nettle-bugs

nettle-bugs@lists.lysator.liu.se

2191 discussions

git.lysator.liu.se temporarily down
by nisse＠lysator.liu.se 30 May '13

30 May '13

The machine git.lysator.liu.se is being upgraded to a more recent debian version. Not sure when it will be operational again (it's maintained on a volunteer basis), but hopefully within a day or two. Possibly the gitorious web interface will be replaced by something different (gitolite, gitlab, ...), since gitorious seems to require quite a bit of work to install. Sorry for the inconvenience. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

ANNOUNCE: Nettle-2.7.1
by nisse＠lysator.liu.se 29 May '13

29 May '13

I'm happy to annnounce a new version of GNU Nettle, a low-level cryptographics library. The Nettle home page can be found at http://www.lysator.liu.se/~nisse/nettle/. One serious bug has been found in the new ECC code shipped in nettle-2.7. Thanks to Magnus Holmgren for help tracking down this problem. NEWS for the 2.7.1 release This is a bugfix release. Bug fixes: * Fixed a bug in the new ECC code. The ecc_j_to_a function called GMP:s mpn_mul_n (via ecc_modp_mul) with overlapping input and output arguments, which is not supported. * The assembly files for SHA1, SHA256 and AES depend on ARMv6 instructions, breaking nettle-2.7 for pre-v6 ARM processors. The configure script now enables those assembly files only when building for ARMv6 or later. * Use a more portable C expression for rotations. The previous version used the following "standard" expression for 32-bit rotation: (x << n) | (x >> (32 - n)) But this gives undefined behavior (according to the C specification) for n = 0. The rotate expression is replaced by the more portable: (x << n) | (x >> ((-n)&31)) This change affects only CAST128, which uses non-constant rotation counts. Unfortunately, the new expression is poorly optimized by released versions of gcc, making CAST128 a bit slower. This is being fixed by the gcc hackers, see http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57157. The following problems have been reported, but are *not* fixed in this release: * ARM assembly files use instruction syntax which is not supported by all assemblers. Workaround: Use a current version of GNU as, or configure with --disable-assembler. * Configuring with --disable-static doesn't work on windows. The libraries are intended to be binary compatible with nettle-2.2 and later. The shared library names are libnettle.so.4.7 and libhogweed.so.2.5, with sonames still libnettle.so.4 and libhogweed.so.2. Available at http://ftp.gnu.org/gnu/nettle/nettle-2.7.1.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-2.7.1.tar.gz http://www.lysator.liu.se/~nisse/archive/nettle-2.7.1.tar.gz and in the "nettle-2.7-fixes" branch in the git repository, see http://git.lysator.liu.se/nettle/nettle. Happy hacking, /Niels Möller -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

arm compilation
by Nikos Mavrogiannopoulos 28 May '13

28 May '13

Hello, Trying to build nettle 2.7 for an arm10 system of mine using its (old) toolchain fails with assembler errors. arm-linux-gcc -Os -I[...] -I. -DHAVE_CONFIG_H -g -O2 -ggdb3 -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-decrypt-internal.o -MD -MP -MF aes-decrypt-internal.o.d -fpic -c aes-decrypt-internal.s aes-decrypt-internal.s: Assembler messages: aes-decrypt-internal.s:81: Error: bad instruction `push {r4,r5,r6,r7,r8,r10,r11,lr}' aes-decrypt-internal.s:87: Error: register or shift expression expected -- `orr r4,r8,lsl#8' aes-decrypt-internal.s:89: Error: register or shift expression expected -- `orr r4,r8,lsl#16' aes-decrypt-internal.s:91: Error: register or shift expression expected -- `orr r4,r8,lsl#24' aes-decrypt-internal.s:93: Error: bad arguments to instruction -- `eor r4,r8' [...] make[2]: *** [aes-decrypt-internal.o] Error 1 $ arm-linux-as -v GNU assembler version 2.16.1 (arm-linux-uclibc) using BFD version 2.16.1 Trying with the latest buildroot another error is issued: arm-buildroot-linux-uclibcgnueabi-as -v GNU assembler version 2.21.1 (arm-buildroot-linux-uclibcgnueabi) using BFD version (GNU Binutils) 2.21.1 arm-buildroot-linux-uclibcgnueabi-gcc -I. -DHAVE_CONFIG_H -pipe -Os -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-encrypt-internal.o -MD -MP -MF aes-encrypt-internal.o.d -fpic -c aes-encrypt-internal.s aes-encrypt-internal.s: Assembler messages: aes-encrypt-internal.s:140: Error: selected processor does not support ARM mode `uxtb r8,r2' aes-encrypt-internal.s:142: Error: selected processor does not support ARM mode `uxtb r8,r3' aes-encrypt-internal.s:144: Error: selected processor does not support ARM mode `uxtb r8,r12' aes-encrypt-internal.s:146: Error: selected processor does not support ARM mode `uxtb r8,r14' Any ideas? regards, Nikos

3 17

Bug in nettle-2.7 ecc code
by nisse＠lysator.liu.se 17 May '13

17 May '13

Testing on the debian build machines revealed a bug in the new ecc code. Curiously enough, causing failures only on 32-bit sparc (see https://buildd.debian.org/status/fetch.php?pkg=nettle&arch=sparc&ver=2.7-2&…), but the bug is not really platform-specific. It turned out that ecc_j_to_a called GMP:s mpn_mul_n (via ecc_modp_mul) with overlapping input and output arguments, which is not supported. The following patch seems to solve the problem: diff --git a/ecc-j-to-a.c b/ecc-j-to-a.c index df8b876..26c1a03 100644 --- a/ecc-j-to-a.c +++ b/ecc-j-to-a.c @@ -46,6 +46,7 @@ ecc_j_to_a (const struct ecc_curve *ecc, #define up (scratch + ecc->size) #define iz2p (scratch + ecc->size) #define iz3p (scratch + 2*ecc->size) +#define izBp (scratch + 3*ecc->size) #define tp scratch mp_limb_t cy; @@ -72,11 +73,11 @@ ecc_j_to_a (const struct ecc_curve *ecc, if (flags & 1) { /* Divide this common factor by B */ - mpn_copyi (iz3p, izp, ecc->size); - mpn_zero (iz3p + ecc->size, ecc->size); - ecc->redc (ecc, iz3p); - - ecc_modp_mul (ecc, iz2p, izp, iz3p); + mpn_copyi (izBp, izp, ecc->size); + mpn_zero (izBp + ecc->size, ecc->size); + ecc->redc (ecc, izBp); + + ecc_modp_mul (ecc, iz2p, izp, izBp); } else ecc_modp_sqr (ecc, iz2p, izp); Thanks to Magnus Holmgren for tracking this down. Note that this bug causes overwrites *within* a properly allocated limb array, which gives incorrect results, but it does not overwrite any pointers or code. I should plan for a bugfix release reasonably soon. Testing with a GMP library compiled with --enable-assert would have revealed the bug earlier. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

Portable rotates
by nisse＠lysator.liu.se 03 May '13

03 May '13

I'm rewriting the cast128 key schedule, to get rid of false warnings, and avoid lots of conditions, and to separate the rotation and the mask subkeys. Then I noticed a portability problem with the rotation macros, #define ROTL32(n,x) (((x)<<(n)) | ((x)>>(32-(n)))) For n == 0, this will work on most machines, but it's not portable, since x >> 32 gives undefined behaviour according to the C spec (when x is a 32-bit type). (On typical hardware, the result of x >> 32 will be either x or 0, and the rotation macro gives the intended result in either case). In most of nettle, there's no problem, because rotation counts are constant and non-zero. cast128 is an exception, with key-dependent rotation counts, which can well be zero (don't know if that's exercised by the test suite, though). A fix is to redefine the macro as #define ROTL32(n,x) (((x)<<(n)) | ((x)>>((-(n))&31))) It should make no difference when n is constant, but for cast128, this portability fix makes the code almost 20% slower. Apparently, gcc, doens't recognize this as a rotate. I just filed a bug report at http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57157 Is there any other trick I'm missing, which is portable C but which doesn't slow it down when compiled with gcc? Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

raspberry pi
by nisse＠lysator.liu.se 30 Apr '13

30 Apr '13

I finally got a Raspberry Pi setup. Took almost 20 minutes to compile nettle, and the configure script figured out not to use neon instructions. It passes the testsuite. Benchmark for the public key functions: name size sign/ms verify/ms rsa 1024 0.1073 1.9099 rsa 2048 0.0167 0.5539 dsa 1024 0.1992 0.1014 ecdsa 192 0.5297 0.1922 ecdsa 224 0.3623 0.1354 ecdsa 256 0.2621 0.0971 ecdsa 384 0.1125 0.0391 ecdsa 521 0.0551 0.0190 So 3 to 5 times slower than the pandaboard (although that's not a completely fair comparison, since the raspberry pi is using gmp-5.0.5, not the gmp bleeding edge). Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

Problems when compiling 32bit version on 64bit host (multilib)
by Florian Pritz 27 Apr '13

27 Apr '13

Hi, I'm compiling nettle for the Arch Linux multilib repository (32bit libraries for a 64bit system so people can run skype and wine without needing a chroot). Looks like the new ecc code doesn't properly handle integer type sizes. Here[1] is the output of make, make check along with the PKGBUILD used to build this and a sample of the generated ecc-*.h files. [1]: http://flo.server-speed.net/tmp/lib32-nettle/ Can I fix that by setting some env variable or does it need code changes? If you need any more files, please tell me.

2 2

ANNOUNCE: Nettle-2.7
by nisse＠lysator.liu.se 24 Apr '13

24 Apr '13

I'm happy to annnounce a new version of GNU Nettle, a low-level cryptographics library. The Nettle home page can be found at http://www.lysator.liu.se/~nisse/nettle/. NEWS for the 2.7 release This release includes an implementation of elliptic curve cryptography (ECC) and optimizations for the ARM architecture. This work was done at the offices of South Pole AB, and generously funded by the .SE Internet Fund. Bug fixes: * Fixed a bug in the buffer handling for incremental SHA3 hashing, with a possible buffer overflow. Patch by Edgar E. Iglesias. New features: * Support for ECDSA signatures. Elliptic curve operations over the following curves: secp192r1, secp224r1, secp256r1, secp384r1 and secp521r1, including x86_64 and ARM assembly for the most important primitives. * Support for UMAC, including x86_64 and ARM assembly. * Support for 12-round salsa20, "salsa20r12", as specified by eSTREAM. Contributed by Nikos Mavrogiannopoulos. Optimizations: * ARM assembly code for several additional algorithms, including AES, Salsa20, and the SHA family of hash functions. * x86_64 assembly for SHA256, SHA512, and SHA3. (SHA3 assembly was included in the 2.6 release, but disabled due to poor performance on some AMD processors. Hopefully, that performance problem is fixed now). The ARM code was tested and benchmarked on Cortex-A9. Some of the functions use "neon" instructions. The configure script decides if neon instructions can be used, and the command line options --enable-arm-neon and --disable-arm-neon can be used to override its choice. Feedback appreciated. The libraries are intended to be binary compatible with nettle-2.2 and later. The shared library names are libnettle.so.4.6 and libhogweed.so.2.4, with sonames still libnettle.so.4 and libhogweed.so.2. http://ftp.gnu.org/gnu/nettle/nettle-2.7.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-2.7.tar.gz http://www.lysator.liu.se/~nisse/archive/nettle-2.7.tar.gz ftp://ftp.lysator.liu.se/pub/security/lsh/nettle-2.7.tar.gz (soon) Happy hacking, /Niels Möller -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

nettle-2.7 release candidate
by nisse＠lysator.liu.se 24 Apr '13

24 Apr '13

I've generated a release candidate, available at http://www.lysator.liu.se/~nisse/archive/nettle-2.7rc1.tar.gz Testing appreciated. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 9

[PATCH 1/2] sha: Add the missing W64_EXIT epilogue macro
by Martin Storsjö 23 Apr '13

23 Apr '13

--- x86_64/sha256-compress.asm | 1 + x86_64/sha512-compress.asm | 1 + 2 files changed, 2 insertions(+) diff --git a/x86_64/sha256-compress.asm b/x86_64/sha256-compress.asm index 6bfb7a7..385654c 100644 --- a/x86_64/sha256-compress.asm +++ b/x86_64/sha256-compress.asm @@ -192,5 +192,6 @@ PROLOGUE(_nettle_sha256_compress) mov 112(%rsp),%r15 add $120, %rsp + W64_EXIT(3, 0) ret EPILOGUE(_nettle_sha256_compress) diff --git a/x86_64/sha512-compress.asm b/x86_64/sha512-compress.asm index 21df82a..663e68e 100644 --- a/x86_64/sha512-compress.asm +++ b/x86_64/sha512-compress.asm @@ -192,5 +192,6 @@ PROLOGUE(_nettle_sha512_compress) mov 176(%rsp),%r15 add $184, %rsp + W64_EXIT(3, 0) ret EPILOGUE(_nettle_sha512_compress) -- 1.7.9.5

1 1

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs