OCaml Weekly News

I'm happy to announce the second release of callipyge which is an implementation of curve25519 in OCaml and eqaf which is an implementation of the equal function on string in a linear time - specially to avoid timing attacks.

digestif will be updated with eqaf too.

The goal of callipyge is to have a good implementation of curve25519 but it should be replaced by a C stub extracted from the HACL Star project (like what Firefox does). So, currently, we provide this implementation which is 3 times slower than the reference implementation.

Then, it's a good project to introduce eqaf which provides only one function equal : string -> string -> bool (a binding to the OpenBSD's implementation) and ensure to execute this function on linear time and avoid timing attacks. So we did some benchmarks and compare them with the current implementation of String.equal from the standard library of OCaml. Then, we get expected results: in any situation eqaf took the same time to compare two string which is not the case with String.equal.

So, happy hacking!

And if you are interesting by eqaf and how we can check if the function has linear time, you should look the first issue of eqaf. You can find a good explanation about expected results of benchmarks on eqaf.

Be Sport is looking for talented developers enjoying functional programming and teamwork. All profiles are welcome.

They will work either on data importation/analysis or on the implementation of our mobile and Web apps. All the code is written in OCaml.

Send me a message for more information!

For those of you who use sedlex, it has moved to a new repository on ocaml-community.

This was done with a github transfer, so existing issues against the repository got moved as well, and existing users should be redirected properly. That said, I've done a pull request to fix the opam packages and hopefully it will be merged soon.

How does the regexp compilation engine compares to what is done in Re? Would it be possible to build a lexer generator on top of an independent regexp library like Tyre or ppx_regexp? (cc @Drup)

That is a very good question, I have some plans in mind, but they require quite a bit of work. Basically, the current situation is the following:

¹: Some built-in mechanism for locally defining regex exists, but no true composition.
²: There are some things to determinize offline, but they need refreshing
³: https://github.com/ocaml/ocaml-re/pull/48
⁴: Within regularity. Lacks full blown complementation. See also this paper.

My plans would not be to try to improve sedlex, but rather to push re (and the related libraries) to the point where it's universally better. Ppx_regexp/tyre provides a convenient "ocamlex" like syntax while preserving composition. The first step would be a refill mechanism, and support for UTF (for which @nojb made a prototype that would need revival).

Performances are a tricky question. Ocamllex is clearly faster, since it generates a C-based DFA. I expect sedlex to be faster than re in small examples, but it would need evaluation. Online determinization is very desirable in many contexts.

wrt. Unicode libraries: At least for sedlex, it was designed so that bunzli's libraries can be used before giving the stream to sedlex. Either to re-encode, or to normalize. I think that's a decen way of doing things.

First off, I'm pleased to see sedlex getting some love finally. Very grateful to the community for that.

I would like to add here that my forthcoming Orsetto project includes another alternative to sedlex that might be worth noting, although it has issues and it remains in the "unstable" branch while I'm slowly working on it in my copious spare time.

I would describe it here as follows:

¹: A subset of UTS #18, RL1 (no loose matching, word or line boundaries, etc.)

Also, I'm not sure what "refill" means here, so I didn't characterize it.

I am announcing the first release of noise, an implementation of the Noise Protocol Framework.

It contains building blocks to implement a secure protocol with confidentiality and authentication on top of modern cryptographic primitives. This protocol framework is used by WhatsApp, WireGuard, and Lightning.

This is still a very early version:

• it contains some custom implementations of cryptographic primitives
• the interface is unstable
• most applications need a higher level protocol like NoiseSocket, which is comparable to TLS

Next on my roadmap is implementing a WireGuard client and server that can be used in Mirage.

If you are interested in implementing a protocol that uses Noise, please get in touch!

I am pleased to announce the release of Bindlib 5.0.1, which is a library for handling structures with bound (and free) variables (typical applications include the development of languages and proof systems). It has already been available on Opam for several weeks, and the source code of the latest version can be found in the development repository.

This new version provides a simpler, more concise interface. It is extensively documented, and includes a small tutorial. An introductory paper has also been recently presented at the LFMTP 2018 workshop.

Bindlib has already been used in fairly big projects (from the most recent): Lambdapi, PML₂, SubML, PML, and many other smaller prototypes.

The implementation is very efficient (in terms of substitution), and it handles renaming to avoid capture.

Feel free to give feedback!

Here is a sneak peek at some potential future features of the Ocaml compiler, discussed by their implementers in these Github Pull Requests.

• Stop supporting obsolete platforms
• {WIP} Deprecated optional arguments