nettle-bugs

nettle-bugs@lists.lysator.liu.se

3 participants
2194 discussions

OCB mode
by Nikos Mavrogiannopoulos 28 Jan '15

28 Jan '15

Hello, What do you think of having OCB mode in nettle? I particularly like OCB due to it's simplicity and performance comparing to GCM/CCM, but was always patented. However in [0] there is license1 which states: "Under this license, you are authorized to make, use, and distribute open-source software implementations of OCB. This license terminates for you if you sue someone over their open-source software implementation of OCB claiming that you have a patent covering their implementation." What do you think? Should the FSF be consulted on that? regards, Nikos [0]. http://www.cs.ucdavis.edu/~rogaway/ocb/license.htm

4 8

ecc.h vs ecc-internal.h
by nisse＠lysator.liu.se 27 Jan '15

27 Jan '15

I'm about to remove a lot of the internal declarations from ecc.h, and move the ones which still are needed to ecc-internal.h. Problem is that most of these functions work only with particular curve types, and are typically installed in function pointers in struct ecc_curve. If they really are needed as public functions, they must be reimplemented to jump via the appropriate function pointer. And some, like most or all of the corresponding itch functions, are not even defined anywhere anymore (replaced by macros in ecc-internal.h, and fields in struct ecc_curve). ecc_size_j is a borderline case, not sure if it should be public (if so, it should probably be renamed, and not mean "convert to jacobian coordinates", but "convert to whatever internal representation is appropriate for the curve". And everything below ecc_size_j in ecc.h should be removed. Any objections? Any function applications are relying on? Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 2

Intel aes instructions
by nisse＠lysator.liu.se 25 Jan '15

25 Jan '15

I've just pushed new aes code using intel's aesni instructions. See https://git.lysator.liu.se/nettle/nettle/blob/530014f3f811d9018ec83a8748fdb… It gave a speedup of almost 10 times on the haswell machine where I tested it (and in addition, it should avoid sidechannel leaks in those functions). Clearly, this will be more useful after adding support for fat binaries, detecting presence of these instructions at runtime. For now, it has to be enabled explicitly with the configure argument --enable-x86-aesni. I have one question, on how to enable support for these instructions in the assembler. For now I added a pseudo-op .arch bdver2 and that seems to work, but it's a bit too specific for my taste. I would have preferred something like .arch generic64,aes, but I couldn't get that to work. So what's the right way to do this? I haven't played with the corresponding arch flags to gcc, but I'd prefer do declare within the .asm file itself which instruction set it is intended for. Feedback on the actual assembler code is also appreciated, of course. It's pretty basic, a dozen lines, no unrolling or other cleverness. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

5 34

[PATCH 1/2] arm: Add .arch directives for armv6
by Martin Storsjö 24 Jan '15

24 Jan '15

This allows building these files as part of a fat build, even if the assembler by default targets a lower architecture version. --- arm/v6/aes-decrypt-internal.asm | 2 ++ arm/v6/aes-encrypt-internal.asm | 2 ++ arm/v6/sha1-compress.asm | 1 + arm/v6/sha256-compress.asm | 1 + 4 files changed, 6 insertions(+) diff --git a/arm/v6/aes-decrypt-internal.asm b/arm/v6/aes-decrypt-internal.asm index 28d8f6f..3eab3eb 100644 --- a/arm/v6/aes-decrypt-internal.asm +++ b/arm/v6/aes-decrypt-internal.asm @@ -30,6 +30,8 @@ ifelse(< not, see http://www.gnu.org/licenses/. >) + .arch armv6 + include_src(<arm/aes.m4>) define(<PARAM_ROUNDS>, <r0>) diff --git a/arm/v6/aes-encrypt-internal.asm b/arm/v6/aes-encrypt-internal.asm index f7f4769..e4fa25d 100644 --- a/arm/v6/aes-encrypt-internal.asm +++ b/arm/v6/aes-encrypt-internal.asm @@ -30,6 +30,8 @@ ifelse(< not, see http://www.gnu.org/licenses/. >) + .arch armv6 + include_src(<arm/aes.m4>) C Benchmarked at at 706, 870, 963 cycles/block on cortex A9, diff --git a/arm/v6/sha1-compress.asm b/arm/v6/sha1-compress.asm index fc1ebf0..59d6297 100644 --- a/arm/v6/sha1-compress.asm +++ b/arm/v6/sha1-compress.asm @@ -31,6 +31,7 @@ ifelse(< >) .file "sha1-compress.asm" + .arch armv6 define(<STATE>, <r0>) define(<INPUT>, <r1>) diff --git a/arm/v6/sha256-compress.asm b/arm/v6/sha256-compress.asm index 93c12b1..7560778 100644 --- a/arm/v6/sha256-compress.asm +++ b/arm/v6/sha256-compress.asm @@ -31,6 +31,7 @@ ifelse(< >) .file "sha256-compress.asm" + .arch armv6 define(<STATE>, <r0>) define(<INPUT>, <r1>) -- 1.9.3 (Apple Git-50)

1 1

[Fwd: [gnutls-help] Generating DH Parameters larger than 3072 bits]
by Nikos Mavrogiannopoulos 16 Dec '14

16 Dec '14

Hello, It seems that by switching gnutls to nettle 2.7.x for DSA (and DH) key generation the forwarded issues occur. Would it be possible to have a 2.7.x release with the attached patch? That would allow gnutls 3.3.x generate arbitrary DH parameters. regards, Nikos

1 0

function casts
by Nikos Mavrogiannopoulos 13 Dec '14

13 Dec '14

It seems that in the GCM macros nettle uses casts to functions. That is pretty dangerous with the changes of parameters in functions in nettle 3. The issue is the compiler will not warn for serious errors such as different function type. An example macro is GCM_ENCRYPT. #define GCM_ENCRYPT(ctx, encrypt, length, dst, src) \ (0 ? (encrypt)(&(ctx)->cipher, 0, (void *)0, (void *)0) \ : gcm_encrypt(&(ctx)->gcm, &(ctx)->key, &(ctx)->cipher, \ (nettle_cipher_func *) (encrypt), \ (length), (dst), (src))) I don't think that nettle should be casting functions. The issue seems to be present in ctr, eax and cbc modes as well. regards, Nikos

2 10

Potential bug in nettle-benchmark.c
by Eli Zaretskii 12 Dec '14

12 Dec '14

This was flagged by GCC: nettle-benchmark.c: In function 'time_cipher': nettle-benchmark.c:504:29: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess] memset(iv, 0, sizeof(iv)); ^ nettle-benchmark.c:520:29: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess] memset(iv, 0, sizeof(iv)); ^ nettle-benchmark.c:537:29: warning: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to provide an explicit length? [-Wsizeof-pointer-memaccess] memset(iv, 0, sizeof(iv)); ^ Here's a suggested patch: --- examples/nettle-benchmark.c~0 2013-05-28 17:21:54.000000000 +0300 +++ examples/nettle-benchmark.c 2014-12-12 17:58:10.670625000 +0200 @@ -501,7 +501,7 @@ time_cipher(const struct nettle_cipher * info.block_size = cipher->block_size; info.iv = iv; - memset(iv, 0, sizeof(iv)); + memset(iv, 0, sizeof(*iv)); cipher->set_encrypt_key(ctx, cipher->key_size, key); @@ -517,7 +517,7 @@ time_cipher(const struct nettle_cipher * info.block_size = cipher->block_size; info.iv = iv; - memset(iv, 0, sizeof(iv)); + memset(iv, 0, sizeof(*iv)); cipher->set_decrypt_key(ctx, cipher->key_size, key); @@ -534,7 +534,7 @@ time_cipher(const struct nettle_cipher * info.block_size = cipher->block_size; info.iv = iv; - memset(iv, 0, sizeof(iv)); + memset(iv, 0, sizeof(*iv)); cipher->set_encrypt_key(ctx, cipher->key_size, key);

2 2

issues found while converting from 2.7 to 3.0
by Nikos Mavrogiannopoulos 08 Dec '14

08 Dec '14

Hello, * gcm.h: The GCM_SET_KEY macro uses key both as input and to access a ctx element, and thus requires the last parameter to be called "key" as well. #define GCM_SET_KEY(ctx, set_key, encrypt, key) \ do { \ (set_key)(&(ctx)->cipher, (key)); \ if (0) (encrypt)(&(ctx)->cipher, 0, (void *)0, (void *)0); \ gcm_set_key(&(ctx)->key, &(ctx)->cipher, \ (nettle_cipher_func *) (encrypt)); \ } while (0) * cbc.h: cbc_encrypt and decrypt use const void* as first parameter. That is, it cannot be wrapped over a function that works for cbc_encrypt as well as gcm_aes_encrypt (the latter doesn't use const). Without casts that is. Overall, what I didn't like it that the new cipher API required more code to wrap around it. * macros.h: The MD_INCR(ctx) macro is now only applicable for sha512. * nettle-types.h: There is still nettle_crypt_func which is identical to nettle_cipher_func. Is that intentional? I was wondering what was its use. * dsa_verify() Note sure if this is a regression, but this function will now succeed verifying data signed with a DSA-2048 key and SHA1 as hash. * libhogweed soname: libhogweed has the same soname with 2.7.1, so applications crash if they are linked against nettle 2.7.1 and 3.0 is installed (that is because hogweed links against libnettle.so.5). It may make sense for both libraries to share the same so version. regards, Nikos

2 16

gcm + encrypt_message
by Nikos Mavrogiannopoulos 25 Nov '14

25 Nov '14

I am trying to figure out how to wrap around CCM and GCM, and it seems like a hard task. They are totally incompatible. Would it make sense instead of have an equivalent of ccm_decrypt_message() in gcm as well, and make that the AEAD API? regards, Nikos

3 2

symbol versioning
by Nikos Mavrogiannopoulos 24 Nov '14

24 Nov '14

The attached patch will add symbol versioning in nettle. That would mean that software linked against nettle 3.x will be able to interoperate with libraries that are linked on a previous version of nettle (and vice versa). You could check the new symbol names with "readelf -Ws libnettle.so" regards, Nikos

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs