nettle-bugs

nettle-bugs@lists.lysator.liu.se

2191 discussions

Using side-channel silent GMP functions
by nisse＠lysator.liu.se 03 Jan '14

03 Jan '14

For the next release of GMP, there will be some new public functions for side-channel silent computations, as part of the low-level "mpn" interface. I think it would make sense to rewrite the RSA and DSA private key operations to use side-channel silent functions. This might require further interface changes; I haven't really looked into it yet, so I don't know to which degree backwards compatibility can be kept. I also don't yet know if it's practical to make use of the new functions optional, or if it will make the latest GMP a strict requirement (unless Nettle's public key support is completely disabled). What do you think? Relatedly, I've updated the release plan on http://www.lysator.liu.se/~nisse/nettle/plan.html. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 1

acoustic cryptanalysis
by Nikos Mavrogiannopoulos 19 Dec '13

19 Dec '13

Hello, It seems that some guys managed to "listen" gnupg private keys. While some parts of the attack are gnupg specific, similar attacks could apply in nettle as well (and I guess every implementation that does RSA decryption). This could affect TLS sessions where the server is decrypting client provided ciphertext. I see on their mitigation section that "ciphertext normalization", i.e., c=c%n, avoids their key recovery attack, so given that there is no harm to have this step anyway, it would be nice to have it in nettle as well (patch attached). http://www.cs.tau.ac.il/~tromer/acoustic/ regards, Nikos

2 2

arm-neon/v6 auto-detection
by Nikos Mavrogiannopoulos 18 Dec '13

18 Dec '13

Hello, As it is now the ARM-neon and v6 optimizations are enabled when nettle is compiled on the exact system it is supposed to run. This is very unlikely to happen in some scenarios, as applications intended to run on an arm mobile (eg [0]) cannot know in advance the target. That is a petty because nettle is pretty unique in having support for assembly in ARMv6 or neon. A solution to that issue would be to have a nettle library constructor that runs the equivalent of cpuid in ARM, and stores it to a global variable. Then each assembly module (e.g., aes-arm) will jump to the correct implementation detected at runtime. This requires no global initialization functions or anything like that. In the systems where library constructors are not available (i.e., static linking), the cost would be running the oldest arm assembly version (unless the constructor is called explicitly). This is similar to what openssl is doing already (with the exception that they use a global initialization function instead of a constructor). To me that seems quite a simple way to improve the current situation. regards, Nikos [0]. https://github.com/cernekee/ics-openconnect

4 10

Building nettle in OSX
by Joachim Strömbergson 18 Dec '13

18 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aloha! (Sorry for this stupid question.) I'm trying to get nettle to build in OSX but are having some problems. If i simply do the bootstrap-configure-make I get problems in the assembly phase: <quote> /Applications/Xcode.app/Contents/Developer/usr/bin/make all-here gcc -I. -DHAVE_CONFIG_H -g -O2 -ggdb3 -Wall -W -Wmissing-prototypes - -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith - -Wbad-function-cast -Wnested-externs -fPIC -MT gcm-hash8.o -MD -MP -MF gcm-hash8.o.d -fPIC -c gcm-hash8.s gcm-hash8.s:220:18: error: unexpected token in '.section' directive .section .rodata ^ gcm-hash8.s:224:1: error: unknown directive .hword 0x0000,0xc201,0x8403,0x4602,0x0807,0xca06,0x8c04,0x4e05 ^ gcm-hash8.s:225:1: error: unknown directive .hword 0x100e,0xd20f,0x940d,0x560c,0x1809,0xda08,0x9c0a,0x5e0b ^ .... </quote> Googling I found some other people having problems: https://gist.github.com/morgant/1753095 Turning of assembly (--disable-assembler to configure) I get through the compilation, assembly, but linking fails (similarly the link above): <quote> Undefined symbols for architecture x86_64: "__nettle_aes_decrypt", referenced from: _nettle_aes_decrypt in aes-decrypt.po _nettle_aes128_decrypt in aes-decrypt.po _nettle_aes192_decrypt in aes-decrypt.po _nettle_aes256_decrypt in aes-decrypt.po "__nettle_aes_encrypt", referenced from: _nettle_aes_encrypt in aes-encrypt.po _nettle_aes128_encrypt in aes-encrypt.po _nettle_aes192_encrypt in aes-encrypt.po _nettle_aes256_encrypt in aes-encrypt.po (maybe you meant: __nettle_aes_encrypt_table) ... </quote> This is on OSX 10.9 with gcc being a wrapper around clang: Apple LLVM version 5.0 (clang-500.2.79) (based on LLVM 3.3svn) Target: x86_64-apple-darwin13.0.0 Thread model: posix and as being: Apple Inc version cctools-846.2.4, GNU assembler version 1.38 and ld being: @(#)PROGRAM:ld PROJECT:ld64-224.1 configured to support archs: armv6 armv7 armv7s arm64 i386 x86_64 armv6m armv7m armv7em LTO support using: LLVM version 3.3svn, from Apple Clang 5.0 (build 500.2.79) Anybody succeeding and building nettle on OSX and if so how. Being able to use the optimized assembler versions would also be good. - -- Med vänlig hälsning, Yours Joachim Strömbergson - Alltid i harmonisk svängning. ======================================================================== Joachim Strömbergson Secworks AB joachim(a)secworks.se ======================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlKq4ZcACgkQZoPr8HT30QEy2QCffi/BpWVuYyNKV5oqFLvDlLg0 CeAAoK0VLGcek5vHcUXkMG9QPHgypl2z =a0RI -----END PGP SIGNATURE-----

3 16

Mentioning of .bootstrap in INSTALL?
by Joachim Strömbergson 17 Dec '13

17 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aloha! Cloned nettle and noticed that INSTALL states: "Briefly, the shell commands `./configure; make; make install' should configure, build, and install this package." But at least in the repo there is only a config.ac and you need to run the .bootstrap shell script in order to invoke autoconf and autoheaders in order to get the configure script. Shouldn't INSTALL mention this? - -- Med vänlig hälsning, Yours Joachim Strömbergson - Alltid i harmonisk svängning. ======================================================================== Joachim Strömbergson Secworks AB joachim(a)secworks.se ======================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlKq2LgACgkQZoPr8HT30QEIbACfWjUuo8IAbigziPGwnw4Pbmx5 P8cAni2UtPVOqH52XlBlZmmsGnRfNz7L =ioBH -----END PGP SIGNATURE-----

2 4

TMP_ALLOC and size_t change
by Nikos Mavrogiannopoulos 17 Dec '13

17 Dec '13

Hello, In master (unsigned int) was replaced with (size_t), that allows for even larger sizes to be input to encryption and decryption functions. However, the usage of TMP_ALLOC to make a copy of the input data (e.g., in ctr.c) contradicts that goal. In general I think the usage of alloca() is dangerous as it not always known whether the stack is limited, e.g, when nettle is called in a co-routine or in application with non-growing stack. I think there can be an easy modification of TMP_ALLOC to use malloc for larger than 128 (or any other fixed number), and alloca otherwise. Would you be interested in such a patch? (it would require the introduction of a TMP_FREE as well) regards, Nikos

3 15

[PATCH] source files for chacha
by Joachim Strömbergson 13 Dec '13

13 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aloha! Here is the patch for the chacha implementation. I will create and send patches for the benchmark, meta, testsuite code when I get nettle to properly build. The code in this patch and my own test program builds and runs as available at: https://github.com/secworks/nettle/tree/master/chacha - -- Med vänlig hälsning, Yours Joachim Strömbergson - Alltid i harmonisk svängning. ======================================================================== Joachim Strömbergson Secworks AB joachim(a)secworks.se ======================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlKq85wACgkQZoPr8HT30QG8JgCfc/scXdxeXKJQSMWsWe7LNDHV 8qwAoN43hGYj1VkXadW65INvvm9OnSyY =AAyY -----END PGP SIGNATURE-----

1 0

ChaCha stream cipher for Nettle available
by Joachim Strömbergson 13 Dec '13

13 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aloha! I've taken a shot at implementing the ChaCha stream cipher for Nettle. Nettle is a modified version of Salsa20 done by DJB in order to improve both performance (esp on CPUs with support for data parallelism) and somewhat improved performance. ChaCha has been suggested as replacement for RC4 both by Adam Langley from Google and separately by Nikos and Me. http://cr.yp.to/chacha.html The code in this implementation is heavily based on the Salsa20 implementation in Nettle. The major changes beside name changes are the quarterround schedules, the different state init and the quarterround. This implementation also supports different number of rounds. There is a pretty simple test program that verifies the functionality for 128 and 256 keys as well as 8, 12 and 20 rounds using the testt vectors in the chacha test vectors draft: http://tools.ietf.org/html/draft-strombergson-chacha-test-vectors-00 The code for the chacha implementation is available at: https://github.com/secworks/nettle The following files comprises the implementation: chacha-core-internal.c chacha-crypt.c chacha-init.c chacha.h And the test program testsuite/chacha-test.c (The other files are clones from Nettle to be able to build.) ChaCha _should_ be a bit faster than Salsa20 and should esp be easier to optimize in asm for modern CPUs. I have however not done any benchmarks nor asm implementation (yet). Since I'm new as a contributor I don't know how you Niels want to have patches. Please let me know if this looks good and something you want to integrate and if so how. - -- Med vänlig hälsning, Yours Joachim Strömbergson - Alltid i harmonisk svängning. ======================================================================== Joachim Strömbergson Secworks AB joachim(a)secworks.se ======================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlKoxesACgkQZoPr8HT30QE6vACfTIV44gkDKJcsoxR9BjnElBfE zGQAnjbRimEsTp8arbDPtsT/RLrkgw5K =cz3W -----END PGP SIGNATURE-----

4 14

Adding number of rounds to context for Salsa20?
by Joachim Strömbergson 11 Dec '13

11 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aloha! I'm looking at the source for Salsa20 and notice that there are separate versions for Salsa20 with 20 rounds and Salsa20 with 12 rounds (with specific r12 function names). Would it be possible to instead add the given number of rounds to the context? This would allow the user to select at key-init time to select the number of rounds being used and also declutter the interface with round specific functions. The default could still be 20, but allows for such things as using 8 rounds, 12, 14 or even 24 rounds etc. - -- Med vänlig hälsning, Yours Joachim Strömbergson - Alltid i harmonisk svängning. ======================================================================== Joachim Strömbergson Secworks AB joachim(a)secworks.se ======================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlKoRusACgkQZoPr8HT30QEiXgCgwTUIbpFeXgh2gNk+WCSrlSw1 E/sAoNWKDrSdVhTh4bw9s8YgOau+NpLf =znL7 -----END PGP SIGNATURE-----

2 1

Safe curves (was: brainpool, Curve25519)
by Joachim Strömbergson 11 Dec '13

11 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aloha! New to the list and responding to an old thread re curves. In September Nikos mentioned the Brainpool curves: http://tools.ietf.org/html/rfc5639 Daniel responded by pointing to Curve25519 by DJB: http://ed25519.cr.yp.to/ DJB and Tanja Lange has a good page about different specified and standardized curves: http://safecurves.cr.yp.to/ Note that they don't consider the Brainpool curves as safe. I myself is somewhat cautious due to their origin. Having Curve25519 and its sister Curve3617 would be really nice albeit for acceptance, support for the NIST curves might be needed. - -- Med vänlig hälsning, Yours Joachim Strömbergson - Alltid i harmonisk svängning. ======================================================================== Joachim Strömbergson Secworks AB joachim(a)secworks.se ======================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlKoMlkACgkQZoPr8HT30QGyvQCfcTSEnhWXy12zEWmsdb7SPK9M isYAoO7BJ1FeJxBaqIw1UROxFf1T9rXO =mHZ7 -----END PGP SIGNATURE-----

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs