uses "canonical s-expressions" to represent key material,
;;; data. We keep it as an opaque object rather than attempting to map them ;;; parameters, and data. We keep it as an opaque object rather than
;;; to Scheme s-expressions because (1) Libgcrypt sexps are stored in secure ;;; attempting to map them to Scheme s-expressions because (1) Libgcrypt sexps
;;; memory, and (2) the read syntax is different. ;;; are stored in secure memory, and (2) the read syntax is different.
;;;
;;; Canonical sexps were defined by Rivest et al. in the IETF draft at
;;; <http://people.csail.mit.edu/rivest/Sexp.txt> for the purposes of SPKI
;;; (see <http://www.ietf.org/rfc/rfc2693.txt>.)
;;; ;;;
;;; Code: ;;; Code:
;; Libgcrypt "s-expressions". ;; Libgcrypt "s-expressions".
(define-wrapped-pointer-type <gcry-sexp> (define-wrapped-pointer-type <canonical-sexp>
gcry-sexp? canonical-sexp?
naked-pointer->gcry-sexp naked-pointer->canonical-sexp
gcry-sexp->pointer canonical-sexp->pointer
(lambda (obj port) (lambda (obj port)
;; Don't print OBJ's external representation: we don't want key material ;; Don't print OBJ's external representation: we don't want key material
;; to leak in backtraces and such. ;; to leak in backtraces and such.
(format port "#<gcry-sexp ~a | ~a>" (format port "#<canonical-sexp ~a | ~a>"
(number->string (object-address obj) 16) (number->string (object-address obj) 16)
(number->string (pointer-address (gcry-sexp->pointer obj)) (number->string (pointer-address (canonical-sexp->pointer obj))
16)))) 16))))
(define libgcrypt-func (define libgcrypt-func
@ -70,22 +74,22 @@ (define libgcrypt-func
"Return a pointer to symbol FUNC in libgcrypt." "Return a pointer to symbol FUNC in libgcrypt."
(dynamic-func func lib)))) (dynamic-func func lib))))
(define finalize-gcry-sexp! (define finalize-canonical-sexp!
(libgcrypt-func "gcry_sexp_release")) (libgcrypt-func "gcry_sexp_release"))
(define-inlinable (pointer->gcry-sexp ptr) (define-inlinable (pointer->canonical-sexp ptr)
"Return a <gcry-sexp> that wraps PTR." "Return a <canonical-sexp> that wraps PTR."
(let* ((sexp (naked-pointer->gcry-sexp ptr)) (let* ((sexp (naked-pointer->canonical-sexp ptr))
(ptr* (gcry-sexp->pointer sexp))) (ptr* (canonical-sexp->pointer sexp)))
;; Did we already have a <gcry-sexp> object for PTR? ;; Did we already have a <canonical-sexp> object for PTR?
(when (equal? ptr ptr*) (when (equal? ptr ptr*)
;; No, so we can safely add a finalizer (in Guile 2.0.9 ;; No, so we can safely add a finalizer (in Guile 2.0.9
;; 'set-pointer-finalizer!' *adds* a finalizer rather than replacing the ;; 'set-pointer-finalizer!' *adds* a finalizer rather than replacing the
;; existing one.) ;; existing one.)
(set-pointer-finalizer! ptr finalize-gcry-sexp!)) (set-pointer-finalizer! ptr finalize-canonical-sexp!))
sexp)) sexp))
(define string->gcry-sexp (define string->canonical-sexp
(let* ((ptr (libgcrypt-func "gcry_sexp_new")) (let* ((ptr (libgcrypt-func "gcry_sexp_new"))
(proc (pointer->procedure int ptr `(* * ,size_t ,int)))) (proc (pointer->procedure int ptr `(* * ,size_t ,int))))
(lambda (str) (lambda (str)
@ -93,58 +97,58 @@ (define string->gcry-sexp
(let* ((sexp (bytevector->pointer (make-bytevector (sizeof '*)))) (let* ((sexp (bytevector->pointer (make-bytevector (sizeof '*))))
(err (proc sexp (string->pointer str) 0 1))) (err (proc sexp (string->pointer str) 0 1)))
(if (= 0 err) (if (= 0 err)
(pointer->gcry-sexp (dereference-pointer sexp)) (pointer->canonical-sexp (dereference-pointer sexp))
(throw 'gcry-error err)))))) (throw 'gcry-error err))))))
(define-syntax GCRYSEXP_FMT_ADVANCED (define-syntax GCRYSEXP_FMT_ADVANCED
(identifier-syntax 3)) (identifier-syntax 3))
(define gcry-sexp->string (define canonical-sexp->string
(let* ((ptr (libgcrypt-func "gcry_sexp_sprint")) (let* ((ptr (libgcrypt-func "gcry_sexp_sprint"))
(proc (pointer->procedure size_t ptr `(* ,int * ,size_t)))) (proc (pointer->procedure size_t ptr `(* ,int * ,size_t))))
(lambda (sexp) (lambda (sexp)
"Return a textual representation of SEXP." "Return a textual representation of SEXP."
(let loop ((len 1024)) (let loop ((len 1024))
(let* ((buf (bytevector->pointer (make-bytevector len))) (let* ((buf (bytevector->pointer (make-bytevector len)))
(size (proc (gcry-sexp->pointer sexp) (size (proc (canonical-sexp->pointer sexp)
GCRYSEXP_FMT_ADVANCED buf len))) GCRYSEXP_FMT_ADVANCED buf len)))
(if (zero? size) (if (zero? size)
(loop (* len 2)) (loop (* len 2))
(pointer->string buf size "ISO-8859-1"))))))) (pointer->string buf size "ISO-8859-1")))))))
(define gcry-sexp-car (define canonical-sexp-car
(let* ((ptr (libgcrypt-func "gcry_sexp_car")) (let* ((ptr (libgcrypt-func "gcry_sexp_car"))
(proc (pointer->procedure '* ptr '(*)))) (proc (pointer->procedure '* ptr '(*))))
(lambda (lst) (lambda (lst)
"Return the first element of LST, an sexp, if that element is a list; "Return the first element of LST, an sexp, if that element is a list;
return #f if LST or its first element is not a list (this is different from return #f if LST or its first element is not a list (this is different from
the usual Lisp 'car'.)" the usual Lisp 'car'.)"
(let ((result (proc (gcry-sexp->pointer lst)))) (let ((result (proc (canonical-sexp->pointer lst))))
(if (null-pointer? result) (if (null-pointer? result)
#f #f
(pointer->gcry-sexp result)))))) (pointer->canonical-sexp result))))))
(define gcry-sexp-cdr (define canonical-sexp-cdr
(let* ((ptr (libgcrypt-func "gcry_sexp_cdr")) (let* ((ptr (libgcrypt-func "gcry_sexp_cdr"))
(proc (pointer->procedure '* ptr '(*)))) (proc (pointer->procedure '* ptr '(*))))
(lambda (lst) (lambda (lst)
"Return the tail of LST, an sexp, or #f if LST is not a list." "Return the tail of LST, an sexp, or #f if LST is not a list."
(let ((result (proc (gcry-sexp->pointer lst)))) (let ((result (proc (canonical-sexp->pointer lst))))
(if (null-pointer? result) (if (null-pointer? result)
#f #f
(pointer->gcry-sexp result)))))) (pointer->canonical-sexp result))))))
(define gcry-sexp-nth (define canonical-sexp-nth
(let* ((ptr (libgcrypt-func "gcry_sexp_nth")) (let* ((ptr (libgcrypt-func "gcry_sexp_nth"))
(proc (pointer->procedure '* ptr `(* ,int)))) (proc (pointer->procedure '* ptr `(* ,int))))
(lambda (lst index) (lambda (lst index)
"Return the INDEXth nested element of LST, an s-expression. Return #f "Return the INDEXth nested element of LST, an s-expression. Return #f
if that element does not exist, or if it's an atom. (Note: this is obviously if that element does not exist, or if it's an atom. (Note: this is obviously
different from Scheme's 'list-ref'.)" different from Scheme's 'list-ref'.)"
(let ((result (proc (gcry-sexp->pointer lst) index))) (let ((result (proc (canonical-sexp->pointer lst) index)))
(if (null-pointer? result) (if (null-pointer? result)
#f #f
(pointer->gcry-sexp result)))))) (pointer->canonical-sexp result))))))
(define (dereference-size_t p) (define (dereference-size_t p)
"Return the size_t value pointed to by P." "Return the size_t value pointed to by P."
@ -152,7 +156,7 @@ (define (dereference-size_t p)
0 (native-endianness) 0 (native-endianness)
(sizeof size_t))) (sizeof size_t)))
(define gcry-sexp-nth-data (define canonical-sexp-nth-data
(let* ((ptr (libgcrypt-func "gcry_sexp_nth_data")) (let* ((ptr (libgcrypt-func "gcry_sexp_nth_data"))
(proc (pointer->procedure '* ptr `(* ,int *)))) (proc (pointer->procedure '* ptr `(* ,int *))))
(lambda (lst index) (lambda (lst index)
@ -161,20 +165,20 @@ (define gcry-sexp-nth-data
Note that the result is a Scheme string, but depending on LST, it may need to Note that the result is a Scheme string, but depending on LST, it may need to
be interpreted in the sense of a C string---i.e., as a series of octets." be interpreted in the sense of a C string---i.e., as a series of octets."
(let* ((size* (bytevector->pointer (make-bytevector (sizeof '*)))) (let* ((size* (bytevector->pointer (make-bytevector (sizeof '*))))
(result (proc (gcry-sexp->pointer lst) index size*))) (result (proc (canonical-sexp->pointer lst) index size*)))
(if (null-pointer? result) (if (null-pointer? result)
#f #f
(pointer->string result (dereference-size_t size*) (pointer->string result (dereference-size_t size*)
"ISO-8859-1")))))) "ISO-8859-1"))))))
(define (number->gcry-sexp number) (define (number->canonical-sexp number)
"Return an s-expression representing NUMBER." "Return an s-expression representing NUMBER."
(string->gcry-sexp (string-append "#" (number->string number 16) "#"))) (string->canonical-sexp (string-append "#" (number->string number 16) "#")))
(define* (bytevector->hash-data bv #:optional (hash-algo "sha256")) (define* (bytevector->hash-data bv #:optional (hash-algo "sha256"))
"Given BV, a bytevector containing a hash, return an s-expression suitable "Given BV, a bytevector containing a hash, return an s-expression suitable
for use as the data for 'sign'." for use as the data for 'sign'."
(string->gcry-sexp (string->canonical-sexp
(format #f "(data (flags pkcs1) (hash \"~a\" #~a#))" (format #f "(data (flags pkcs1) (hash \"~a\" #~a#))"
hash-algo hash-algo
(bytevector->base16-string bv)))) (bytevector->base16-string bv))))
@ -192,8 +196,8 @@ (define (hash-data->bytevector data)
Return #f if DATA does not conform." Return #f if DATA does not conform."
(let ((hash (find-sexp-token data 'hash))) (let ((hash (find-sexp-token data 'hash)))
(if hash (if hash
(let ((algo (gcry-sexp-nth-data hash 1)) (let ((algo (canonical-sexp-nth-data hash 1))
(value (gcry-sexp-nth-data hash 2))) (value (canonical-sexp-nth-data hash 2)))
(values (latin1-string->bytevector value) (values (latin1-string->bytevector value)
algo)) algo))
(values #f #f)))) (values #f #f))))
@ -205,10 +209,10 @@ (define sign
"Sign DATA (an s-expression) with SECRET-KEY (an s-expression whose car "Sign DATA (an s-expression) with SECRET-KEY (an s-expression whose car
is 'private-key'.)" is 'private-key'.)"
(let* ((sig (bytevector->pointer (make-bytevector (sizeof '*)))) (let* ((sig (bytevector->pointer (make-bytevector (sizeof '*))))
(err (proc sig (gcry-sexp->pointer data) (err (proc sig (canonical-sexp->pointer data)
(gcry-sexp->pointer secret-key)))) (canonical-sexp->pointer secret-key))))
(if (= 0 err) (if (= 0 err)
(pointer->gcry-sexp (dereference-pointer sig)) (pointer->canonical-sexp (dereference-pointer sig))
(throw 'gry-error err)))))) (throw 'gry-error err))))))
(define verify (define verify
@ -217,9 +221,9 @@ (define verify
(lambda (signature data public-key) (lambda (signature data public-key)
"Verify that SIGNATURE is a signature of DATA with PUBLIC-KEY, all of "Verify that SIGNATURE is a signature of DATA with PUBLIC-KEY, all of
which are gcrypt s-expressions." which are gcrypt s-expressions."
(zero? (proc (gcry-sexp->pointer signature) (zero? (proc (canonical-sexp->pointer signature)
(gcry-sexp->pointer data) (canonical-sexp->pointer data)
(gcry-sexp->pointer public-key)))))) (canonical-sexp->pointer public-key))))))
(define generate-key (define generate-key
(let* ((ptr (libgcrypt-func "gcry_pk_genkey")) (let* ((ptr (libgcrypt-func "gcry_pk_genkey"))
@ -228,9 +232,9 @@ (define generate-key
"Return as an s-expression a new key pair for PARAMS. PARAMS must be an "Return as an s-expression a new key pair for PARAMS. PARAMS must be an
s-expression like: (genkey (rsa (nbits 4:2048)))." s-expression like: (genkey (rsa (nbits 4:2048)))."
(let* ((key (bytevector->pointer (make-bytevector (sizeof '*)))) (let* ((key (bytevector->pointer (make-bytevector (sizeof '*))))
(err (proc key (gcry-sexp->pointer params)))) (err (proc key (canonical-sexp->pointer params))))
(if (zero? err) (if (zero? err)
(pointer->gcry-sexp (dereference-pointer key)) (pointer->canonical-sexp (dereference-pointer key))
(throw 'gcry-error err)))))) (throw 'gcry-error err))))))
(define find-sexp-token (define find-sexp-token
@ -240,9 +244,9 @@ (define find-sexp-token
"Find in SEXP the first element whose 'car' is TOKEN and return it; "Find in SEXP the first element whose 'car' is TOKEN and return it;
return #f if not found." return #f if not found."
(let* ((token (string->pointer (symbol->string token))) (let* ((token (string->pointer (symbol->string token)))
(res (proc (gcry-sexp->pointer sexp) token 0))) (res (proc (canonical-sexp->pointer sexp) token 0)))
(if (null-pointer? res) (if (null-pointer? res)
#f #f
(pointer->gcry-sexp res)))))) (pointer->canonical-sexp res))))))
;;; pk-crypto.scm ends here ;;; pk-crypto.scm ends here

18
guix/scripts/authenticate.scm
View file

@ -33,10 +33,10 @@ (define-module (guix scripts authenticate)
;;; ;;;
;;; Code: ;;; Code:
(define (read-gcry-sexp file) (define (read-canonical-sexp file)
"Read a gcrypt sexp from FILE and return it." "Read a gcrypt sexp from FILE and return it."
(call-with-input-file file (call-with-input-file file
(compose string->gcry-sexp get-string-all))) (compose string->canonical-sexp get-string-all)))
(define (read-hash-data file) (define (read-hash-data file)
"Read sha256 hash data from FILE and return it as a gcrypt sexp." "Read sha256 hash data from FILE and return it as a gcrypt sexp."
@ -56,18 +56,18 @@ (define (guix-authenticate . args)
(("rsautl" "-sign" "-inkey" key "-in" hash-file) (("rsautl" "-sign" "-inkey" key "-in" hash-file)
;; Sign the hash in HASH-FILE with KEY, and return an sexp that includes ;; Sign the hash in HASH-FILE with KEY, and return an sexp that includes
;; both the hash and the actual signature. ;; both the hash and the actual signature.
(let* ((secret-key (read-gcry-sexp key)) (let* ((secret-key (read-canonical-sexp key))
(data (read-hash-data hash-file))) (data (read-hash-data hash-file)))
(format #t (format #t
"(guix-signature ~a (payload ~a))" "(guix-signature ~a (payload ~a))"
(gcry-sexp->string (sign data secret-key)) (canonical-sexp->string (sign data secret-key))
(gcry-sexp->string data)) (canonical-sexp->string data))
#t)) #t))
(("rsautl" "-verify" "-inkey" key "-pubin" "-in" signature-file) (("rsautl" "-verify" "-inkey" key "-pubin" "-in" signature-file)
;; Read the signature as produced above, check it against KEY, and print ;; Read the signature as produced above, check it against KEY, and print
;; the signed data to stdout upon success. ;; the signed data to stdout upon success.
(let* ((public-key (read-gcry-sexp key)) (let* ((public-key (read-canonical-sexp key))
(sig+data (read-gcry-sexp signature-file)) (sig+data (read-canonical-sexp signature-file))
(data (find-sexp-token sig+data 'payload)) (data (find-sexp-token sig+data 'payload))
(signature (find-sexp-token sig+data 'sig-val))) (signature (find-sexp-token sig+data 'sig-val)))
(if (and data signature) (if (and data signature)
@ -79,12 +79,12 @@ (define (guix-authenticate . args)
(begin (begin
(format (current-error-port) (format (current-error-port)
"error: invalid signature: ~a~%" "error: invalid signature: ~a~%"
(gcry-sexp->string signature)) (canonical-sexp->string signature))
(exit 1))) (exit 1)))
(begin (begin
(format (current-error-port) (format (current-error-port)
"error: corrupt signature data: ~a~%" "error: corrupt signature data: ~a~%"
(gcry-sexp->string sig+data)) (canonical-sexp->string sig+data))
(exit 1))))) (exit 1)))))
(("--help") (("--help")
(display (_ "Usage: guix authenticate OPTION... (display (_ "Usage: guix authenticate OPTION...

46
tests/pk-crypto.scm
View file

@ -32,7 +32,7 @@ (define-module (test-pk-crypto)
(define %key-pair (define %key-pair
;; Key pair that was generated with: ;; Key pair that was generated with:
;; (generate-key (string->gcry-sexp "(genkey (rsa (nbits 4:1024)))")) ;; (generate-key (string->canonical-sexp "(genkey (rsa (nbits 4:1024)))"))
;; which takes a bit of time. ;; which takes a bit of time.
"(key-data "(key-data
(public-key (public-key
@ -57,11 +57,11 @@ (define %key-pair
;;"#C0FFEE#" ;;"#C0FFEE#"
"(genkey \n (rsa \n (nbits \"1024\")\n )\n )"))) "(genkey \n (rsa \n (nbits \"1024\")\n )\n )")))
(test-equal "string->gcry-sexp->string" (test-equal "string->canonical-sexp->string"
sexps sexps
(let ((sexps (map string->gcry-sexp sexps))) (let ((sexps (map string->canonical-sexp sexps)))
(and (every gcry-sexp? sexps) (and (every canonical-sexp? sexps)
(map (compose string-trim-both gcry-sexp->string) sexps))))) (map (compose string-trim-both canonical-sexp->string) sexps)))))
(gc) ; stress test! (gc) ; stress test!
@ -75,43 +75,43 @@ (define %key-pair
sexps) sexps)
(map (match-lambda (map (match-lambda
((input token '-> _) ((input token '-> _)
(let ((sexp (find-sexp-token (string->gcry-sexp input) token))) (let ((sexp (find-sexp-token (string->canonical-sexp input) token)))
(and sexp (and sexp
(string-trim-both (gcry-sexp->string sexp)))))) (string-trim-both (canonical-sexp->string sexp))))))
sexps))) sexps)))
(gc) (gc)
(test-equal "gcry-sexp-car + cdr" (test-equal "canonical-sexp-car + cdr"
'("(b \n (c xyz)\n )") '("(b \n (c xyz)\n )")
(let ((lst (string->gcry-sexp "(a (b (c xyz)))"))) (let ((lst (string->canonical-sexp "(a (b (c xyz)))")))
(map (lambda (sexp) (map (lambda (sexp)
(and sexp (string-trim-both (gcry-sexp->string sexp)))) (and sexp (string-trim-both (canonical-sexp->string sexp))))
;; Note: 'car' returns #f when the first element is an atom. ;; Note: 'car' returns #f when the first element is an atom.
(list (gcry-sexp-car (gcry-sexp-cdr lst)))))) (list (canonical-sexp-car (canonical-sexp-cdr lst))))))
(gc) (gc)
(test-equal "gcry-sexp-nth" (test-equal "canonical-sexp-nth"
'("(b pqr)" "(c \"456\")" "(d xyz)" #f #f) '("(b pqr)" "(c \"456\")" "(d xyz)" #f #f)
(let ((lst (string->gcry-sexp "(a (b 3:pqr) (c 3:456) (d 3:xyz))"))) (let ((lst (string->canonical-sexp "(a (b 3:pqr) (c 3:456) (d 3:xyz))")))
;; XXX: In Libgcrypt 1.5.3, (gcry-sexp-nth lst 0) returns LST, whereas in ;; XXX: In Libgcrypt 1.5.3, (canonical-sexp-nth lst 0) returns LST, whereas in
;; 1.6.0 it returns #f. ;; 1.6.0 it returns #f.
(map (lambda (sexp) (map (lambda (sexp)
(and sexp (string-trim-both (gcry-sexp->string sexp)))) (and sexp (string-trim-both (canonical-sexp->string sexp))))
(unfold (cut > <> 5) (unfold (cut > <> 5)
(cut gcry-sexp-nth lst <>) (cut canonical-sexp-nth lst <>)
1+ 1+
1)))) 1))))
(gc) (gc)
(test-equal "gcry-sexp-nth-data" (test-equal "canonical-sexp-nth-data"
'("Name" "Otto" "Meier" #f #f #f) '("Name" "Otto" "Meier" #f #f #f)
(let ((lst (string->gcry-sexp "(Name Otto Meier (address Burgplatz))"))) (let ((lst (string->canonical-sexp "(Name Otto Meier (address Burgplatz))")))
(unfold (cut > <> 5) (unfold (cut > <> 5)
(cut gcry-sexp-nth-data lst <>) (cut canonical-sexp-nth-data lst <>)
1+ 1+
0))) 0)))
@ -120,9 +120,9 @@ (define %key-pair
;; XXX: The test below is typically too long as it needs to gather enough entropy. ;; XXX: The test below is typically too long as it needs to gather enough entropy.
;; (test-assert "generate-key" ;; (test-assert "generate-key"
;; (let ((key (generate-key (string->gcry-sexp ;; (let ((key (generate-key (string->canonical-sexp
;; "(genkey (rsa (nbits 3:128)))")))) ;; "(genkey (rsa (nbits 3:128)))"))))
;; (and (gcry-sexp? key) ;; (and (canonical-sexp? key)
;; (find-sexp-token key 'key-data) ;; (find-sexp-token key 'key-data)
;; (find-sexp-token key 'public-key) ;; (find-sexp-token key 'public-key)
;; (find-sexp-token key 'private-key)))) ;; (find-sexp-token key 'private-key))))
@ -130,13 +130,13 @@ (define %key-pair
(test-assert "bytevector->hash-data->bytevector" (test-assert "bytevector->hash-data->bytevector"
(let* ((bv (sha256 (string->utf8 "Hello, world."))) (let* ((bv (sha256 (string->utf8 "Hello, world.")))
(data (bytevector->hash-data bv "sha256"))) (data (bytevector->hash-data bv "sha256")))
(and (gcry-sexp? data) (and (canonical-sexp? data)
(let-values (((value algo) (hash-data->bytevector data))) (let-values (((value algo) (hash-data->bytevector data)))
(and (string=? algo "sha256") (and (string=? algo "sha256")
(bytevector=? value bv)))))) (bytevector=? value bv))))))
(test-assert "sign + verify" (test-assert "sign + verify"
(let* ((pair (string->gcry-sexp %key-pair)) (let* ((pair (string->canonical-sexp %key-pair))
(secret (find-sexp-token pair 'private-key)) (secret (find-sexp-token pair 'private-key))
(public (find-sexp-token pair 'public-key)) (public (find-sexp-token pair 'public-key))
(data (bytevector->hash-data (data (bytevector->hash-data