nettle-bugs

nettle-bugs@lists.lysator.liu.se

2191 discussions

[PATCH] ctr16: fix encryption if src == dst
by Dmitry Eremin-Solenikov 11 Oct '18

11 Oct '18

If src == dst, ctr16 code will fail to increment src and dst pointers, always overwriting first block. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- ctr16.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ctr16.c b/ctr16.c index 60418e8b9032..7e1c23d20832 100644 --- a/ctr16.c +++ b/ctr16.c @@ -91,7 +91,7 @@ _ctr_crypt16(const void *ctx, nettle_cipher_func *f, f(ctx, CTR_BUFFER_LIMIT, buffer->b, buffer->b); if (length - i < CTR_BUFFER_LIMIT) goto done; - memxor3 (dst, src, buffer->b, CTR_BUFFER_LIMIT); + memxor3 (dst + i, src + i, buffer->b, CTR_BUFFER_LIMIT); } if (blocks > 0) -- 2.18.0

2 4

[PATCH 0/3] Add CMAC-64 and CMAC-DES3 support
by Dmitry Eremin-Solenikov 21 Sep '18

21 Sep '18

To further improve GOST ciphers support in GnuTLS I need 64-bit CMAC variant (since one of GOST ciphers is 64-bit one). Implement CMAC-64 and CMAC-DES3 as a way to prove CMAC-64 correctness. -- With best wishes Dmitry

1 3

Deprecation
by nisse＠lysator.liu.se 13 Aug '18

13 Aug '18

I've looked into using __attribute__ ((deprecated)). See branch attribute-deprecated. I define _NETTLE_ATTRIBUTE_DEPRECATED in nettle-types.h (and _NETTLE_ATTRIBUTE_PURE, needed in a few places). For a start, I've marked the old aes and gcm-aes interfaces as deprecated, as discussed earlier, and the obsolete _rsa_blind and _rsa_unblind functions. Some more functions are candidates for deprecation: 1. Everything in des-compat.h and md5-compat.h. Unless we think it can be deleted without deprecation; I'm not aware of any usage, and they made more sense back in 2001 when Nettle-1.0 was brand new. 2. The "general" hmac functions: hmac_set_key, hmac_update, hmac_digest. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

2 3

[RFC 1/4] hmac: provide alternative HMAC interface
by Dmitry Eremin-Solenikov 30 Jul '18

30 Jul '18

Provide alternative HMAC interface, with context struct having just derived key and single hash state instead of three hash states at once. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- hmac.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ hmac.h | 34 ++++++++++++++++++++++++++++- 2 files changed, 101 insertions(+), 1 deletion(-) diff --git a/hmac.c b/hmac.c index 6ac5e11a0686..44ac705856ad 100644 --- a/hmac.c +++ b/hmac.c @@ -115,3 +115,71 @@ hmac_digest(const void *outer, const void *inner, void *state, memcpy(state, inner, hash->context_size); } + +void +hmac2_set_key(void *outer, void *inner, void *state, + const struct nettle_hash *hash, + size_t key_length, const uint8_t *key) +{ + TMP_DECL(pad, uint8_t, NETTLE_MAX_HASH_BLOCK_SIZE); + TMP_ALLOC(pad, hash->block_size); + + hash->init(state); + if (key_length > hash->block_size) + { + /* Reduce key to the algorithm's hash size. Use the area pointed + * to by state for the temporary state. */ + + TMP_DECL(digest, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE); + TMP_ALLOC(digest, hash->digest_size); + + hash->update(state, key_length, key); + hash->digest(state, hash->digest_size, digest); + + key = digest; + key_length = hash->digest_size; + } + + assert(key_length <= hash->block_size); + + memset(pad, OPAD, hash->block_size); + memxor(pad, key, key_length); + + /* Init happened before */ + hash->update(state, hash->block_size, pad); + memcpy(outer, state, hash->state_size); + + memset(pad, IPAD, hash->block_size); + memxor(pad, key, key_length); + + hash->init(state); + hash->update(state, hash->block_size, pad); + + memcpy(inner, state, hash->state_size); +} + +void +hmac2_update(void *state, + const struct nettle_hash *hash, + size_t length, const uint8_t *data) +{ + hash->update(state, length, data); +} + +void +hmac2_digest(const void *outer, const void *inner, void *state, + const struct nettle_hash *hash, + size_t length, uint8_t *dst) +{ + TMP_DECL(digest, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE); + TMP_ALLOC(digest, hash->digest_size); + + hash->digest(state, hash->digest_size, digest); + + memcpy(state, outer, hash->state_size); + + hash->update(state, hash->digest_size, digest); + hash->digest(state, length, dst); + + memcpy(state, inner, hash->state_size); +} diff --git a/hmac.h b/hmac.h index 40a8e77aab6d..e6519023d259 100644 --- a/hmac.h +++ b/hmac.h @@ -49,6 +49,9 @@ extern "C" { #define hmac_set_key nettle_hmac_set_key #define hmac_update nettle_hmac_update #define hmac_digest nettle_hmac_digest +#define hmac2_set_key nettle_hmac2_set_key +#define hmac2_update nettle_hmac2_update +#define hmac2_digest nettle_hmac2_digest #define hmac_md5_set_key nettle_hmac_md5_set_key #define hmac_md5_update nettle_hmac_md5_update #define hmac_md5_digest nettle_hmac_md5_digest @@ -87,6 +90,24 @@ hmac_digest(const void *outer, const void *inner, void *state, size_t length, uint8_t *digest); +void +hmac2_set_key(void *outer, void *inner, void *state, + const struct nettle_hash *hash, + size_t length, const uint8_t *key); + +/* This function is not strictly needed, it's s just the same as the + * hash update or hmac2_update functions. */ +void +hmac2_update(void *state, + const struct nettle_hash *hash, + size_t length, const uint8_t *data); + +void +hmac2_digest(const void *outer, const void *inner, void *state, + const struct nettle_hash *hash, + size_t length, uint8_t *digest); + + #define HMAC_CTX(type) \ { type outer; type inner; type state; } @@ -98,10 +119,21 @@ hmac_digest(const void *outer, const void *inner, void *state, hmac_digest( &(ctx)->outer, &(ctx)->inner, &(ctx)->state, \ (hash), (length), (digest) ) +#define HMAC2_CTX(ctx_type, type) \ +{ type outer; type inner; ctx_type state; } + +#define HMAC2_SET_KEY(ctx, hash, length, key) \ + hmac2_set_key( &(ctx)->outer, &(ctx)->inner, &(ctx)->state, \ + (hash), (length), (key) ) + +#define HMAC2_DIGEST(ctx, hash, length, digest) \ + hmac2_digest( &(ctx)->outer, &(ctx)->inner, &(ctx)->state, \ + (hash), (length), (digest) ) + /* HMAC using specific hash functions */ /* hmac-md5 */ -struct hmac_md5_ctx HMAC_CTX(struct md5_ctx); +struct hmac_md5_ctx HMAC2_CTX(struct md5_ctx, struct md5_state); void hmac_md5_set_key(struct hmac_md5_ctx *ctx, -- 2.18.0

2 4

[PATCH] Add benchmarking for HMAC functions
by Dmitry Eremin-Solenikov 30 Jul '18

30 Jul '18

In preparation of changing internal HMAC interface add benchmarking for HMAC functions. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- examples/nettle-benchmark.c | 154 ++++++++++++++++++++++++++++++++++++ 1 file changed, 154 insertions(+) diff --git a/examples/nettle-benchmark.c b/examples/nettle-benchmark.c index 5a88e72dd678..101ba7d4abcc 100644 --- a/examples/nettle-benchmark.c +++ b/examples/nettle-benchmark.c @@ -67,6 +67,7 @@ #include "umac.h" #include "cmac.h" #include "poly1305.h" +#include "hmac.h" #include "nettle-meta.h" #include "nettle-internal.h" @@ -476,6 +477,147 @@ time_poly1305_aes(void) time_function(bench_hash, &info)); } +struct bench_hmac_info +{ + void *ctx; + nettle_hash_update_func *update; + nettle_hash_digest_func *digest; + size_t length; + size_t digest_length; + const uint8_t *data; +}; + +static void +bench_hmac(void *arg) +{ + struct bench_hmac_info *info = arg; + uint8_t digest[NETTLE_MAX_HASH_DIGEST_SIZE]; + size_t pos, length; + + length = info->length; + for (pos = 0; pos < BENCH_BLOCK; pos += length) + { + size_t single = pos + length < BENCH_BLOCK ? + length : + BENCH_BLOCK - pos; + info->update(info->ctx, single, info->data + pos); + info->digest(info->ctx, info->digest_length, digest); + } +} + +static const struct +{ + size_t length; + const char *msg; +} hmac_tests[] = { + { 64, "64 bytes" }, + { 256, "256 bytes" }, + { 1024, "1024 bytes" }, + { 4096, "4096 bytes" }, + { BENCH_BLOCK, "single msg" }, + { 0, NULL }, +}; + +static void +time_hmac_md5(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_md5_ctx md5_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_md5_set_key(&md5_ctx, MD5_BLOCK_SIZE, data); + info.ctx = &md5_ctx; + info.update = (nettle_hash_update_func *) hmac_md5_update; + info.digest = (nettle_hash_digest_func *) hmac_md5_digest; + info.digest_length = MD5_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-md5", hmac_tests[pos].msg, MD5_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + +static void +time_hmac_sha1(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_sha1_ctx sha1_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_sha1_set_key(&sha1_ctx, SHA1_BLOCK_SIZE, data); + info.ctx = &sha1_ctx; + info.update = (nettle_hash_update_func *) hmac_sha1_update; + info.digest = (nettle_hash_digest_func *) hmac_sha1_digest; + info.digest_length = SHA1_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-sha1", hmac_tests[pos].msg, SHA1_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + +static void +time_hmac_sha256(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_sha256_ctx sha256_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_sha256_set_key(&sha256_ctx, SHA256_BLOCK_SIZE, data); + info.ctx = &sha256_ctx; + info.update = (nettle_hash_update_func *) hmac_sha256_update; + info.digest = (nettle_hash_digest_func *) hmac_sha256_digest; + info.digest_length = SHA256_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-sha256", hmac_tests[pos].msg, SHA256_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + +static void +time_hmac_sha512(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_sha512_ctx sha512_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_sha512_set_key(&sha512_ctx, SHA512_BLOCK_SIZE, data); + info.ctx = &sha512_ctx; + info.update = (nettle_hash_update_func *) hmac_sha512_update; + info.digest = (nettle_hash_digest_func *) hmac_sha512_digest; + info.digest_length = SHA512_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-sha512", hmac_tests[pos].msg, SHA512_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + static int prefix_p(const char *prefix, const char *s) { @@ -883,6 +1025,18 @@ main(int argc, char **argv) if (!alg || strstr(aeads[i]->name, alg)) time_aead(aeads[i]); + if (!alg || strstr ("hmac-md5", alg)) + time_hmac_md5(); + + if (!alg || strstr ("hmac-sha1", alg)) + time_hmac_sha1(); + + if (!alg || strstr ("hmac-sha256", alg)) + time_hmac_sha256(); + + if (!alg || strstr ("hmac-sha512", alg)) + time_hmac_sha512(); + optind++; } while (alg && argv[optind]); -- 2.18.0

2 1

[PATCH 0/2] Rework HMAC interface
by Dmitry Eremin-Solenikov 25 Jul '18

25 Jul '18

Hello colleagues, I gave a little thought to Niels' idea: 5. Revamp hmac and underlying hash functions with a separate state struct. Probably low priority, but it is a bit silly that, e.g., hmac_sha512_ctx includes three 128-byte large block buffers. I've implemented new approach using hmac2 prefix, but if you like this approach I can switch hmac2 prefix to just hmac and drop older API. -- With best wishes Dmitry

3 6

nettle symbols: improve map files
by Nikos Mavrogiannopoulos 16 Jul '18

16 Jul '18

Hi, This patch makes the exported symbols explicit in the map file. Furthermore it moves symbols only listed in internal headers in a special section which makes them valid only for testing. I've tested it with abi-compliance-checker and it detects the following missing from nettle: nettle_aeads, nettle_armors, nettle_ciphers, nettle_hashes and from hogweed the nettle_secp_*r1, which seem expected. Niels, I'm not sure however if that was your intention. Didn't you want to deprecate some of the _nettle symbols as well like _nettle_secp_256r1? These are however still present in the exported headers and unless we remove them, they seem to be part of the API and ABI. I also attach the script which generated the files in case you'd like to play with it. regards, Nikos

3 26

Xcode/CLT 10+ Patch
by Dominyk Tiller 18 Jun '18

18 Jun '18

Hey folks, With the obvious enough disclaimer that Xcode/CLT 10 are very much beta releases at this point and will remain so for several months yet, I've attached a diff to fix the only current build issue with the new developer tools available for macOS 10.13/10.14. The new Apple LLVM (10.0.0) ships with a new stack probing function, which embeds the symbol `____chkstk_darwin` into seemingly the vast majority of libraries & binaries, including both libnettle.a & libhogweed.a, which in turn currently blows up nettle's `make check` stage on the symbol check: ---------------------- PASS: sexp-conv PASS: pkcs1-conv PASS: nettle-pbkdf2 Exported symbols in libnettle.a, lacking the nettle prefix: 00000000000001b0 T ____chkstk_darwin 0000000000000230 T ____chkstk_darwin 0000000000000350 T ____chkstk_darwin 0000000000000360 T ____chkstk_darwin 0000000000000380 T ____chkstk_darwin FAIL: symbols PASS: dlopen ==================== 1 of 94 tests failed ==================== make[1]: *** [check] Error 1 make: *** [check] Error 2 ---------------------- The attached diff simply scopes out an exception to the check, with a short explanatory note. I appreciate fully y'all may decide it's too soon to be accepting patches for prerelease developer tools, but the chances of Apple removing the new function or disabling it by default seem pretty low. Let me know if anything further is needed. Thanks, Dominyk -- Sent from macOS. If you wish to communicate more securely my PGP Public Key is at: https://pgp.mit.edu/pks/lookup?search=0xE5F21DD98E4DF470&op=index

2 2

[PATCH] Add support for reading/writing integers in Little Endian format
by Dmitry Eremin-Solenikov 17 Jun '18

17 Jun '18

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- bignum.c | 35 +++++++++++++++++++++++++++++++++++ bignum.h | 17 +++++++++++++++++ testsuite/bignum-test.c | 29 +++++++++++++++++++++++++++++ 3 files changed, 81 insertions(+) diff --git a/bignum.c b/bignum.c index 335252876544..413a630cb3aa 100644 --- a/bignum.c +++ b/bignum.c @@ -133,12 +133,32 @@ nettle_mpz_get_str_256(size_t length, uint8_t *s, const mpz_t x) } } +void +nettle_mpz_get_str_256_u_le(size_t length, uint8_t *s, const mpz_t x) +{ + if (!length) + { + /* x must be zero */ + assert(!mpz_sgn(x)); + return; + } + + size_t count; + + assert(nettle_mpz_sizeinbase_256_u(x) <= length); + mpz_export(s, &count, -1, 1, 0, 0, x); + memset(s + count, 0, length - count); +} + /* Converting from strings */ /* mpz_import was introduced in GMP-4.1 */ #define nettle_mpz_from_octets(x, length, s) \ mpz_import((x), (length), 1, 1, 0, 0, (s)) +#define nettle_mpz_from_octets_le(x, length, s) \ + mpz_import((x), (length), -1, 1, 0, 0, (s)) + void nettle_mpz_set_str_256_u(mpz_t x, size_t length, const uint8_t *s) @@ -154,6 +174,21 @@ nettle_mpz_init_set_str_256_u(mpz_t x, nettle_mpz_from_octets(x, length, s); } +void +nettle_mpz_set_str_256_u_le(mpz_t x, + size_t length, const uint8_t *s) +{ + nettle_mpz_from_octets_le(x, length, s); +} + +void +nettle_mpz_init_set_str_256_u_le(mpz_t x, + size_t length, const uint8_t *s) +{ + mpz_init(x); + nettle_mpz_from_octets_le(x, length, s); +} + void nettle_mpz_set_str_256_s(mpz_t x, size_t length, const uint8_t *s) diff --git a/bignum.h b/bignum.h index 7871d843168c..42a97e63d6b6 100644 --- a/bignum.h +++ b/bignum.h @@ -68,11 +68,19 @@ nettle_mpz_sizeinbase_256_s(const mpz_t x); size_t nettle_mpz_sizeinbase_256_u(const mpz_t x); +#define nettle_mpz_sizeinbase_256_u_le nettle_mpz_sizeinbase_256_u + /* Writes an integer as length octets, using big endian byte order, * and two's complement for negative numbers. */ void nettle_mpz_get_str_256(size_t length, uint8_t *s, const mpz_t x); +/* Writes an integer as length octets, using big endian byte order, + * and unsigned number format. */ +void +nettle_mpz_get_str_256_u_le(size_t length, uint8_t *s, const mpz_t x); + + /* Reads a big endian, two's complement, integer. */ void nettle_mpz_set_str_256_s(mpz_t x, @@ -92,6 +100,15 @@ void nettle_mpz_init_set_str_256_u(mpz_t x, size_t length, const uint8_t *s); +/* Similar, but for little endian byte order. */ +void +nettle_mpz_set_str_256_u_le(mpz_t x, + size_t length, const uint8_t *s); + +void +nettle_mpz_init_set_str_256_u_le(mpz_t x, + size_t length, const uint8_t *s); + /* Returns a uniformly distributed random number 0 <= x < 2^n */ void nettle_mpz_random_size(mpz_t x, diff --git a/testsuite/bignum-test.c b/testsuite/bignum-test.c index 602554b53941..79fd92e2d37d 100644 --- a/testsuite/bignum-test.c +++ b/testsuite/bignum-test.c @@ -34,6 +34,30 @@ test_bignum(const char *hex, const struct tstring *base256) free(buf); } +static void +test_bignum_le(const char *hex, const struct tstring *base256) +{ + mpz_t a; + mpz_t b; + uint8_t *buf; + + mpz_init_set_str(a, hex, 16); + nettle_mpz_init_set_str_256_u_le(b, base256->length, base256->data); + + ASSERT(mpz_cmp(a, b) == 0); + + buf = xalloc(base256->length + 1); + memset(buf, 17, base256->length + 1); + + nettle_mpz_get_str_256_u_le(base256->length, buf, a); + ASSERT(MEMEQ(base256->length, buf, base256->data)); + + ASSERT(buf[base256->length] == 17); + + mpz_clear(a); mpz_clear(b); + free(buf); +} + static void test_size(long x, unsigned size) { @@ -86,6 +110,11 @@ test_main(void) test_bignum("-7fff", SHEX( "8001")); test_bignum("-8000", SHEX( "8000")); test_bignum("-8001", SHEX("ff7fff")); + + test_bignum_le("0", SHEX("00")); + test_bignum_le("010203040506", SHEX("060504030201")); + test_bignum_le("80010203040506", SHEX("06050403020180")); + test_bignum_le("01020304050680", SHEX("80060504030201")); #else /* !WITH_HOGWEED */ SKIP(); -- 2.17.1

2 2

[PATCH] Fix quoting in autoconf ifunc test
by Dmitry Eremin-Solenikov 17 Jun '18

17 Jun '18

* aclocal.m4 (NETTLE_CHECK_IFUNC): fix quoting so that AC_LINK_IFELSE/AC_TRY_LINK is defined outside of this test. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- aclocal.m4 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/aclocal.m4 b/aclocal.m4 index 783dbc492b5c..772f68e8eb9d 100644 --- a/aclocal.m4 +++ b/aclocal.m4 @@ -650,7 +650,7 @@ AC_DEFUN([NETTLE_CHECK_IFUNC], [AC_REQUIRE([AC_PROG_CC]) AC_CACHE_CHECK([for ifunc support], nettle_cv_link_ifunc, - AC_LINK_IFELSE([AC_LANG_PROGRAM([ + [AC_LINK_IFELSE([AC_LANG_PROGRAM([ static int foo_imp(int x) { @@ -671,7 +671,7 @@ int foo (int x) __attribute__ ((ifunc("foo_resolv"))); ])], [nettle_cv_link_ifunc=yes], -[nettle_cv_link_ifunc=no])) +[nettle_cv_link_ifunc=no])]) AH_TEMPLATE([HAVE_LINK_IFUNC], [Define if compiler and linker supports __attribute__ ifunc]) if test "x$nettle_cv_link_ifunc" = xyes ; then AC_DEFINE(HAVE_LINK_IFUNC) -- 2.17.1

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs