sha.clj

(import 'java.security.MessageDigest)

(defn bytes-str
  "Does what it says on the tin"
  [byte-array]
  (apply str (map #(format "%02x" (bit-and % 0xff)) byte-array)))

(defn sha-hash
  "Returns the SHA hash of string s"
  [s]
  (bytes-str
   (.digest
    (doto (MessageDigest/getInstance "SHA-1") (.update (.getBytes s))))))

(defn salted-hash
  [s]
  (sha-hash (str "your salt here" s)))

(defn object-token
  "Creates security token for a given object"
  [x hash-fn]
  (hash-fn (pr-str x)))

(def *token-key* :obj-hash)

(defn sign
  "Returns an object with a verifiable signature"
  [x]
  (with-meta x (assoc ^x *token-key* (object-token x salted-hash))))

(defn auth
  "Verifies the authenticity of a signed object"
  [x]
  (= (^x *token-key*) (object-token x salted-hash)))