nettle-bugs July 2019

nettle-bugs@lists.lysator.liu.se

9 participants
21 discussions

[PATCH 0/7] Add meta interface for MAC algorithms
by Daiki Ueno 20 Jul '19

20 Jul '19

From: Daiki Ueno <dueno(a)redhat.com> As discussed in: https://lists.lysator.liu.se/pipermail/nettle-bugs/2019/007662.html This moves `struct nettle_mac` to nettle-meta.h and provide the meta interface for all defined MAC algorithms. Each meta interface shall provide the following 4 functions: nettle_set_key_func *set_key; nettle_set_key_func *set_nonce; nettle_hash_update_func *update; nettle_hash_digest_func *digest; where set_nonce is only used by UMAC, and expects that the nonce has always the same length as AES_BLOCK_SIZE. For CMAC and HMAC, a no-op set_nonce function is defined. Also the signature of set_key is slightly different from hmac_*_set_key in that it doesn't take key length as an argument. A wrapper function is provided to clamp the length to hash block size. Daiki Ueno (7): hmac: Add set_key_expanded function nettle-meta: Move struct nettle_mac to nettle-meta.h nettle-meta: Add meta interface for CMAC functions nettle-meta: Add meta interface for HMAC functions nettle-meta: Add meta interface for UMAC functions nettle-meta: Expose all defined MACs through nettle_macs tests: Add test for meta interface for MAC algorithms Makefile.in | 7 +++- cmac-aes128-meta.c | 48 ++++++++++++++++++++++ cmac-aes256-meta.c | 48 ++++++++++++++++++++++ hmac-md5-meta.c | 46 ++++++++++++++++++++++ hmac-md5.c | 7 ++++ hmac-ripemd160-meta.c | 46 ++++++++++++++++++++++ hmac-ripemd160.c | 7 ++++ hmac-sha1-meta.c | 46 ++++++++++++++++++++++ hmac-sha1.c | 7 ++++ hmac-sha224-meta.c | 46 ++++++++++++++++++++++ hmac-sha224.c | 7 ++++ hmac-sha256-meta.c | 46 ++++++++++++++++++++++ hmac-sha256.c | 7 ++++ hmac-sha384-meta.c | 46 ++++++++++++++++++++++ hmac-sha384.c | 7 ++++ hmac-sha512-meta.c | 46 ++++++++++++++++++++++ hmac-sha512.c | 7 ++++ hmac.c | 48 ++++++++++++++-------- hmac.h | 45 +++++++++++++++++++++ nettle-meta-macs.c | 61 ++++++++++++++++++++++++++++ nettle-meta.h | 81 ++++++++++++++++++++++++++++++++++++++ testsuite/.gitignore | 1 + testsuite/.test-rules.make | 3 ++ testsuite/Makefile.in | 2 +- testsuite/cmac-test.c | 24 ----------- testsuite/meta-mac-test.c | 37 +++++++++++++++++ testsuite/testutils.h | 29 -------------- umac128-meta.c | 47 ++++++++++++++++++++++ umac32-meta.c | 47 ++++++++++++++++++++++ umac64-meta.c | 47 ++++++++++++++++++++++ umac96-meta.c | 47 ++++++++++++++++++++++ 31 files changed, 922 insertions(+), 71 deletions(-) create mode 100644 cmac-aes128-meta.c create mode 100644 cmac-aes256-meta.c create mode 100644 hmac-md5-meta.c create mode 100644 hmac-ripemd160-meta.c create mode 100644 hmac-sha1-meta.c create mode 100644 hmac-sha224-meta.c create mode 100644 hmac-sha256-meta.c create mode 100644 hmac-sha384-meta.c create mode 100644 hmac-sha512-meta.c create mode 100644 nettle-meta-macs.c create mode 100644 testsuite/meta-mac-test.c create mode 100644 umac128-meta.c create mode 100644 umac32-meta.c create mode 100644 umac64-meta.c create mode 100644 umac96-meta.c -- 2.21.0

2 11

nettle-meta interface for MACs
by Daiki Ueno 17 Jul '19

17 Jul '19

Hello, In testutils.h, there is a nettle-meta definition for MACs, similar to hashes and ciphers: /* FIXME: When interface stabilizes, move to nettle-meta.h */ struct nettle_mac { const char *name; /* Size of the context struct */ unsigned context_size; /* Size of digests */ unsigned digest_size; /* Suggested key size; other sizes are sometimes possible. */ unsigned key_size; nettle_set_key_func *set_key; nettle_hash_update_func *update; nettle_hash_digest_func *digest; }; This is, however, not usable for HMAC, because Nettle build uses -Wcast-function-type and the set_key member has an incompatible type with hmac_*_set_key, which requires a key length argument as HMAC allows arbitrary key length up to the hash block size. Is there any plan to make it more generic and eventually move it to nettle-meta.h? That would be particularly useful in applications passing around HMAC functions (e.g., HKDF, deterministic ECDSA). For example, I'm thinking to use nettle_hash_update_func for set_key and provide a wrapper around other MACs which don't take key length, something like: void _cmac_aes128_set_key(struct cmac_aes128_ctx *ctx, size_t length, const uint8_t *key) { assert (length == AES128_KEY_LENGTH); cmac_aes128_set_key (ctx, length, key); } Regards, -- Daiki Ueno

2 2

[PATCH v2 0/3] Add support for deterministic DSA/ECDSA (RFC 6979)
by Daiki Ueno 12 Jul '19

12 Jul '19

From: Daiki Ueno <dueno(a)redhat.com> It turned out that the initial version of _dsa_compute_k was not constant time with the input message. In this version it is checked with a valgrind-based check. Also the ecdsa-sign-deterministic test has been reorganized using a similar abstraction to struct nettle_mac in testutils.h. Daiki Ueno (3): dsa: Add a function to find k deterministically ecdsa: Add support for deterministic signature generation dsa: Add support for deterministic signature generation Makefile.in | 6 +- dsa-compute-k.c | 179 +++++++++++++++++ dsa-compute-k.h | 63 ++++++ dsa-sign-deterministic.c | 107 ++++++++++ dsa.h | 12 ++ ecdsa-sign-deterministic.c | 74 +++++++ ecdsa.h | 11 ++ testsuite/.gitignore | 2 + testsuite/.test-rules.make | 6 + testsuite/Makefile.in | 4 +- testsuite/dsa-compute-k-test.c | 127 ++++++++++++ testsuite/dsa-test.c | 148 +++++++++++++- testsuite/ecdsa-sign-deterministic-test.c | 230 ++++++++++++++++++++++ 13 files changed, 965 insertions(+), 4 deletions(-) create mode 100644 dsa-compute-k.c create mode 100644 dsa-compute-k.h create mode 100644 dsa-sign-deterministic.c create mode 100644 ecdsa-sign-deterministic.c create mode 100644 testsuite/dsa-compute-k-test.c create mode 100644 testsuite/ecdsa-sign-deterministic-test.c -- 2.21.0

1 3

[PATCH 1/3] eax: drop w field from nettle_block16
by Dmitry Eremin-Solenikov 09 Jul '19

09 Jul '19

"unsigned long w" comes from the time when Nettle didn't use uint64_t. It is unused now and thus can be dropped. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- eax.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/eax.c b/eax.c index 621020def5ce..4b8b5117746e 100644 --- a/eax.c +++ b/eax.c @@ -54,12 +54,8 @@ omac_init (union nettle_block16 *state, unsigned t) static void block16_xor (union nettle_block16 *dst, const union nettle_block16 *src) { - dst->w[0] ^= src->w[0]; - dst->w[1] ^= src->w[1]; -#if SIZEOF_LONG == 4 - dst->w[2] ^= src->w[2]; - dst->w[3] ^= src->w[3]; -#endif + dst->u64[0] ^= src->u64[0]; + dst->u64[1] ^= src->u64[1]; } static void -- 2.20.1

2 4

[PATCH] nettle-types: drop w field from nettle_block16
by Dmitry Eremin-Solenikov 04 Jul '19

04 Jul '19

"unsigned long w" comes from the time when Nettle didn't use uint64_t. It is unused now and thus can be dropped. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- nettle-types.h | 1 - 1 file changed, 1 deletion(-) diff --git a/nettle-types.h b/nettle-types.h index 5addf3600d69..93a68f3b305c 100644 --- a/nettle-types.h +++ b/nettle-types.h @@ -61,7 +61,6 @@ extern "C" { union nettle_block16 { uint8_t b[16]; - unsigned long w[16 / sizeof(unsigned long)]; uint64_t u64[2]; }; -- 2.20.1

2 3

SIV-CMAC
by Nikos Mavrogiannopoulos 04 Jul '19

04 Jul '19

This patch adds the SIV-CMAC algorithm to nettle (an update of the previous attempt). It is an atypical cipher which fits into the encrypt_message interface. regards, Nikos

6 16

[PATCH v2 0/3] drop w field from nettle_block16
by Dmitry Eremin-Solenikov 03 Jul '19

03 Jul '19

I'm sorry for the noise. This iteration fixes an issue with cross-mips build, noticed with the help of GitLab CI. -- With best wishes Dmitry

1 3

Add check for ECC at point 0
by Simo Sorce 02 Jul '19

02 Jul '19

While reviewing FIPS requirements for public key checks in Ephemeral Diffie-Hellman key exchanges it came out that FIPS requires checks that the public key point is not the (0, 0) coordinate and nettle is not doing it (only checks that neither point is negative. Add this check as we never want to allow this point in any case. Simo. -- Simo Sorce Sr. Principal Software Engineer Red Hat, Inc

4 11

siv and cmac
by nisse＠lysator.liu.se 02 Jul '19

02 Jul '19

I think the siv code could benefit from a funtion to create a cmac digest in one step, without the update/digest split and the intermediate buffer. That would be something like cmac128_message(const struct cmac128_key *key, const void *cipher, nettle_crypt_func *encrypt, size_t digest_length, uint8_t *digest, size_t message_length, const uint8_t *message); Then the key need to be taken out from the cmac128_ctx. I'm trying that out, on the branch cmac-layout. Patch below. What do you think? Regards, /Niels commit 9b41e3b82b567abb68c1b7fc3b1e6b1a4ed87b26 Author: Niels Möller <nisse(a)lysator.liu.se> Date: 2019-06-01 10:30:29 +0200 New struct cmac128_key. diff --git a/ChangeLog b/ChangeLog index 53cdc41d..a7a4355f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2019-06-01 Niels Möller <nisse(a)lysator.liu.se> + + * cmac.h (struct cmac128_key): New struct. + * cmac.h (struct cmac128_ctx): Use struct cmac128_key. + * cmac.c (cmac128_set_key, cmac128_digest): Update accordingly. + 2019-05-12 Niels Möller <nisse(a)lysator.liu.se> Delete old libdes/openssl compatibility interface. diff --git a/cmac.c b/cmac.c index ed3b5eb8..07d805f3 100644 --- a/cmac.c +++ b/cmac.c @@ -83,8 +83,8 @@ cmac128_set_key(struct cmac128_ctx *ctx, const void *cipher, /* step 1 - generate subkeys k1 and k2 */ encrypt(cipher, 16, L->b, const_zero); - block_mulx(&ctx->K1, L); - block_mulx(&ctx->K2, &ctx->K1); + block_mulx(&ctx->key.K1, L); + block_mulx(&ctx->key.K2, &ctx->key.K1); } #define MIN(x,y) ((x)<(y)?(x):(y)) @@ -148,11 +148,11 @@ cmac128_digest(struct cmac128_ctx *ctx, const void *cipher, if (ctx->index < 16) { ctx->block.b[ctx->index] = 0x80; - memxor(ctx->block.b, ctx->K2.b, 16); + memxor(ctx->block.b, ctx->key.K2.b, 16); } else { - memxor(ctx->block.b, ctx->K1.b, 16); + memxor(ctx->block.b, ctx->key.K1.b, 16); } memxor3(Y.b, ctx->block.b, ctx->X.b, 16); diff --git a/cmac.h b/cmac.h index 6d107982..9d972ea5 100644 --- a/cmac.h +++ b/cmac.h @@ -55,18 +55,22 @@ extern "C" { #define cmac_aes256_update nettle_cmac_aes256_update #define cmac_aes256_digest nettle_cmac_aes256_digest -struct cmac128_ctx +struct cmac128_key { - /* Key */ union nettle_block16 K1; union nettle_block16 K2; +}; + +struct cmac128_ctx +{ + struct cmac128_key key; /* MAC state */ union nettle_block16 X; /* Block buffer */ - union nettle_block16 block; size_t index; + union nettle_block16 block; }; void -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

3 4

[PATCH 00/14] HMAC implementation rework
by Dmitry Eremin-Solenikov 02 Jul '19

02 Jul '19

This is my current attempt to rework hash/HMAC internal API to use separate block buffer from main hash state and thus decrease HMAC context data size by removing byte buffer duplication. Unfortunately this breaks GnuTLS accelerated implementations. Patch for GnuTLS will be provided, if this approach is going to be accepted to Nettle. The following changes since commit ee5d62898cf070f08beedc410a8d7c418588bd95: Fixes for Nettle 3.5.1 (2019-06-26 21:51:36 +0200) are available in the Git repository at: https://gitlab.com/GostCrypt/nettle.git gitlab/hmac-3 for you to fetch changes up to dda00a07d26dbdb6647186c778febe870c30cafc: hmac-sha512/hmac-sha384: use new hmac and hash split state/buffer interface (2019-07-02 16:21:48 +0300) ---------------------------------------------------------------- Dmitry Eremin-Solenikov (14): sha512-224,-256: use _NETTLE_HASH_US instead of hand-coding structure definitions hash: start separating state and block contexts macros: add interface for working with separate hash state and buffer md5: split context into hash state and byte buffer hmac: add interface for working with separate hash state and buffer hmac-md5: use new hmac and hash split state/buffer interface ripemd160: split context into hash state and byte buffer hmac-ripemd160: use new hmac and hash split state/buffer interface sha1: split context into hash state and byte buffer hmac-sha1: use new hmac and hash split state/buffer interface sha256/sha224: split context into hash state and byte buffer hmac-sha256/hmac-sha224: use new hmac and hash split state/buffer interface sha512/sha384: split context into hash state and byte buffer hmac-sha512/hmac-sha384: use new hmac and hash split state/buffer interface hmac-md5.c | 6 +-- hmac-ripemd160.c | 6 +-- hmac-sha1.c | 6 +-- hmac-sha224.c | 4 +- hmac-sha256.c | 6 +-- hmac-sha384.c | 4 +- hmac-sha512.c | 6 +-- hmac.c | 62 ++++++++++++++++++++++++++ hmac.h | 37 +++++++++++++--- macros.h | 66 ++++++++++++++++++++++++++++ md5-meta.c | 3 ++ md5.c | 52 ++++++++++++++++------ md5.h | 29 ++++++++++-- nettle-meta.h | 56 ++++++++++++++++++++++++ nettle-types.h | 15 +++++++ ripemd160-meta.c | 3 ++ ripemd160.c | 50 ++++++++++++++++----- ripemd160.h | 29 ++++++++++-- sha1-meta.c | 3 ++ sha1.c | 56 +++++++++++++++++------- sha1.h | 29 ++++++++++-- sha2.h | 87 +++++++++++++++++++++++++++++++++--- sha224-meta.c | 3 ++ sha256-meta.c | 3 ++ sha256.c | 76 +++++++++++++++++++++++++------- sha384-meta.c | 3 ++ sha512-224-meta.c | 12 +---- sha512-256-meta.c | 12 +---- sha512-meta.c | 3 ++ sha512.c | 129 +++++++++++++++++++++++++++++++++++++++--------------- 30 files changed, 701 insertions(+), 155 deletions(-)

1 14

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs July 2019