nettle-bugs

nettle-bugs@lists.lysator.liu.se

2191 discussions

Start a nNew thread

added functions to zeroize
by Nikos Mavrogiannopoulos 13 Nov '13

13 Nov '13

Hello, Attached is a patch that allows overwriting values (points and scalars) in the ECC API. regards, Nikos

2 4

Re: Git repository down?
by nisse＠lysator.liu.se 17 Oct '13

17 Oct '13

Andrew Walrond <andrew(a)walrond.org> writes: > Is the git repository down? Now it seems to work again. Some deamon had died, for unknown reason, and has been restarted. BTW, switching git.lysator.liu.se from gitorious to some other software is under consideraton. Any recommendations? Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 3

Re: Git repository down?
by nisse＠lysator.liu.se 16 Oct '13

16 Oct '13

Andrew Walrond <andrew(a)walrond.org> writes: > Is the git repository down? Appearantly, yes. The machine is still up, though, and responding to http. I'll ask sysadm what's happening. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

internal bug in pgp_put_public_rsa_key
by Paul Tagliamonte 15 Oct '13

15 Oct '13

Howdy folks! Thanks for working on nettle, pgp_put_public_rsa_key seems to throw an assertion error: > assert(buffer->size == start + length) buffer->size is 3 larger than (start + length). Removing the PGP_LENGTH_TWO_OCTETS works (but this is wrong, since 4880 defines it as it's written, I think, still new with the spec), so I think there might be a bug in the assert. Can someone who groks the code confirm this? Thanks! Paul -- #define sizeof(x) rand() :wq

2 2

loading RSA keys from a PEM file
by Ted Zlatanov 06 Oct '13

06 Oct '13

If I generate a public RSA key into a PEM file and then base64-decode the contents (this is in Emacs): (string-to-unibyte (base64-decode-string "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAreGA/Qky9W3izQV0kzba 7wKl/wzwxkbbQxvcUqUT1krgAbO/n1tYFjXdJZoWwbMO/qv7NRoMDY4yPWGpsQfY +PSIknAhTZVbgwXrm/wb37+hKRKax2UZ9A/Rx4vJZRYlkpvZ9LbBziseFNN7SMWW qkjBO/NeT8/I9mURDa+4RoYfT6ZwjTvt808PH7uIghk+MHAx9EMBAfafF1Jn9TqW y+Hgdqik9sZteMvCumvGK4grSwzdfPO5I05tt/0I7QVPxlXbHIk/bBsE7mpgOxur P0DAkFKtYDM7oZPBwB6X778ba2EEFKPpVIyzw/jlDPd9PB6gE6dixmax3Hlg69RI EwIDAQAB")) I seem unable to load that as a public key (SCHARS macro == length, SDATA macro == data): struct rsa_public_key key; rsa_public_key_init(&key); rsa_keypair_from_der (&key, NULL, 0, SCHARS (public_key), SDATA (public_key)) It keeps failing. From the docs and example it seems like that should work. Can you see what I'm doing wrong? I've spent a few hours on it and can't trace the problem. If not I will start digging into the key loading functions, but was hoping it's something obvious (and if you have a working example that would be great). As soon as I have this working I will publish my work for review; the RSA signatures are the last piece missing. Ted

3 5

PBKDF2 generic hashing method: unclear usage, examples needed
by Ted Zlatanov 05 Oct '13

05 Oct '13

Hi, I'm trying to use the Nettle PBKDF2 functionality from Emacs. This call (assume that the macros and variables are correct): pbkdf2_hmac_sha1 (SCHARS (key), SDATA (key), XINT (iterations), SCHARS (salt), SDATA (salt), outlength, digest); works great, but I'd like to be able to use any generic nettle_hash. I tried this, given alg is a pointer to a nettle_hash: HMAC_SET_KEY(ctx, alg, SCHARS (key), SDATA (key)); PBKDF2 (ctx, alg->update, alg->digest, alg->digest_size, XINT (iterations), SCHARS (salt), SDATA (salt), outlength, digest); in many combinations but couldn't get it to work (the tests don't match up), and the docs don't explain how the PRF needs to be initialized. I tried to copy what pbkdf2_hmac_sha1() does but wasn't successful. Is there an example you could provide here or in the Nettle sources? (The confusing part is that "ctx" is used for both the HMAC context (the one with inner, outer, and state contexts) and for the hashing state context itself. At one point in the macro chain the HMAC context is passed where a hashing state context is expected, I think, and I really need an example to ensure I'm doing it correctly. I am verifying with the RFC 6070 test vectors and can provide the full source if necessary.) Thanks! Ted

2 2

GCM vs SHA1
by nisse＠lysator.liu.se 22 Sep '13

22 Sep '13

Nikos noted (off list) that Nettle's gcm hashing is slower than sha1. Which seems contrary to what's expected. Should gcm be faster, or a lot faster, than sha1 in software (even without fancy instructions for the gf2 arithmetic)? Below is a first rough assembly implementation of the main step of gcm hashing. Gives a speedup of about 20%, making it *slightly* faster than sha1 on my system. BTW, I'm back from some 40 days of travelling with my familiy, and I'm just trying to remember how to do some hacking ;-) Regards, /Niels diff --git a/Makefile.in b/Makefile.in index ebc9357..c900c58 100644 --- a/Makefile.in +++ b/Makefile.in @@ -12,7 +12,8 @@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = $(INSTALL_PROGRAM) -s MKDIR_P = @MKDIR_P@ -OPT_ASM_SOURCES = @OPT_ASM_SOURCES@ +OPT_ASM_NETTLE_SOURCES = @OPT_ASM_NETTLE_SOURCES@ +OPT_ASM_HOGWEED_SOURCES = @OPT_ASM_HOGWEED_SOURCES@ SUBDIRS = tools testsuite examples @@ -179,10 +180,10 @@ DISTFILES = $(SOURCES) $(HEADERS) getopt.h .bootstrap run-tests \ nettle.texinfo nettle.info nettle.html nettle.pdf sha-example.c # Rules building static libraries -nettle_OBJS = $(nettle_SOURCES:.c=.$(OBJEXT)) +nettle_OBJS = $(nettle_SOURCES:.c=.$(OBJEXT)) $(OPT_ASM_NETTLE_SOURCES:.asm=.$(OBJEXT)) nettle_PURE_OBJS = $(nettle_OBJS:.$(OBJEXT)=.p$(OBJEXT)) -hogweed_OBJS = $(hogweed_SOURCES:.c=.$(OBJEXT)) $(OPT_ASM_SOURCES:.asm=.$(OBJEXT)) +hogweed_OBJS = $(hogweed_SOURCES:.c=.$(OBJEXT)) $(OPT_ASM_HOGWEED_SOURCES:.asm=.$(OBJEXT)) hogweed_PURE_OBJS = $(hogweed_OBJS:.$(OBJEXT)=.p$(OBJEXT)) libnettle.a: $(nettle_OBJS) diff --git a/configure.ac b/configure.ac index 3dd3a99..72da6d7 100644 --- a/configure.ac +++ b/configure.ac @@ -266,14 +266,15 @@ asm_replace_list="aes-encrypt-internal.asm aes-decrypt-internal.asm \ sha3-permute.asm umac-nh.asm umac-nh-n.asm machine.m4" # Assembler files which generate additional object files if they are used. -asm_optional_list="" - +asm_nettle_optional_list="gcm-gf-mul-8.asm" +asm_hogweed_optional_list="" if test "x$enable_public_key" = "xyes" ; then - asm_optional_list="ecc-192-modp.asm ecc-224-modp.asm ecc-256-redc.asm \ - ecc-384-modp.asm ecc-521-modp.asm" + asm_hogweed_optional_list="ecc-192-modp.asm ecc-224-modp.asm \ + ecc-256-redc.asm ecc-384-modp.asm ecc-521-modp.asm" fi -OPT_ASM_SOURCES="" +OPT_ASM_NETTLE_SOURCES="" +OPT_ASM_HOGWEED_SOURCES="" asm_file_list="" @@ -291,18 +292,34 @@ if test "x$enable_assembler" = xyes ; then done dnl Workaround for AC_CONFIG_LINKS, which complains if we use the dnl same destination argument $tmp_f multiple times. - for tmp_o in $asm_optional_list ; do + for tmp_n in $asm_nettle_optional_list ; do + for asm_dir in $asm_path ; do + if test -f "$srcdir/$asm_dir/$tmp_n"; then + asm_file_list="$asm_file_list $tmp_n" + AC_CONFIG_LINKS($tmp_n:$asm_dir/$tmp_n) + while read tmp_func ; do + AC_DEFINE_UNQUOTED(HAVE_NATIVE_$tmp_func) + eval HAVE_NATIVE_$tmp_func=yes + done <<EOF +[`sed -n 's/[^ ]*PROLOGUE(_*$nettle_$*$[^)]*$).*$/\2/p' < "$srcdir/$asm_dir/$tmp_n"`] +EOF + OPT_ASM_NETTLE_SOURCES="$OPT_ASM_NETTLE_SOURCES $tmp_n" + break + fi + done + done + for tmp_h in $asm_hogweed_optional_list ; do for asm_dir in $asm_path ; do - if test -f "$srcdir/$asm_dir/$tmp_o"; then - asm_file_list="$asm_file_list $tmp_o" - AC_CONFIG_LINKS($tmp_o:$asm_dir/$tmp_o) + if test -f "$srcdir/$asm_dir/$tmp_h"; then + asm_file_list="$asm_file_list $tmp_h" + AC_CONFIG_LINKS($tmp_h:$asm_dir/$tmp_h) while read tmp_func ; do AC_DEFINE_UNQUOTED(HAVE_NATIVE_$tmp_func) eval HAVE_NATIVE_$tmp_func=yes done <<EOF -[`sed -n 's/[^ ]*PROLOGUE(_*$nettle_$*$[^)]*$).*$/\2/p' < "$srcdir/$asm_dir/$tmp_o"`] +[`sed -n 's/[^ ]*PROLOGUE(_*$nettle_$*$[^)]*$).*$/\2/p' < "$srcdir/$asm_dir/$tmp_h"`] EOF - OPT_ASM_SOURCES="$OPT_ASM_SOURCES $tmp_o" + OPT_ASM_HOGWEED_SOURCES="$OPT_ASM_HOGWEED_SOURCES $tmp_h" break fi done @@ -314,7 +331,8 @@ EOF fi fi -AC_SUBST([OPT_ASM_SOURCES]) +AC_SUBST([OPT_ASM_NETTLE_SOURCES]) +AC_SUBST([OPT_ASM_HOGWEED_SOURCES]) AH_VERBATIM([HAVE_NATIVE], [/* Define to 1 each of the following for which a native (ie. CPU specific) @@ -328,7 +346,8 @@ AH_VERBATIM([HAVE_NATIVE], #undef HAVE_NATIVE_ecc_384_modp #undef HAVE_NATIVE_ecc_384_redc #undef HAVE_NATIVE_ecc_521_modp -#undef HAVE_NATIVE_ecc_521_redc]) +#undef HAVE_NATIVE_ecc_521_redc +#undef HAVE_NATIVE_gcm_gf_mul_8]) # Besides getting correct dependencies, the explicit rules also tell # make that the .s files "ought to exist", so they are preferred over diff --git a/gcm.c b/gcm.c index 6893d51..7b387ba 100644 --- a/gcm.c +++ b/gcm.c @@ -214,6 +214,12 @@ gcm_gf_mul (union gcm_block *x, const union gcm_block *table) memcpy (x->b, Z.b, sizeof(Z)); } # elif GCM_TABLE_BITS == 8 +# if HAVE_NATIVE_gcm_gf_mul_8 + +#define gcm_gf_mul _nettle_gcm_gf_mul_8 +void +gcm_gf_mul (union gcm_block *x, const union gcm_block *y); +# else /* !HAVE_NATIVE_gcm_gf_mul_8 */ static const uint16_t shift_table[0x100] = { W(00,00),W(01,c2),W(03,84),W(02,46),W(07,08),W(06,ca),W(04,8c),W(05,4e), @@ -304,7 +310,7 @@ gcm_gf_mul (union gcm_block *x, const union gcm_block *table) gcm_gf_shift_8(&Z); gcm_gf_add(x, &Z, &table[x->b[0]]); } - +# endif /* ! HAVE_NATIVE_gcm_gf_mul_8 */ # else /* GCM_TABLE_BITS != 8 */ # error Unsupported table size. # endif /* GCM_TABLE_BITS != 8 */ diff --git a/x86_64/gcm-gf-mul-8.asm b/x86_64/gcm-gf-mul-8.asm new file mode 100644 index 0000000..2296ba8 --- /dev/null +++ b/x86_64/gcm-gf-mul-8.asm @@ -0,0 +1,130 @@ +C nettle, low-level cryptographics library +C +C Copyright (C) 2013, Niels MÃ¶ller +C +C The nettle library is free software; you can redistribute it and/or modify +C it under the terms of the GNU Lesser General Public License as published by +C the Free Software Foundation; either version 2.1 of the License, or (at your +C option) any later version. +C +C The nettle library is distributed in the hope that it will be useful, but +C WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +C or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public +C License for more details. +C +C You should have received a copy of the GNU Lesser General Public License +C along with the nettle library; see the file COPYING.LIB. If not, write to +C the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, +C MA 02111-1301, USA. + +C Register usage: + +define(<XP>, <%rdi>) +define(<TABLE>, <%rsi>) +define(<XW>, <%rax>) +define(<CNT>, <%ecx>) +define(<Z0>, <%rdx>) +define(<Z1>, <%r8>) +define(<T0>, <%r9>) +define(<T1>, <%r10>) +define(<T2>, <%r11>) +define(<SHIFT_TABLE>, <%rbx>) + +C The C code is 12.5 c/byte, slower than sha1 (10.6), while this code runs +C at 10.2, slightly faster. Benchmarked on a low-end AMD E-350. + + .file "gcm-gf-mul-8.asm" + + C void _gcm_gf_mul_8(union gcm_block *x, const union gcm_block *table) + .text + ALIGN(16) +PROLOGUE(_nettle_gcm_gf_mul_8) + W64_ENTRY(2, 0) + push %rbx + mov 8(XP), XW + rol $8, XW + movzbl LREG(XW), XREG(T0) + shl $4, T0 + mov (TABLE, T0), Z0 + mov 8(TABLE, T0), Z1 + lea .Lshift_table(%rip), SHIFT_TABLE + movl $7, CNT + call .Lmul_word + mov (XP), XW + movl $8, CNT + call .Lmul_word + mov Z0, (XP) + mov Z1, 8(XP) + W64_EXIT(2, 0) + pop %rbx + ret + +.Lmul_word: + C shift Z1, Z0, transforming + C +-----------------------+-----------------------+ + C |15 14 13 12 11 10 09 08|07 06 05 04 03 02 01 00| + C +-----------------------+-----------------------+ + C into + C +-----------------------+-----------------------+ + C |14 13 12 11 10 09 08 07|06 05 04 03 02 01 00 | + C +-----------------------+-----------------+-----+ + C xor |T[15]| + C +-----+ + mov Z1, T1 + mov Z0, T0 + shl $8, Z1 C Use shld? + shl $8, Z0 + shr $56, T1 + shr $56, T0 + movzwl (SHIFT_TABLE, T1, 2), XREG(T1) + rol $8, XW + add T0, Z1 + xor T1, Z0 + movzbl LREG(XW), XREG(T2) + shl $4, T2 + xor (TABLE, T2), Z0 + xor 8(TABLE, T2), Z1 + decl CNT + jne .Lmul_word + ret + +EPILOGUE(_nettle_gcm_gf_mul_8) + +define(<W>, <0x$2$1>) + .section .rodata + ALIGN(2) +.Lshift_table: +.hword W(00,00),W(01,c2),W(03,84),W(02,46),W(07,08),W(06,ca),W(04,8c),W(05,4e) +.hword W(0e,10),W(0f,d2),W(0d,94),W(0c,56),W(09,18),W(08,da),W(0a,9c),W(0b,5e) +.hword W(1c,20),W(1d,e2),W(1f,a4),W(1e,66),W(1b,28),W(1a,ea),W(18,ac),W(19,6e) +.hword W(12,30),W(13,f2),W(11,b4),W(10,76),W(15,38),W(14,fa),W(16,bc),W(17,7e) +.hword W(38,40),W(39,82),W(3b,c4),W(3a,06),W(3f,48),W(3e,8a),W(3c,cc),W(3d,0e) +.hword W(36,50),W(37,92),W(35,d4),W(34,16),W(31,58),W(30,9a),W(32,dc),W(33,1e) +.hword W(24,60),W(25,a2),W(27,e4),W(26,26),W(23,68),W(22,aa),W(20,ec),W(21,2e) +.hword W(2a,70),W(2b,b2),W(29,f4),W(28,36),W(2d,78),W(2c,ba),W(2e,fc),W(2f,3e) +.hword W(70,80),W(71,42),W(73,04),W(72,c6),W(77,88),W(76,4a),W(74,0c),W(75,ce) +.hword W(7e,90),W(7f,52),W(7d,14),W(7c,d6),W(79,98),W(78,5a),W(7a,1c),W(7b,de) +.hword W(6c,a0),W(6d,62),W(6f,24),W(6e,e6),W(6b,a8),W(6a,6a),W(68,2c),W(69,ee) +.hword W(62,b0),W(63,72),W(61,34),W(60,f6),W(65,b8),W(64,7a),W(66,3c),W(67,fe) +.hword W(48,c0),W(49,02),W(4b,44),W(4a,86),W(4f,c8),W(4e,0a),W(4c,4c),W(4d,8e) +.hword W(46,d0),W(47,12),W(45,54),W(44,96),W(41,d8),W(40,1a),W(42,5c),W(43,9e) +.hword W(54,e0),W(55,22),W(57,64),W(56,a6),W(53,e8),W(52,2a),W(50,6c),W(51,ae) +.hword W(5a,f0),W(5b,32),W(59,74),W(58,b6),W(5d,f8),W(5c,3a),W(5e,7c),W(5f,be) +.hword W(e1,00),W(e0,c2),W(e2,84),W(e3,46),W(e6,08),W(e7,ca),W(e5,8c),W(e4,4e) +.hword W(ef,10),W(ee,d2),W(ec,94),W(ed,56),W(e8,18),W(e9,da),W(eb,9c),W(ea,5e) +.hword W(fd,20),W(fc,e2),W(fe,a4),W(ff,66),W(fa,28),W(fb,ea),W(f9,ac),W(f8,6e) +.hword W(f3,30),W(f2,f2),W(f0,b4),W(f1,76),W(f4,38),W(f5,fa),W(f7,bc),W(f6,7e) +.hword W(d9,40),W(d8,82),W(da,c4),W(db,06),W(de,48),W(df,8a),W(dd,cc),W(dc,0e) +.hword W(d7,50),W(d6,92),W(d4,d4),W(d5,16),W(d0,58),W(d1,9a),W(d3,dc),W(d2,1e) +.hword W(c5,60),W(c4,a2),W(c6,e4),W(c7,26),W(c2,68),W(c3,aa),W(c1,ec),W(c0,2e) +.hword W(cb,70),W(ca,b2),W(c8,f4),W(c9,36),W(cc,78),W(cd,ba),W(cf,fc),W(ce,3e) +.hword W(91,80),W(90,42),W(92,04),W(93,c6),W(96,88),W(97,4a),W(95,0c),W(94,ce) +.hword W(9f,90),W(9e,52),W(9c,14),W(9d,d6),W(98,98),W(99,5a),W(9b,1c),W(9a,de) +.hword W(8d,a0),W(8c,62),W(8e,24),W(8f,e6),W(8a,a8),W(8b,6a),W(89,2c),W(88,ee) +.hword W(83,b0),W(82,72),W(80,34),W(81,f6),W(84,b8),W(85,7a),W(87,3c),W(86,fe) +.hword W(a9,c0),W(a8,02),W(aa,44),W(ab,86),W(ae,c8),W(af,0a),W(ad,4c),W(ac,8e) +.hword W(a7,d0),W(a6,12),W(a4,54),W(a5,96),W(a0,d8),W(a1,1a),W(a3,5c),W(a2,9e) +.hword W(b5,e0),W(b4,22),W(b6,64),W(b7,a6),W(b2,e8),W(b3,2a),W(b1,6c),W(b0,ae) +.hword W(bb,f0),W(ba,32),W(b8,74),W(b9,b6),W(bc,f8),W(bd,3a),W(bf,7c),W(be,be) + + -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 3

EAX mode
by nisse＠lysator.liu.se 25 Jun '13

25 Jun '13

For fun, I've tried implementing the EAX mode for "authenticated encryption with associated data". Patch below. It's pretty simple, the main file, eax.c, is only some 150 lines including comments. Comments appreciated, particularly on the interface. Some features suggested in the paper, http://www.cs.ucdavis.edu/~rogaway/papers/eax.pdf, and currently not implemented: 1. There's no interface for providing the nonce incrementally. I don't think that's needed. In any case, the nonce must be provided before any of the plaintext can be processed. The interface could be extended if there are any reasonable use-cases. 2. There's no interface for reusing the same associated data for multiple messages, which might be an important optimization in some cases. I don't quite like the suggestion that not providing any associated data should imply reuse of the previous message; it seems cleaner that not providing associated data means that the associated data is the empty string. So some additional functions may be needed to provide that feature (if it is deemed important enough). For blocking, the convention is the same as for the CTR and GCM implementations: When the message (or associated data) is provided using multiple calls to _encrypt (or _decrypt or _update), the data size for each call, except the final one, *must* be a multiple of the block size. Regards, /Niels diff --git a/Makefile.in b/Makefile.in index ebc9357..e7eb2e0 100644 --- a/Makefile.in +++ b/Makefile.in @@ -74,8 +74,8 @@ nettle_SOURCES = aes-decrypt-internal.c aes-decrypt.c \ cast128.c cast128-meta.c \ blowfish.c \ cbc.c ctr.c gcm.c gcm-aes.c \ - des.c \ - des3.c des-compat.c \ + des.c des3.c des-compat.c \ + eax.c eax-aes.c \ hmac.c hmac-md5.c hmac-ripemd160.c hmac-sha1.c \ hmac-sha224.c hmac-sha256.c hmac-sha384.c hmac-sha512.c \ pbkdf2.c pbkdf2-hmac-sha1.c pbkdf2-hmac-sha256.c \ diff --git a/eax-aes.c b/eax-aes.c index e69de29..24a5560 100644 --- a/eax-aes.c +++ b/eax-aes.c @@ -0,0 +1,70 @@ +/* eax-aes.c + * + * EAX mode using AES as the underlying cipher. + */ + +/* nettle, low-level cryptographics library + * + * Copyright (C) 2011, 2013 Niels MÃ¶ller + * + * The nettle library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or (at your + * option) any later version. + * + * The nettle library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public + * License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with the nettle library; see the file COPYING.LIB. If not, write to + * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02111-1301, USA. + */ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include "eax.h" + +void +eax_aes_set_key(struct eax_aes_ctx *ctx, size_t length, const uint8_t *key) +{ + EAX_SET_KEY(ctx, aes_set_encrypt_key, aes_encrypt, length, key); +} + +void +eax_aes_set_nonce(struct eax_aes_ctx *ctx, + size_t length, const uint8_t *iv) +{ + EAX_SET_NONCE(ctx, aes_encrypt, length, iv); +} + +void +eax_aes_update(struct eax_aes_ctx *ctx, size_t length, const uint8_t *data) +{ + EAX_UPDATE(ctx, aes_encrypt, length, data); +} + +void +eax_aes_encrypt(struct eax_aes_ctx *ctx, + size_t length, uint8_t *dst, const uint8_t *src) +{ + EAX_ENCRYPT(ctx, aes_encrypt, length, dst, src); +} + +void +eax_aes_decrypt(struct eax_aes_ctx *ctx, + size_t length, uint8_t *dst, const uint8_t *src) +{ + EAX_DECRYPT(ctx, aes_encrypt, length, dst, src); +} + +void +eax_aes_digest(struct eax_aes_ctx *ctx, + size_t length, uint8_t *digest) +{ + EAX_DIGEST(ctx, aes_encrypt, length, digest); +} diff --git a/eax.c b/eax.c index e69de29..ec0dda9 100644 --- a/eax.c +++ b/eax.c @@ -0,0 +1,152 @@ +/* eax.c + * + * EAX mode, see http://www.cs.ucdavis.edu/~rogaway/papers/eax.pdf + */ + +/* nettle, low-level cryptographics library + * + * Copyright (C) 2013 Niels MÃ¶ller + * + * The nettle library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or (at your + * option) any later version. + * + * The nettle library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public + * License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with the nettle library; see the file COPYING.LIB. If not, write to + * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02111-1301, USA. + */ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include <assert.h> +#include <string.h> + +#include "eax.h" + +#include "ctr.h" +#include "memxor.h" + +static void +omac_init (uint8_t *state, unsigned t) +{ + memset (state, 0, EAX_BLOCK_SIZE - 1); + state[EAX_BLOCK_SIZE - 1] = t; +} + +static void +omac_update (uint8_t *state, const struct eax_key *key, + void *cipher, nettle_crypt_func *f, + size_t length, const uint8_t *data) +{ + for (; length >= EAX_BLOCK_SIZE; + length -= EAX_BLOCK_SIZE, data += EAX_BLOCK_SIZE) + { + f (cipher, EAX_BLOCK_SIZE, state, state); + memxor (state, data, EAX_BLOCK_SIZE); + } + if (length > 0) + { + /* Allowed only for the last call */ + f (cipher, EAX_BLOCK_SIZE, state, state); + memxor (state, data, length); + state[length] ^= 0x80; + /* XOR with (P ^ B), since the digest processing + * unconditionally XORs with B */ + memxor (state, key->pad_partial, EAX_BLOCK_SIZE); + } +} + +static void +omac_final (uint8_t *state, const struct eax_key *key, + void *cipher, nettle_crypt_func *f) +{ + memxor (state, key->pad_block, EAX_BLOCK_SIZE); + f (cipher, EAX_BLOCK_SIZE, state, state); +} + +/* Allows r == a */ +static void +gf2_double (uint8_t *r, const uint8_t *a) +{ + unsigned high = - (a[0] >> 7); + unsigned i; + /* Shift left */ + for (i = 0; i < EAX_BLOCK_SIZE - 1; i++) + r[i] = (a[i] << 1) + (a[i+1] >> 7); + + /* Wrap around for x^{128} = x^7 + x^2 + x + 1 */ + r[EAX_BLOCK_SIZE - 1] = (a[EAX_BLOCK_SIZE - 1] << 1) ^ (high & 0x87); +} + +void +eax_set_key (struct eax_key *key, void *cipher, nettle_crypt_func *f) +{ + static const uint8_t zero_block[EAX_BLOCK_SIZE]; + f (cipher, EAX_BLOCK_SIZE, key->pad_block, zero_block); + gf2_double (key->pad_block, key->pad_block); + gf2_double (key->pad_partial, key->pad_block); + memxor (key->pad_partial, key->pad_block, EAX_BLOCK_SIZE); +} + +void +eax_set_nonce (struct eax_ctx *eax, const struct eax_key *key, + void *cipher, nettle_crypt_func *f, + size_t nonce_length, const uint8_t *nonce) +{ + omac_init (eax->omac_nonce, 0); + omac_update (eax->omac_nonce, key, cipher, f, nonce_length, nonce); + omac_final (eax->omac_nonce, key, cipher, f); + memcpy (eax->ctr, eax->omac_nonce, EAX_BLOCK_SIZE); + + omac_init (eax->omac_data, 1); + omac_init (eax->omac_message, 2); +} + +void +eax_update (struct eax_ctx *eax, const struct eax_key *key, + void *cipher, nettle_crypt_func *f, + size_t data_length, const uint8_t *data) +{ + omac_update (eax->omac_data, key, cipher, f, data_length, data); +} + +void +eax_encrypt (struct eax_ctx *eax, const struct eax_key *key, + void *cipher, nettle_crypt_func *f, + size_t length, uint8_t *dst, const uint8_t *src) +{ + ctr_crypt (cipher, f, EAX_BLOCK_SIZE, eax->ctr, length, dst, src); + omac_update (eax->omac_message, key, cipher, f, length, dst); +} + +void +eax_decrypt (struct eax_ctx *eax, const struct eax_key *key, + void *cipher, nettle_crypt_func *f, + size_t length, uint8_t *dst, const uint8_t *src) +{ + omac_update (eax->omac_message, key, cipher, f, length, src); + ctr_crypt (cipher, f, EAX_BLOCK_SIZE, eax->ctr, length, dst, src); +} + +void +eax_digest (struct eax_ctx *eax, const struct eax_key *key, + void *cipher, nettle_crypt_func *f, + size_t length, uint8_t *digest) +{ + assert (length > 0); + assert (length <= EAX_BLOCK_SIZE); + omac_final (eax->omac_data, key, cipher, f); + omac_final (eax->omac_message, key, cipher, f); + + memxor (eax->omac_nonce, eax->omac_data, length); + memxor3 (digest, eax->omac_nonce, eax->omac_message, length); +} diff --git a/eax.h b/eax.h index e69de29..0177767 100644 --- a/eax.h +++ b/eax.h @@ -0,0 +1,169 @@ +/* eax.h + * + * EAX mode, see http://www.cs.ucdavis.edu/~rogaway/papers/eax.pdf + */ + +/* nettle, low-level cryptographics library + * + * Copyright (C) 2013 Niels MÃ¶ller + * + * The nettle library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or (at your + * option) any later version. + * + * The nettle library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public + * License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with the nettle library; see the file COPYING.LIB. If not, write to + * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, + * MA 02111-1301, USA. + */ + +#ifndef NETTLE_EAX_H_INCLUDED +#define NETTLE_EAX_H_INCLUDED + +#include "aes.h" + +#ifdef __cplusplus +extern "C" { +#endif + +/* Name mangling */ +#define eax_set_key nettle_eax_set_key +#define eax_set_nonce nettle_eax_set_nonce +#define eax_update nettle_eax_update +#define eax_encrypt nettle_eax_encrypt +#define eax_decrypt nettle_eax_decrypt +#define eax_digest nettle_eax_digest + +#define eax_aes_set_key nettle_eax_aes_set_key +#define eax_aes_set_nonce nettle_eax_aes_set_nonce +#define eax_aes_update nettle_eax_aes_update +#define eax_aes_encrypt nettle_eax_aes_encrypt +#define eax_aes_decrypt nettle_eax_aes_decrypt +#define eax_aes_digest nettle_eax_aes_digest + +/* Restricted to block ciphers with 128 bit block size. FIXME: Reflect + this in naming? */ + +#define EAX_BLOCK_SIZE 16 + +/* FIXME: Ensure nice alignment. See gcm.h, union gcm_block. */ + +/* Values independent of message and nonce */ +struct eax_key +{ + uint8_t pad_block[EAX_BLOCK_SIZE]; + uint8_t pad_partial[EAX_BLOCK_SIZE]; +}; + +struct eax_ctx +{ + uint8_t omac_nonce[EAX_BLOCK_SIZE]; + uint8_t omac_data[EAX_BLOCK_SIZE]; + uint8_t omac_message[EAX_BLOCK_SIZE]; + uint8_t ctr[EAX_BLOCK_SIZE]; +}; + +void +eax_set_key (struct eax_key *key, void *cipher, nettle_crypt_func *f); + +void +eax_set_nonce (struct eax_ctx *eax, const struct eax_key *key, + void *cipher, nettle_crypt_func *f, + size_t nonce_length, const uint8_t *nonce); + +void +eax_update (struct eax_ctx *eax, const struct eax_key *key, + void *cipher, nettle_crypt_func *f, + size_t data_length, const uint8_t *data); + +void +eax_encrypt (struct eax_ctx *eax, const struct eax_key *key, + void *cipher, nettle_crypt_func *f, + size_t length, uint8_t *dst, const uint8_t *src); + +void +eax_decrypt (struct eax_ctx *eax, const struct eax_key *key, + void *cipher, nettle_crypt_func *f, + size_t length, uint8_t *dst, const uint8_t *src); + +void +eax_digest (struct eax_ctx *eax, const struct eax_key *key, + void *cipher, nettle_crypt_func *f, + size_t length, uint8_t *digest); + +#define EAX_CTX(type) \ + { type cipher; struct eax_key key; struct eax_ctx eax; } + +#define EAX_SET_KEY(ctx, set_key, encrypt, length, data) \ + do { \ + (set_key)(&(ctx)->cipher, (length), (data)); \ + if (0) (encrypt) (&(ctx)->cipher, 0, (void *) 0, (void *) 0); \ + eax_set_key (&(ctx)->key, &(ctx)->cipher, (nettle_crypt_func *) encrypt); \ + } while (0) + +#define EAX_SET_NONCE(ctx, encrypt, length, nonce) \ + (0 ? (encrypt) (&(ctx)->cipher, 0, (void *) 0, (void *) 0) \ + : eax_set_nonce (&(ctx)->eax, &(ctx)->key, \ + &(ctx)->cipher, (nettle_crypt_func *) (encrypt), \ + (length), (nonce))) + +#define EAX_UPDATE(ctx, encrypt, length, data) \ + (0 ? (encrypt) (&(ctx)->cipher, 0, (void *) 0, (void *) 0) \ + : eax_update (&(ctx)->eax, &(ctx)->key, \ + &(ctx)->cipher, (nettle_crypt_func *) (encrypt), \ + (length), (data))) + +#define EAX_ENCRYPT(ctx, encrypt, length, dst, src) \ + (0 ? (encrypt) (&(ctx)->cipher, 0, (void *) 0, (void *) 0) \ + : eax_encrypt (&(ctx)->eax, &(ctx)->key, \ + &(ctx)->cipher, (nettle_crypt_func *) (encrypt), \ + (length), (dst), (src))) + +#define EAX_DECRYPT(ctx, encrypt, length, dst, src) \ + (0 ? (encrypt) (&(ctx)->cipher, 0, (void *) 0, (void *) 0) \ + : eax_decrypt (&(ctx)->eax, &(ctx)->key, \ + &(ctx)->cipher, (nettle_crypt_func *) (encrypt), \ + (length), (dst), (src))) + +#define EAX_DIGEST(ctx, encrypt, length, digest) \ + (0 ? (encrypt) (&(ctx)->cipher, 0, (void *) 0, (void *) 0) \ + : eax_digest (&(ctx)->eax, &(ctx)->key, \ + &(ctx)->cipher, (nettle_crypt_func *) (encrypt), \ + (length), (digest))) + +struct eax_aes_ctx EAX_CTX(struct aes_ctx); + +void +eax_aes_set_key(struct eax_aes_ctx *ctx, + size_t length, const uint8_t *key); + +void +eax_aes_set_nonce(struct eax_aes_ctx *ctx, + size_t length, const uint8_t *iv); + +void +eax_aes_update(struct eax_aes_ctx *ctx, + size_t length, const uint8_t *data); + +void +eax_aes_encrypt(struct eax_aes_ctx *ctx, + size_t length, uint8_t *dst, const uint8_t *src); + +void +eax_aes_decrypt(struct eax_aes_ctx *ctx, + size_t length, uint8_t *dst, const uint8_t *src); + +void +eax_aes_digest(struct eax_aes_ctx *ctx, size_t length, uint8_t *digest); + +#ifdef __cplusplus +} +#endif + +#endif /* NETTLE_EAX_H_INCLUDED */ diff --git a/nettle-internal.c b/nettle-internal.c index 5cd5828..f6ff864 100644 --- a/nettle-internal.c +++ b/nettle-internal.c @@ -34,6 +34,7 @@ #include "nettle-internal.h" #include "blowfish.h" #include "des.h" +#include "eax.h" #include "gcm.h" #include "salsa20.h" @@ -112,3 +113,12 @@ const struct nettle_aead nettle_gcm_aes192 = _NETTLE_AEAD(gcm, GCM, aes, 192); const struct nettle_aead nettle_gcm_aes256 = _NETTLE_AEAD(gcm, GCM, aes, 256); + +#define eax_aes_set_iv eax_aes_set_nonce + +const struct nettle_aead +nettle_eax_aes128 = _NETTLE_AEAD(eax, EAX, aes, 128); +const struct nettle_aead +nettle_eax_aes192 = _NETTLE_AEAD(eax, EAX, aes, 192); +const struct nettle_aead +nettle_eax_aes256 = _NETTLE_AEAD(eax, EAX, aes, 256); diff --git a/nettle-internal.h b/nettle-internal.h index e094064..d9f1195 100644 --- a/nettle-internal.h +++ b/nettle-internal.h @@ -127,4 +127,8 @@ extern const struct nettle_aead nettle_gcm_twofish128; extern const struct nettle_aead nettle_gcm_twofish192; extern const struct nettle_aead nettle_gcm_twofish256; +extern const struct nettle_aead nettle_eax_aes128; +extern const struct nettle_aead nettle_eax_aes192; +extern const struct nettle_aead nettle_eax_aes256; + #endif /* NETTLE_INTERNAL_H_INCLUDED */ diff --git a/testsuite/.test-rules.make b/testsuite/.test-rules.make index 93ba9a8..5549fc0 100644 --- a/testsuite/.test-rules.make +++ b/testsuite/.test-rules.make @@ -103,6 +103,9 @@ ctr-test$(EXEEXT): ctr-test.$(OBJEXT) gcm-test$(EXEEXT): gcm-test.$(OBJEXT) $(LINK) gcm-test.$(OBJEXT) $(TEST_OBJS) -o gcm-test$(EXEEXT) +eax-test$(EXEEXT): eax-test.$(OBJEXT) + $(LINK) eax-test.$(OBJEXT) $(TEST_OBJS) -o eax-test$(EXEEXT) + hmac-test$(EXEEXT): hmac-test.$(OBJEXT) $(LINK) hmac-test.$(OBJEXT) $(TEST_OBJS) -o hmac-test$(EXEEXT) diff --git a/testsuite/Makefile.in b/testsuite/Makefile.in index bf0e53c..4a4aa69 100644 --- a/testsuite/Makefile.in +++ b/testsuite/Makefile.in @@ -25,7 +25,8 @@ TS_NETTLE_SOURCES = aes-test.c arcfour-test.c arctwo-test.c \ sha3-384-test.c sha3-512-test.c \ serpent-test.c twofish-test.c \ knuth-lfib-test.c \ - cbc-test.c ctr-test.c gcm-test.c hmac-test.c umac-test.c \ + cbc-test.c ctr-test.c gcm-test.c eax-test \ + hmac-test.c umac-test.c \ meta-hash-test.c meta-cipher-test.c meta-armor-test.c \ buffer-test.c yarrow-test.c pbkdf2-test.c diff --git a/testsuite/eax-test.c b/testsuite/eax-test.c index e69de29..5fe0b3f 100644 --- a/testsuite/eax-test.c +++ b/testsuite/eax-test.c @@ -0,0 +1,87 @@ +#include "testutils.h" +#include "nettle-internal.h" + +void +test_main(void) +{ + /* From the EAX specification, http://www.cs.ucdavis.edu/~rogaway/papers/eax.pdf */ + test_aead(&nettle_eax_aes128, + SHEX("233952DEE4D5ED5F9B9C6D6FF80FF478"), /* key */ + SHEX("6BFB914FD07EAE6B"), /* auth data */ + SHEX(""), /* plaintext */ + SHEX(""), /* ciphertext */ + SHEX("62EC67F9C3A4A407FCB2A8C49031A8B3"), /* nonce */ + SHEX("E037830E8389F27B025A2D6527E79D01")); /* tag */ + + test_aead(&nettle_eax_aes128, + SHEX("91945D3F4DCBEE0BF45EF52255F095A4"), + SHEX("FA3BFD4806EB53FA"), + SHEX("F7FB"), + SHEX("19DD"), + SHEX("BECAF043B0A23D843194BA972C66DEBD"), + SHEX("5C4C9331049D0BDAB0277408F67967E5")); + + test_aead(&nettle_eax_aes128, + SHEX("01F74AD64077F2E704C0F60ADA3DD523"), + SHEX("234A3463C1264AC6"), + SHEX("1A47CB4933"), + SHEX("D851D5BAE0"), + SHEX("70C3DB4F0D26368400A10ED05D2BFF5E"), + SHEX("3A59F238A23E39199DC9266626C40F80")); + + test_aead(&nettle_eax_aes128, + SHEX("D07CF6CBB7F313BDDE66B727AFD3C5E8"), + SHEX("33CCE2EABFF5A79D"), + SHEX("481C9E39B1"), + SHEX("632A9D131A"), + SHEX("8408DFFF3C1A2B1292DC199E46B7D617"), + SHEX("D4C168A4225D8E1FF755939974A7BEDE")); + + test_aead(&nettle_eax_aes128, + SHEX("35B6D0580005BBC12B0587124557D2C2"), + SHEX("AEB96EAEBE2970E9"), + SHEX("40D0C07DA5E4"), + SHEX("071DFE16C675"), + SHEX("FDB6B06676EEDC5C61D74276E1F8E816"), + SHEX("CB0677E536F73AFE6A14B74EE49844DD")); + + test_aead(&nettle_eax_aes128, + SHEX("BD8E6E11475E60B268784C38C62FEB22"), + SHEX("D4482D1CA78DCE0F"), + SHEX("4DE3B35C3FC039245BD1FB7D"), + SHEX("835BB4F15D743E350E728414"), + SHEX("6EAC5C93072D8E8513F750935E46DA1B"), + SHEX("ABB8644FD6CCB86947C5E10590210A4F")); + + test_aead(&nettle_eax_aes128, + SHEX("7C77D6E813BED5AC98BAA417477A2E7D"), + SHEX("65D2017990D62528"), + SHEX("8B0A79306C9CE7ED99DAE4F87F8DD61636"), + SHEX("02083E3979DA014812F59F11D52630DA30"), + SHEX("1A8C98DCD73D38393B2BF1569DEEFC19"), + SHEX("137327D10649B0AA6E1C181DB617D7F2")); + + test_aead(&nettle_eax_aes128, + SHEX("5FFF20CAFAB119CA2FC73549E20F5B0D"), + SHEX("54B9F04E6A09189A"), + SHEX("1BDA122BCE8A8DBAF1877D962B8592DD2D56"), + SHEX("2EC47B2C4954A489AFC7BA4897EDCDAE8CC3"), + SHEX("DDE59B97D722156D4D9AFF2BC7559826"), + SHEX("3B60450599BD02C96382902AEF7F832A")); + + test_aead(&nettle_eax_aes128, + SHEX("A4A4782BCFFD3EC5E7EF6D8C34A56123"), + SHEX("899A175897561D7E"), + SHEX("6CF36720872B8513F6EAB1A8A44438D5EF11"), + SHEX("0DE18FD0FDD91E7AF19F1D8EE8733938B1E8"), + SHEX("B781FCF2F75FA5A8DE97A9CA48E522EC"), + SHEX("E7F6D2231618102FDB7FE55FF1991700")); + + test_aead(&nettle_eax_aes128, + SHEX("8395FCF1E95BEBD697BD010BC766AAC3"), + SHEX("126735FCC320D25A"), + SHEX("CA40D7446E545FFAED3BD12A740A659FFBBB3CEAB7"), + SHEX("CB8920F87A6C75CFF39627B56E3ED197C552D295A7"), + SHEX("22E7ADD93CFC6393C57EC0B3C17D6B44"), + SHEX("CFC46AFC253B4652B1AF3795B124AB6E")); +} -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

Supported Algorithms/Key Format
by Mallikarjun Bailamanavar 21 Jun '13

21 Jun '13

Hi *, My name is Malik and I just started using the Nettle. I am looking for APIs for RSA crypto operations. >From rsa.h header file, I can make out that Nettle supports, - RSA crypto APIs only for PKCS#1 v1.5 padding mechanisms and - CRT format for RSA private key My questions, - Does nettle not support PKCS#1 v2.1 padding mechanisms e.g. RSASSA-PSS? - Does nettle not support exponent format for private key?. Meaning private key is made up of modulus and private exponent. - Is there an API for raw RSA crypto operation? Raw meaning, API must not do any encoding with input data but just has to sign/encrypt it. Can someone please clarify my questions? Thanks very much indeed in advance for the clarifications. Regards, Malik

2 1

query on nettle support.
by manish kanchan 21 Jun '13

21 Jun '13

Hi , I am trying to used Nettle cryptolibrary. I download the source, installed on ubuntu wrote a some sample application using the readme, examples files. There are couple of thing which i am still unsure. Can you help me understand this. 1. Does nettle support on PKCS1 encoding fro RSA encrytpion and signing? 2. In the PrivateKey structure, Is the d ( private expoenent ) never used? Does nettle use private key in CRT format only? and not in expoenent format ( i.e modulus and priv exp) I would be glad if you can clarify this to me. Regards Manish Kanchan

2 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs