sigil-crypto

Cryptographic primitives for Sigil.

Hashing, message authentication, key derivation, base64 encoding, and cryptographically secure random bytes. Built on a vendored mbedTLS and usable independently of TLS.

Modules

Module	Purpose
`(sigil crypto)`	SHA/HMAC/PBKDF2 hashes, base64, random bytes

API summary

Procedure	Purpose
`sha1`	SHA-1 hex digest of a string or bytevector
`sha256`	SHA-256 hex digest of a string or bytevector
`sha256-bytes`	SHA-256 digest as a bytevector
`hmac-sha256`	HMAC-SHA256 hex digest (key + message)
`hmac-sha1`	HMAC-SHA1 hex digest (key + message)
`pbkdf2-sha1`	PBKDF2-SHA1 key derivation (hex digest)
`base64-encode`	Base64 encoding of a string or bytevector
`base64-decode`	Base64 decoding to a string
`random-bytes`	Cryptographically secure random bytevector
`timing-safe-equal?`	Constant-time string comparison

System prerequisites

None beyond a working C toolchain. mbedTLS is vendored under vendor/mbedtls/ and compiled in-tree with a minimal sigil_mbedtls_config.h (TLS 1.2 primitives only — TLS 1.3 and the PSA crypto machinery are compiled out).

Dependencies

sigil-stdlib

Build

sigil deps install
sigil build
sigil test --report

The first build compiles ~108 mbedTLS translation units plus native/crypto.c. Subsequent builds hit the cache.

Usage

(import (sigil crypto))

(sha256 "hello")                          ; => hex string
(sha256-bytes "hello")                    ; => 32-byte bytevector
(hmac-sha256 "secret-key" "message")      ; => hex string
(pbkdf2-sha1 "password" "salt" 4096 20)   ; => hex string
(base64-encode "hello")                   ; => "aGVsbG8="
(base64-decode "aGVsbG8=")                ; => "hello"
(random-bytes 16)                         ; => #u8(...)
(timing-safe-equal? "abc" "abc")          ; => #t

License

BSD-3-Clause.

Vendored mbedTLS (under vendor/mbedtls/) is distributed under Apache-2.0 OR GPL-2.0-or-later. sigil-crypto's own sources are BSD-3-Clause. See vendor/mbedtls/LICENSE for the mbedTLS terms.