crypto 2.1.3

Cryptographic hashing functions for Dart #

A set of cryptographic hashing functions implemented in pure Dart

The following hashing algorithms are supported:

  • SHA-1
  • SHA-224
  • SHA-256
  • SHA-384
  • SHA-512
  • MD5
  • HMAC (i.e. HMAC-MD5, HMAC-SHA1, HMAC-SHA256)

Usage #

Digest on a single input #

To hash a list of bytes, invoke the convert method on the sha1, sha256 or md5 objects.

import 'package:crypto/crypto.dart';
import 'dart:convert'; // for the utf8.encode method

void main() {
  var bytes = utf8.encode("foobar"); // data being hashed

  var digest = sha1.convert(bytes);

  print("Digest as bytes: ${digest.bytes}");
  print("Digest as hex string: $digest");
}

Digest on chunked input #

If the input data is not available as a single list of bytes, use the chunked conversion approach.

Invoke the startChunkedConversion method to create a sink for the input data. On the sink, invoke the add method for each chunk of input data, and invoke the close method when all the chunks have been added. The digest can then be retrieved from the Sink<Digest> used to create the input data sink.

import 'dart:convert';
import 'package:convert/convert.dart';
import 'package:crypto/crypto.dart';

void main() {
  var firstChunk = utf8.encode("foo");
  var secondChunk = utf8.encode("bar");

  var output = new AccumulatorSink<Digest>();
  var input = sha1.startChunkedConversion(output);
  input.add(firstChunk);
  input.add(secondChunk); // call `add` for every chunk of input data
  input.close();
  var digest = output.events.single;

  print("Digest as bytes: ${digest.bytes}");
  print("Digest as hex string: $digest");
}

The above example uses the AccumulatorSink class that comes with the convert package. It is capable of accumulating multiple events, but in this usage only a single Digest is added to it when the data sink's close method is invoked.

HMAC #

Create an instance of the Hmac class with the hash function and secret key being used. The object can then be used like the other hash calculating objects.

import 'dart:convert';
import 'package:crypto/crypto.dart';

void main() {
  var key = utf8.encode('p@ssw0rd');
  var bytes = utf8.encode("foobar");

  var hmacSha256 = new Hmac(sha256, key); // HMAC-SHA256
  var digest = hmacSha256.convert(bytes);
  
  print("HMAC digest as bytes: ${digest.bytes}");
  print("HMAC digest as hex string: $digest");
}

Disclaimer #

Support for this library is given as best effort.

This library has not been reviewed or vetted by security professionals.

Features and bugs #

Please file feature requests and bugs at the issue tracker.

2.1.3 #

  • Security vulnerability: Fixed constant-time comparison in Digest.

2.1.2 #

  • Fix bug in SHA-2 384/512 blocksize.
  • Added HMAC-SHA-2 test vectors

2.1.1+1 #

  • Bump version number for publish mishap (spare file uploaded with pub publish).

2.1.1 #

  • Added a workaround for a bug in DDC (used in build_web_compilers 1.x). This bug is not present in DDK (used in build_web_compilers 2.x).

2.1.0 #

  • Added SHA384, and SHA512
  • Add Sha224 + Refactor
  • Support 32bit and 64bit operations for SHA384/51
  • Add conditional imports
  • De-listify 32bit allocations
  • Add sha monte tests for 224,256,384, and 512

2.0.5 #

  • Changed the max message size instead to 0x3ffffffffffff, which is the largest portable value for both JS and the Dart VM.

2.0.4 #

  • Made max message size a BigNum instead of an int so that dart2js can compile with crypto.

2.0.3 #

  • Updated SDK version to 2.0.0-dev.17.0

2.0.2+1 #

  • Fix SDK constraint.

2.0.2 #

  • Prepare HashSink implementation for limiting integers to 64 bits in Dart language.

2.0.1 #

  • Support convert 2.0.0.

2.0.0 #

Note: There are no APIs in 2.0.0 that weren't also in 0.9.2. Packages that would use 2.0.0 as a lower bound should use 0.9.2 instead—for example, crypto: ">=0.9.2 <3.0.0".

  • Hash and Hmac no longer extend ChunkedConverter.

1.1.1 #

  • Properly close sinks passed to Hash.startChunkedConversion() when ByteConversionSink.close() is called.

1.1.0 #

  • Hmac and Hash now extend the new ChunkedConverter class from dart:convert.

  • Fix all strong mode warnings.

1.0.0 #

  • All APIs that were deprecated in 0.9.2 have been removed. No new APIs have been added. Packages that would use 1.0.0 as a lower bound should use 0.9.2 instead—for example, crypto: ">=0.9.2 <2.0.0".

0.9.2+1 #

  • Avoid core library methods that don't work on dart2js.

0.9.2 #

  • Hash, MD5, SHA1, and SHA256 now implement Converter. They convert between List<int>s and the new Digest class, which represents a hash digest. The Converter APIs—Hash.convert() and Hash.startChunkedConversion—should be used in preference to the old APIs, which are now deprecated.

  • SHA1, SHA256, and HMAC have been renamed to Sha1, Sha256, and Hmac, respectively. The old names still work, but are deprecated.

  • Top-level sha1, sha256, and md5 fields have been added to make it easier to use those hash algorithms without having to instantiate new instances.

  • Hashing now works correctly for input sizes up to 2^64 bytes.

Deprecations #

  • Hash.add, Hash.close, and Hash.newInstance are deprecated. Hash.convert should be used for hashing single values, and Hash.startChunkedConversion should be used for hashing streamed values.

  • SHA1 and SHA256 are deprecated. Use the top-level sha1 and sha256 fields instead.

  • While the MD5 class is not deprecated, the new MD5() constructor is. Use the top-level md5 field instead.

  • HMAC is deprecated. Use Hmac instead.

  • Base64Codec, Base64Encoder, Base64Decoder, Base64EncoderSink, Base64DecoderSink, and BASE64 are deprecated. Use the Base64 APIs in dart:convert instead.

  • CryptoUtils is deprecated. Use the Base64 APIs in dart:convert and the hex APIs in the convert package instead.

0.9.1 #

  • Base64 convert returns an Uint8List
  • Base64 codec and encoder can now take an encodePaddingCharacter
  • Implement a Base64 codec similar to codecs in 'dart:convert'

0.9.0 #

  • ChangeLog starts here.

Use this package as a library

1. Depend on it

Add this to your package's pubspec.yaml file:


dependencies:
  crypto: ^2.1.3

2. Install it

You can install packages from the command line:

with pub:


$ pub get

with Flutter:


$ flutter pub get

Alternatively, your editor might support pub get or flutter pub get. Check the docs for your editor to learn more.

3. Import it

Now in your Dart code, you can use:


import 'package:crypto/crypto.dart';
  
Popularity:
Describes how popular the package is relative to other packages. [more]
99
Health:
Code health derived from static analysis. [more]
100
Maintenance:
Reflects how tidy and up-to-date the package is. [more]
80
Overall:
Weighted score of the above. [more]
95
Learn more about scoring.

We analyzed this package on Sep 13, 2019, and provided a score, details, and suggestions below. Analysis was completed with status completed using:

  • Dart: 2.5.0
  • pana: 0.12.21

Platforms

Detected platforms: Flutter, web, other

No platform restriction found in primary library package:crypto/crypto.dart.

Maintenance suggestions

The package description is too short. (-20 points)

Add more detail to the description field of pubspec.yaml. Use 60 to 180 characters to describe the package, what it does, and its target use case.

Maintain an example.

None of the files in the package's example/ directory matches known example patterns.

Common filename patterns include main.dart, example.dart, and crypto.dart. Packages with multiple examples should provide example/README.md.

For more information see the pub package layout conventions.

Dependencies

Package Constraint Resolved Available
Direct dependencies
Dart SDK >=2.1.0 <3.0.0
collection ^1.0.0 1.14.12
convert >=1.0.0 <3.0.0 2.1.1
typed_data ^1.0.0 1.1.6
Transitive dependencies
charcode 1.1.2
Dev dependencies
pedantic ^1.0.0
test ^1.0.0