Stdlib: Crypto hashing builtins (SHA-256, HMAC-SHA256) #244

New issue

Closed

opened 2026-01-12 02:36:23 +00:00 by navicore · 1 comment

navicore commented

2026-01-12 02:36:23 +00:00

(Migrated from github.com)

Summary

Add cryptographic hashing builtins to enable JWT verification, webhook handling, secure tokens, and API authentication.

Proposed API

# SHA-256 hashing
"hello world" crypto.sha256          # ( String -- String ) hex-encoded
"hello world" crypto.sha256-bytes    # ( String -- Bytes ) raw bytes

# HMAC for API authentication / webhook verification
"webhook-payload" "secret-key" crypto.hmac-sha256
# ( message key -- signature )

# Timing-safe comparison (prevent timing attacks)
received-sig computed-sig crypto.constant-time-eq
# ( String String -- Bool )

Implementation

FFI wrappers around Rust's RustCrypto ecosystem:

sha2 crate for SHA-256/SHA-512
hmac crate for HMAC
subtle crate for constant-time comparison

Estimated effort: 1-2 days

Deliverables Checklist

Runtime builtins in crates/runtime/src/crypto.rs
Unit tests for each function
Integration tests in tests/integration/src/test-crypto.seq
LSP support: signatures in BUILTIN_SIGNATURES, docs in BUILTIN_DOCS
Example: examples/crypto/hash-demo.seq
Example: examples/crypto/webhook-verify.seq
Update docs/BATTERIES_INCLUDED.md status

Use Cases Unlocked

JWT signature verification
Webhook signature validation (GitHub, Stripe, etc.)
Content addressing / checksums
Password hashing preparation (input to bcrypt/argon2)

References

See docs/BATTERIES_INCLUDED.md Priority 4: Cryptography
RustCrypto: https://github.com/RustCrypto

## Summary Add cryptographic hashing builtins to enable JWT verification, webhook handling, secure tokens, and API authentication. ## Proposed API ```seq # SHA-256 hashing "hello world" crypto.sha256 # ( String -- String ) hex-encoded "hello world" crypto.sha256-bytes # ( String -- Bytes ) raw bytes # HMAC for API authentication / webhook verification "webhook-payload" "secret-key" crypto.hmac-sha256 # ( message key -- signature ) # Timing-safe comparison (prevent timing attacks) received-sig computed-sig crypto.constant-time-eq # ( String String -- Bool ) ``` ## Implementation FFI wrappers around Rust's RustCrypto ecosystem: - `sha2` crate for SHA-256/SHA-512 - `hmac` crate for HMAC - `subtle` crate for constant-time comparison Estimated effort: 1-2 days ## Deliverables Checklist - [ ] Runtime builtins in `crates/runtime/src/crypto.rs` - [ ] Unit tests for each function - [ ] Integration tests in `tests/integration/src/test-crypto.seq` - [ ] LSP support: signatures in `BUILTIN_SIGNATURES`, docs in `BUILTIN_DOCS` - [ ] Example: `examples/crypto/hash-demo.seq` - [ ] Example: `examples/crypto/webhook-verify.seq` - [ ] Update `docs/BATTERIES_INCLUDED.md` status ## Use Cases Unlocked - JWT signature verification - Webhook signature validation (GitHub, Stripe, etc.) - Content addressing / checksums - Password hashing preparation (input to bcrypt/argon2) ## References - See `docs/BATTERIES_INCLUDED.md` Priority 4: Cryptography - RustCrypto: https://github.com/RustCrypto

navicore commented

2026-01-12 03:46:07 +00:00

(Migrated from github.com)

https://github.com/navicore/patch-seq/pull/254