crypto.ltl

// Lateralus Standard Library — crypto.ltl  (v1.4.0)
// Cryptographic primitives, hashing, and secure utilities
// Wraps built-in preamble crypto functions.

module stdlib.crypto

// -- Hashing ------------------------------------------------------------------

pub fn hash_sha256(data) {
    return sha256(data)
}

pub fn hash_sha512(data) {
    return sha512(data)
}

pub fn hash_blake2b(data) {
    return blake2b(data)
}

pub fn hash_sha3(data) {
    return sha3_256(data)
}

pub fn hash_md5(data) {
    // MD5 — not recommended for security, only checksums
    return md5(data)
}

// -- HMAC ---------------------------------------------------------------------

pub fn hmac(key, message) {
    return hmac_sha256(key, message)
}

// -- Key Derivation -----------------------------------------------------------

pub fn derive_key(password, salt, iterations) {
    return pbkdf2(password, salt, iterations)
}

// -- Symmetric Encryption (Fernet) --------------------------------------------

pub fn encrypt(plaintext, key) {
    return fernet_encrypt(plaintext, key)
}

pub fn decrypt(ciphertext, key) {
    return fernet_decrypt(ciphertext, key)
}

// -- Secure Random ------------------------------------------------------------

pub fn secure_bytes(n) {
    return random_bytes(n)
}

pub fn secure_hex(n) {
    return random_hex(n)
}

pub fn secure_token(n) {
    return random_urlsafe(n)
}

// -- Encoding -----------------------------------------------------------------

pub fn to_base64(data) {
    return b64_encode(data)
}

pub fn from_base64(encoded) {
    return b64_decode(encoded)
}

pub fn to_hex(data) {
    return hex_encode(data)
}

pub fn from_hex(encoded) {
    return hex_decode(encoded)
}

// -- Timing-Safe Comparison ---------------------------------------------------

pub fn safe_compare(a, b) {
    return constant_time_compare(a, b)
}

// -- Password Hashing ---------------------------------------------------------

pub fn hash_password(password, salt) {
    // Using PBKDF2 with 100,000 iterations (OWASP recommendation)
    return derive_key(password, salt, 100000)
}

pub fn verify_password(password, salt, expected_hash) {
    let computed = hash_password(password, salt)
    return safe_compare(computed, expected_hash)
}