nettle-bugs September 2026

nettle-bugs@lists.lysator.liu.se

2 participants
3 discussions

ML-KEM
by Niels Möller 25 Sep '26

25 Sep '26

Hi, I've now merge Daiki's ML-KEM implementation, see https://git.lysator.liu.se/nettle/nettle/-/merge_requests/67. I think there's some further changes I think I'd like to do before release: 1. Add more randomized tests, and add assert_maybe for some of the invariants, in particular for arithmetics. 2. Probably remove the ml_kem_params from the api, and instead use separate functions for ML-KEM 768 and ML-KEM 1024. 3. Add functions exposing structs for expanded keys. To avoid having to expand them over and over again if using the same key repeatedly. And for all-in-one functions, these structs could also be used as the types for needed scratch space, to make things a bit more type/alignment safe, and have a natural way to allocate needed storage without the _itch functions. Should then be done in a consistent way also for sntrup. (The reason sntrup api doesn't have any itch function is that its expanded keys are smaller, and it's more reasonable to just allocate them on the stack). 4. Micro optimize various internals. Regards, /Niels -- Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677. Internet email is subject to wholesale government surveillance.

2 4

FYI: Montréal next week
by Niels Möller 23 Sep '26

23 Sep '26

I'll be traveling to Montréal over coming weekend and next week. Tuesday-Thursday I'll attend https://transparency.dev/summit2026/. I'll be offline much of the time, but if anyone is in the area and want to meet up, let me know. Regards, /Niels -- Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677. Internet email is subject to wholesale government surveillance.

1 0

Canonicalization problems with gostdsa
by Niels Möller 06 Sep '26

06 Sep '26

Hi, I've received a bug report on gostdsa. When the digest is converted to an integer mod q, the spec says that if that happens to become 0, it should be replaced by 1 (and using 0 results in private key leakage). The current code checks for 0 without first reducing mod q, which is bad. I have a tentative fix on branch https://git.lysator.liu.se/nettle/nettle/-/tree/fix-gostdsa-zero. Then there's a related problem in handling of the "UKM" input for gostdsa_vko, if that happens to equal q or a multiple thereof. I suspect the UKM is usually rather small, which would help. E.g., if I could do something like ukm_max_length = (ecc->q.bit_size - 1) / 8; assert (ukm_length <= ukm_max_length); the number would surely be less than q, and current plain check for 0 would be fine. Is there a specified maximum size? I've looked at * RFC 4357, which seems to say the UKM is 64 bits * RFC 9189, which seems to say that the UKM is 128 bits (16 bytes). * GnuTLS (only user of this function I'm aware of). It's unobvious to me what size of the nonce/ukm is actually passed down to nettle, but at least I've found a #define VKO_GOST_UKM_LEN 8 which seems to indicate 64 bits. Anyone who's more familiar with how this is used in TLS or elsewhere? Regards, /Niels -- Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677. Internet email is subject to wholesale government surveillance.

2 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs September 2026