计算机密码学与算法工具（Cryptography & Algorithm Tools）

package main

import (
  "crypto/aes"
  "crypto/cipher"
  "crypto/rand"
  "io"
)

func encrypt(plaintext, key []byte) ([]byte, error) {
  block, _ := aes.NewCipher(key)
  aesgcm, _ := cipher.NewGCM(block)
  nonce := make([]byte, aesgcm.NonceSize())
  io.ReadFull(rand.Reader, nonce)
  return aesgcm.Seal(nonce, nonce, plaintext, nil), nil
}

use chacha20poly1305::{
    ChaCha20Poly1305, Key, Nonce, aead::Aead
};
use rand::rngs::OsRng;

let key = Key::from_slice(&[0u8; 32]);
let cipher = ChaCha20Poly1305::new(key);
let nonce = Nonce::from_slice(&[0u8; 12]);

let ct = cipher.encrypt(nonce, b"hello".as_ref())
    .expect("encryption failure");

package main

import (
  "crypto/ed25519"
  "crypto/rand"
)

pub, priv, _ := ed25519.GenerateKey(rand.Reader)
message := []byte("hello world")
sig := ed25519.Sign(priv, message)
ok := ed25519.Verify(pub, message, sig)
// ok == true

from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives import hashes

alice = X25519PrivateKey.generate()
bob = X25519PrivateKey.generate()

alice_shared = alice.exchange(bob.public_key())
bob_shared = bob.exchange(alice.public_key())
assert alice_shared == bob_shared

derived = HKDF(
    algorithm=hashes.SHA256(), length=32, salt=None, info=b'handshake',
).derive(alice_shared)

import "golang.org/x/crypto/argon2"

func hashPassword(pw, salt []byte) []byte {
  return argon2.IDKey(pw, salt,
    1,         // iterations
    64*1024,   // memory (64 MB)
    4,         // parallelism
    32,        // 输出 32 bytes
  )
}
// OWASP 2023 推荐:
// iterations≥2, memory≥46MB

import blake3

h = blake3.blake3(b"hello world")
digest = h.digest()       # 32 bytes
hex_digest = h.hexdigest()

# 增量哈希
h2 = blake3.blake3()
h2.update(b"hello ")
h2.update(b"world")
assert h2.digest() == digest

# 键控模式（MAC）
k = blake3.derive_key(b"app key")
mac = blake3.blake3(b"message", key=k).digest()

package main

import (
  "crypto/tls"
  "net/http"
)

func main() {
  mux := http.NewServeMux()
  mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
    w.Write([]byte("secure"))
  })
  srv := &http.Server{
    Addr: ":8443",
    Handler: mux,
    TLSConfig: &tls.Config{
      MinVersion: tls.VersionTLS13,
      CurvePreferences: []tls.CurveID{
        tls.X25519,
      },
    },
  }
  srv.ListenAndServeTLS("cert.pem", "key.pem")
}

use std::sync::Arc;
use rustls::ClientConfig;

let root_store = rustls::RootCertStore {
    roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
};
let config = ClientConfig::builder()
    .with_root_certificates(root_store)
    .with_no_client_auth();

let server_name = "example.com"
    .try_into()
    .unwrap();
let mut conn = rustls::ClientConnection::new(
    Arc::new(config), server_name
).unwrap();