nettle-bugs January 2018

nettle-bugs@lists.lysator.liu.se

7 participants
13 discussions

possible new modes (was: [PATCH v3 0/1] Add Cipher FeedBack mode support)
by Nikos Mavrogiannopoulos 05 Jan '18

05 Jan '18

On Thu, Jan 4, 2018 at 2:57 AM, Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> wrote: > 2018-01-03 12:44 GMT+03:00 Nikos Mavrogiannopoulos > <n.mavrogiannopoulos(a)gmail.com>: >> On Sat, Oct 7, 2017 at 8:55 PM, Dmitry Eremin-Solenikov >> <dbaryshkov(a)gmail.com> wrote: >>> Add CFB mode support. CFB uses segment size = block size. >>> >>> Changes since V2: >>> >>> - Dropped CFB8, isn't widely used. >> >> I'm getting late into this discussion, but it seems that samba (which >> uses nettle and gnutls), could benefit from an 8-bit CFB mode as well. >> They are already implementing it on top of nettle, and it is being >> used on the newer samba versions: >> >> https://git.samba.org/?p=samba.git;a=blob;f=lib/crypto/REQUIREMENTS;h=351c2… > > Hmm, interesting. It looks like they miss CFB8 and CMAC. However > from the first glance I could not understand, do they reference nettle/ > GNUTLS as code reference, or are they using them as crypto backends? > Skimming over WAF scripts did not give me the answer. They are used as backends, though they also re-implement quite few stuff. My understanding is that they would like to get rid of their crypto implementations, and rely on nettle and gnutls for that. > I can (re-)post CFB8 if that will be helpful to Samba (or other parties). > CMAC also sounds like and interesting topic. Niels what do think about CFB8? On that view, I've compiled a list of new modes which seem to be useful in other applications: AES-CMAC: fast MAC used in samba and there is a draft for NTP protocol. There is implementation in samba at [1]. AES-XTS: it is a mode used in disk volume encryption when no authentication is to be present (ntfs and luks can use it). It is implemented in qemu [0] which already has a nettle back-end. AES-SIV-CMAC: An AES AEAD mode which does not fail secrecy/catastrophically when a nonce is repeated. There is a draft for its use under NTP (draft-ietf-ntp-using-nts-for-ntp-10). regards, Nikos [0]. https://github.com/qemu/qemu/blob/507e4ddc3abf67391bcbc9624fd60b969c159b78/… [1]. https://github.com/samba-team/samba/blob/d8a5565ae647352d11d622bd4e73ff4568…

4 6

[PATCH v3 0/1] Add Cipher FeedBack mode support
by Dmitry Eremin-Solenikov 04 Jan '18

04 Jan '18

Add CFB mode support. CFB uses segment size = block size. Changes since V2: - Dropped CFB8, isn't widely used. - Simplified cfb_encrypt code. - Dropped code handling IV for last-partial-segment. One should set IV for new message anyway, so there little point in adding additional complexity there. Changes since V1: - Add CFB8 support - Minor corrections in documentation. Dmitry Eremin-Solenikov (1): Add CFB block mode support Makefile.in | 4 +- cfb.c | 165 ++++++++++++++++++++++++++ cfb.h | 87 ++++++++++++++ nettle.texinfo | 106 +++++++++++++++-- testsuite/.gitignore | 1 + testsuite/.test-rules.make | 3 + testsuite/Makefile.in | 2 +- testsuite/cfb-test.c | 287 +++++++++++++++++++++++++++++++++++++++++++++ testsuite/testutils.c | 179 ++++++++++++++++++++++++++++ testsuite/testutils.h | 7 ++ 10 files changed, 829 insertions(+), 12 deletions(-) create mode 100644 cfb.c create mode 100644 cfb.h create mode 100644 testsuite/cfb-test.c -- 2.14.2

3 6

Skein status
by nisse＠lysator.liu.se 01 Jan '18

01 Jan '18

I'm looking at the skein code I wrote a while ago, and I might merge it pretty soon, just need a little cleanup. I'm doing skein256 and skein512 (other variants, in particular, skein512-256, mey be of interest). For skein256, it works quite well with two-way unrolling (by which I mean that each loop iteration performs 8 mixing rounds, adding in subkeys twice). I did an x86_64 assembly version, but I'm not being able to beat C code compiled by gcc, so I think I'll scrap that. Which isn't so surprising, since skein uses only operations that the C compiler knows well, and I'm not trying anything clever with scheduling or register allocation. For skein512, subkeys are accessed with mod 9 indexing, which is challenging to do with high performance, if indexes need to be constructed at runtime. I get pretty good performance with full unrolling (so indices are constant), and I'm afraid we have to do either that, or copy subkeys into an area where they are repeated multiple times. As I think I wrote earlier, skein looks similar in spirit to salsa20 and chacha, but unlike those, it's doesn't fit well with simd instructions. To use simd instructions for skein, one would like to put put 2 64-bit values in one xmm register, but one then needs a way to rotate the two halves with different shift counts, which I haven't found any good way to do. Also the odd number of subkeys (five for skein256, and nine for skein512, with the last subkey being the xor of all the other keys and a magic constant), usued in a rotationg fashion, doesn't fit well with storing keys in simd registers. I'm benchmarking on a intel broadwell cpu (marketing name "core i3-5010U") running at 2.1 GHz. Algorithm mode Mbyte/s cycles/byte cycles/block skein256 update 242.45 8.26 264.33 skein512 update 350.44 5.71 365.75 For comparison, timing for sha1, sha2 and sha3: Algorithm mode Mbyte/s cycles/byte cycles/block sha1 update 326.40 6.14 392.69 openssl sha1 update 560.98 3.57 228.48 sha256 update 156.07 12.83 821.24 sha512 update 252.54 7.93 1015.10 sha3_224 update 161.90 12.37 1781.33 sha3_256 update 152.83 13.10 1782.18 sha3_384 update 117.06 17.11 1779.22 sha3_512 update 80.52 24.87 1790.77 So skein512 is faster than both sha2 and sha3 (and one can also see that for sha1 we currently lose to openssl). skein256 is fastet than sha3, but slightly slower than sha512. So maybe we shouldn't do skein256 at all, but skein512-256 (skein can be used with arbitrary output size). Code size for is 408 bytes for skein256, and 3992 bytes for skein512 (which is completely unrolled). Counting only the main block processing function. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs January 2018