Maamoun TK maamoun.tk@googlemail.com writes:
btw the page is 429ing..
Sorry about that. I think the gitlab instance is struggling with bots (likely the same ai crawlers trying to kill most of the open internet). It may help to try again later, or login, for those that have an account on that instance.
For reference, see commit below.
Regards, /Niels
commit bb9bba13cc327d578e7dab2921b021bad9af8ee1 Author: Niels Möller nisse@lysator.liu.se Date: Wed Aug 5 16:17:42 2026 +0200
Require non-empty IV for gcm_set_iv.
diff --git a/ChangeLog b/ChangeLog index beecc55b..606cfd23 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,10 @@ +2026-08-05 Niels Möller nisse@lysator.liu.se + + * gcm.c (gcm_set_iv): Reject empty IV, with an assertion failure. + Empty IV is not allowed by the spec, and results in leakage of the + ghash authentication subkey. Reported by Feng Li and Yaobin Shen. + * nettle.texinfo (GCM): Document that IV must be non-empty. + 2026-06-30 Niels Möller nisse@lysator.liu.se
* slh-dsa.c (_slh_dsa_sign): Change return type from void to int. diff --git a/gcm.c b/gcm.c index ab74b72d..ab6933c0 100644 --- a/gcm.c +++ b/gcm.c @@ -108,6 +108,7 @@ void gcm_set_iv(struct gcm_ctx *ctx, const struct gcm_key *key, size_t length, const uint8_t *iv) { + assert (length > 0); if (length == GCM_IV_SIZE) { memcpy (ctx->iv.b, iv, GCM_BLOCK_SIZE - 4); diff --git a/nettle.texinfo b/nettle.texinfo index 3047b836..51d0c20d 100644 --- a/nettle.texinfo +++ b/nettle.texinfo @@ -3081,7 +3081,8 @@ Size of the @acronym{GCM} digest, also 16. @end defvr
@defvr Constant GCM_IV_SIZE -Recommended size of the @acronym{IV}, 12. Arbitrary sizes are allowed. +Recommended size of the @acronym{IV}, 12. Arbitrary non-zero sizes are +allowed. @end defvr
@deftypefun void gcm_set_key (struct gcm_key *@var{key}, const void *@var{cipher}, nettle_cipher_func *@var{f}) @@ -3091,9 +3092,9 @@ encryption, and @var{f} is the encryption function. @end deftypefun
@deftypefun void gcm_set_iv (struct gcm_ctx *@var{ctx}, const struct gcm_key *@var{key}, size_t @var{length}, const uint8_t *@var{iv}) -Initializes @var{ctx} using the given @acronym{IV}. The @var{key} -argument is actually needed only if @var{length} differs from -@code{GCM_IV_SIZE}. +Initializes @var{ctx} using the given @acronym{IV}, which must be +non-empty. The @var{key} argument is actually needed only if +@var{length} differs from @code{GCM_IV_SIZE}. @end deftypefun
@deftypefun void gcm_update (struct gcm_ctx *@var{ctx}, const struct gcm_key *@var{key}, size_t @var{length}, const uint8_t *@var{data})