nettle-bugs

nettle-bugs@lists.lysator.liu.se

2191 discussions

[PATCH 1/2] arm: Add .arch directives for armv6
by Martin Storsjö 24 Jan '15

24 Jan '15

This allows building these files as part of a fat build, even if the assembler by default targets a lower architecture version. --- arm/v6/aes-decrypt-internal.asm | 2 ++ arm/v6/aes-encrypt-internal.asm | 2 ++ arm/v6/sha1-compress.asm | 1 + arm/v6/sha256-compress.asm | 1 + 4 files changed, 6 insertions(+) diff --git a/arm/v6/aes-decrypt-internal.asm b/arm/v6/aes-decrypt-internal.asm index 28d8f6f..3eab3eb 100644 --- a/arm/v6/aes-decrypt-internal.asm +++ b/arm/v6/aes-decrypt-internal.asm @@ -30,6 +30,8 @@ ifelse(< not, see http://www.gnu.org/licenses/. >) + .arch armv6 + include_src(<arm/aes.m4>) define(<PARAM_ROUNDS>, <r0>) diff --git a/arm/v6/aes-encrypt-internal.asm b/arm/v6/aes-encrypt-internal.asm index f7f4769..e4fa25d 100644 --- a/arm/v6/aes-encrypt-internal.asm +++ b/arm/v6/aes-encrypt-internal.asm @@ -30,6 +30,8 @@ ifelse(< not, see http://www.gnu.org/licenses/. >) + .arch armv6 + include_src(<arm/aes.m4>) C Benchmarked at at 706, 870, 963 cycles/block on cortex A9, diff --git a/arm/v6/sha1-compress.asm b/arm/v6/sha1-compress.asm index fc1ebf0..59d6297 100644 --- a/arm/v6/sha1-compress.asm +++ b/arm/v6/sha1-compress.asm @@ -31,6 +31,7 @@ ifelse(< >) .file "sha1-compress.asm" + .arch armv6 define(<STATE>, <r0>) define(<INPUT>, <r1>) diff --git a/arm/v6/sha256-compress.asm b/arm/v6/sha256-compress.asm index 93c12b1..7560778 100644 --- a/arm/v6/sha256-compress.asm +++ b/arm/v6/sha256-compress.asm @@ -31,6 +31,7 @@ ifelse(< >) .file "sha256-compress.asm" + .arch armv6 define(<STATE>, <r0>) define(<INPUT>, <r1>) -- 1.9.3 (Apple Git-50)

1 1

[Fwd: [gnutls-help] Generating DH Parameters larger than 3072 bits]
by Nikos Mavrogiannopoulos 16 Dec '14

16 Dec '14

Hello, It seems that by switching gnutls to nettle 2.7.x for DSA (and DH) key generation the forwarded issues occur. Would it be possible to have a 2.7.x release with the attached patch? That would allow gnutls 3.3.x generate arbitrary DH parameters. regards, Nikos

1 0

function casts
by Nikos Mavrogiannopoulos 13 Dec '14

13 Dec '14

It seems that in the GCM macros nettle uses casts to functions. That is pretty dangerous with the changes of parameters in functions in nettle 3. The issue is the compiler will not warn for serious errors such as different function type. An example macro is GCM_ENCRYPT. #define GCM_ENCRYPT(ctx, encrypt, length, dst, src) \ (0 ? (encrypt)(&(ctx)->cipher, 0, (void *)0, (void *)0) \ : gcm_encrypt(&(ctx)->gcm, &(ctx)->key, &(ctx)->cipher, \ (nettle_cipher_func *) (encrypt), \ (length), (dst), (src))) I don't think that nettle should be casting functions. The issue seems to be present in ctr, eax and cbc modes as well. regards, Nikos

2 10

Potential bug in nettle-benchmark.c
by Eli Zaretskii 12 Dec '14

12 Dec '14

This was flagged by GCC: nettle-benchmark.c: In function 'time_cipher': nettle-benchmark.c:504:29: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess] memset(iv, 0, sizeof(iv)); ^ nettle-benchmark.c:520:29: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess] memset(iv, 0, sizeof(iv)); ^ nettle-benchmark.c:537:29: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess] memset(iv, 0, sizeof(iv)); ^ Here's a suggested patch: --- examples/nettle-benchmark.c~0 2013-05-28 17:21:54.000000000 +0300 +++ examples/nettle-benchmark.c 2014-12-12 17:58:10.670625000 +0200 @@ -501,7 +501,7 @@ time_cipher(const struct nettle_cipher * info.block_size = cipher->block_size; info.iv = iv; - memset(iv, 0, sizeof(iv)); + memset(iv, 0, sizeof(*iv)); cipher->set_encrypt_key(ctx, cipher->key_size, key); @@ -517,7 +517,7 @@ time_cipher(const struct nettle_cipher * info.block_size = cipher->block_size; info.iv = iv; - memset(iv, 0, sizeof(iv)); + memset(iv, 0, sizeof(*iv)); cipher->set_decrypt_key(ctx, cipher->key_size, key); @@ -534,7 +534,7 @@ time_cipher(const struct nettle_cipher * info.block_size = cipher->block_size; info.iv = iv; - memset(iv, 0, sizeof(iv)); + memset(iv, 0, sizeof(*iv)); cipher->set_encrypt_key(ctx, cipher->key_size, key);

2 2

issues found while converting from 2.7 to 3.0
by Nikos Mavrogiannopoulos 08 Dec '14

08 Dec '14

Hello, * gcm.h: The GCM_SET_KEY macro uses key both as input and to access a ctx element, and thus requires the last parameter to be called "key" as well. #define GCM_SET_KEY(ctx, set_key, encrypt, key) \ do { \ (set_key)(&(ctx)->cipher, (key)); \ if (0) (encrypt)(&(ctx)->cipher, 0, (void *)0, (void *)0); \ gcm_set_key(&(ctx)->key, &(ctx)->cipher, \ (nettle_cipher_func *) (encrypt)); \ } while (0) * cbc.h: cbc_encrypt and decrypt use const void* as first parameter. That is, it cannot be wrapped over a function that works for cbc_encrypt as well as gcm_aes_encrypt (the latter doesn't use const). Without casts that is. Overall, what I didn't like it that the new cipher API required more code to wrap around it. * macros.h: The MD_INCR(ctx) macro is now only applicable for sha512. * nettle-types.h: There is still nettle_crypt_func which is identical to nettle_cipher_func. Is that intentional? I was wondering what was its use. * dsa_verify() Note sure if this is a regression, but this function will now succeed verifying data signed with a DSA-2048 key and SHA1 as hash. * libhogweed soname: libhogweed has the same soname with 2.7.1, so applications crash if they are linked against nettle 2.7.1 and 3.0 is installed (that is because hogweed links against libnettle.so.5). It may make sense for both libraries to share the same so version. regards, Nikos

2 16

gcm + encrypt_message
by Nikos Mavrogiannopoulos 25 Nov '14

25 Nov '14

I am trying to figure out how to wrap around CCM and GCM, and it seems like a hard task. They are totally incompatible. Would it make sense instead of have an equivalent of ccm_decrypt_message() in gcm as well, and make that the AEAD API? regards, Nikos

3 2

symbol versioning
by Nikos Mavrogiannopoulos 24 Nov '14

24 Nov '14

The attached patch will add symbol versioning in nettle. That would mean that software linked against nettle 3.x will be able to interoperate with libraries that are linked on a previous version of nettle (and vice versa). You could check the new symbol names with "readelf -Ws libnettle.so" regards, Nikos

2 2

FAILs in make check
by braga 10 Nov '14

10 Nov '14

Dear nettle community I am triyng to install nettle2.7.1 (because I want to install gnutls-cli but it doesn't support nettle3.0) on my Ubuntu 12.04 i686 architecture but I always get this result on make check zaamus@zaamuspc:~/Dependencies/nettle-2.7.1$ make check make check-here make[1]: ingresso nella directory "/home/zaamus/Dependencies/nettle-2.7.1" true make[1]: uscita dalla directory "/home/zaamus/Dependencies/nettle-2.7.1" set -e; for d in tools testsuite examples; do \ echo "Making check in $d" ; (cd $d && make check); done Making check in tools make[1]: ingresso nella directory "/home/zaamus/Dependencies/nettle-2.7.1/tools" true make[1]: uscita dalla directory "/home/zaamus/Dependencies/nettle-2.7.1/tools" Making check in testsuite make[1]: ingresso nella directory "/home/zaamus/Dependencies/nettle-2.7.1/testsuite" LD_LIBRARY_PATH=../.lib PATH="../.lib:$PATH" srcdir="." \ EMULATOR="" NM="nm" EXEEXT="" \ ../run-tests aes-test arcfour-test arctwo-test blowfish-test cast128-test base16-test base64-test camellia-test des-test des3-test des-compat-test md2-test md4-test md5-test md5-compat-test memxor-test gosthash94-test ripemd160-test salsa20-test sha1-test sha224-test sha256-test sha384-test sha512-test sha3-permute-test sha3-224-test sha3-256-test sha3-384-test sha3-512-test serpent-test twofish-test knuth-lfib-test cbc-test ctr-test gcm-test hmac-test umac-test meta-hash-test meta-cipher-test meta-armor-test buffer-test yarrow-test pbkdf2-test sexp-test sexp-format-test rsa2sexp-test sexp2rsa-test bignum-test random-prime-test pkcs1-test rsa-test rsa-encrypt-test rsa-keygen-test dsa-test dsa-keygen-test ecc-mod-test ecc-modinv-test ecc-redc-test ecc-mul-g-test ecc-mul-a-test ecdsa-sign-test ecdsa-verify-test ecdsa-keygen-test cxx-test sexp-conv-test pkcs1-conv-test symbols-test PASS: aes PASS: arcfour PASS: arctwo PASS: blowfish PASS: cast128 PASS: base16 PASS: base64 PASS: camellia PASS: des PASS: des3 PASS: des-compat PASS: md2 PASS: md4 PASS: md5 PASS: md5-compat PASS: memxor PASS: gosthash94 PASS: ripemd160 PASS: salsa20 PASS: sha1 PASS: sha224 PASS: sha256 PASS: sha384 PASS: sha512 PASS: sha3-permute PASS: sha3-224 PASS: sha3-256 PASS: sha3-384 PASS: sha3-512 PASS: serpent PASS: twofish PASS: knuth-lfib PASS: cbc PASS: ctr PASS: gcm PASS: hmac PASS: umac PASS: meta-hash PASS: meta-cipher PASS: meta-armor PASS: buffer PASS: yarrow PASS: pbkdf2 PASS: sexp PASS: sexp-format PASS: rsa2sexp PASS: sexp2rsa PASS: bignum PASS: random-prime PASS: pkcs1 PASS: rsa PASS: rsa-encrypt PASS: rsa-keygen PASS: dsa PASS: dsa-keygen ./ecc-mod-test: symbol lookup error: ../.lib/libhogweed.so.2: undefined symbol: __gmpz_limbs_read FAIL: ecc-mod ./ecc-modinv-test: symbol lookup error: ../.lib/libhogweed.so.2: undefined symbol: __gmpz_limbs_read FAIL: ecc-modinv ./ecc-redc-test: symbol lookup error: ../.lib/libhogweed.so.2: undefined symbol: __gmpz_limbs_read FAIL: ecc-redc ./ecc-mul-g-test: symbol lookup error: ../.lib/libhogweed.so.2: undefined symbol: __gmpn_cnd_add_n FAIL: ecc-mul-g ./ecc-mul-a-test: symbol lookup error: ../.lib/libhogweed.so.2: undefined symbol: __gmpn_cnd_add_n FAIL: ecc-mul-a ./ecdsa-sign-test: symbol lookup error: ../.lib/libhogweed.so.2: undefined symbol: __gmpz_limbs_modify FAIL: ecdsa-sign ./ecdsa-verify-test: symbol lookup error: ../.lib/libhogweed.so.2: undefined symbol: __gmpz_limbs_read FAIL: ecdsa-verify ./ecdsa-keygen-test: symbol lookup error: ../.lib/libhogweed.so.2: undefined symbol: __gmpn_cnd_add_n FAIL: ecdsa-keygen PASS: cxx PASS: sexp-conv PASS: pkcs1-conv PASS: symbols ==================== 8 of 67 tests failed ==================== make[1]: *** [check] Errore 1 make[1]: uscita dalla directory "/home/zaamus/Dependencies/nettle-2.7.1/testsuite" make: *** [check] Errore 2 I have libgcrypt1.6.2, libgpg-error1.17, m4 macro processor and gmp6.0.0 installed. Library lgmp is correctly found when I compile some random c source. Can you help me? Do you need other information? Thanks, Vittorio -- Vittorio Francesco Braga PhD student in Tor Vergata University of Rome Mobile: +393203753307, Office (PhD room): +390672594868

2 10

chacha-poly1305
by Nikos Mavrogiannopoulos 31 Oct '14

31 Oct '14

Hello, I was checking what is required for the chacha-poly1305 implementation to be kept up to date with the current draft [0], on Last-Call. My understanding is that the current implementation: 1. Is missing support for 96-bit nonce Chacha (could be solved by adding a chacha_set_nonce96 function) 2. Misses the optimization which you proposed to CFRG (and was incorporated). It seems however, that if nettle is changed for the latter (i.e., to pad AAD), then using chacha_poly1305_update() becomes tricky. It could only be called once. Would in that case make sense to rename it to chacha_poly1305_set_aad() rather than update? regards, Nikos [0]. https://tools.ietf.org/html/draft-irtf-cfrg-chacha20-poly1305-02

3 8

Side-channel silence
by nisse＠lysator.liu.se 29 Oct '14

29 Oct '14

I've written a simple program to setup valgrind to check for bad uses of secret data. Maybe you have heard of Adam Langley's ctgrind (https://github.com/agl/ctgrind), but it seems to work fine to use plain valgrind and mark the secret data with VALGRIND_MAKE_MEM_UNDEFINED. Non-silent algorithms include aes, camellia, cast128, twofish, arctwo, des, blowfish, gcm (the hashing), arcfour. Almost anything using sboxes. Silent algorithms include serpent (sboxes, but with nice bit-slicing instead of tables), salsa20, chacha, poly1305. Not sure if and how this testing could be added to a plain make check EMULATOR='$(VALGRIND)' As for AES, an implementations using the aesni instructions ought to be side-channel silent. And if one is concerned about side channel attacks on AES, but too conservative to jump to salsa20 or chacha, serpent might be a good alternative. (I'll be doing a short talk on side-channel attacks on Southpole's 15 year anniversary party on November 7, so that's why I'm looking into this now). Regards, /Niels -----8<--- /* cipher-sidechannel-test.c Copyright (C) 2014 Niels MÃ¶ller This file is part of GNU Nettle. GNU Nettle is free software: you can redistribute it and/or modify it under the terms of either: * the GNU Lesser General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. or * the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. or both in parallel, as here. GNU Nettle is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received copies of the GNU General Public License and the GNU Lesser General Public License along with this program. If not, see http://www.gnu.org/licenses/. */ #include "testutils.h" #include "nettle-internal.h" #if !HAVE_VALGRIND_MEMCHECK_H void testmain (void) { SKIP (); } #else /* HAVE_VALGRIND_MEMCHECK_H */ #include <valgrind/memcheck.h> static uint8_t * xalloc_secret (size_t size) { uint8_t *p = xalloc (size); memset (p, 0, size); VALGRIND_MAKE_MEM_UNDEFINED (p, size); return p; } static void test_sc_cipher (const struct nettle_cipher *cipher) { void *ctx; uint8_t *key; uint8_t *src; uint8_t *dst; ctx = xalloc (cipher->context_size); key = xalloc_secret (cipher->key_size); src = xalloc_secret (cipher->block_size); dst = xalloc (cipher->block_size); cipher->set_encrypt_key (ctx, key); cipher->encrypt (ctx, cipher->block_size, dst, src); free (ctx); free (key); free (src); free (dst); } #define DATA_SIZE 32 static void test_sc_aead (const struct nettle_aead *aead) { void *ctx; uint8_t *key; uint8_t *nonce; uint8_t *src; uint8_t *data; uint8_t *dst; uint8_t *digest; ctx = xalloc (aead->context_size); key = xalloc_secret (aead->key_size); nonce = xalloc_secret (aead->nonce_size); src = xalloc_secret (aead->block_size); data = xalloc_secret (DATA_SIZE); dst = xalloc (aead->block_size); digest = xalloc (aead->digest_size); aead->set_encrypt_key (ctx, key); if (aead->set_nonce) aead->set_nonce (ctx, nonce); if (aead->update) aead->update (ctx, DATA_SIZE, data); aead->encrypt (ctx, aead->block_size, dst, src); if (aead->update) aead->digest (ctx, aead->digest_size, digest); free (ctx); free (key); free (nonce); free (src); free (data); free (dst); free (digest); } static const struct nettle_cipher * other_ciphers[] = { &nettle_des, &nettle_des3, &nettle_blowfish128, NULL, }; static const struct nettle_aead * other_aeads[] = { &nettle_arcfour128, &nettle_chacha, &nettle_salsa20, &nettle_salsa20r12, NULL, }; void test_main (void) { unsigned i; const struct nettle_cipher *cipher; const struct nettle_aead *aead; for (i = 0; ((cipher = nettle_ciphers[i])); i++) test_sc_cipher (cipher); for (i = 0; ((cipher = other_ciphers[i])); i++) test_sc_cipher (cipher); for (i = 0; ((aead = nettle_aeads[i])); i++) test_sc_aead (aead); for (i = 0; ((aead = other_aeads[i])); i++) test_sc_aead (aead); } #endif /* HAVE_VALGRIND_MEMCHECK_H */ -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs