nettle-bugs January 2021

nettle-bugs@lists.lysator.liu.se

5 participants
7 discussions

Curve point decompression
by Wim Lewis 10 Nov '21

10 Nov '21

I'm looking at implementing elliptic curve point compression a la SEC1 (admittedly, mostly to reduce the number of "feature not supported" code paths in a library, but it seems like a somewhat useful ability). Nettle/Hogweed already implements it internally for curve25519, but I want to implement it for the "secp" curves as well. Point compression is easy enough, but point decompression requires some curve math, potentially dependent on the specific curve, and some of it is redundant with what's already done in ecc_point_set(). So I was thinking about moving this functionality into Hogweed as a function along the lines of ecc_point_set_compressed(), which would take, instead of a y-coordinate, an int containing the sign/parity of the y-coordinate. So my question for the list and for the maintainers is, is this a reasonable API to add to Hogweed? Is there interest in including it in Hogweed if I were to take the time to turn it into a tidy patch?

3 10

[S390x] Optimize AES modes
by Maamoun TK 19 Sep '21

19 Sep '21

I made a merge request for optimizing AES modes on s390x architecture, the patch implements the optimized cores using cipher instructions that have been added to s390x arch in message security assist extensions. The patch uses the following functions: KM-AES-128 (ECB-AES128) KM-AES-192 (ECB-AES192) KM-AES-256 (ECB-AES256) KMC-AES-128 (CBC-AES128) KMC-AES-192 (CBC-AES192) KMC-AES-256 (CBC-AES256) KMAC-AES-128 (CCM-AES128, CMAC-AES128) KMAC-AES-192 (CCM-AES192) KMAC-AES-256 (CCM-AES256, CMAC-AES256) KMF-AES-128 (CFB-AES128, CFB8-AES128) KMF-AES-192 (CFB-AES192, CFB8-AES192) KMF-AES-256 (CFB-AES256, CFB8-AES256) KM-XTS-AES-128 (XTS-AES128) KM-XTS-AES-256 (XTS-AES256) KIMD-GHASH (GHASH) KMCTR-AES-128, KMA-GCM-AES-128 (CTR-AES128) KMCTR-AES-192, KMA-GCM-AES-192 (CTR-AES192) KMCTR-AES-256, KMA-GCM-AES-256 (CTR-AES256) KMA-GCM-AES-128 (GCM-AES128) KMA-GCM-AES-192 (GCM-AES192) KMA-GCM-AES-256 (GCM-AES256) The merge request has also a benchmark that measures the speed of optimized cores on s390x arch. I can't set up gitlab CI for automatic testing on s390x arch because qemu hasn't implemented cipher functions for this arch. However, there is an easy way to test the patch manually by requesting a free account on the LinuxONE Community Cloud, both short-term and long-term access are available. https://linuxone.cloud.marist.edu/#/register?flag=VM regards, Mamone

4 39

Compile issue on Solaris 11.3
by Jeffrey Walton 28 Mar '21

28 Mar '21

Hi Everyone, I bumped to Nettle 3.7. The build is resulting in: gcc -I. -I/export/home/jwalton/tmp/ok2delete/include -DNDEBUG -DHAVE_CONFIG_H -g2 -O2 -m64 -march=native -fPIC -pthread -ggdb3 -Wall -W -Wno-sign-compare -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fPIC -MT sha256-compress-2.o -MD -MP -MF sha256-compress-2.o.d -c sha256-compress-2.s gcc -I. -I/export/home/jwalton/tmp/ok2delete/include -DNDEBUG -DHAVE_CONFIG_H -g2 -O2 -m64 -march=native -fPIC -pthread -ggdb3 -Wall -W -Wno-sign-compare -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fPIC -MT sexp.o -MD -MP -MF sexp.o.d -c sexp.c \ && true sha256-compress-2.ssha1-compress-2.s: Assembler messages: sha1-compress-2.s:73: Error: : no such instruction: `sha1rnds4 $0,%xmm5,%xmm4'Assembler messages: sha256-compress-2.s:87 : Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.s:78sha256-compress-2.s: Error: no such instruction: `sha1nexte %xmm1,%xmm6':89 : Error: no such instruction: `sha256rnds2 %xmm6,%xmm5'sha1-compress-2.s:80 : Error: no such instruction: `sha1rnds4 $0,%xmm6,%xmm4' sha256-compress-2.ssha1-compress-2.s:96:81: Error: : Error: no such instruction: `sha1msg1 %xmm1,%xmm0'no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.s:86sha256-compress-2.s: Error: :98no such instruction: `sha1nexte %xmm2,%xmm5' : Error: sha1-compress-2.s:88: no such instruction: `sha256rnds2 %xmm6,%xmm5'Error: sha256-compress-2.sno such instruction: `sha1rnds4 $0,%xmm5,%xmm4':99 : Error: sha1-compress-2.sno such instruction: `sha256msg1 %xmm2,%xmm1' :89: Error: no such instruction: `sha1msg1 %xmm2,%xmm1' sha256-compress-2.s:106: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.s:96sha256-compress-2.s: Error: no such instruction: `sha1nexte %xmm3,%xmm6' :108sha1-compress-2.s:98: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5': Error: no such instruction: `sha1msg2 %xmm3,%xmm0' sha256-compress-2.ssha1-compress-2.s:109:99: : Error: Error: no such instruction: `sha1rnds4 $0,%xmm6,%xmm4'no such instruction: `sha256msg1 %xmm3,%xmm2' sha256-compress-2.s:117: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:119: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.s:123: Error: no such instruction: `sha256msg2 %xmm4,%xmm1' sha256-compress-2.s:124: sha1-compress-2.sError: no such instruction: `sha256msg1 %xmm4,%xmm3' :100: Error: sha256-compress-2.sno such instruction: `sha1msg1 %xmm3,%xmm2' :129: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.s:104: Error: no such instruction: `sha1nexte %xmm0,%xmm5'sha256-compress-2.s:131: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha1-compress-2.s:106sha256-compress-2.s: :135: Error: Error: no such instruction: `sha1msg2 %xmm0,%xmm1'no such instruction: `sha256msg2 %xmm1,%xmm2' sha256-compress-2.ssha1-compress-2.s:107:136: : Error: no such instruction: `sha256msg1 %xmm1,%xmm4' Error: no such instruction: `sha1rnds4 $0,%xmm5,%xmm4'sha256-compress-2.s :141: sha1-compress-2.sError: no such instruction: `sha256rnds2 %xmm5,%xmm6' :108: sha256-compress-2.sError: no such instruction: `sha1msg1 %xmm0,%xmm3':143: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha1-compress-2.s:113: Error: sha256-compress-2.s:147: Error: no such instruction: `sha1nexte %xmm1,%xmm6'no such instruction: `sha256msg2 %xmm2,%xmm3' sha256-compress-2.ssha1-compress-2.s:148:115: Error: : no such instruction: `sha256msg1 %xmm2,%xmm1' Error: sha256-compress-2.sno such instruction: `sha1msg2 %xmm1,%xmm2':153: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.ssha1-compress-2.s:155: Error: :116: no such instruction: `sha256rnds2 %xmm6,%xmm5' Error: no such instruction: `sha1rnds4 $1,%xmm6,%xmm4' sha1-compress-2.s:117: Error: sha256-compress-2.sno such instruction: `sha1msg1 %xmm1,%xmm0':159: Error: no such instruction: `sha256msg2 %xmm3,%xmm4' sha256-compress-2.s:160sha1-compress-2.s: Error: no such instruction: `sha256msg1 %xmm3,%xmm2' :121: Error: no such instruction: `sha1nexte %xmm2,%xmm5'sha256-compress-2.s :165: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.ssha256-compress-2.s:123: Error: no such instruction: `sha1msg2 %xmm2,%xmm3' sha1-compress-2.s:167: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5':124 : Error: no such instruction: `sha1rnds4 $1,%xmm5,%xmm4' sha256-compress-2.ssha1-compress-2.s:125:171: : Error: no such instruction: `sha256msg2 %xmm4,%xmm1'Error: no such instruction: `sha1msg1 %xmm2,%xmm1' sha256-compress-2.s:172: Error: sha1-compress-2.s:129no such instruction: `sha256msg1 %xmm4,%xmm3' : Error: no such instruction: `sha1nexte %xmm3,%xmm6'sha256-compress-2.s :177: sha1-compress-2.sError: no such instruction: `sha256rnds2 %xmm5,%xmm6' :131: Error: sha256-compress-2.sno such instruction: `sha1msg2 %xmm3,%xmm0':179 : Error: no such instruction: `sha256rnds2 %xmm6,%xmm5'sha1-compress-2.s :132: Error: no such instruction: `sha1rnds4 $1,%xmm6,%xmm4' sha256-compress-2.s:183: Error: sha1-compress-2.s:133no such instruction: `sha256msg2 %xmm1,%xmm2' : sha256-compress-2.sError: :184no such instruction: `sha1msg1 %xmm3,%xmm2' : Error: no such instruction: `sha256msg1 %xmm1,%xmm4' sha1-compress-2.s:137: Error: no such instruction: `sha1nexte %xmm0,%xmm5' sha1-compress-2.s:139: sha256-compress-2.sError: no such instruction: `sha1msg2 %xmm0,%xmm1':189: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.s:140sha256-compress-2.s:191: : Error: no such instruction: `sha256rnds2 %xmm6,%xmm5'Error: no such instruction: `sha1rnds4 $1,%xmm5,%xmm4' sha1-compress-2.ssha256-compress-2.s:141: :195: Error: Error: no such instruction: `sha1msg1 %xmm0,%xmm3'no such instruction: `sha256msg2 %xmm2,%xmm3' sha256-compress-2.s:196sha1-compress-2.s:145: : Error: no such instruction: `sha256msg1 %xmm2,%xmm1' Error: no such instruction: `sha1nexte %xmm1,%xmm6' sha256-compress-2.s:201: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6'sha1-compress-2.s:147 : Error: sha256-compress-2.s:203: Error: no such instruction: `sha1msg2 %xmm1,%xmm2'no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.ssha1-compress-2.s:148:207: : Error: Error: no such instruction: `sha256msg2 %xmm3,%xmm4' sha256-compress-2.s:208: Error: no such instruction: `sha256msg1 %xmm3,%xmm2' sha256-compress-2.s:213: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:215: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.s:219: Error: no such instruction: `sha256msg2 %xmm4,%xmm1' sha256-compress-2.s:220: Error: no such instruction: `sha256msg1 %xmm4,%xmm3' sha256-compress-2.s:225: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:227: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.s:231: Error: no such instruction: `sha256msg2 %xmm1,%xmm2' sha256-compress-2.s:232: Error: no such instruction: `sha256msg1 %xmm1,%xmm4' sha256-compress-2.s:237: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:239: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.s:243: Error: no such instruction: `sha256msg2 %xmm2,%xmm3' sha256-compress-2.s:247: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:249: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.s:253: Error: no such instruction: `sha256msg2 %xmm3,%xmm4' sha256-compress-2.s:257: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:259: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' no such instruction: `sha1rnds4 $1,%xmm6,%xmm4' sha1-compress-2.s:149: Error: no such instruction: `sha1msg1 %xmm1,%xmm0' sha1-compress-2.s:154: Error: no such instruction: `sha1nexte %xmm2,%xmm5' sha1-compress-2.s:156: Error: no such instruction: `sha1msg2 %xmm2,%xmm3' sha1-compress-2.s:157: Error: no such instruction: `sha1rnds4 $2,%xmm5,%xmm4' sha1-compress-2.s:158: Error: no such instruction: `sha1msg1 %xmm2,%xmm1' sha1-compress-2.s:162: Error: no such instruction: `sha1nexte %xmm3,%xmm6' sha1-compress-2.s:164: Error: no such instruction: `sha1msg2 %xmm3,%xmm0' sha1-compress-2.s:165: Error: no such instruction: `sha1rnds4 $2,%xmm6,%xmm4' sha1-compress-2.s:166: Error: no such instruction: `sha1msg1 %xmm3,%xmm2' sha1-compress-2.s:170: Error: no such instruction: `sha1nexte %xmm0,%xmm5' sha1-compress-2.s:172: Error: no such instruction: `sha1msg2 %xmm0,%xmm1' sha1-compress-2.s:173: Error: no such instruction: `sha1rnds4 $2,%xmm5,%xmm4' sha1-compress-2.s:174: Error: no such instruction: `sha1msg1 %xmm0,%xmm3' sha1-compress-2.s:178: Error: no such instruction: `sha1nexte %xmm1,%xmm6' sha1-compress-2.s:180: Error: no such instruction: `sha1msg2 %xmm1,%xmm2' sha1-compress-2.s:181: Error: no such instruction: `sha1rnds4 $2,%xmm6,%xmm4' sha1-compress-2.s:182: Error: no such instruction: `sha1msg1 %xmm1,%xmm0' sha1-compress-2.s:186: Error: no such instruction: `sha1nexte %xmm2,%xmm5' sha1-compress-2.s:188: Error: no such instruction: `sha1msg2 %xmm2,%xmm3' sha1-compress-2.s:189: Error: no such instruction: `sha1rnds4 $2,%xmm5,%xmm4' sha1-compress-2.s:190: Error: no such instruction: `sha1msg1 %xmm2,%xmm1' sha1-compress-2.s:195: Error: no such instruction: `sha1nexte %xmm3,%xmm6' sha1-compress-2.s:197: Error: no such instruction: `sha1msg2 %xmm3,%xmm0' sha1-compress-2.s:198: Error: no such instruction: `sha1rnds4 $3,%xmm6,%xmm4' sha1-compress-2.s:199: Error: no such instruction: `sha1msg1 %xmm3,%xmm2' sha1-compress-2.s:203: Error: no such instruction: `sha1nexte %xmm0,%xmm5' sha1-compress-2.s:205: Error: no such instruction: `sha1msg2 %xmm0,%xmm1' sha1-compress-2.s:206: Error: no such instruction: `sha1rnds4 $3,%xmm5,%xmm4' sha1-compress-2.s:207: Error: no such instruction: `sha1msg1 %xmm0,%xmm3' sha1-compress-2.s:211: Error: no such instruction: `sha1nexte %xmm1,%xmm6' sha1-compress-2.s:213: Error: no such instruction: `sha1msg2 %xmm1,%xmm2' sha1-compress-2.s:214: Error: no such instruction: `sha1rnds4 $3,%xmm6,%xmm4' sha1-compress-2.s:217: Error: no such instruction: `sha1nexte %xmm2,%xmm5' sha1-compress-2.s:219: Error: no such instruction: `sha1msg2 %xmm2,%xmm3' sha1-compress-2.s:220: Error: no such instruction: `sha1rnds4 $3,%xmm5,%xmm4' sha1-compress-2.s:222: Error: no such instruction: `sha1nexte %xmm3,%xmm6' sha1-compress-2.s:224: Error: no such instruction: `sha1rnds4 $3,%xmm6,%xmm4' sha1-compress-2.s:226: Error: no such instruction: `sha1nexte %xmm8,%xmm5' gmake[1]: *** [sha1-compress-2.o] Error 1 gmake[1]: *** Waiting for unfinished jobs.... Jeff

2 6

Re: Release of Nettle-3.7?
by nisse＠lysator.liu.se 06 Feb '21

06 Feb '21

Michael Weiser <michael(a)weiser.dinsnail.net> writes: > Porting over the basic > IF_[LB]E mechanism from chacha-core-internal was easy and fixed up the > first of the three interleaved blocks right away. For the other two I am > still in the process of wrapping my head around how the interleaving > works and how it would need some adjustment for BE. The 3-way functions don't do anything fancy, just each of the three blocks represented in separate registers, and same instruction sequence as for the 1-way version, duplicated threee times and interleaved. The 2-way version (for ARM, that's salsa only) tries to be a bit more clever, with registers representing either odd or even words from both blocks. Not sure how endianness affects the code to move words around. Byte swapping should go close to the final stores, but after the addition of the initial state. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

3 16

[AArch64] Optimize GHASH
by Maamoun TK 06 Feb '21

06 Feb '21

I made a merge request in the main repo that enables optimized GHASH on AArch64 architecture. The implementation is based on Niels Möller's enhanced algorithm which yields more speedup on AArch64 arch in comparison with intel algorithm. Using the Karatsuba algorithm with Intel algorithm yielded an overhead so I dropped its benchmark result. I'll attach the file of Intel algorithm implementation here since it's not include in the MR. Here is the benchmark result on AArch64: *---------------------------------------------------------------------------------------------* | C version | Intel algorithm | Niels Möller's enhanced algorithm | | 208 Mbyte/s | 2781 Mbyte/s | 3255 Mbyte/s | *---------------------------------------------------------------------------------------------* This is +17% performance boost of the enhanced algorithm over the Intel algorithm, it's not as impressive as PowerPC benchmark result but it did a great job on AArch64 considering PMULL instruction doesn't have the assistance that vpmsumd offers by multiply four polynomials then summing. I tried to avoid using the stack in this implementation so I wrote a procedure to handle leftovers by just using the registers, let me know if there's a room for improvement here. regards, Mamone C arm/v8/gcm-hash.asm ifelse(` Copyright (C) 2020 Niels Möller and Mamone Tarsha This file is part of GNU Nettle. GNU Nettle is free software: you can redistribute it and/or modify it under the terms of either: * the GNU Lesser General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. or * the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. or both in parallel, as here. GNU Nettle is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received copies of the GNU General Public License and the GNU Lesser General Public License along with this program. If not, see http://www.gnu.org/licenses/. ') C gcm_set_key() assigns H value in the middle element of the table define(`H_Idx', `128') .file "gcm-hash.asm" .text C void gcm_init_key (union gcm_block *table) C This function populates the gcm table as the following layout C ******************************************************************************* C | H1M = (H1 div x⁶⁴)||((H1 mod x⁶⁴) × (x⁶⁴+x⁶³+x⁶²+x⁵⁷)) div x⁶⁴ | C | H1L = (H1 mod x⁶⁴)||(((H1 mod x⁶⁴) × (x⁶³+x⁶²+x⁵⁷)) mod x⁶⁴) + (H1 div x⁶⁴) | C | | C | H2M = (H2 div x⁶⁴)||((H2 mod x⁶⁴) × (x⁶⁴+x⁶³+x⁶²+x⁵⁷)) div x⁶⁴ | C | H2L = (H2 mod x⁶⁴)||(((H2 mod x⁶⁴) × (x⁶³+x⁶²+x⁵⁷)) mod x⁶⁴) + (H2 div x⁶⁴) | C | | C | H3M = (H3 div x⁶⁴)||((H3 mod x⁶⁴) × (x⁶⁴+x⁶³+x⁶²+x⁵⁷)) div x⁶⁴ | C | H3L = (H3 mod x⁶⁴)||(((H3 mod x⁶⁴) × (x⁶³+x⁶²+x⁵⁷)) mod x⁶⁴) + (H3 div x⁶⁴) | C | | C | H4M = (H3 div x⁶⁴)||((H4 mod x⁶⁴) × (x⁶⁴+x⁶³+x⁶²+x⁵⁷)) div x⁶⁴ | C | H4L = (H3 mod x⁶⁴)||(((H4 mod x⁶⁴) × (x⁶³+x⁶²+x⁵⁷)) mod x⁶⁴) + (H4 div x⁶⁴) | C ******************************************************************************* define(`TABLE', `x0') define(`ZERO', `v0') define(`EMSB', `v1') define(`POLY', `v2') define(`B', `v3') define(`H', `v4') define(`HQ', `q4') define(`H_t', `v5') define(`H2', `v6') define(`H2_t', `v7') define(`H3', `v16') define(`H3_t', `v17') define(`H4', `v18') define(`H4_t', `v19') define(`H_m', `v20') define(`H_m1', `v21') define(`H_h', `v22') define(`H_l', `v23') define(`RP', `v24') define(`Ml', `v25') define(`Mh', `v26') PROLOGUE(_nettle_gcm_init_key) ldr HQ,[TABLE,#16*H_Idx] dup EMSB.16b,H.b[0] rev64 H.16b,H.16b mov x9,#0xC200000000000000 mov x10,#1 mov POLY.d[0],x9 mov POLY.d[1],x10 sshr EMSB.16b,EMSB.16b,#7 and EMSB.16b,EMSB.16b,POLY.16b ushr B.2d,H.2d,#63 and B.16b,B.16b,POLY.16b ext B.16b,B.16b,B.16b,#8 shl H.2d,H.2d,#1 orr H.16b,H.16b,B.16b eor H.16b,H.16b,EMSB.16b eor ZERO.16b,ZERO.16b,ZERO.16b dup POLY.2d,POLY.d[0] ext H_t.16b,H.16b,H.16b,#8 pmull H_m.1q,H.1d,H_t.1d pmull2 H_m1.1q,H.2d,H_t.2d pmull H_h.1q,H.1d,H.1d pmull2 H_l.1q,H.2d,H.2d eor H_m.16b,H_m.16b,H_m1.16b pmull RP.1q,H_l.1d,POLY.1d ext Ml.16b,ZERO.16b,H_m.16b,#8 ext Mh.16b,H_m.16b,ZERO.16b,#8 ext RP.16b,RP.16b,RP.16b,#8 eor H_l.16b,H_l.16b,Ml.16b eor H_h.16b,H_h.16b,Mh.16b eor H_l.16b,H_l.16b,RP.16b pmull2 RP.1q,H_l.2d,POLY.2d eor H_h.16b,H_h.16b,H_l.16b eor H2_t.16b,H_h.16b,RP.16b ext H2.16b,H2_t.16b,H2_t.16b,#8 st1 {H.16b,H_t.16b,H2.16b,H2_t.16b},[TABLE],#64 pmull H_m.1q,H.1d,H2_t.1d pmull2 H_m1.1q,H.2d,H2_t.2d pmull H_h.1q,H.1d,H2.1d pmull2 H_l.1q,H.2d,H2.2d eor H_m.16b,H_m.16b,H_m1.16b pmull RP.1q,H_l.1d,POLY.1d ext Ml.16b,ZERO.16b,H_m.16b,#8 ext Mh.16b,H_m.16b,ZERO.16b,#8 ext RP.16b,RP.16b,RP.16b,#8 eor H_l.16b,H_l.16b,Ml.16b eor H_h.16b,H_h.16b,Mh.16b eor H_l.16b,H_l.16b,RP.16b pmull2 RP.1q,H_l.2d,POLY.2d eor H_h.16b,H_h.16b,H_l.16b eor H3_t.16b,H_h.16b,RP.16b ext H3.16b,H3_t.16b,H3_t.16b,#8 pmull H_m.1q,H2.1d,H2_t.1d pmull2 H_m1.1q,H2.2d,H2_t.2d pmull H_h.1q,H2.1d,H2.1d pmull2 H_l.1q,H2.2d,H2.2d eor H_m.16b,H_m.16b,H_m1.16b pmull RP.1q,H_l.1d,POLY.1d ext Ml.16b,ZERO.16b,H_m.16b,#8 ext Mh.16b,H_m.16b,ZERO.16b,#8 ext RP.16b,RP.16b,RP.16b,#8 eor H_l.16b,H_l.16b,Ml.16b eor H_h.16b,H_h.16b,Mh.16b eor H_l.16b,H_l.16b,RP.16b pmull2 RP.1q,H_l.2d,POLY.2d eor H_h.16b,H_h.16b,H_l.16b eor H4_t.16b,H_h.16b,RP.16b ext H4.16b,H4_t.16b,H4_t.16b,#8 st1 {H3.16b,H3_t.16b,H4.16b,H4_t.16b},[TABLE] ret EPILOGUE(_nettle_gcm_init_key) define(`TABLE', `x0') define(`X', `x1') define(`LENGTH', `x2') define(`DATA', `x3') define(`POLY', `v0') define(`ZERO', `v1') define(`D', `v2') define(`C0', `v3') define(`C0D', `d3') define(`C1', `v4') define(`C2', `v5') define(`C3', `v6') define(`RP', `v7') define(`H', `v16') define(`H_t', `v17') define(`H2', `v18') define(`H2_t', `v19') define(`H3', `v20') define(`H3_t', `v21') define(`H4', `v22') define(`H4_t', `v23') define(`H_m', `v24') define(`H_m1', `v25') define(`H_h', `v26') define(`H_l', `v27') define(`H_m2', `v28') define(`H_m3', `v29') define(`H_h2', `v30') define(`H_l2', `v31') define(`Ml', `v4') define(`Mh', `v5') C void gcm_hash (const struct gcm_key *key, union gcm_block *x, C size_t length, const uint8_t *data) PROLOGUE(_nettle_gcm_hash) mov x10,#0xC200000000000000 mov POLY.d[0],x10 dup POLY.2d,POLY.d[0] eor ZERO.16b,ZERO.16b,ZERO.16b ld1 {D.16b},[X] rev64 D.16b,D.16b ands x10,LENGTH,#-64 b.eq L2x add x9,TABLE,64 ld1 {H.16b,H_t.16b,H2.16b,H2_t.16b},[TABLE] ld1 {H3.16b,H3_t.16b,H4.16b,H4_t.16b},[x9] L4x_loop: ld1 {C0.16b,C1.16b,C2.16b,C3.16b},[DATA],#64 rev64 C0.16b,C0.16b rev64 C1.16b,C1.16b rev64 C2.16b,C2.16b rev64 C3.16b,C3.16b eor C0.16b,C0.16b,D.16b pmull H_m.1q,C1.1d,H3_t.1d pmull2 H_m1.1q,C1.2d,H3_t.2d pmull H_h.1q,C1.1d,H3.1d pmull2 H_l.1q,C1.2d,H3.2d pmull H_m2.1q,C2.1d,H2_t.1d pmull2 H_m3.1q,C2.2d,H2_t.2d pmull H_h2.1q,C2.1d,H2.1d pmull2 H_l2.1q,C2.2d,H2.2d eor H_m.16b,H_m.16b,H_m2.16b eor H_m1.16b,H_m1.16b,H_m3.16b eor H_h.16b,H_h.16b,H_h2.16b eor H_l.16b,H_l.16b,H_l2.16b pmull H_m2.1q,C3.1d,H_t.1d pmull2 H_m3.1q,C3.2d,H_t.2d pmull H_h2.1q,C3.1d,H.1d pmull2 H_l2.1q,C3.2d,H.2d eor H_m.16b,H_m.16b,H_m2.16b eor H_m1.16b,H_m1.16b,H_m3.16b eor H_h.16b,H_h.16b,H_h2.16b eor H_l.16b,H_l.16b,H_l2.16b pmull H_m2.1q,C0.1d,H4_t.1d pmull2 H_m3.1q,C0.2d,H4_t.2d pmull H_h2.1q,C0.1d,H4.1d pmull2 H_l2.1q,C0.2d,H4.2d eor H_m.16b,H_m.16b,H_m2.16b eor H_m1.16b,H_m1.16b,H_m3.16b eor H_h.16b,H_h.16b,H_h2.16b eor H_l.16b,H_l.16b,H_l2.16b eor H_m.16b,H_m.16b,H_m1.16b pmull RP.1q,H_l.1d,POLY.1d ext Ml.16b,ZERO.16b,H_m.16b,#8 ext Mh.16b,H_m.16b,ZERO.16b,#8 ext RP.16b,RP.16b,RP.16b,#8 eor H_l.16b,H_l.16b,Ml.16b eor H_h.16b,H_h.16b,Mh.16b eor H_l.16b,H_l.16b,RP.16b pmull2 RP.1q,H_l.2d,POLY.2d eor H_h.16b,H_h.16b,H_l.16b eor D.16b,H_h.16b,RP.16b ext D.16b,D.16b,D.16b,#8 subs x10,x10,64 b.ne L4x_loop and LENGTH,LENGTH,#63 L2x: tst LENGTH,#-32 b.eq L1x ld1 {H.16b,H_t.16b,H2.16b,H2_t.16b},[TABLE] ld1 {C0.16b,C1.16b},[DATA],#32 rev64 C0.16b,C0.16b rev64 C1.16b,C1.16b eor C0.16b,C0.16b,D.16b pmull H_m.1q,C1.1d,H_t.1d pmull2 H_m1.1q,C1.2d,H_t.2d pmull H_h.1q,C1.1d,H.1d pmull2 H_l.1q,C1.2d,H.2d pmull H_m2.1q,C0.1d,H2_t.1d pmull2 H_m3.1q,C0.2d,H2_t.2d pmull H_h2.1q,C0.1d,H2.1d pmull2 H_l2.1q,C0.2d,H2.2d eor H_m.16b,H_m.16b,H_m2.16b eor H_m1.16b,H_m1.16b,H_m3.16b eor H_h.16b,H_h.16b,H_h2.16b eor H_l.16b,H_l.16b,H_l2.16b eor H_m.16b,H_m.16b,H_m1.16b pmull RP.1q,H_l.1d,POLY.1d ext Ml.16b,ZERO.16b,H_m.16b,#8 ext Mh.16b,H_m.16b,ZERO.16b,#8 ext RP.16b,RP.16b,RP.16b,#8 eor H_l.16b,H_l.16b,Ml.16b eor H_h.16b,H_h.16b,Mh.16b eor H_l.16b,H_l.16b,RP.16b pmull2 RP.1q,H_l.2d,POLY.2d eor H_h.16b,H_h.16b,H_l.16b eor D.16b,H_h.16b,RP.16b ext D.16b,D.16b,D.16b,#8 and LENGTH,LENGTH,#31 L1x: tst LENGTH,#-16 b.eq Lmod ld1 {H.16b,H_t.16b},[TABLE] ld1 {C0.16b},[DATA],#16 rev64 C0.16b,C0.16b eor C0.16b,C0.16b,D.16b pmull H_m.1q,C0.1d,H_t.1d pmull2 H_m1.1q,C0.2d,H_t.2d pmull H_h.1q,C0.1d,H.1d pmull2 H_l.1q,C0.2d,H.2d eor H_m.16b,H_m.16b,H_m1.16b pmull RP.1q,H_l.1d,POLY.1d ext Ml.16b,ZERO.16b,H_m.16b,#8 ext Mh.16b,H_m.16b,ZERO.16b,#8 ext RP.16b,RP.16b,RP.16b,#8 eor H_l.16b,H_l.16b,Ml.16b eor H_h.16b,H_h.16b,Mh.16b eor H_l.16b,H_l.16b,RP.16b pmull2 RP.1q,H_l.2d,POLY.2d eor H_h.16b,H_h.16b,H_l.16b eor D.16b,H_h.16b,RP.16b ext D.16b,D.16b,D.16b,#8 Lmod: tst LENGTH,#15 b.eq Ldone ld1 {H.16b,H_t.16b},[TABLE] tbz LENGTH,3,Lmod_8 ldr C0D,[DATA],#8 rev64 C0.16b,C0.16b mov x10,#0 mov C0.d[1],x10 Lmod_8: tst LENGTH,#7 b.eq Lmod_8_done mov x9,#0 mov x8,#64 and x7,LENGTH,#7 Lmod_8_loop: mov x10,#0 ldrb w10,[DATA],#1 sub x8,x8,#8 lsl x10,x10,x8 orr x9,x9,x10 subs x7,x7,#1 b.ne Lmod_8_loop tbz LENGTH,3,Lmod_8_load mov C0.d[1],x9 b Lmod_8_done Lmod_8_load: mov x10,#0 mov C0.d[0],x9 mov C0.d[1],x10 Lmod_8_done: eor C0.16b,C0.16b,D.16b pmull H_m.1q,C0.1d,H_t.1d pmull2 H_m1.1q,C0.2d,H_t.2d pmull H_h.1q,C0.1d,H.1d pmull2 H_l.1q,C0.2d,H.2d eor H_m.16b,H_m.16b,H_m1.16b pmull RP.1q,H_l.1d,POLY.1d ext Ml.16b,ZERO.16b,H_m.16b,#8 ext Mh.16b,H_m.16b,ZERO.16b,#8 ext RP.16b,RP.16b,RP.16b,#8 eor H_l.16b,H_l.16b,Ml.16b eor H_h.16b,H_h.16b,Mh.16b eor H_l.16b,H_l.16b,RP.16b pmull2 RP.1q,H_l.2d,POLY.2d eor H_h.16b,H_h.16b,H_l.16b eor D.16b,H_h.16b,RP.16b ext D.16b,D.16b,D.16b,#8 Ldone: rev64 D.16b,D.16b st1 {D.16b},[X] ret EPILOGUE(_nettle_gcm_hash)

6 62

ANNOUNCE: Nettle-3.7
by nisse＠lysator.liu.se 04 Jan '21

04 Jan '21

I'm happy to announce a new release of GNU Nettle, a low-level cryptographics library. This includes one new feature, and several optimizations, see NEWS entries below. The Nettle home page can be found at https://www.lysator.liu.se/~nisse/nettle/, and the manual at https://www.lysator.liu.se/~nisse/nettle/nettle.html. The release can be downloaded from https://ftp.gnu.org/gnu/nettle/nettle-3.7.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-3.7.tar.gz https://www.lysator.liu.se/~nisse/archive/nettle-3.7.tar.gz Happy hacking, /Niels Möller NEWS for the Nettle 3.7 release This release adds one new feature, the bcrypt password hashing function, and lots of optimizations. There's also one important change to how Nettle is configured: Fat builds are now on by default. The release adds PowerPC64 assembly for a few algorithms, resulting in great speedups. Benchmarked on a Power9 machine, speedup was 13 times for AES256-CTR and AES256-GCM, and 3.5 times for Chacha. For fat builds (now the default), the new code is used automatically, on processors supporting the needed instruction set extensions. The new version is intended to be fully source and binary compatible with Nettle-3.6. The shared library names are libnettle.so.8.1 and libhogweed.so.6.1, with sonames libnettle.so.8 and libhogweed.so.6. New features: * Support for bcrypt, contributed by Stephen R. van den Berg. Optimizations: * Much faster AES and GCM on PowerPC64 processors supporting the corresponding crypto extensions. Contributed by Mamone Tarsha. * Speed of Chacha improved on PowerPC64, x86_64 and ARM Neon. * Speed of Salsa20 improved on x86_64 and ARM Neon. * Overhaul of some elliptic curve primitives, improving ECDSA signature speed. Configure: * Fat builds are enabled by default on the architectures where it is supported (x86_64, arm and powerpc64). To disable runtime selection, and instead specify the processor flavor at configure time, you need to pass --disable-fat to the configure script. Known issues: * The ARM assembly code in this release doesn't work correctly on big-endian ARM systems. This will hopefully be fixed in a later release. Miscellaneous: * Use a few more gmp-6.1 functions: mpn_cnd_add_n, mpn_cnd_sub_n, mpn_cnd_swap. Delete corresponding internal Nettle functions. * Convert all assembly files to use the default m4 quote characters. -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

Release of Nettle-3.7?
by nisse＠lysator.liu.se 02 Jan '21

02 Jan '21

Hi, I wonder if it would make sense to try to cut a release pretty soon (and without any arm64 changes)? Previous release was made end of April, and there's been quite a few improvements since then. I wonder if it is possible to make a release in time for the upcoming debian release? https://lists.debian.org/debian-devel-announce/2020/11/msg00002.html Nettle-3.7 should be abi-compatible, and with unchanged soname, so I'm not sure if it would count as a "transition" in the debian world. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

6 16

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs January 2021