nettle-bugs

nettle-bugs@lists.lysator.liu.se

2191 discussions

Re: benchmarks
by nisse＠lysator.liu.se 10 Dec '13

10 Dec '13

Werner Koch <wk(a)gnupg.org> writes: > But the whole discussion is moot; Nettle and Libgcrypt are very > different and there is no need to merge them. I imagine that it would be technically possible to write libgcrypt so that parts of it is a thin layer on top of Nettle. For a simple example, in libcgrypt/cipher/md5.c, either replace the transform function with a call to _nettle_md5_compress (which is implemented in assembly on some platforms, and somewhat internal). Or write the internal (not visible in libgcrypt's ABI) MD5_CONTEXT as something like #include <nettle/md5.h> typedef struct { struct md5_ctx ctx; uint8_t digest[MD5_DIGEST_SIZE]; } MD5_CONTEXT; and redefine _gcr_digest_spec_md5 to point to corresponding nettle functions, or trivial wrappers if needed. I see that there's some impedance mismatch, e.g., (init,write,final,read), vs (init,update,digest). I can't say if that's a big deal, aesthetically or in terms of performance overhead. Now, there may sure be good reasons why that's an undesirable change, but I'd like to understand what the obstacles are. The advantage is sharing of more low-level code. And if libgcrypt is faster than nettle for some particular algorithm, we'd obviously want to get the faster code into Nettle before changing libgcrypt. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

Re: benchmarks
by Nikos Mavrogiannopoulos 10 Dec '13

10 Dec '13

On Tue, Dec 10, 2013 at 11:15 AM, Werner Koch <wk(a)gnupg.org> wrote: >> Well, I really want to think that it is also about collaboration. > Right, I thought about the same lines but back then Niels decided to > compile his own library without the need to comply to the strict GNU > rules. Thus he was able to use all kind of code while I was not. A > decade or more ago I had to reject Brian Gladman's offer to use his code > due simply due to the CA requirement. Latter then the GNU project seems > to have concluded that CAs are not important anymore unless they are > already in use. The effect was that GNUTLS silently started to use > Nettle instead of helping to convince the GNU towers to drop the CA > requirement for Libgcrypt. I thought that this was done quite vocally :) There was quite a long discussion in this list about the issues I had back then, that if I remember well were (a) libgcrypt could not be used in setuid processes, and (b) that it was much slower -more than 2x- than openssl (and nettle). The conclusion of that discussion was that libgcrypt wouldn't change. I now understand that (b) was because you were strictly following the gnu rules, but that provided no comfort to me who was seeing gnutls being at the bottom of any benchmark. That's why I switched to nettle and as it is now we are more than 2x faster compared to openssl in public key operations. >> While I understand that everyone has a different agenda on the things >> that need to be done, schedules etc., a compromise that will benefit >> everyone may be possible. > Well, you removed all support for Libgcrypt from GNUTLS. If you want to > use it again, you only need to add that layer again. I removed it because I changed the internal API and libgcrypt support would be incomplete (gcm was missing at the time). I don't think it is would be trivial to re-add, but it is not hard either. Nevertheless, even if such a switch would be possible today, it would solve nothing, as now we have some few parts that libgcrypt is better than nettle, and other parts which nettle is better than libgcrypt. My argumentation for the merging was with the intention to have the best implementations of each library merged. regards, Nikos

2 1

Re: benchmarks
by Nikos Mavrogiannopoulos 10 Dec '13

10 Dec '13

On Mon, Dec 9, 2013 at 9:48 PM, Werner Koch <wk(a)gnupg.org> wrote: >> Could libgcrypt and nettle share the low level algorithms so >> improvements on one project will be shared with the other? As it is now > Fell free to take whatever you need from Libgcrypt. Of course that is possible, it always was. However, copying isn't easy when different low-level interfaces are involved, and pretty much that just prolongs the current situation. > They both you the > same license me thinks. Only for the cipher/hash/mac part which was the part I suggested to be shared. Nettle's PK interface is effectively LGPLv3 due to reliance on GMP. So that part would be more hard to benefit from a sharing. >> I think there is quite some duplicate effort being spent in making the >> two libraries faster and there is no much reason they couldn't be >> combined. > That is what free software is about, right? Well, I really want to think that it is also about collaboration. While I understand that everyone has a different agenda on the things that need to be done, schedules etc., a compromise that will benefit everyone may be possible. regards, Nikos

1 0

Re: benchmarks
by Nikos Mavrogiannopoulos 09 Dec '13

09 Dec '13

On Mon, 2013-12-09 at 18:04 +0100, Werner Koch wrote: > Hi, > > I did some benchmark charts for Libgcrypt. See > ftp://ftp.g10code.com/g10code/scratch/gcrypt-bench-x220-2300.gnumeric > or just the charts: > ftp://ftp.g10code.com/g10code/scratch/gcrypt-bench-x220-2300.pdf > this nicely shows Jussi's improvements. The values for Nettle have been > taken from the nettle-benchmark example program. I did not add data for > OpenSSL because it is a bit of work to extract the numbers from "openssl > speed". It would be nice to have wrapper for openssl so that > bench-slope can be used to create compatible numbers. Could libgcrypt and nettle share the low level algorithms so improvements on one project will be shared with the other? As it is now I think there is quite some duplicate effort being spent in making the two libraries faster and there is no much reason they couldn't be combined. In the end I feel disappointed to see that because of that, even the gnulib people will use openssl's libcrypto because it is faster: http://lists.gnu.org/archive/html/bug-gnulib/2013-12/msg00058.html regards, Nikos

2 1

Re: Nettle-2.7.1 with static GMP error
by nisse＠lysator.liu.se 30 Nov '13

30 Nov '13

Alexey Pavlov <alexpux(a)gmail.com> writes: > 2013/11/29 Niels Möller <nisse(a)lysator.liu.se>: >> What failed? Can I repost your message to the list? > > I do it already. I receive subscribing message now. Ok. I'm now cc:ing the list. Context: Link error when building a dynamic libnettle.dll and libhogweed.dll, and statically linking to libgmp.a. >>> i686-w64-mingw32-gcc -march=i686 -mtune=generic -O2 -pipe >>> -I/mingw32/include -ggdb3 -Wno-pointer-sign -Wall -W >>> -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes >>> -Wpointer-arith -Wbad-function-cast -Wnested-externs -L.. -pipe >>> -L/mingw32/lib ecc-mod-test.o testutils.o ../nettle-internal.o >>> -lhogweed -lnettle -lgmp -o ecc-mod-test.exe >>> >>> C:/msys64/mingw32/lib/libgmp.a(sub_n.o):(.text+0x0): multiple >>> definition of `__gmpn_sub_n' >>> >>> ../libhogweed.dll.a(d000131.o):(.text+0x0): first defined here >>> >>> collect2.exe: error: ld returned 1 exit status >> >> So you're building shared libraries for nettle, but you have a static >> gmp library? The way I understand the error, the used gmp functions gets >> copied into libhogweed.dll. Not sure if that is the best behavior. >> > Yes I have static GMP because we build toolchains with static > prerequisites and don't want to has dynamic dependencies from them > (gmp, mpc, mpfr, clog, isl). I prefer to use static versions of them. >> But I'm not sure I understand the link error. There's some function >> depending on __gmpn_sub_n ("mpn_sub_n" to user code), but if that >> function is included in libhogweed.dll, why isn't that function just >> skipped when the linker processes libgmp.a? > > A program in C can have only one definition (declaration which assigns > a value) for each object (storage space for a variable). But when doing linking with static libraries, multiple definitions are generally ok. The linker copies only the object files which are needed, and when it needs a symbol, it includes only the first object file in any of the libraries, which define the symbol. One may still get clashes if each object file includes multiple symbols, since in the set of object files selected by the linker in the end, multiple definitions of the same symbol are not allowed. > As I understand, somewhere header file contains definitions for > several functions __gmpn_sub_n which when included in several > different translation units results in the linker throwing this error. I don't think so. My understanding is that 1. The symbol __gmp_sub_n is defined in some object file included in libgmp.a, and nowhere in the nettle source or object code (and mini-gmp.c doesn't count, it's not involved in the link, and it uses different linker symbol names than the real gmp). 2. This object file gets copied from libgmp.a into libhogweed.dll by the linker. Not sure if this is right; -lgmp was added to the libhogweed link command primarily to get dependencies between *shared* libraries right. 3. You then link the executable ecc-mod-test.exe with -lhogweed and -lgmp. The linked sees two definitions of the symbol __gmpn_sub_n, one in libgmp.a, and one in libhogweed.dll, and it considers this an error. What I don't understand, is why, in (3) above, the linker doesn't just ignore the object in libgmp.a which defines the symbol. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 3

Building nettle-2.7.1 with static GMP bug
by Alexey Pavlov 29 Nov '13

29 Nov '13

Hi! I'm try to build nettle-2.7.1 with static GMP with mingw-w64 toolchain GCC-4.8.2 and got error while linking with static GMP: i686-w64-mingw32-gcc -march=i686 -mtune=generic -O2 -pipe -I/mingw32/include -ggdb3 -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -L.. -pipe -L/mingw32/lib ecc-mod-test.o testutils.o ../nettle-internal.o -lhogweed -lnettle -lgmp -o ecc-mod-test.exe C:/msys64/mingw32/lib/libgmp.a(sub_n.o):(.text+0x0): multiple definition of `__gmpn_sub_n' ../libhogweed.dll.a(d000131.o):(.text+0x0): first defined here collect2.exe: error: ld returned 1 exit status /msys_repo/mingw-w64-nettle/src/nettle-2.7.1/testsuite/.test-rules.make:167: recipe for target 'ecc-mod-test.exe' failed make[1]: *** [ecc-mod-test.exe] Error 1 Is any fix for this? Regards, Alexey.

1 0

Apparent bug in SHA-1 digests
by Paul Tagliamonte 28 Nov '13

28 Nov '13

Hey hackers, I'm seeing some behavior that confuses me a bit. I'm sure I'm doing something wrong, but I can't tell. Here's a minimal example: / | #include <stdio.h> | #include <nettle/rsa.h> | | int main ( int argc, char ** argv ) { | struct sha1_ctx hash_ctx; | uint8_t headers[] = { | 0xDE, 0xEA, 0xAD, | 0xBE, 0xEF | }; | sha1_update(&hash_ctx, 5, headers); | | for (int i = 0; i < 3; ++i) { | uint8_t _fingerprint[SHA1_DIGEST_SIZE]; | sha1_digest(&hash_ctx, SHA1_DIGEST_SIZE, _fingerprint); | for (int i = 0; i < SHA1_DIGEST_SIZE; ++i) | printf("%02X ", _fingerprint[i]); | printf("\n"); | } | } \ The output, when run is: / | 89 22 AA 95 F2 02 C9 BB 35 FC 2D A2 DE 22 BE 48 2B B6 6C 1D | DA 39 A3 EE 5E 6B 4B 0D 32 55 BF EF 95 60 18 90 AF D8 07 09 | DA 39 A3 EE 5E 6B 4B 0D 32 55 BF EF 95 60 18 90 AF D8 07 09 \ (that last line is stable after the inital hash) Does doing the sha1_digest alter state in some way? I can't image it is, but then how does this behavior crop up? Much love, thanks all! Cheers, Paul -- #define sizeof(x) rand() :wq

3 2

poly1305 nonce increments
by nisse＠lysator.liu.se 21 Nov '13

21 Nov '13

As I wrote, I'm working with poly1305. One question: The _digest function will update the nonce value, so that by default one gets a nonce sequence of 0, 1, 2, .... In the code I'm working with (contributed by Nikos), this increment is done in a big-endian fashion, just like increments for CTR mode. Is this going to be the common way to generate nonces for poly1305? Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 2

Make error on CentOS 6.4 x64
by Martin Lambev 16 Nov '13

16 Nov '13

Hello nettle gurus, I'm trying to build GnuTLS 3.2.6 on CentOS 6.4 x64, but having some issues with nettle during compilation. nettle 2.7.1 make errors: configure: summary of build options: Version: nettle 2.7.1 Host type: x86_64-unknown-linux-gnu ABI: 64 Assembly files: x86_64 Install prefix: /usr/local Library directory: ${exec_prefix}/lib64 Compiler: gcc Static libraries: yes Shared libraries: yes Public key crypto: yes Documentation: no During "$ make" exits with error: hogweed-benchmark.c:575: error: ‘struct openssl_ctx’ has no member named ‘key’ hogweed-benchmark.c:576: error: ‘struct openssl_ctx’ has no member named ‘digest’ make[1]: *** [hogweed-benchmark.o] Error 1 make[1]: Leaving directory `/home/mve/Downloads/ocserv/nettle/nettle-2.7.1/examples' make: *** [all] Error 1 It fails "error: ‘struct openssl_ctx’" so I looked configure help options… $ make clean $ ./configure --help #give a few options so I disabled this one as I'm assuming it's not used in my case isn't it? $ ./configre --disable-openssl #Do not include openssl glue in the benchmark program after doing this "make" successfully finished and I can install "nettle" Is this proper workaround or not? If not how should be handed properly? Thank you! Regards, Martin

2 1

Re: undefined behaviors
by John Regehr 13 Nov '13

13 Nov '13

> I imagine you intended to mail the nettle-bugs list, rather than > nettle-bugs-owner administrative address? Feel free to reply on list. Ugh, sorry, cut and paste... > That's unexpected. Hmm. The NEWS file for 2.7.1 claims that this problem > was fixed in that release, but appearantly it wasn't. You can check if > the error disappears if you replace the definition of ROT32 in macros.h > by > > #define ROTL32(n,x) (((x)<<(n)) | ((x)>>((-(n)&31)))) I'll check this tonight. >> blowfish.c:353:19: runtime error: left shift of 244 by 24 places >> cannot be represented in type 'int' >> twofish.c:196:54: runtime error: left shift of 184 by 24 places cannot >> be represented in type 'int' > > These should have some casts to uint32_t, I think. Unlikely to cause > real problems. Right, I don't know of any compiler that exploits these, and in fact in C++ (but not C) this particular case is covered by a defect report that makes it defined. Thanks, John

2 4

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs