nettle-bugs June 2014

nettle-bugs@lists.lysator.liu.se

9 participants
10 discussions

ANNOUNCE: Nettle-3.0
by nisse＠lysator.liu.se 13 Apr '15

13 Apr '15

I'm happy to announce a new version of GNU Nettle, a low-level cryptographics library. The Nettle home page can be found at http://www.lysator.liu.se/~nisse/nettle/. This release is dual licensed as LGPLv3 or later, or GPLv2 or later. See the manual for details. NEWS for the Nettle 3.0 release This is a major release, including several interface changes, and new features, some of which are a bit experimental. Feedback is highly appreciated. It is *not* binary (ABI) compatible with earlier versions. It is mostly source-level (API) compatible, with a couple of incompatibilities noted below. The shared library names are libnettle.so.5.0 and libhogweed.so.3.0, with sonames libnettle.so.5 and libhogweed.so.3. There may be some problems in the new interfaces and new features which really need incompatible fixes. It is likely that there will be an update in the form of a 3.1 release in the not too distant future, with small but incompatible changes, and if that happens, bugfix-only releases 3.0.x are unlikely. Users and applications which desire better API and ABI stability are advised to stay with nettle-2.7.x (latest version is now 2.7.1) until the dust settles. Interface changes: * For the many _set_key functions, it is now consider the normal case to have a fixed key size, with no key_size arguments. _set_key functions with a length parameter are provided only for algorithms with a truly variable keysize, and where it makes sense for backwards compatibility. INCOMPATIBLE CHANGE: cast128_set_key no longer accepts a key size argument. The old function is available under a new name, cast5_set_key. INCOMPATIBLE CHANGE: The function typedef nettle_set_key_func no longer accepts a key size argument. In particular, this affects users of struct nettle_cipher. * The nettle_cipher abstraction (in nettle-meta.h) is restricted to block ciphers only. The encrypt and decrypt functions now take a const argument for the context. INCOMPATIBLE CHANGE: nettle_arcfour, i.e., the nettle_cipher abstraction for the arcfour stream cipher, is deleted. INCOMPATIBLE CHANGE: New type, nettle_cipher_func, for the encrypt and decrypt fields of struct nettle_cipher. * New DSA interface, with a separate struct dsa_param to represent the underlying group, and generalized dsa_sign and dsa_verify functions which don't care about the hash function used. Limited backwards compatibility provided in dsa-compat.h. INCOMPATIBLE CHANGE: Declarations of the old interface, e.g., struct dsa_public_key, dsa_sha1_sign, etc, is moved to dsa-compat.h. INCOMPATIBLE CHANGE: The various key conversion functions, e.g., dsa_keypair_to_sexp, all use the new DSA interface, with no backwards compatible functions. INCOMPATIBLE CHANGE: dsa_generate_keypair also uses the new interface. dsa-compat.h declares a function dsa_compat_generate_keypair, implementing the old interface, and #defines dsa_generate_keypair to refer to this backwards compatible function. * New AES and Camellia interfaces. There are now separate context structs for each key size, e.g., aes128_ctx and camellia256_ctx, and corresponding new functions. The old interface, with struct aes_ctx and struct camellia_ctx, is kept for backwards compatibility, but might be removed in later versions. * The type of most length arguments is changed from unsigned to size_t. The memxor functions have their pointer arguments changed from uint8_t * to void *, for consistency with related libc functions. * For hash functions, the constants *_DATA_SIZE have been renamed to *_BLOCK_SIZE. Old names kept for backwards compatibility. Removed features: * The nettle_next_prime function has been deleted. Applications should use GMP's mpz_nextprime instead. * Deleted the RSAREF compatibility, including the header file rsa-compat.h and everything declared therein. * Also under consideration for removal is des-compat.h and everything declared therein. This implements a subset of the old libdes/ssleay/openssl interface for DES and triple-DES, and it is poorly tested. If anyone uses this interface, please speak up! Otherwise, it will likely be removed in the next release. Bug fixes: * Building with ./configure --disable-static now works. * Use GMP's allocation functions for temporary storage related to bignums, to avoid potentially large stack allocations. * Fixes for shared libraries on M$ Windows. New features: * Support for Poly1305-AES MAC. * Support for the ChaCha stream cipher and EXPERIMENTAL support for the ChaCha-Poly1305 AEAD mode. Specifications are still in flux, and future releases may do incompatible changes to track standardization. Currently uses 256-bit key and 64-bit nonce. * Support for EAX mode. * Support for CCM mode. Contributed by Owen Kirby. * Additional variants of SHA512 with output size of 224 and 256 bits. Contributed by Joachim Strömbergson. * New interface, struct nettle_aead, for mechanisms providing authenticated encryption with associated data (AEAD). * DSA: Support a wider range for the size of q and a wider range for the digest size. Optimizations: * New x86_64 assembly for GCM and MD5. Modest speedups on the order of 10%-20%. Miscellaneous: * SHA3 is now documented as EXPERIMENTAL. Nettle currently implements SHA3 as specified at the time Keccak won the SHA3 competition. However, the final standard specified by NIST is likely to be incompatible, in which case future releases may do incompatible changes to track standardization. * The portability fix for the rotation macros, mentioned in NEWS for 2.7.1, actually didn't make it into that release. It is included now. * cast128_set_key rewritten for clarity, also eliminating a couple of compiler warnings. * New command line tool nettle-pbkdf2. Available at: https://ftp.gnu.org/gnu/nettle/nettle-3.0.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-3.0.tar.gz http://www.lysator.liu.se/~nisse/archive/nettle-3.0.tar.gz ftp://ftp.lysator.liu.se/pub/security/lsh/nettle-3.0.tar.gz (soon) Happy hacking, /Niels Möller -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

5 12

OCB mode
by Nikos Mavrogiannopoulos 28 Jan '15

28 Jan '15

Hello, What do you think of having OCB mode in nettle? I particularly like OCB due to it's simplicity and performance comparing to GCM/CCM, but was always patented. However in [0] there is license1 which states: "Under this license, you are authorized to make, use, and distribute open-source software implementations of OCB. This license terminates for you if you sue someone over their open-source software implementation of OCB claiming that you have a patent covering their implementation." What do you think? Should the FSF be consulted on that? regards, Nikos [0]. http://www.cs.ucdavis.edu/~rogaway/ocb/license.htm

4 8

Simplifying pic vs non-pic object files
by nisse＠lysator.liu.se 03 Sep '14

03 Sep '14

Currently, the nettle Makefile creates two object files for each source file, .o for inclusion in the static library, and .po ("pure object") for the shared library. By default, both are compiled as pic code, but --disable-pic drops the pic flags when compiling the .o files, to get non-pic code into the static library. I'm considering dropping this complication. Just build a single .o file, which is pic by default, and non-pic if --disable-pic is given. To build a non-pic static library, one would configure with "--disable-pic --disable-shared" (since just --disable-pic would produce a shared library with non-pic code, which is highly undesirable). And to produce a static non-pic library and a shared pic library, one would need to use separate build trees. Does that make sense? It would make things simpler, shorten build time, and eliminate the problem of naming two types of object files. One might also have --disable-pic imply --disable-shared (unless explicitly overridden by the user). Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 2

[PATCH 1/5] Don't include OPT_ASM_SOURCES twice in hogweed_PURE_OBJS
by Martin Storsjö 24 Aug '14

24 Aug '14

OPT_ASM_SOURCES is already included via hogweed_OBJS. This avoids build errors about duplicate symbols in the shared library. --- Makefile.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile.in b/Makefile.in index 1ec807b..2db76c5 100644 --- a/Makefile.in +++ b/Makefile.in @@ -180,7 +180,7 @@ nettle_OBJS = $(nettle_SOURCES:.c=.$(OBJEXT)) $(LIBOBJS) nettle_PURE_OBJS = $(nettle_OBJS:.$(OBJEXT)=.p$(OBJEXT)) hogweed_OBJS = $(hogweed_SOURCES:.c=.$(OBJEXT)) $(OPT_ASM_SOURCES:.asm=.$(OBJEXT)) -hogweed_PURE_OBJS = $(hogweed_OBJS:.$(OBJEXT)=.p$(OBJEXT)) $(OPT_ASM_SOURCES:.asm=.p$(OBJEXT)) +hogweed_PURE_OBJS = $(hogweed_OBJS:.$(OBJEXT)=.p$(OBJEXT)) libnettle.a: $(nettle_OBJS) -rm -f $@ -- 1.7.9.4

5 29

[PATCH 1/3] Don't hardcode the -lgmp linker flag in the hogweed pkg-config file
by Martin Storsjö 26 Jun '14

26 Jun '14

--- hogweed.pc.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hogweed.pc.in b/hogweed.pc.in index 457f5f2..839f7d0 100644 --- a/hogweed.pc.in +++ b/hogweed.pc.in @@ -13,6 +13,6 @@ URL: http://www.lysator.liu.se/~nisse/nettle Version: @PACKAGE_VERSION@ Requires.private: nettle Libs: -L${libdir} -lhogweed -Libs.private: -lgmp +Libs.private: @LIBS@ Cflags: -I${includedir} -- 1.8.5.2 (Apple Git-48)

2 4

nettle-mini
by Nikos Mavrogiannopoulos 26 Jun '14

26 Jun '14

Hello, I have put in https://github.com/nmav/nettle-mini/tree/gmp-mini a version of nettle that has an additional configure option. The --enable-mini-gmp. This will compile libghoweed using mini-gmp thus allowing nettle to be used in space constrained systems. Note that using nettle with mini-gmp instead of gmp imposes a penalty of around 10x, and may leak more information due to side-channels (this should not be the case for RSA as blinding is performed in hogweed, but I haven't checked the other algorithms). regards, Nikos

3 5

turn RSA blinding off in openssl
by Nikos Mavrogiannopoulos 24 Jun '14

24 Jun '14

2 1

pbkdf2 functions return longer values than requested
by Aapo Talvensaari 10 Jun '14

10 Jun '14

I started implementing LuaJIT FFI bindings to Nettle, and I found that nettle_pbkdf2_hmac_sha1 and nettle_pbkdf2_hmac_sha256 sometimes return longer dst than what was requested. See: https://github.com/bungle/lua-resty-nettle/blob/master/lib/resty/nettle/pbk… I had to put ":sub(1, len)" to overcome that. Is it by a design or is it a bug (maybe in my code?). Regards Aapo

2 2

git server changes
by nisse＠lysator.liu.se 08 Jun '14

08 Jun '14

Lysator's git server, git.lysator.liu.se, is about to be replaced. New server will run gitlab software instead of the current gitorious. Nettle and LSH repos (as well as other repos I have there) will move, but they may be temporarily unavailable in the weekend or next week. Don't panic. I'll send another mail once everything is ready at the new server. Intention is that git urls will be unchanged. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 3

Problem with w32 shared libraries
by nisse＠lysator.liu.se 02 Jun '14

02 Jun '14

I just tested w32 support, ./configure --host=i586-mingw32msvc which produces shared libraries (and I'm not sure I've tested this eariler, I may have used --disable-shared on earlier builds for w32). When I run the testsuite with make check EMULATOR=wine, the arcfour testcase fails. wine reports the error like Unhandled exception: page fault on read access to 0x70dc344d in 32-bit code (0x70dc344d). Register dump: CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b EIP:70dc344d ESP:0061fc5c EBP:0061fdc8 EFLAGS:00010202( R- -- I - - - ) EAX:0061fcba EBX:00000001 ECX:00000001 EDX:00000001 ESI:001139ef EDI:001139b0 Stack dump: 0x0061fc5c: 004014bd 0061fcba 00000001 001139f0 0x0061fc6c: 001139b0 0061fcd0 7bc4abf6 00000001 0x0061fc7c: 00113990 001139f8 001139b0 001139d0 0x0061fc8c: 00000000 00000000 00113988 001139a8 0x0061fc9c: 001139c8 00000008 00000009 001139f0 0x0061fcac: 7bc3812f 00000020 0061fcc8 df019956 Backtrace: =>0 0x70dc344d (0x0061fdc8) 1 0x00401767 test_main+0x36() [/home/nisse/hack/nettle/testsuite/arcfour-test.c:73] in arcfour-test (0x0061fde8) 2 0x00401767 test_main+0x36() [/home/nisse/hack/nettle/testsuite/arcfour-test.c:73] in arcfour-test (0x0061fe08) I'm not entirely sure how to interpret this, but it looks like the instruction pointer gets a bogus value. It looks like there's a problem with arcfoure-crypt.asm, because configuring with --disable-assembler seems to work fine. Also compiling with --disable-shared works fine. Questions: 1. Can the problem be reproduced on a M$ windows machine? 2. Are there any calling convention subtleties in dll calls? I just push and pop the callee-save registers %ebx, %ebp, %esi, %edi, and read the arguments from the stack. I have no dllimport/dllexport stuff in the header files, instead relying on mingw tools doing the right thing automatically. I get lots of messages like Info: resolving _nettle_arcfour_crypt by linking to __imp__nettle_arcfour_crypt (auto-import) /usr/lib/gcc/i586-mingw32msvc/4.2.1-sjlj/../../../../i586-mingw32msvc/bin/ld: warning: auto-importing has been activated without --enable-auto-import specified on the command line. This should work unless it involves constant data structures referencing symbols from auto-imported DLLs. This probably needs fixing at some point, but as far as I see, arcfour-test doesn't use any references from constant data, and it should be independent of the choice between C or assembly for arcfour-crypt. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

3 24

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs June 2014