On Thu, Aug 13, 2026 at 10:16 AM Niels Möller nisse@lysator.liu.se wrote:
Maamoun TK maamoun.tk@googlemail.com writes:
btw the page is 429ing..
Sorry about that. I think the gitlab instance is struggling with bots (likely the same ai crawlers trying to kill most of the open internet). It may help to try again later, or login, for those that have an account on that instance.
Logging in works, thanks. I agree that empty IV should be rejected, I have the spec in an updated document that may be worth referencing in this case. I will look for the document and try to send it later today.
For reference, see commit below.
Regards, /Niels
commit bb9bba13cc327d578e7dab2921b021bad9af8ee1 Author: Niels Möller nisse@lysator.liu.se Date: Wed Aug 5 16:17:42 2026 +0200
Require non-empty IV for gcm_set_iv.diff --git a/ChangeLog b/ChangeLog index beecc55b..606cfd23 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2026-08-05 Niels Möller nisse@lysator.liu.se
* gcm.c (gcm_set_iv): Reject empty IV, with an assertion failure.Empty IV is not allowed by the spec, and results in leakage of theghash authentication subkey. Reported by Feng Li and Yaobin Shen.* nettle.texinfo (GCM): Document that IV must be non-empty.2026-06-30 Niels Möller nisse@lysator.liu.se
* slh-dsa.c (_slh_dsa_sign): Change return type from void to int.diff --git a/gcm.c b/gcm.c index ab74b72d..ab6933c0 100644 --- a/gcm.c +++ b/gcm.c @@ -108,6 +108,7 @@ void gcm_set_iv(struct gcm_ctx *ctx, const struct gcm_key *key, size_t length, const uint8_t *iv) {
- assert (length > 0); if (length == GCM_IV_SIZE) { memcpy (ctx->iv.b, iv, GCM_BLOCK_SIZE - 4);
diff --git a/nettle.texinfo b/nettle.texinfo index 3047b836..51d0c20d 100644 --- a/nettle.texinfo +++ b/nettle.texinfo @@ -3081,7 +3081,8 @@ Size of the @acronym{GCM} digest, also 16. @end defvr
@defvr Constant GCM_IV_SIZE -Recommended size of the @acronym{IV}, 12. Arbitrary sizes are allowed. +Recommended size of the @acronym{IV}, 12. Arbitrary non-zero sizes are +allowed. @end defvr
@deftypefun void gcm_set_key (struct gcm_key *@var{key}, const void *@var{cipher}, nettle_cipher_func *@var{f}) @@ -3091,9 +3092,9 @@ encryption, and @var{f} is the encryption function. @end deftypefun
@deftypefun void gcm_set_iv (struct gcm_ctx *@var{ctx}, const struct gcm_key *@var{key}, size_t @var{length}, const uint8_t *@var{iv}) -Initializes @var{ctx} using the given @acronym{IV}. The @var{key} -argument is actually needed only if @var{length} differs from -@code{GCM_IV_SIZE}. +Initializes @var{ctx} using the given @acronym{IV}, which must be +non-empty. The @var{key} argument is actually needed only if +@var{length} differs from @code{GCM_IV_SIZE}. @end deftypefun
@deftypefun void gcm_update (struct gcm_ctx *@var{ctx}, const struct gcm_key *@var{key}, size_t @var{length}, const uint8_t *@var{data})
-- Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677. Internet email is subject to wholesale government surveillance.