nettle-bugs March 2015

nettle-bugs@lists.lysator.liu.se

6 participants
8 discussions

ANNOUNCE: Nettle-3.0
by nisse＠lysator.liu.se 13 Apr '15

13 Apr '15

I'm happy to announce a new version of GNU Nettle, a low-level cryptographics library. The Nettle home page can be found at http://www.lysator.liu.se/~nisse/nettle/. This release is dual licensed as LGPLv3 or later, or GPLv2 or later. See the manual for details. NEWS for the Nettle 3.0 release This is a major release, including several interface changes, and new features, some of which are a bit experimental. Feedback is highly appreciated. It is *not* binary (ABI) compatible with earlier versions. It is mostly source-level (API) compatible, with a couple of incompatibilities noted below. The shared library names are libnettle.so.5.0 and libhogweed.so.3.0, with sonames libnettle.so.5 and libhogweed.so.3. There may be some problems in the new interfaces and new features which really need incompatible fixes. It is likely that there will be an update in the form of a 3.1 release in the not too distant future, with small but incompatible changes, and if that happens, bugfix-only releases 3.0.x are unlikely. Users and applications which desire better API and ABI stability are advised to stay with nettle-2.7.x (latest version is now 2.7.1) until the dust settles. Interface changes: * For the many _set_key functions, it is now consider the normal case to have a fixed key size, with no key_size arguments. _set_key functions with a length parameter are provided only for algorithms with a truly variable keysize, and where it makes sense for backwards compatibility. INCOMPATIBLE CHANGE: cast128_set_key no longer accepts a key size argument. The old function is available under a new name, cast5_set_key. INCOMPATIBLE CHANGE: The function typedef nettle_set_key_func no longer accepts a key size argument. In particular, this affects users of struct nettle_cipher. * The nettle_cipher abstraction (in nettle-meta.h) is restricted to block ciphers only. The encrypt and decrypt functions now take a const argument for the context. INCOMPATIBLE CHANGE: nettle_arcfour, i.e., the nettle_cipher abstraction for the arcfour stream cipher, is deleted. INCOMPATIBLE CHANGE: New type, nettle_cipher_func, for the encrypt and decrypt fields of struct nettle_cipher. * New DSA interface, with a separate struct dsa_param to represent the underlying group, and generalized dsa_sign and dsa_verify functions which don't care about the hash function used. Limited backwards compatibility provided in dsa-compat.h. INCOMPATIBLE CHANGE: Declarations of the old interface, e.g., struct dsa_public_key, dsa_sha1_sign, etc, is moved to dsa-compat.h. INCOMPATIBLE CHANGE: The various key conversion functions, e.g., dsa_keypair_to_sexp, all use the new DSA interface, with no backwards compatible functions. INCOMPATIBLE CHANGE: dsa_generate_keypair also uses the new interface. dsa-compat.h declares a function dsa_compat_generate_keypair, implementing the old interface, and #defines dsa_generate_keypair to refer to this backwards compatible function. * New AES and Camellia interfaces. There are now separate context structs for each key size, e.g., aes128_ctx and camellia256_ctx, and corresponding new functions. The old interface, with struct aes_ctx and struct camellia_ctx, is kept for backwards compatibility, but might be removed in later versions. * The type of most length arguments is changed from unsigned to size_t. The memxor functions have their pointer arguments changed from uint8_t * to void *, for consistency with related libc functions. * For hash functions, the constants *_DATA_SIZE have been renamed to *_BLOCK_SIZE. Old names kept for backwards compatibility. Removed features: * The nettle_next_prime function has been deleted. Applications should use GMP's mpz_nextprime instead. * Deleted the RSAREF compatibility, including the header file rsa-compat.h and everything declared therein. * Also under consideration for removal is des-compat.h and everything declared therein. This implements a subset of the old libdes/ssleay/openssl interface for DES and triple-DES, and it is poorly tested. If anyone uses this interface, please speak up! Otherwise, it will likely be removed in the next release. Bug fixes: * Building with ./configure --disable-static now works. * Use GMP's allocation functions for temporary storage related to bignums, to avoid potentially large stack allocations. * Fixes for shared libraries on M$ Windows. New features: * Support for Poly1305-AES MAC. * Support for the ChaCha stream cipher and EXPERIMENTAL support for the ChaCha-Poly1305 AEAD mode. Specifications are still in flux, and future releases may do incompatible changes to track standardization. Currently uses 256-bit key and 64-bit nonce. * Support for EAX mode. * Support for CCM mode. Contributed by Owen Kirby. * Additional variants of SHA512 with output size of 224 and 256 bits. Contributed by Joachim Strömbergson. * New interface, struct nettle_aead, for mechanisms providing authenticated encryption with associated data (AEAD). * DSA: Support a wider range for the size of q and a wider range for the digest size. Optimizations: * New x86_64 assembly for GCM and MD5. Modest speedups on the order of 10%-20%. Miscellaneous: * SHA3 is now documented as EXPERIMENTAL. Nettle currently implements SHA3 as specified at the time Keccak won the SHA3 competition. However, the final standard specified by NIST is likely to be incompatible, in which case future releases may do incompatible changes to track standardization. * The portability fix for the rotation macros, mentioned in NEWS for 2.7.1, actually didn't make it into that release. It is included now. * cast128_set_key rewritten for clarity, also eliminating a couple of compiler warnings. * New command line tool nettle-pbkdf2. Available at: https://ftp.gnu.org/gnu/nettle/nettle-3.0.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-3.0.tar.gz http://www.lysator.liu.se/~nisse/archive/nettle-3.0.tar.gz ftp://ftp.lysator.liu.se/pub/security/lsh/nettle-3.0.tar.gz (soon) Happy hacking, /Niels Möller -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

5 12

nettle-3.1rc1
by nisse＠lysator.liu.se 03 Apr '15

03 Apr '15

Available now, at http://www.lysator.liu.se/~nisse/archive/nettle-3.1rc1.tar.gz http://www.lysator.liu.se/~nisse/archive/nettle-3.1rc1.tar.gz.sig There's also a corresponding tag in the repo (except that the suffix "rc1" on the package version in configure.ac is not committed). All testing and proof-reading highly appreciated. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

4 12

Getting closer to nettle-3.1
by nisse＠lysator.liu.se 26 Mar '15

26 Mar '15

I think the remaining items on http://www.lysator.liu.se/~nisse/nettle/plan.html aren't very urgent, and can be postponed. Discussed recently, but not on that list, is mem_equalp (or whatever it should be called). That's also not very urgent. I plan to move NETTLE_USE_MINI_GMP from bignum.h to version.h, and drop bignum.h.in. It should be enough with one configure-generated header like that. It also has the advantage that version.h actually gets used during the build. That change touches a couple of files, so I don't want to check that in tonight. Anyway, I think it's time to get into final testing. I've done some tests on freebsd, revealing one real bug (triggered only when compiled with the ancient gcc version freebsd keeps in /usr/bin). And I've made some fixes to what gets included by make dist. I hope to be able to create a nettle-3.1rc1.tar.gz in a day or two. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 2

curve25519 and eddsa
by nisse＠lysator.liu.se 19 Mar '15

19 Mar '15

I've just pushed some documentation for the curve25519 and eddsa functions. This raises a few questions on the current interfaces. 1. Should ecc-curves.h really declare nettle_curve25519? Its' not needed for any of the documented functions, except for obscurities like doing ecdsa (not eddsa) over the curve. It could be moved to ecc-internal, or be marked as internal in some other way. Perhaps renaming to _nettle_ed25519 would be appropriate. 2. curve25519_mul should be changed to have a void return type (an earlier implementation failed for inputs which didn't correspond to points on the curve, but instead were points on its twist). But the current implementation, using the Montgomery ladder, doesn't care and computes a well defined result for all inputs. 3. struct ed25519_private_key and struct ed25519_public_key include compile-time constant limb arrays. At least for the public key, this will imply an ABI break if/when we switch to a base 2^51 representations for GF(2^255 - 19). So maybe switch to dynamic allocation for struct ed25519_public_key, or both structs? 4. There's no function to generate eddsa key pairs. To generate a private key, use a random 32-octet string. To get the corresponding public key, one can call ed25519_set_private_key, and copy the pub element of the struct. This needs some additional documentation or maybe some additional function. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

3 12

patch: define API version number
by Nikos Mavrogiannopoulos 19 Mar '15

19 Mar '15

Hello, This patch adds a definition in nettle-meta.h with nettle's version number. That way applications can be easily modified to support both the 2.7 and the 3.x API. I didn't add for hogweed because it didn't seem to make sense, the API version is fully determined by nettle only. regards, Nikos

2 8

patch: added missing dist files
by Nikos Mavrogiannopoulos 19 Mar '15

19 Mar '15

1 0

test failures on powerpc64le-redhat-linux
by Martin Sebor 17 Mar '15

17 Mar '15

Running Nettle 3.0 tests on a powerpc64le RHEL 7.1 box shows the two failures below. The cause is in the second definition of the HAVE_NATIVE_64_BIT configuration macro: $ grep HAVE_NATIVE_64_BIT config.* config.h:# define HAVE_NATIVE_64_BIT 1 config.h:# define HAVE_NATIVE_64_BIT (SIZEOF_LONG * CHAR_BIT >= 64) The macro relies on the CHAR_BIT macro being defined at the point of its expansion. Uses of HAVE_NATIVE_64_BIT of the form #if !HAVE_NATIVE_64_BIT in files that don't include <limits.h> (and thus don't have the CHAR_BIT macro defined) end up compiling the conditional blocks that are intended to be included only when the target has no native support for 64 bit arithmetic. One such file that comes into play in the failing tests is camellia-absorb.c. Since powerpc64le obviously does have such support, the code is unnecessary and, as it turns out, introduces errors. Once <limits.h> is included all of Nettle's tests pass even on powerpc64le-redhat-linux. Martin ... Encrypt failed: Input: 0123456789abcdef fedcba9876543210 Output: df51fc645013f77c 25c472e2871f742a Expected: 6767313854966973 0857065648eabe43 /src/nettle-3.0/run-tests: line 57: 46381 Aborted "$1" $testflags FAIL: camellia ... Assert failed: /src/nettle-3.0/testsuite/testutils.c:513: MEMEQ(digest->length, buffer, digest->data) /src/nettle-3.0/run-tests: line 57: 49811 Aborted "$1" $testflags FAIL: gcm ... ==================== 2 of 55 tests failed ====================

2 1

memeql_sec
by nisse＠lysator.liu.se 14 Mar '15

14 Mar '15

I think there's only one sensitive use of memcmp within nettle, and that's the tag comparison in ccm_decrypt_message. I've now written a private function memeql_sec to do that comparison in a more side-channel silent fashion. static int memeql_sec (const void *a, const void *b, size_t n) { volatile const unsigned char *ap = (const unsigned char *) a; volatile const unsigned char *bp = (const unsigned char *) b; volatile unsigned char d; size_t i; for (d = i = 0; i < n; i++) d |= (ap[i] ^ bp[i]); return d == 0; } The idea is to avoid leaking (via timing or memory access patterns) the location of the first difference. Information that a guess for a forged MAC tag matches some characters of the correct MAC can be used to attack the MAC key, in particular for MAC algorithms with linear structure such as gcm and poly1305 (which is why chacha-poly1305 uses a new poly1305 key for each message, and why one shouldn't use gcm with short authentication tags). memeql_sec is a bit similar to http://nacl.cr.yp.to/verify.html. Now, applications using nettle are likely doing a lot of similar comparisons on hash and hmac digests. So it would be good to make this function public. But then I'd need to decide on 1. A good name. 2. A suitable headerfile to declare it in. It would make some sense to group it together with memxor, but memxor.h isn't a good name for that header file. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs March 2015