nettle-bugs

nettle-bugs@lists.lysator.liu.se

3 participants
2194 discussions

ChaCha stream cipher for Nettle available
by Joachim Strömbergson 13 Dec '13

13 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aloha! I've taken a shot at implementing the ChaCha stream cipher for Nettle. Nettle is a modified version of Salsa20 done by DJB in order to improve both performance (esp on CPUs with support for data parallelism) and somewhat improved performance. ChaCha has been suggested as replacement for RC4 both by Adam Langley from Google and separately by Nikos and Me. http://cr.yp.to/chacha.html The code in this implementation is heavily based on the Salsa20 implementation in Nettle. The major changes beside name changes are the quarterround schedules, the different state init and the quarterround. This implementation also supports different number of rounds. There is a pretty simple test program that verifies the functionality for 128 and 256 keys as well as 8, 12 and 20 rounds using the testt vectors in the chacha test vectors draft: http://tools.ietf.org/html/draft-strombergson-chacha-test-vectors-00 The code for the chacha implementation is available at: https://github.com/secworks/nettle The following files comprises the implementation: chacha-core-internal.c chacha-crypt.c chacha-init.c chacha.h And the test program testsuite/chacha-test.c (The other files are clones from Nettle to be able to build.) ChaCha _should_ be a bit faster than Salsa20 and should esp be easier to optimize in asm for modern CPUs. I have however not done any benchmarks nor asm implementation (yet). Since I'm new as a contributor I don't know how you Niels want to have patches. Please let me know if this looks good and something you want to integrate and if so how. - -- Med vänlig hälsning, Yours Joachim Strömbergson - Alltid i harmonisk svängning. ======================================================================== Joachim Strömbergson Secworks AB joachim(a)secworks.se ======================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlKoxesACgkQZoPr8HT30QE6vACfTIV44gkDKJcsoxR9BjnElBfE zGQAnjbRimEsTp8arbDPtsT/RLrkgw5K =cz3W -----END PGP SIGNATURE-----

4 14

Adding number of rounds to context for Salsa20?
by Joachim Strömbergson 11 Dec '13

11 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aloha! I'm looking at the source for Salsa20 and notice that there are separate versions for Salsa20 with 20 rounds and Salsa20 with 12 rounds (with specific r12 function names). Would it be possible to instead add the given number of rounds to the context? This would allow the user to select at key-init time to select the number of rounds being used and also declutter the interface with round specific functions. The default could still be 20, but allows for such things as using 8 rounds, 12, 14 or even 24 rounds etc. - -- Med vänlig hälsning, Yours Joachim Strömbergson - Alltid i harmonisk svängning. ======================================================================== Joachim Strömbergson Secworks AB joachim(a)secworks.se ======================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlKoRusACgkQZoPr8HT30QEiXgCgwTUIbpFeXgh2gNk+WCSrlSw1 E/sAoNWKDrSdVhTh4bw9s8YgOau+NpLf =znL7 -----END PGP SIGNATURE-----

2 1

Safe curves (was: brainpool, Curve25519)
by Joachim Strömbergson 11 Dec '13

11 Dec '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aloha! New to the list and responding to an old thread re curves. In September Nikos mentioned the Brainpool curves: http://tools.ietf.org/html/rfc5639 Daniel responded by pointing to Curve25519 by DJB: http://ed25519.cr.yp.to/ DJB and Tanja Lange has a good page about different specified and standardized curves: http://safecurves.cr.yp.to/ Note that they don't consider the Brainpool curves as safe. I myself is somewhat cautious due to their origin. Having Curve25519 and its sister Curve3617 would be really nice albeit for acceptance, support for the NIST curves might be needed. - -- Med vänlig hälsning, Yours Joachim Strömbergson - Alltid i harmonisk svängning. ======================================================================== Joachim Strömbergson Secworks AB joachim(a)secworks.se ======================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAlKoMlkACgkQZoPr8HT30QGyvQCfcTSEnhWXy12zEWmsdb7SPK9M isYAoO7BJ1FeJxBaqIw1UROxFf1T9rXO =mHZ7 -----END PGP SIGNATURE-----

1 0

Re: benchmarks
by nisse＠lysator.liu.se 10 Dec '13

10 Dec '13

Werner Koch <wk(a)gnupg.org> writes: > But the whole discussion is moot; Nettle and Libgcrypt are very > different and there is no need to merge them. I imagine that it would be technically possible to write libgcrypt so that parts of it is a thin layer on top of Nettle. For a simple example, in libcgrypt/cipher/md5.c, either replace the transform function with a call to _nettle_md5_compress (which is implemented in assembly on some platforms, and somewhat internal). Or write the internal (not visible in libgcrypt's ABI) MD5_CONTEXT as something like #include <nettle/md5.h> typedef struct { struct md5_ctx ctx; uint8_t digest[MD5_DIGEST_SIZE]; } MD5_CONTEXT; and redefine _gcr_digest_spec_md5 to point to corresponding nettle functions, or trivial wrappers if needed. I see that there's some impedance mismatch, e.g., (init,write,final,read), vs (init,update,digest). I can't say if that's a big deal, aesthetically or in terms of performance overhead. Now, there may sure be good reasons why that's an undesirable change, but I'd like to understand what the obstacles are. The advantage is sharing of more low-level code. And if libgcrypt is faster than nettle for some particular algorithm, we'd obviously want to get the faster code into Nettle before changing libgcrypt. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

Re: benchmarks
by Nikos Mavrogiannopoulos 10 Dec '13

10 Dec '13

On Tue, Dec 10, 2013 at 11:15 AM, Werner Koch <wk(a)gnupg.org> wrote: >> Well, I really want to think that it is also about collaboration. > Right, I thought about the same lines but back then Niels decided to > compile his own library without the need to comply to the strict GNU > rules. Thus he was able to use all kind of code while I was not. A > decade or more ago I had to reject Brian Gladman's offer to use his code > due simply due to the CA requirement. Latter then the GNU project seems > to have concluded that CAs are not important anymore unless they are > already in use. The effect was that GNUTLS silently started to use > Nettle instead of helping to convince the GNU towers to drop the CA > requirement for Libgcrypt. I thought that this was done quite vocally :) There was quite a long discussion in this list about the issues I had back then, that if I remember well were (a) libgcrypt could not be used in setuid processes, and (b) that it was much slower -more than 2x- than openssl (and nettle). The conclusion of that discussion was that libgcrypt wouldn't change. I now understand that (b) was because you were strictly following the gnu rules, but that provided no comfort to me who was seeing gnutls being at the bottom of any benchmark. That's why I switched to nettle and as it is now we are more than 2x faster compared to openssl in public key operations. >> While I understand that everyone has a different agenda on the things >> that need to be done, schedules etc., a compromise that will benefit >> everyone may be possible. > Well, you removed all support for Libgcrypt from GNUTLS. If you want to > use it again, you only need to add that layer again. I removed it because I changed the internal API and libgcrypt support would be incomplete (gcm was missing at the time). I don't think it is would be trivial to re-add, but it is not hard either. Nevertheless, even if such a switch would be possible today, it would solve nothing, as now we have some few parts that libgcrypt is better than nettle, and other parts which nettle is better than libgcrypt. My argumentation for the merging was with the intention to have the best implementations of each library merged. regards, Nikos

2 1

Re: benchmarks
by Nikos Mavrogiannopoulos 10 Dec '13

10 Dec '13

On Mon, Dec 9, 2013 at 9:48 PM, Werner Koch <wk(a)gnupg.org> wrote: >> Could libgcrypt and nettle share the low level algorithms so >> improvements on one project will be shared with the other? As it is now > Fell free to take whatever you need from Libgcrypt. Of course that is possible, it always was. However, copying isn't easy when different low-level interfaces are involved, and pretty much that just prolongs the current situation. > They both you the > same license me thinks. Only for the cipher/hash/mac part which was the part I suggested to be shared. Nettle's PK interface is effectively LGPLv3 due to reliance on GMP. So that part would be more hard to benefit from a sharing. >> I think there is quite some duplicate effort being spent in making the >> two libraries faster and there is no much reason they couldn't be >> combined. > That is what free software is about, right? Well, I really want to think that it is also about collaboration. While I understand that everyone has a different agenda on the things that need to be done, schedules etc., a compromise that will benefit everyone may be possible. regards, Nikos

1 0

Re: benchmarks
by Nikos Mavrogiannopoulos 09 Dec '13

09 Dec '13

On Mon, 2013-12-09 at 18:04 +0100, Werner Koch wrote: > Hi, > > I did some benchmark charts for Libgcrypt. See > ftp://ftp.g10code.com/g10code/scratch/gcrypt-bench-x220-2300.gnumeric > or just the charts: > ftp://ftp.g10code.com/g10code/scratch/gcrypt-bench-x220-2300.pdf > this nicely shows Jussi's improvements. The values for Nettle have been > taken from the nettle-benchmark example program. I did not add data for > OpenSSL because it is a bit of work to extract the numbers from "openssl > speed". It would be nice to have wrapper for openssl so that > bench-slope can be used to create compatible numbers. Could libgcrypt and nettle share the low level algorithms so improvements on one project will be shared with the other? As it is now I think there is quite some duplicate effort being spent in making the two libraries faster and there is no much reason they couldn't be combined. In the end I feel disappointed to see that because of that, even the gnulib people will use openssl's libcrypto because it is faster: http://lists.gnu.org/archive/html/bug-gnulib/2013-12/msg00058.html regards, Nikos

2 1

Re: Nettle-2.7.1 with static GMP error
by nisse＠lysator.liu.se 30 Nov '13

30 Nov '13

Alexey Pavlov <alexpux(a)gmail.com> writes: > 2013/11/29 Niels Möller <nisse(a)lysator.liu.se>: >> What failed? Can I repost your message to the list? > > I do it already. I receive subscribing message now. Ok. I'm now cc:ing the list. Context: Link error when building a dynamic libnettle.dll and libhogweed.dll, and statically linking to libgmp.a. >>> i686-w64-mingw32-gcc -march=i686 -mtune=generic -O2 -pipe >>> -I/mingw32/include -ggdb3 -Wno-pointer-sign -Wall -W >>> -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes >>> -Wpointer-arith -Wbad-function-cast -Wnested-externs -L.. -pipe >>> -L/mingw32/lib ecc-mod-test.o testutils.o ../nettle-internal.o >>> -lhogweed -lnettle -lgmp -o ecc-mod-test.exe >>> >>> C:/msys64/mingw32/lib/libgmp.a(sub_n.o):(.text+0x0): multiple >>> definition of `__gmpn_sub_n' >>> >>> ../libhogweed.dll.a(d000131.o):(.text+0x0): first defined here >>> >>> collect2.exe: error: ld returned 1 exit status >> >> So you're building shared libraries for nettle, but you have a static >> gmp library? The way I understand the error, the used gmp functions gets >> copied into libhogweed.dll. Not sure if that is the best behavior. >> > Yes I have static GMP because we build toolchains with static > prerequisites and don't want to has dynamic dependencies from them > (gmp, mpc, mpfr, clog, isl). I prefer to use static versions of them. >> But I'm not sure I understand the link error. There's some function >> depending on __gmpn_sub_n ("mpn_sub_n" to user code), but if that >> function is included in libhogweed.dll, why isn't that function just >> skipped when the linker processes libgmp.a? > > A program in C can have only one definition (declaration which assigns > a value) for each object (storage space for a variable). But when doing linking with static libraries, multiple definitions are generally ok. The linker copies only the object files which are needed, and when it needs a symbol, it includes only the first object file in any of the libraries, which define the symbol. One may still get clashes if each object file includes multiple symbols, since in the set of object files selected by the linker in the end, multiple definitions of the same symbol are not allowed. > As I understand, somewhere header file contains definitions for > several functions __gmpn_sub_n which when included in several > different translation units results in the linker throwing this error. I don't think so. My understanding is that 1. The symbol __gmp_sub_n is defined in some object file included in libgmp.a, and nowhere in the nettle source or object code (and mini-gmp.c doesn't count, it's not involved in the link, and it uses different linker symbol names than the real gmp). 2. This object file gets copied from libgmp.a into libhogweed.dll by the linker. Not sure if this is right; -lgmp was added to the libhogweed link command primarily to get dependencies between *shared* libraries right. 3. You then link the executable ecc-mod-test.exe with -lhogweed and -lgmp. The linked sees two definitions of the symbol __gmpn_sub_n, one in libgmp.a, and one in libhogweed.dll, and it considers this an error. What I don't understand, is why, in (3) above, the linker doesn't just ignore the object in libgmp.a which defines the symbol. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 3

Building nettle-2.7.1 with static GMP bug
by Alexey Pavlov 29 Nov '13

29 Nov '13

Hi! I'm try to build nettle-2.7.1 with static GMP with mingw-w64 toolchain GCC-4.8.2 and got error while linking with static GMP: i686-w64-mingw32-gcc -march=i686 -mtune=generic -O2 -pipe -I/mingw32/include -ggdb3 -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -L.. -pipe -L/mingw32/lib ecc-mod-test.o testutils.o ../nettle-internal.o -lhogweed -lnettle -lgmp -o ecc-mod-test.exe C:/msys64/mingw32/lib/libgmp.a(sub_n.o):(.text+0x0): multiple definition of `__gmpn_sub_n' ../libhogweed.dll.a(d000131.o):(.text+0x0): first defined here collect2.exe: error: ld returned 1 exit status /msys_repo/mingw-w64-nettle/src/nettle-2.7.1/testsuite/.test-rules.make:167: recipe for target 'ecc-mod-test.exe' failed make[1]: *** [ecc-mod-test.exe] Error 1 Is any fix for this? Regards, Alexey.

1 0

Apparent bug in SHA-1 digests
by Paul Tagliamonte 28 Nov '13

28 Nov '13

Hey hackers, I'm seeing some behavior that confuses me a bit. I'm sure I'm doing something wrong, but I can't tell. Here's a minimal example: / | #include <stdio.h> | #include <nettle/rsa.h> | | int main ( int argc, char ** argv ) { | struct sha1_ctx hash_ctx; | uint8_t headers[] = { | 0xDE, 0xEA, 0xAD, | 0xBE, 0xEF | }; | sha1_update(&hash_ctx, 5, headers); | | for (int i = 0; i < 3; ++i) { | uint8_t _fingerprint[SHA1_DIGEST_SIZE]; | sha1_digest(&hash_ctx, SHA1_DIGEST_SIZE, _fingerprint); | for (int i = 0; i < SHA1_DIGEST_SIZE; ++i) | printf("%02X ", _fingerprint[i]); | printf("\n"); | } | } \ The output, when run is: / | 89 22 AA 95 F2 02 C9 BB 35 FC 2D A2 DE 22 BE 48 2B B6 6C 1D | DA 39 A3 EE 5E 6B 4B 0D 32 55 BF EF 95 60 18 90 AF D8 07 09 | DA 39 A3 EE 5E 6B 4B 0D 32 55 BF EF 95 60 18 90 AF D8 07 09 \ (that last line is stable after the inital hash) Does doing the sha1_digest alter state in some way? I can't image it is, but then how does this behavior crop up? Much love, thanks all! Cheers, Paul -- #define sizeof(x) rand() :wq

3 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs