Niels Möller nisse@lysator.liu.se writes:
The current code checks for 0 without first reducing mod q, which is bad. I have a tentative fix on branch https://git.lysator.liu.se/nettle/nettle/-/tree/fix-gostdsa-zero.
Then there's a related problem in handling of the "UKM" input for gostdsa_vko, if that happens to equal q or a multiple thereof. I suspect the UKM is usually rather small, which would help. E.g., if I could do something like
ukm_max_length = (ecc->q.bit_size - 1) / 8; assert (ukm_length <= ukm_max_length);
the number would surely be less than q, and current plain check for 0 would be fine.
I've added a change along those lines to the same branch. I've also reenabled the gnutls tests in CI (they were "temporarily" disabled a year ago, due to the incompatible nettle changes for nettle 4). Tests seem to pass, but it's not entirely clear to me what's gnutls' test coverage for gostdsa-vko. See https://git.lysator.liu.se/nettle/nettle/-/jobs/7285
Is there a specified maximum size? I've looked at
RFC 4357, which seems to say the UKM is 64 bits
RFC 9189, which seems to say that the UKM is 128 bits (16 bytes).
GnuTLS (only user of this function I'm aware of). It's unobvious to me what size of the nonce/ukm is actually passed down to nettle, but at least I've found a
#define VKO_GOST_UKM_LEN 8
which seems to indicate 64 bits.
Anyone who's more familiar with how this is used in TLS or elsewhere?
Actually, there was already a similar limit, so the change reduces the maximum UKM size in nettle from 32 to 31 or 64 to 63 (depending on which of the two supported gost curves are used).
Any additional insights welcome, but I think I will merge the branch soon.
Regards, /Niels