- nettle-bugs - lists.lysator.liu.se

[Arm64, S390x] Optimize Chacha20
by Maamoun TK 20 Jan '22

20 Jan '22

I created merge requests that have improvements of Chacha20 for arm64 and s390x architectures by following the approach used in powerpc implementation. https://git.lysator.liu.se/nettle/nettle/-/merge_requests/37 https://git.lysator.liu.se/nettle/nettle/-/merge_requests/40 The patches have 80.85% speedup for arm64 arch and 284.79% speedup for s390x arch. It would be nice if the arm64 patch will be tested on big-endian mode since I don't have access to any big-endian variant for testing. regards, Mamone

2 5

[S390x] Optimize various elliptic curve functions
by Maamoun TK 19 Jan '22

19 Jan '22

I created merge requests that have improvements of prime modulo functions of elliptic curves and scalar multiply of curve25519 and curve448 for s390x architecture https://git.lysator.liu.se/nettle/nettle/-/merge_requests/42 https://git.lysator.liu.se/nettle/nettle/-/merge_requests/43 The prime modulo functions are implemented using basic arithmetic instructions (including addition with carry and subtraction with borrow) while scalar multiply of curve25519 and curve448 takes advantage of hardware-accelerated instruction pcc (Perform Cryptographic Computation). Benchmark numbers of the patches are attached to the MR description. regards, Mamone

1 0

Re: Build problem on ppc64be + musl
by Maamoun TK 04 Jan '22

04 Jan '22

On Wed, Aug 18, 2021 at 11:38 PM Stijn Tintel <stijn(a)linux-ipv6.be> wrote: > On 18/08/2021 22:29, Maamoun TK wrote: > > On Tue, Aug 17, 2021 at 9:40 AM Niels Möller <nisse(a)lysator.liu.se > > <mailto:nisse@lysator.liu.se>> wrote: > > > > The configuration where it didn't work was > > powerpc64-openwrt-linux-musl. I'd like Nettle to work on embedded > > systems whenever practical. But support depends on assistance from > > users > > of those systems. > > > > As I understood it, this system needs to use the v2 ABI. I would hope > > it's easy to detect the abi used by the configured C compiler, and > > then > > select the same prologue sequence as is currently used for > > little-endian. I.e., one more configure test, and changing the > > "ifelse(WORDS_BIGENDIAN,no," condition in powerpc64/machine.m4 to > > check > > a different configure variable. > > > > > > I skipped processing the assembly files with a different approach, I > > made the configuration check for musl and endianness variant to > > trigger assembly processing. You can check the fix in this branch > > https://git.lysator.liu.se/mamonet/nettle/-/tree/ppc64_musl_fix > > <https://git.lysator.liu.se/mamonet/nettle/-/tree/ppc64_musl_fix> > > Apparently, the bug reporter uses a cross-compiler for powerpc arch. > > It would be great to run this fix at the same bug environment since I > > tested the patch in different circumstances. > > Your patch has no effect in my environment (OpenWrt build system), as > host_os is linux-gnu, according to config.log, so it doesn't match > *musl. See [1] for config.log and [2] for full compile log. > > The output of powerpc64-openwrt-linux-musl-gcc -E -dM - </dev/null | > sort, which was requested earlier in this thread can be seen at [3]. > > Thanks, > Stijn > > [1] https://gist.github.com/9e0ecb025033dda1d0d58094da84c308 > [2] https://gist.github.com/stintel/0e7046df511cf4d1ca20edb56df50b1b > [3] https://gist.github.com/stintel/b3651a7db87edea9e8bd0aef242bcdae config.guess detects the C standard library based on a result from the compiler defined in "CC_FOR_BUILD" variable, for some reason OpenWrt build system failed to set that variable properly, from your config.log I can see CC_FOR_BUILD='gcc -O -g' but when I use bare musl tools I get CC_FOR_BUILD='musl-gcc' There is nothing specific in the output of powerpc64-openwrt-linux-musl-gcc -E -dM log as I can see. In musl libc FAQ, they stated that there is no __MUSL__ in the preprocessor macros https://wiki.musl-libc.org/faq.html regards, Mamone

2 9

Status update
by nisse＠lysator.liu.se 17 Dec '21

17 Dec '21

Hi, just a heads up that I'll likely not be very responsive next few weeks. I may or may not get some hacking time during Christmas holidays. What I'd like to do when I get time: Review recent patches for powerpc ecc and sm4. Complete support for ANSI x9.62 (I'm not really up-to-date on the details, but needed square root code is already in, and there's code to do the rest was posted by Wim Lewis long ago). Prepare a new release. Maybe write salsa20 and chacha assembly for more platforms. But not necessarily in that order. Feel free to reply with suggested priorities, and remind me if there's something important that I've missed. Regards, /Niels -- Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677. Internet email is subject to wholesale government surveillance.

1 0

[PATCH] doc: documentation fot SM3 hash
by Tianjia Zhang 07 Dec '21

07 Dec '21

Signed-off-by: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> --- nettle.texinfo | 74 ++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 72 insertions(+), 2 deletions(-) diff --git a/nettle.texinfo b/nettle.texinfo index 39d01159..76934637 100644 --- a/nettle.texinfo +++ b/nettle.texinfo @@ -950,6 +950,52 @@ This function also resets the context in the same way as @code{streebog256_init}. @end deftypefun +@subsubsection @acronym{SM3} + +SM3 is a cryptographic hash function standard adopted by the government of the +People's Republic of China, which was issued by the Cryptography Standardization +Technical Committee of China on December 17, 2010. The corresponding standard +is GM/T 0004-2012 "SM3 Cryptographic Hash Algorithm". + +SM3 algorithm is a hash algorithm in ShangMi cryptosystems. SM3 is mainly used +for digital signature and verification, message authentication code generation +and verification, random number generation, and the RFC 8998 specification +defines the usage of ShangMi algorithm suite in TLS 1.3, etc. According to the +State Cryptography Administration of China, its security and efficiency are +equivalent to SHA-256. + +Nettle defines SM3 in @file{<nettle/sm3.h>}. + +@deftp {Context struct} {struct sm3_ctx} +@end deftp + +@defvr Constant SM3_DIGEST_SIZE +The size of a SM3 digest, i.e. 32. +@end defvr + +@defvr Constant SM3_BLOCK_SIZE +The internal block size of SM3. Useful for some special constructions, +in particular HMAC-SM3. +@end defvr + +@deftypefun void sm3_init (struct sm3_ctx *@var{ctx}) +Initialize the SM3 state. +@end deftypefun + +@deftypefun void sm3_update (struct sm3_ctx *@var{ctx}, size_t @var{length}, const uint8_t *@var{data}) +Hash some more data. +@end deftypefun + +@deftypefun void sm3_digest (struct sm3_ctx *@var{ctx}, size_t @var{length}, uint8_t *@var{digest}) +Performs final processing and extracts the message digest, writing it +to @var{digest}. @var{length} may be smaller than +@code{SM3_DIGEST_SIZE}, in which case only the first @var{length} +octets of the digest are written. + +This function also resets the context in the same way as +@code{sm3_init}. +@end deftypefun + @node Legacy hash functions @subsection Legacy hash functions @@ -1256,6 +1302,7 @@ The last three attributes are function pointers, of types @deftypevrx {Constant Struct} {struct nettle_hash} nettle_sha3_256 @deftypevrx {Constant Struct} {struct nettle_hash} nettle_gosthash94 @deftypevrx {Constant Struct} {struct nettle_hash} nettle_gosthash94cp +@deftypevrx {Constant Struct} {struct nettle_hash} nettle_sm3 These are all the hash functions that Nettle implements. @end deftypevr @@ -3775,8 +3822,8 @@ There are abstract functions that use a pointer to a @code{struct nettle_hash} to represent the underlying hash function and @code{void *} pointers that point to three different context structs for that hash function. There are also concrete functions for @acronym{HMAC-MD5}, -@acronym{HMAC-RIPEMD160} @acronym{HMAC-SHA1}, @acronym{HMAC-SHA256}, and -@acronym{HMAC-SHA512}. First, the abstract functions: +@acronym{HMAC-RIPEMD160} @acronym{HMAC-SHA1}, @acronym{HMAC-SHA256}, +@acronym{HMAC-SHA512}, and @acronym{HMAC-SM3}. First, the abstract functions: @deftypefun void hmac_set_key (void *@var{outer}, void *@var{inner}, void *@var{state}, const struct nettle_hash *@var{H}, size_t @var{length}, const uint8_t *@var{key}) Initializes the three context structs from the key. The @var{outer} and @@ -3963,6 +4010,29 @@ This function also resets the context for processing new messages, with the same key. @end deftypefun + +@subsubsection @acronym{HMAC-SM3} + +@deftp {Context struct} {struct hmac_sm3_ctx} +@end deftp + +@deftypefun void hmac_sm3_set_key (struct hmac_sm3_ctx *@var{ctx}, size_t @var{key_length}, const uint8_t *@var{key}) +Initializes the context with the key. +@end deftypefun + +@deftypefun void hmac_sm3_update (struct hmac_sm3_ctx *@var{ctx}, size_t @var{length}, const uint8_t *@var{data}) +Process some more data. +@end deftypefun + +@deftypefun void hmac_sm3_digest (struct hmac_sm3_ctx *@var{ctx}, size_t @var{length}, uint8_t *@var{digest}) +Extracts the @acronym{MAC}, writing it to @var{digest}. @var{length} may be smaller than +@code{SM3_DIGEST_SIZE}, in which case only the first @var{length} +octets of the @acronym{MAC} are written. + +This function also resets the context for processing new messages, with +the same key. +@end deftypefun + @node UMAC @subsection @acronym{UMAC} @cindex UMAC -- 2.32.0

2 1

[PATCH v2 0/4] Introduce OSCCA SM3 hash algorithm
by Tianjia Zhang 06 Dec '21

06 Dec '21

Add OSCCA SM3 secure hash generic hash algorithm, described in OSCCA GM/T 0004-2012 SM3, the corresponding English specification: http://www.gmbz.org.cn/upload/2018-07-24/1532401392982079739.pdf Tianjia Zhang (4): Add OSCCA SM3 hash algorithm testsuite: add test for SM3 hash function hmac: add support for SM3 hash function nettle-benchmark: bench SM3 hashes Makefile.in | 7 +- examples/nettle-benchmark.c | 2 +- hmac-sm3-meta.c | 47 +++++++ hmac-sm3.c | 59 +++++++++ hmac.h | 19 +++ nettle-meta-hashes.c | 1 + nettle-meta-macs.c | 1 + nettle-meta.h | 2 + sm3-meta.c | 42 ++++++ sm3.c | 251 ++++++++++++++++++++++++++++++++++++ sm3.h | 82 ++++++++++++ testsuite/.gitignore | 1 + testsuite/Makefile.in | 2 +- testsuite/hmac-test.c | 6 + testsuite/meta-hash-test.c | 3 +- testsuite/meta-mac-test.c | 1 + testsuite/sm3-test.c | 20 +++ 17 files changed, 540 insertions(+), 6 deletions(-) create mode 100644 hmac-sm3-meta.c create mode 100644 hmac-sm3.c create mode 100644 sm3-meta.c create mode 100644 sm3.c create mode 100644 sm3.h create mode 100644 testsuite/sm3-test.c -- 2.32.0

2 8

Re: ANNOUNCE: Serious bug in Nettle's ecdsa_verify - Critical Confirmation
by nisse＠lysator.liu.se 06 Dec '21

06 Dec '21

"Jayakumar, Jaikanth" <jaikanth.jayakumar1(a)optum.com> writes: > There is a small confusion, I believe the bug reported here > (https://lists.lysator.liu.se/pipermail/nettle-bugs/2021/009457.html) > is related to CVE-2021-20305, right ? and this (CVE-2021-20305) is > fixed in version 3.7.2. Which *two* problems are you asking about? The problem referred to as https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20305 was fixed in nettle-3.7.2. Then there was a different problem, in RSA decryption, https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3580, fixed in nettle-3.7.3. > In the case it is the same, it would help big time if the CVE was > mentioned somewhere in the bug announcement thread. I'll try to remember to mention relevant CVE ids in future release announcements. Would help to also document in the NEWS file? Regards, /Niels -- Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677. Internet email is subject to wholesale government surveillance.

1 0

[PATCH 0/4] Introduce OSCCA SM3 hash algorithm
by Tianjia Zhang 29 Nov '21

29 Nov '21

Add OSCCA SM3 secure hash generic hash algorithm, described in OSCCA GM/T 0004-2012 SM3. Tianjia Zhang (4): Add OSCCA SM3 hash algorithm testsuite: add test for SM3 hash function hmac: add support for SM3 hash function nettle-benchmark: bench SM3 hashes Makefile.in | 7 +- examples/nettle-benchmark.c | 2 +- hmac-sm3-meta.c | 47 +++++++ hmac-sm3.c | 59 +++++++++ hmac.h | 19 +++ nettle-meta-hashes.c | 1 + nettle-meta-macs.c | 1 + nettle-meta.h | 2 + sm3-meta.c | 41 ++++++ sm3.c | 250 ++++++++++++++++++++++++++++++++++++ sm3.h | 81 ++++++++++++ testsuite/.gitignore | 1 + testsuite/Makefile.in | 2 +- testsuite/hmac-test.c | 6 + testsuite/meta-hash-test.c | 3 +- testsuite/meta-mac-test.c | 1 + testsuite/sm3-test.c | 20 +++ 17 files changed, 537 insertions(+), 6 deletions(-) create mode 100644 hmac-sm3-meta.c create mode 100644 hmac-sm3.c create mode 100644 sm3-meta.c create mode 100644 sm3.c create mode 100644 sm3.h create mode 100644 testsuite/sm3-test.c -- 2.32.0

2 8

Curve point decompression
by Wim Lewis 10 Nov '21

10 Nov '21

I'm looking at implementing elliptic curve point compression a la SEC1 (admittedly, mostly to reduce the number of "feature not supported" code paths in a library, but it seems like a somewhat useful ability). Nettle/Hogweed already implements it internally for curve25519, but I want to implement it for the "secp" curves as well. Point compression is easy enough, but point decompression requires some curve math, potentially dependent on the specific curve, and some of it is redundant with what's already done in ecc_point_set(). So I was thinking about moving this functionality into Hogweed as a function along the lines of ecc_point_set_compressed(), which would take, instead of a y-coordinate, an int containing the sign/parity of the y-coordinate. So my question for the list and for the maintainers is, is this a reasonable API to add to Hogweed? Is there interest in including it in Hogweed if I were to take the time to turn it into a tidy patch?

3 10

[S390x] Optimize SHA3 permute using vector facility
by Maamoun TK 31 Oct '21

31 Oct '21

I've added a new patch that optimizes SHA3 permute function for S390x architecture https://git.lysator.liu.se/nettle/nettle/-/merge_requests/36 More about the patch in merge request description. regards, Mamone

2 4

secp256r1 mod functions
by nisse＠lysator.liu.se 22 Oct '21

22 Oct '21

Hi, a while ago I was asked to explain the 64-bit C versions of ecc_secp256r1_modp and ecc_secp256r1_modq (in ecc-secp256r1.c), and I found that a bit difficult. I've rewritten them, on branch https://git.lysator.liu.se/nettle/nettle/-/blob/secp256r1-mod/ecc-secp256r1…. Main difference is handling of the case that next quotient is close to 2^{64}: Old code allowed the quotient to overflow 64 bits, using an additional carry variable q2. New code ensures that next quotient is always at most 2^{64} - 1. For the new implementation, the modp function is a special case of the 2/1 division in https://gmplib.org/~tege/division-paper.pdf (would usually need 3/2 division to get sufficient accuracy, but reduces to 2/1 since the next most significant word of p is 0), and the modq function is a special case of divappr2, described in https://www.lysator.liu.se/~nisse/misc/schoolbook-divappr.pdf. I've not been able to measure any significant difference in speed (I get somewhat noisy measurements from the examples/ecc-benchmark tool), although I would expect the new code to be very slightly faster. These functions are not that performance critical, since the bulk of the reductions for this curve is done using redc, not mod. Any additional testing, benchmarking, or code staring, is appreciated. I will likely merge the new code to the master branch in a few days. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

Structural fixes to the manual
by nisse＠lysator.liu.se 22 Sep '21

22 Sep '21

I've spent some time to improve structure (mostly non-text changes) of the manual. 1. Deleted all explicit node pointers in nettle.texinfo, instead letting makeinfo infer the node structure. This is the recommended way these days, according to texinfo documentation. 2. Changed the make rules producing nettle.pdf to use texi2pdf, instead of the chain texi2dvi + dvips + pstopdf. Most obvious result is that hyperlinks work better, and output file is slightly smaller. It's done in whatever way is default in texi2pdf, I haven't tried to check the details (e.g., what kind of fonts are used, and if they're all embedded in the file). 3. Split the huge Cipher functions node into one node per cipher. 4. Fixed a few places where urls or example code was too wide for the page. According to the docs (https://www.gnu.org/software/texinfo/manual/texinfo/html_node/URL-Line-Brea…), line breaks should be automatically added in urls when needed (and that's true also according to the docs for texinfo-6.7, which is what I have installed), but that didn't work at all when I tried it, so I've added a few explicit hints on how to break long urls. Also the @urefbreakstyle command wasn't recognized at all. Anyone here more familiar with texinfo that can explain? Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

[S390x] Optimize SHA1 with fat build support
by Maamoun TK 20 Sep '21

20 Sep '21

I made a merge request in the main repository that optimizes SHA1 for s390x architecture with fat build support !33 <https://git.lysator.liu.se/nettle/nettle/-/merge_requests/33>. regards, Mamone

2 10

[S390x] Optimize AES modes
by Maamoun TK 19 Sep '21

19 Sep '21

I made a merge request for optimizing AES modes on s390x architecture, the patch implements the optimized cores using cipher instructions that have been added to s390x arch in message security assist extensions. The patch uses the following functions: KM-AES-128 (ECB-AES128) KM-AES-192 (ECB-AES192) KM-AES-256 (ECB-AES256) KMC-AES-128 (CBC-AES128) KMC-AES-192 (CBC-AES192) KMC-AES-256 (CBC-AES256) KMAC-AES-128 (CCM-AES128, CMAC-AES128) KMAC-AES-192 (CCM-AES192) KMAC-AES-256 (CCM-AES256, CMAC-AES256) KMF-AES-128 (CFB-AES128, CFB8-AES128) KMF-AES-192 (CFB-AES192, CFB8-AES192) KMF-AES-256 (CFB-AES256, CFB8-AES256) KM-XTS-AES-128 (XTS-AES128) KM-XTS-AES-256 (XTS-AES256) KIMD-GHASH (GHASH) KMCTR-AES-128, KMA-GCM-AES-128 (CTR-AES128) KMCTR-AES-192, KMA-GCM-AES-192 (CTR-AES192) KMCTR-AES-256, KMA-GCM-AES-256 (CTR-AES256) KMA-GCM-AES-128 (GCM-AES128) KMA-GCM-AES-192 (GCM-AES192) KMA-GCM-AES-256 (GCM-AES256) The merge request has also a benchmark that measures the speed of optimized cores on s390x arch. I can't set up gitlab CI for automatic testing on s390x arch because qemu hasn't implemented cipher functions for this arch. However, there is an easy way to test the patch manually by requesting a free account on the LinuxONE Community Cloud, both short-term and long-term access are available. https://linuxone.cloud.marist.edu/#/register?flag=VM regards, Mamone

4 39

Reorganization of x86_64 aesni code
by nisse＠lysator.liu.se 04 Sep '21

04 Sep '21

I've merged a reorganization of the x86_64 aesni code to the master-updates branch for testing. This replaces the x86_64/aesni/aes-*crypt-internal.asm files with separate files for the different key sizes, as has been discussed earlier. And I've implemented 2-way interleaving, i.e., doing 2 blocks at a time, which gave a nice speedup on the order of 15% in my tests. I may be worthwhile to go to 3-way or 4-way, but I don't plan to try that soon. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

2 1

Re: Build problem on ppc64be + musl
by Maamoun TK 21 Aug '21

21 Aug '21

Forcing ELFv2 abi doesn't work for big-endian mode as this mode has no support for ELFv2. ppc64 linux big-endian is deprecated, it' not unexpected to get such issues. Dropping big-endian support for powerpc could be an option to solve this issue but that will be a drawback for AIX (BE) systems. regards, Maamoun On Mon, Aug 16, 2021 at 10:54 PM Niels Möller <nisse(a)lysator.liu.se> wrote: > Stijn Tintel <stijn(a)linux-ipv6.be> writes: > > > I suspect this is because musl doesn't support the ELFv1 ABI on ppc64 at > > all, regardless of endianness. I've tried adding -mabi=elfv2 to CFLAGS, > > to force using the ELFv2 ABI, but the problem persists. Suggestions > welcome. > > I don't know that much about ppc64 abi issues myself. From your > description, it seems clear that it's a linker error, and that object > files corresponding to C source files somehow carry different "abi > version attributes" than object files corresponding to nettle's assembly > source files. > > As you've found, configuring with --disable-assembler works around the > problem, but to solve it properly, we'd need to understand why that is. > The assembler should not be invoked directly, but via the same $(CC) and > $(CFLAGS) as the C compiler. > > You'd need to compare those object files and how they're generated. > Compare the compiler command lines. You could perhaps use gcc -v to see > how gcc invokes the assembler in both cases. You can use gcc -save-temps > to look at the assembly files generated by gcc, and check if they use > some special pseudoops to specify the abi. You can use tools like > objdump or readelf to compare attributes in the object files. > > If you can figure out how to produce object files that are compatible > according to the linker, that may not be sufficient, though. You also > need to tweak the assembly files and related macros and configure checks > to use the right api. See powerpc64/README and powerpc64/machine.m4. As > I understand it, abi is currently selected depending on the endianness, > using v1 for big endian and v2 for little endian. > > It may need a configure test independent of endianness. Maybe there's > some predefined symbol we can check, similar to 32-bit/64-bit ABI checks > on other platforms? You could run something like > > powerpc64-openwrt-linux-musl-gcc -E -dM - </dev/null | sort > > With the powerpc64le-linux-gnu-gcc cross compiler I have, the closest > suspect I see is > > #define _CALL_ELF 2 > > Maybe that's the right thing to check? I don't have a big-endian system > or crosscompiler close at hand, but at least there's a bigendian > powerpc64-linux-gnu cross compile setup in the ci system hosted at gitlab. > > Regards, > /Niels > > -- > Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. > Internet email is subject to wholesale government surveillance. >

3 8

Is there an equivalent to curve25519_mul for ECC keys?
by Nicolas Mora 16 Aug '21

16 Aug '21

Hello, I'm wondering if there is a function of a combination of functions to perform a DH computation using ECC keys and their parameters "struct ecc_point *pub1, struct ecc_scalar *key2"? /Nicolas

2 2

[S390x] Optimize SHA256 and SHA512 compress functions
by Maamoun TK 13 Aug '21

13 Aug '21

I made a merge request in the main repository that optimizes SHA256 and SHA512 compress functions for s390x architecture with fat build support !35 <https://git.lysator.liu.se/nettle/nettle/-/merge_requests/35>. regards, Mamone

1 0

[AArch64] Optimize AES with fat build support
by Maamoun TK 30 Jul '21

30 Jul '21

I made a merge request in the main repository that optimizes AES for arm64 architecture with fat build support !34 <https://git.lysator.liu.se/nettle/nettle/-/merge_requests/34>. regards, Mamone

1 0

[S390x] Fat build support for AES and GHASH
by Maamoun TK 24 Jul '21

24 Jul '21

I created a MR !31 <https://git.lysator.liu.se/nettle/nettle/-/merge_requests/31> that adds fat build support of AES and GHASH for S390x architecture. The MR's description has a brief overview of the modifications done to add the fat build support. regards, Mamone

2 6

[S390x] Optimize memxor
by Maamoun TK 22 Jul '21

22 Jul '21

I made a merge request !30 <https://git.lysator.liu.se/nettle/nettle/-/merge_requests/30> that optimizes memxor function for S390x architecture. I've attached a benchmark on a Z15 processor in the MR description. regards, Mamone

1 1

Fwd: [S390x] Optimize GHASH
by Maamoun TK 17 Jul '21

17 Jul '21

---------- Forwarded message --------- From: Maamoun TK <maamoun.tk(a)googlemail.com> Date: Sat, Jul 17, 2021 at 2:00 PM Subject: Re: [S390x] Optimize GHASH To: Niels Möller <nisse(a)lysator.liu.se> On Sat, Jul 17, 2021 at 1:37 PM Niels Möller <nisse(a)lysator.liu.se> wrote: > Maamoun TK <maamoun.tk(a)googlemail.com> writes: > > In another topic, I've optimized the SHA-512 algorithm for arm64 > > architecture but it turned out all CFarm variants don't support SHA-512 > > crypto extension so I can't do any performance or correctness testing for > > now. Do you know any CFarm alternative that supports SHA-512 and SHA3 > > extensions for arm64 architectures? > > Can you do correctness tests on qemu? (I've been using a crosscompiler > and qemu-user to test other ARM code, and that's also what the ci tests > do). > Sure, but I'm also concerned about the performance testing. I was always trying to get the best performance out of hardware-accelerated cores. > I have access to the systems listed on > https://gmplib.org/devel/testsystems, is any of those applicable? The > arm64 machines available includes one Cortex-A73 and one Apple M1. > Cortex-A73 doesn't support SHA-512 and SHA3 List of ARM microarchitectures - Wikipedia <https://en.wikipedia.org/wiki/List_of_ARM_microarchitectures> Cortex-A75 is the minimum architecture that has a full implementation of ARMv8.2-A which is the arch that introduced SHA-512 and SHA3 AArch64 Options (Using the GNU Compiler Collection (GCC)) <https://gcc.gnu.org/onlinedocs/gcc/AArch64-Options.html> Cortex-A55 should support those extensions according to the list.

1 0

Re: [Aarch64] Optimize AES
by Maamoun TK 17 Jul '21

17 Jul '21

On Sat, Jul 17, 2021 at 1:46 PM Niels Möller <nisse(a)lysator.liu.se> wrote: > Maamoun TK <maamoun.tk(a)googlemail.com> writes: > > > It fits better to have one implementation per key size, I'll modify this > > patch to apply this approach. However, we need to merge the s390x branch > at > > first since it has a separate implementation for each key size. > > Right. With fat support in, is there anything else that is essential > before merging? > No, AES and GHASH have the full functionalities for S390x architecture in this way.

1 0

[S390x] Optimize GHASH
by Maamoun TK 17 Jul '21

17 Jul '21

I made a merge request !26 <https://git.lysator.liu.se/nettle/nettle/-/merge_requests/26> that optimizes the GHASH algorithm for S390x architecture. I've attached a benchmark in the description of merge request that describes the improvement of using GHASH accelerator over C implementation. I've also made two patches for fat build support of AES and GHASH for S390x architecture in addition to optimize memxor function using 'xc (xor storage-to-storage) instruction' Files · s390x-fat · Maamoun TK / nettle · GitLab (liu.se) <https://git.lysator.liu.se/mamonet/nettle/-/tree/s390x-fat> Files · s390x-memxor · Maamoun TK / nettle · GitLab (liu.se) <https://git.lysator.liu.se/mamonet/nettle/-/tree/s390x-memxor> I'll make merge requests for both patches after the current one being merged since they need to rebase on top of that patch. regards, Mamone

3 14

[Aarch64] Optimize AES
by Maamoun TK 17 Jul '21

17 Jul '21

This patch optimizes nettle_aes_encrypt() and nettle_aes_decrypt() functions for arm64 architecture, it takes advantage of 'aese' and 'aesmc' instructions to optimize the encryption function and 'aesd' and 'aesimc' to optimize the decryption function. The patch passes the testsuite of nettle. I also run the benchmark on gcc117 instance of CFarm by configuring the library with "--disable-fat --enable-arm64-crypto" options then executing examples/nettle-benchmark: aes128 ECB encrypt 2522.67 aes128 ECB decrypt 2522.53 aes192 ECB encrypt 2165.06 aes192 ECB decrypt 2165.04 aes256 ECB encrypt 1866.80 aes256 ECB decrypt 1866.38 openssl aes128 ECB encrypt 1043.52 openssl aes128 ECB decrypt 1043.05 openssl aes192 ECB encrypt 904.08 openssl aes192 ECB decrypt 903.85 openssl aes256 ECB encrypt 787.43 openssl aes256 ECB decrypt 787.20 gcm_aes128 encrypt 955.10 gcm_aes128 decrypt 955.06 gcm_aes128 update 3269.18 gcm_aes192 encrypt 896.26 gcm_aes192 decrypt 896.46 gcm_aes192 update 3270.24 gcm_aes256 encrypt 840.17 gcm_aes256 decrypt 843.53 gcm_aes256 update 3270.08 openssl gcm_aes128 encrypt 894.51 openssl gcm_aes128 decrypt 899.05 openssl gcm_aes128 update 1636.61 openssl gcm_aes192 encrypt 834.94 openssl gcm_aes192 decrypt 841.99 openssl gcm_aes192 update 1631.40 openssl gcm_aes256 encrypt 788.48 openssl gcm_aes256 decrypt 791.31 openssl gcm_aes256 update 1635.18 I'm a little suspicious about the benchmark numbers because as I remember the performance of gcm update doesn't double the openssl number, I repeat running the process but kept giving the same performance margin. --- arm64/crypto/aes-decrypt-internal.asm | 223 ++++++++++++++++++++++++++++++++++ arm64/crypto/aes-encrypt-internal.asm | 223 ++++++++++++++++++++++++++++++++++ 2 files changed, 446 insertions(+) create mode 100644 arm64/crypto/aes-decrypt-internal.asm create mode 100644 arm64/crypto/aes-encrypt-internal.asm diff --git a/arm64/crypto/aes-decrypt-internal.asm b/arm64/crypto/aes-decrypt-internal.asm new file mode 100644 index 00000000..4bfdb314 --- /dev/null +++ b/arm64/crypto/aes-decrypt-internal.asm @@ -0,0 +1,223 @@ +C arm64/crypto/aes-decrypt-internal.asm + +ifelse(` + Copyright (C) 2021 Mamone Tarsha + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +') + +.file "aes-decrypt-internal.asm" +.arch armv8-a+crypto + +.text + +C Register usage: + +define(`ROUNDS', `x0') +define(`KEYS', `x1') +define(`LENGTH', `x3') +define(`DST', `x4') +define(`SRC', `x5') + +define(`S0', `v0') +define(`S1', `v1') +define(`S2', `v2') +define(`S3', `v3') +define(`K0', `v16') +define(`K1', `v17') +define(`K2', `v18') +define(`K3', `v19') +define(`K4', `v20') +define(`K5', `v21') +define(`K6', `v22') +define(`K7', `v23') +define(`K8', `v24') +define(`K9', `v25') +define(`K10', `v26') +define(`K11', `v27') +define(`K12', `v28') +define(`K13', `v29') +define(`K14', `v30') + +C AES_ROUND_4B(KEY) +define(`AES_ROUND_4B', m4_assert_numargs(1)` + aesd S0.16b,$1.16b + aesimc S0.16b,S0.16b + aesd S1.16b,$1.16b + aesimc S1.16b,S1.16b + aesd S2.16b,$1.16b + aesimc S2.16b,S2.16b + aesd S3.16b,$1.16b + aesimc S3.16b,S3.16b +') + +C AES_LAST_ROUND_4B(KEY) +define(`AES_LAST_ROUND_4B', m4_assert_numargs(1)` + aesd S0.16b,$1.16b + eor S0.16b,S0.16b,K14.16b + aesd S1.16b,$1.16b + eor S1.16b,S1.16b,K14.16b + aesd S2.16b,$1.16b + eor S2.16b,S2.16b,K14.16b + aesd S3.16b,$1.16b + eor S3.16b,S3.16b,K14.16b +') + +C AES_ROUND_1B(KEY) +define(`AES_ROUND_1B', m4_assert_numargs(1)` + aesd S0.16b,$1.16b + aesimc S0.16b,S0.16b +') + +C AES_LAST_ROUND_1B(KEY) +define(`AES_LAST_ROUND_1B', m4_assert_numargs(1)` + aesd S0.16b,$1.16b + eor S0.16b,S0.16b,K14.16b +') + +C _aes_decrypt(unsigned rounds, const uint32_t *keys, +C const struct aes_table *T, +C size_t length, uint8_t *dst, +C const uint8_t *src) + +PROLOGUE(_nettle_aes_decrypt) + ands x6,LENGTH,#-64 + b.eq L1B + + mov x7,KEYS + ld1 {K0.4s,K1.4s,K2.4s,K3.4s},[x7],#64 + ld1 {K4.4s,K5.4s,K6.4s,K7.4s},[x7],#64 + ld1 {K8.4s,K9.4s},[x7],#32 + cmp ROUNDS,#10 + b.eq L4B_last_key + ld1 {K10.4s,K11.4s},[x7],#32 + cmp ROUNDS,#12 + b.eq L4B_last_key + ld1 {K12.4s,K13.4s},[x7],#32 + +L4B_last_key: + ld1 {K14.4s},[x7] + +L4B_loop: + ld1 {S0.16b,S1.16b,S2.16b,S3.16b},[SRC],#64 + + AES_ROUND_4B(K0) + AES_ROUND_4B(K1) + AES_ROUND_4B(K2) + AES_ROUND_4B(K3) + AES_ROUND_4B(K4) + AES_ROUND_4B(K5) + AES_ROUND_4B(K6) + AES_ROUND_4B(K7) + AES_ROUND_4B(K8) + cmp ROUNDS,#10 + b.eq L4B_10_round + cmp ROUNDS,#12 + b.eq L4B_12_round + b L4B_14_round + +L4B_10_round: + AES_LAST_ROUND_4B(K9) + b L4B_done +L4B_12_round: + AES_ROUND_4B(K9) + AES_ROUND_4B(K10) + AES_LAST_ROUND_4B(K11) + b L4B_done +L4B_14_round: + AES_ROUND_4B(K9) + AES_ROUND_4B(K10) + AES_ROUND_4B(K11) + AES_ROUND_4B(K12) + AES_LAST_ROUND_4B(K13) + +L4B_done: + st1 {S0.16b,S1.16b,S2.16b,S3.16b},[DST],#64 + + subs x6,x6,#64 + b.ne L4B_loop + + and LENGTH,LENGTH,#63 + +L1B: + cbz LENGTH,Ldone + + mov x6,KEYS + ld1 {K0.4s,K1.4s,K2.4s,K3.4s},[x6],#64 + ld1 {K4.4s,K5.4s,K6.4s,K7.4s},[x6],#64 + ld1 {K8.4s,K9.4s},[x6],#32 + cmp ROUNDS,#10 + b.eq L1B_last_key + ld1 {K10.4s,K11.4s},[x6],#32 + cmp ROUNDS,#12 + b.eq L1B_last_key + ld1 {K12.4s,K13.4s},[x6],#32 + +L1B_last_key: + ld1 {K14.4s},[x6] + +L1B_loop: + ld1 {S0.16b},[SRC],#16 + + AES_ROUND_1B(K0) + AES_ROUND_1B(K1) + AES_ROUND_1B(K2) + AES_ROUND_1B(K3) + AES_ROUND_1B(K4) + AES_ROUND_1B(K5) + AES_ROUND_1B(K6) + AES_ROUND_1B(K7) + AES_ROUND_1B(K8) + cmp ROUNDS,#10 + b.eq L1B_10_round + cmp ROUNDS,#12 + b.eq L1B_12_round + b L1B_14_round + +L1B_10_round: + AES_LAST_ROUND_1B(K9) + b L1B_done +L1B_12_round: + AES_ROUND_1B(K9) + AES_ROUND_1B(K10) + AES_LAST_ROUND_1B(K11) + b L1B_done +L1B_14_round: + AES_ROUND_1B(K9) + AES_ROUND_1B(K10) + AES_ROUND_1B(K11) + AES_ROUND_1B(K12) + AES_LAST_ROUND_1B(K13) + +L1B_done: + st1 {S0.16b},[DST],#16 + + subs LENGTH,LENGTH,#16 + b.ne L1B_loop + +Ldone: + ret +EPILOGUE(_nettle_aes_decrypt) diff --git a/arm64/crypto/aes-encrypt-internal.asm b/arm64/crypto/aes-encrypt-internal.asm new file mode 100644 index 00000000..314f9333 --- /dev/null +++ b/arm64/crypto/aes-encrypt-internal.asm @@ -0,0 +1,223 @@ +C arm64/crypto/aes-encrypt-internal.asm + +ifelse(` + Copyright (C) 2021 Mamone Tarsha + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +') + +.file "aes-encrypt-internal.asm" +.arch armv8-a+crypto + +.text + +C Register usage: + +define(`ROUNDS', `x0') +define(`KEYS', `x1') +define(`LENGTH', `x3') +define(`DST', `x4') +define(`SRC', `x5') + +define(`S0', `v0') +define(`S1', `v1') +define(`S2', `v2') +define(`S3', `v3') +define(`K0', `v16') +define(`K1', `v17') +define(`K2', `v18') +define(`K3', `v19') +define(`K4', `v20') +define(`K5', `v21') +define(`K6', `v22') +define(`K7', `v23') +define(`K8', `v24') +define(`K9', `v25') +define(`K10', `v26') +define(`K11', `v27') +define(`K12', `v28') +define(`K13', `v29') +define(`K14', `v30') + +C AES_ROUND_4B(KEY) +define(`AES_ROUND_4B', m4_assert_numargs(1)` + aese S0.16b,$1.16b + aesmc S0.16b,S0.16b + aese S1.16b,$1.16b + aesmc S1.16b,S1.16b + aese S2.16b,$1.16b + aesmc S2.16b,S2.16b + aese S3.16b,$1.16b + aesmc S3.16b,S3.16b +') + +C AES_LAST_ROUND_4B(KEY) +define(`AES_LAST_ROUND_4B', m4_assert_numargs(1)` + aese S0.16b,$1.16b + eor S0.16b,S0.16b,K14.16b + aese S1.16b,$1.16b + eor S1.16b,S1.16b,K14.16b + aese S2.16b,$1.16b + eor S2.16b,S2.16b,K14.16b + aese S3.16b,$1.16b + eor S3.16b,S3.16b,K14.16b +') + +C AES_ROUND_1B(KEY) +define(`AES_ROUND_1B', m4_assert_numargs(1)` + aese S0.16b,$1.16b + aesmc S0.16b,S0.16b +') + +C AES_LAST_ROUND_1B(KEY) +define(`AES_LAST_ROUND_1B', m4_assert_numargs(1)` + aese S0.16b,$1.16b + eor S0.16b,S0.16b,K14.16b +') + +C _aes_encrypt(unsigned rounds, const uint32_t *keys, +C const struct aes_table *T, +C size_t length, uint8_t *dst, +C uint8_t *src) + +PROLOGUE(_nettle_aes_encrypt) + ands x6,LENGTH,#-64 + b.eq L1B + + mov x7,KEYS + ld1 {K0.4s,K1.4s,K2.4s,K3.4s},[x7],#64 + ld1 {K4.4s,K5.4s,K6.4s,K7.4s},[x7],#64 + ld1 {K8.4s,K9.4s},[x7],#32 + cmp ROUNDS,#10 + b.eq L4B_last_key + ld1 {K10.4s,K11.4s},[x7],#32 + cmp ROUNDS,#12 + b.eq L4B_last_key + ld1 {K12.4s,K13.4s},[x7],#32 + +L4B_last_key: + ld1 {K14.4s},[x7] + +L4B_loop: + ld1 {S0.16b,S1.16b,S2.16b,S3.16b},[SRC],#64 + + AES_ROUND_4B(K0) + AES_ROUND_4B(K1) + AES_ROUND_4B(K2) + AES_ROUND_4B(K3) + AES_ROUND_4B(K4) + AES_ROUND_4B(K5) + AES_ROUND_4B(K6) + AES_ROUND_4B(K7) + AES_ROUND_4B(K8) + cmp ROUNDS,#10 + b.eq L4B_10_round + cmp ROUNDS,#12 + b.eq L4B_12_round + b L4B_14_round + +L4B_10_round: + AES_LAST_ROUND_4B(K9) + b L4B_done +L4B_12_round: + AES_ROUND_4B(K9) + AES_ROUND_4B(K10) + AES_LAST_ROUND_4B(K11) + b L4B_done +L4B_14_round: + AES_ROUND_4B(K9) + AES_ROUND_4B(K10) + AES_ROUND_4B(K11) + AES_ROUND_4B(K12) + AES_LAST_ROUND_4B(K13) + +L4B_done: + st1 {S0.16b,S1.16b,S2.16b,S3.16b},[DST],#64 + + subs x6,x6,#64 + b.ne L4B_loop + + and LENGTH,LENGTH,#63 + +L1B: + cbz LENGTH,Ldone + + mov x6,KEYS + ld1 {K0.4s,K1.4s,K2.4s,K3.4s},[x6],#64 + ld1 {K4.4s,K5.4s,K6.4s,K7.4s},[x6],#64 + ld1 {K8.4s,K9.4s},[x6],#32 + cmp ROUNDS,#10 + b.eq L1B_last_key + ld1 {K10.4s,K11.4s},[x6],#32 + cmp ROUNDS,#12 + b.eq L1B_last_key + ld1 {K12.4s,K13.4s},[x6],#32 + +L1B_last_key: + ld1 {K14.4s},[x6] + +L1B_loop: + ld1 {S0.16b},[SRC],#16 + + AES_ROUND_1B(K0) + AES_ROUND_1B(K1) + AES_ROUND_1B(K2) + AES_ROUND_1B(K3) + AES_ROUND_1B(K4) + AES_ROUND_1B(K5) + AES_ROUND_1B(K6) + AES_ROUND_1B(K7) + AES_ROUND_1B(K8) + cmp ROUNDS,#10 + b.eq L1B_10_round + cmp ROUNDS,#12 + b.eq L1B_12_round + b L1B_14_round + +L1B_10_round: + AES_LAST_ROUND_1B(K9) + b L1B_done +L1B_12_round: + AES_ROUND_1B(K9) + AES_ROUND_1B(K10) + AES_LAST_ROUND_1B(K11) + b L1B_done +L1B_14_round: + AES_ROUND_1B(K9) + AES_ROUND_1B(K10) + AES_ROUND_1B(K11) + AES_ROUND_1B(K12) + AES_LAST_ROUND_1B(K13) + +L1B_done: + st1 {S0.16b},[DST],#16 + + subs LENGTH,LENGTH,#16 + b.ne L1B_loop + +Ldone: + ret +EPILOGUE(_nettle_aes_encrypt) -- 2.25.1

2 2

HPKE implementation
by Norbert Pocs 14 Jul '21

14 Jul '21

Hello mailing list, I am a student at Brno University of Technology at Faculty of Information Technology and intern at Red Hat Crypto team. My current project is the implementation of HPKE draft [0]. The first goal is to implement mode_base. Example usage for the project is the encrypted hello message in TLS [1]. Do you have interest in merging the code after completion? [0] https://tools.ietf.org/html/draft-irtf-cfrg-hpke-07 [1] https://gitlab.com/gnutls/gnutls/-/issues/595 Regards Norbert Pócs

2 3

[AArch64] Fat build support for SHA-256 compress
by Maamoun TK 05 Jul '21

05 Jul '21

I made a merge request that adds fat build support for SHA-256 compress function !29 <https://git.lysator.liu.se/nettle/nettle/-/merge_requests/29> regards, Mamone

2 1

[AArch64] Optimize SHA-256 compress
by Maamoun TK 01 Jul '21

01 Jul '21

I made a merge request !28 <https://git.lysator.liu.se/nettle/nettle/-/merge_requests/28> to the 'arm64-sha1' branch that optimizes SHA-256 compress function, I've added a brief description of the patch in addition to benchmark numbers in the MR description. A patch for fat build support will be followed in another merge request. regards, Mamone

2 1

[Aarch64] Fat build support for SHA1 compress
by Maamoun TK 30 Jun '21

30 Jun '21

This patch added fat build support SHA1 compress function using the regular HWCAP features. --- arm64/fat/sha1-compress-2.asm | 37 +++++++++++++++++++++++++++++++++++++ fat-arm64.c | 32 ++++++++++++++++++++++++++++++-- 2 files changed, 67 insertions(+), 2 deletions(-) create mode 100644 arm64/fat/sha1-compress-2.asm diff --git a/arm64/fat/sha1-compress-2.asm b/arm64/fat/sha1-compress-2.asm new file mode 100644 index 00000000..b53cb63e --- /dev/null +++ b/arm64/fat/sha1-compress-2.asm @@ -0,0 +1,37 @@ +C arm64/fat/sha1-compress-2.asm + + +ifelse(` + Copyright (C) 2021 Mamone Tarsha + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +') + +dnl PROLOGUE(nettle_sha1_compress) picked up by configure + +define(`fat_transform', `_$1_arm64') +include_src(`arm64/crypto/sha1-compress.asm') diff --git a/fat-arm64.c b/fat-arm64.c index 9f81951f..c696e9bb 100644 --- a/fat-arm64.c +++ b/fat-arm64.c @@ -61,10 +61,14 @@ #ifndef HWCAP_PMULL #define HWCAP_PMULL (1 << 4) #endif +#ifndef HWCAP_SHA1 +#define HWCAP_SHA1 (1 << 5) +#endif struct arm64_features { int have_pmull; + int have_sha1; }; #define MATCH(s, slen, literal, llen) \ @@ -75,6 +79,7 @@ get_arm64_features (struct arm64_features *features) { const char *s; features->have_pmull = 0; + features->have_sha1 = 0; s = secure_getenv (ENV_OVERRIDE); if (s) @@ -85,6 +90,8 @@ get_arm64_features (struct arm64_features *features) if (MATCH (s, length, "pmull", 5)) features->have_pmull = 1; + else if (MATCH (s, length, "sha1", 4)) + features->have_sha1 = 1; if (!sep) break; s = sep + 1; @@ -95,6 +102,8 @@ get_arm64_features (struct arm64_features *features) unsigned long hwcap = getauxval(AT_HWCAP); features->have_pmull = ((hwcap & (HWCAP_ASIMD | HWCAP_PMULL)) == (HWCAP_ASIMD | HWCAP_PMULL)); + features->have_sha1 + = ((hwcap & (HWCAP_ASIMD | HWCAP_SHA1)) == (HWCAP_ASIMD | HWCAP_SHA1)); #endif } } @@ -109,6 +118,10 @@ DECLARE_FAT_FUNC_VAR(gcm_hash, gcm_hash_func, c) DECLARE_FAT_FUNC_VAR(gcm_hash, gcm_hash_func, arm64) #endif /* GCM_TABLE_BITS == 8 */ +DECLARE_FAT_FUNC(nettle_sha1_compress, sha1_compress_func) +DECLARE_FAT_FUNC_VAR(sha1_compress, sha1_compress_func, c) +DECLARE_FAT_FUNC_VAR(sha1_compress, sha1_compress_func, arm64) + static void CONSTRUCTOR fat_init (void) { @@ -119,8 +132,9 @@ fat_init (void) verbose = getenv (ENV_VERBOSE) != NULL; if (verbose) - fprintf (stderr, "libnettle: cpu features: %s\n", - features.have_pmull ? "polynomial multiply long instructions (PMULL/PMULL2)" : ""); + fprintf (stderr, "libnettle: cpu features:%s%s\n", + features.have_pmull ? " polynomial multiply long instructions (PMULL/PMULL2)" : "", + features.have_sha1 ? " sha1 instructions" : ""); if (features.have_pmull) { @@ -142,6 +156,16 @@ fat_init (void) _nettle_gcm_hash_vec = _nettle_gcm_hash_c; #endif /* GCM_TABLE_BITS == 8 */ } + if (features.have_sha1) + { + if (verbose) + fprintf (stderr, "libnettle: enabling hardware-accelerated sha1 compress code.\n"); + nettle_sha1_compress_vec = _nettle_sha1_compress_arm64; + } + else + { + nettle_sha1_compress_vec = _nettle_sha1_compress_c; + } } #if GCM_TABLE_BITS == 8 @@ -154,3 +178,7 @@ DEFINE_FAT_FUNC(_nettle_gcm_hash, void, size_t length, const uint8_t *data), (key, x, length, data)) #endif /* GCM_TABLE_BITS == 8 */ + +DEFINE_FAT_FUNC(nettle_sha1_compress, void, + (uint32_t *state, const uint8_t *input), + (state, input)) -- 2.25.1

2 1

Re: [S390x] Optimize AES modes
by Maamoun TK 30 Jun '21

30 Jun '21

Hi Niels, Did you get a chance to look at the recently posted patches? Thank you, Mamone

1 0

ANNOUNCE: Nettle-3.7.3
by nisse＠lysator.liu.se 08 Jun '21

08 Jun '21

I've prepared a new bug-fix release of Nettle, a low-level cryptographics library, to fix bugs in the RSA decryption functions. The bugs cause crashes on certain invalid inputs, which could be used for denial of service attacks on applications using these functions. More details in NEWS file below. Upgrading is strongly recommended. The Nettle home page can be found at https://www.lysator.liu.se/~nisse/nettle/, and the manual at https://www.lysator.liu.se/~nisse/nettle/nettle.html. The release can be downloaded from https://ftp.gnu.org/gnu/nettle/nettle-3.7.3.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-3.7.3.tar.gz https://www.lysator.liu.se/~nisse/archive/nettle-3.7.3.tar.gz Regards, /Niels NEWS for the Nettle 3.7.3 release This is bugfix release, fixing bugs that could make the RSA decryption functions crash on invalid inputs. Upgrading to the new version is strongly recommended. For applications that want to support older versions of Nettle, the bug can be worked around by adding a check that the RSA ciphertext is in the range 0 < ciphertext < n, before attempting to decrypt it. Thanks to Paul Schaub and Justus Winter for reporting these problems. The new version is intended to be fully source and binary compatible with Nettle-3.6. The shared library names are libnettle.so.8.4 and libhogweed.so.6.4, with sonames libnettle.so.8 and libhogweed.so.6. Bug fixes: * Fix crash for zero input to rsa_sec_decrypt and rsa_decrypt_tr. Potential denial of service vector. * Ensure that all of rsa_decrypt_tr and rsa_sec_decrypt return failure for out of range inputs, instead of either crashing, or silently reducing input modulo n. Potential denial of service vector. * Ensure that rsa_decrypt returns failure for out of range inputs, instead of silently reducing input modulo n. * Ensure that rsa_sec_decrypt returns failure if the message size is too large for the given key. Unlike the other bugs, this would typically be triggered by invalid local configuration, rather than by processing untrusted remote data. -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 1

[RFC PATCH 0/6] Introduce combined AES-GCM assembly for POWER9+
by Christopher M. Riedl 01 Jun '21

01 Jun '21

Hi! This series introduces a mechanism to support arch specific, combined AES+GCM {en,de}cryption functions. These functions are stubbed by default and will fall-back to the separate hash and crypt functions if no arch override exists. The arch override can be provided either at build time via appropriate config options or using the FAT runtime mechanism. An implementation combining AES+GCM _can potentially_ yield significant performance boosts by allowing for increased instruction parallelism, avoiding C-function call overhead, more flexibility in assembly fine-tuning, etc. This series provides such an implementation based on the existing optimized Nettle routines for POWER9 and later processors. Benchmark results on a POWER9 Blackbird running at 3.5GHz are given at the end of this mail. Both builds were configured statically ie. not FAT. FAT performance is slightly lower for both but shows similar gains with this series. The OpenSSL build is based on latest OpenSSL master with all PowerPC optimizations enabled. Note that the gains on an early POWER10 system are even more impressive but unfortunately I cannot share those results publically yet :( AES+GCM combined (this series) ------------------------------ Algorithm mode Mbyte/s gcm_aes128 encrypt 2567.62 gcm_aes128 decrypt 2582.32 gcm_aes128 update 7724.15 gcm_aes192 encrypt 2279.39 gcm_aes192 decrypt 2293.20 gcm_aes192 update 7724.41 gcm_aes256 encrypt 2054.09 gcm_aes256 decrypt 2061.25 gcm_aes256 update 7724.04 openssl gcm_aes128 encrypt 2336.93 openssl gcm_aes128 decrypt 2337.95 openssl gcm_aes128 update 6248.22 openssl gcm_aes192 encrypt 2113.93 openssl gcm_aes192 decrypt 2114.93 openssl gcm_aes192 update 6210.65 openssl gcm_aes256 encrypt 1936.95 openssl gcm_aes256 decrypt 1935.88 openssl gcm_aes256 update 6208.72 AES,GCM separate (nettle master) -------------------------------- Algorithm mode Mbyte/s gcm_aes128 encrypt 1418.66 gcm_aes128 decrypt 1418.97 gcm_aes128 update 7766.31 gcm_aes192 encrypt 1314.03 gcm_aes192 decrypt 1313.17 gcm_aes192 update 7760.23 gcm_aes256 encrypt 1218.75 gcm_aes256 decrypt 1218.64 gcm_aes256 update 7760.52 openssl gcm_aes128 encrypt 2324.70 openssl gcm_aes128 decrypt 2317.19 openssl gcm_aes128 update 6152.77 openssl gcm_aes192 encrypt 2102.99 openssl gcm_aes192 decrypt 2098.98 openssl gcm_aes192 update 6175.62 openssl gcm_aes256 encrypt 1925.85 openssl gcm_aes256 decrypt 1922.49 openssl gcm_aes256 update 6204.55 Christopher M. Riedl (6): gcm: Introduce gcm_aes_{de,en}crypt() ppc: Fix variable name for --enable-power-altivec ppc: Add FAT feature and config option for ISA 3.0 ppc: Add gcm_aes_encrypt() asm for ISA 3.0 (P9) ppc: Add gcm_aes_decrypt() asm for ISA 3.0 (P9) ppc: Enable gcm_aes_{de,en}crypt() FAT configure.ac | 19 +- fat-ppc.c | 45 ++ fat-setup.h | 6 + gcm-internal.h | 14 + gcm.c | 151 ++++++- powerpc64/fat/gcm-aes-decrypt.asm | 37 ++ powerpc64/fat/gcm-aes-encrypt.asm | 37 ++ powerpc64/p9/gcm-aes-decrypt.asm | 663 +++++++++++++++++++++++++++++ powerpc64/p9/gcm-aes-encrypt.asm | 666 ++++++++++++++++++++++++++++++ 9 files changed, 1630 insertions(+), 8 deletions(-) create mode 100644 powerpc64/fat/gcm-aes-decrypt.asm create mode 100644 powerpc64/fat/gcm-aes-encrypt.asm create mode 100644 powerpc64/p9/gcm-aes-decrypt.asm create mode 100644 powerpc64/p9/gcm-aes-encrypt.asm -- 2.26.1

3 12

[Aarch64] Optimize SHA1 Compress
by Maamoun TK 01 Jun '21

01 Jun '21

This patch optimizes SHA1 compress function for arm64 architecture by taking advantage of SHA-1 instructions of Armv8 crypto extension. The SHA-1 instructions: SHA1C: SHA1 hash update (choose) SHA1H: SHA1 fixed rotate SHA1M: SHA1 hash update (majority) SHA1P: SHA1 hash update (parity) SHA1SU0: SHA1 schedule update 0 SHA1SU1: SHA1 schedule update 1 The patch is based on sha1-arm.c - ARMv8 SHA extensions using C intrinsics of repository https://github.com/noloader/SHA-Intrinsics by Jeffrey Walton. The patch passes the testsuite of nettle library and the benchmark numbers are considerably improved but the performance of the overall sha1 hash function doesn't surpass the corresponding openssl numbers. Benchmark on gcc117 instance of CFarm before applying the patch: Algorithm mode Mbyte/s sha1 update 214.16 openssl sha1 update 849.44 hmac-sha1 64 bytes 61.69 hmac-sha1 256 bytes 131.50 hmac-sha1 1024 bytes 185.20 hmac-sha1 4096 bytes 204.55 hmac-sha1 single msg 210.97 Benchmark on gcc117 instance of CFarm after applying the patch: Algorithm mode Mbyte/s sha1 update 795.57 openssl sha1 update 849.25 hmac-sha1 64 bytes 167.65 hmac-sha1 256 bytes 408.24 hmac-sha1 1024 bytes 636.68 hmac-sha1 4096 bytes 739.42 hmac-sha1 single msg 775.89 --- arm64/crypto/sha1-compress.asm | 245 +++++++++++++++++++++++++++++++++++++++++ arm64/machine.m4 | 7 ++ 2 files changed, 252 insertions(+) create mode 100644 arm64/crypto/sha1-compress.asm diff --git a/arm64/crypto/sha1-compress.asm b/arm64/crypto/sha1-compress.asm new file mode 100644 index 00000000..bb3f1d35 --- /dev/null +++ b/arm64/crypto/sha1-compress.asm @@ -0,0 +1,245 @@ +C arm64/crypto/sha1-compress.asm + +ifelse(` + Copyright (C) 2021 Mamone Tarsha + + Based on sha1-arm.c - ARMv8 SHA extensions using C intrinsics of + repository https://github.com/noloader/SHA-Intrinsics + sha1-arm.c is written and placed in public domain by Jeffrey Walton, + based on code from ARM, and by Johannes Schneiders, Skip + Hovsmith and Barry O'Rourke for the mbedTLS project. + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +') + +.file "sha1-compress.asm" +.arch armv8-a+crypto + +.text + +C Register usage: + +define(`STATE', `x0') +define(`INPUT', `x1') + +define(`CONST0', `v0') +define(`CONST1', `v1') +define(`CONST2', `v2') +define(`CONST3', `v3') +define(`MSG0', `v4') +define(`MSG1', `v5') +define(`MSG2', `v6') +define(`MSG3', `v7') +define(`ABCD', `v16') +define(`ABCD_SAVED', `v17') +define(`E0', `v18') +define(`E0_SAVED', `v19') +define(`E1', `v20') +define(`TMP0', `v21') +define(`TMP1', `v22') + +C void nettle_sha1_compress(uint32_t *state, const uint8_t *input) + +PROLOGUE(nettle_sha1_compress) + C Initialize constants + mov w2,#0x7999 + movk w2,#0x5A82,lsl #16 + dup CONST0.4s,w2 + mov w2,#0xEBA1 + movk w2,#0x6ED9,lsl #16 + dup CONST1.4s,w2 + mov w2,#0xBCDC + movk w2,#0x8F1B,lsl #16 + dup CONST2.4s,w2 + mov w2,#0xC1D6 + movk w2,#0xCA62,lsl #16 + dup CONST3.4s,w2 + + C Load state + add x2,STATE,#16 + movi E0.4s,#0 + ld1 {ABCD.4s},[STATE] + ld1 {E0.s}[0],[x2] + + C Save state + mov ABCD_SAVED.16b,ABCD.16b + mov E0_SAVED.16b,E0.16b + + C Load message + ld1 {MSG0.16b,MSG1.16b,MSG2.16b,MSG3.16b},[INPUT] + + C Reverse for little endian + rev32 MSG0.16b,MSG0.16b + rev32 MSG1.16b,MSG1.16b + rev32 MSG2.16b,MSG2.16b + rev32 MSG3.16b,MSG3.16b + + add TMP0.4s,MSG0.4s,CONST0.4s + add TMP1.4s,MSG1.4s,CONST0.4s + + C Rounds 0-3 + sha1h SFP(E1),SFP(ABCD) + sha1c QFP(ABCD),SFP(E0),TMP0.4s + add TMP0.4s,MSG2.4s,CONST0.4s + sha1su0 MSG0.4s,MSG1.4s,MSG2.4s + + C Rounds 4-7 + sha1h SFP(E0),SFP(ABCD) + sha1c QFP(ABCD),SFP(E1),TMP1.4s + add TMP1.4s,MSG3.4s,CONST0.4s + sha1su1 MSG0.4s,MSG3.4s + sha1su0 MSG1.4s,MSG2.4s,MSG3.4s + + C Rounds 8-11 + sha1h SFP(E1),SFP(ABCD) + sha1c QFP(ABCD),SFP(E0),TMP0.4s + add TMP0.4s,MSG0.4s,CONST0.4s + sha1su1 MSG1.4s,MSG0.4s + sha1su0 MSG2.4s,MSG3.4s,MSG0.4s + + C Rounds 12-15 + sha1h SFP(E0),SFP(ABCD) + sha1c QFP(ABCD),SFP(E1),TMP1.4s + add TMP1.4s,MSG1.4s,CONST1.4s + sha1su1 MSG2.4s,MSG1.4s + sha1su0 MSG3.4s,MSG0.4s,MSG1.4s + + C Rounds 16-19 + sha1h SFP(E1),SFP(ABCD) + sha1c QFP(ABCD),SFP(E0),TMP0.4s + add TMP0.4s,MSG2.4s,CONST1.4s + sha1su1 MSG3.4s,MSG2.4s + sha1su0 MSG0.4s,MSG1.4s,MSG2.4s + + C Rounds 20-23 + sha1h SFP(E0),SFP(ABCD) + sha1p QFP(ABCD),SFP(E1),TMP1.4s + add TMP1.4s,MSG3.4s,CONST1.4s + sha1su1 MSG0.4s,MSG3.4s + sha1su0 MSG1.4s,MSG2.4s,MSG3.4s + + C Rounds 24-27 + sha1h SFP(E1),SFP(ABCD) + sha1p QFP(ABCD),SFP(E0),TMP0.4s + add TMP0.4s,MSG0.4s,CONST1.4s + sha1su1 MSG1.4s,MSG0.4s + sha1su0 MSG2.4s,MSG3.4s,MSG0.4s + + C Rounds 28-31 + sha1h SFP(E0),SFP(ABCD) + sha1p QFP(ABCD),SFP(E1),TMP1.4s + add TMP1.4s,MSG1.4s,CONST1.4s + sha1su1 MSG2.4s,MSG1.4s + sha1su0 MSG3.4s,MSG0.4s,MSG1.4s + + C Rounds 32-35 + sha1h SFP(E1),SFP(ABCD) + sha1p QFP(ABCD),SFP(E0),TMP0.4s + add TMP0.4s,MSG2.4s,CONST2.4s + sha1su1 MSG3.4s,MSG2.4s + sha1su0 MSG0.4s,MSG1.4s,MSG2.4s + + C Rounds 36-39 + sha1h SFP(E0),SFP(ABCD) + sha1p QFP(ABCD),SFP(E1),TMP1.4s + add TMP1.4s,MSG3.4s,CONST2.4s + sha1su1 MSG0.4s,MSG3.4s + sha1su0 MSG1.4s,MSG2.4s,MSG3.4s + + C Rounds 40-43 + sha1h SFP(E1),SFP(ABCD) + sha1m QFP(ABCD),SFP(E0),TMP0.4s + add TMP0.4s,MSG0.4s,CONST2.4s + sha1su1 MSG1.4s,MSG0.4s + sha1su0 MSG2.4s,MSG3.4s,MSG0.4s + + C Rounds 44-47 + sha1h SFP(E0),SFP(ABCD) + sha1m QFP(ABCD),SFP(E1),TMP1.4s + add TMP1.4s,MSG1.4s,CONST2.4s + sha1su1 MSG2.4s,MSG1.4s + sha1su0 MSG3.4s,MSG0.4s,MSG1.4s + + C Rounds 48-51 + sha1h SFP(E1),SFP(ABCD) + sha1m QFP(ABCD),SFP(E0),TMP0.4s + add TMP0.4s,MSG2.4s,CONST2.4s + sha1su1 MSG3.4s,MSG2.4s + sha1su0 MSG0.4s,MSG1.4s,MSG2.4s + + C Rounds 52-55 + sha1h SFP(E0),SFP(ABCD) + sha1m QFP(ABCD),SFP(E1),TMP1.4s + add TMP1.4s,MSG3.4s,CONST3.4s + sha1su1 MSG0.4s,MSG3.4s + sha1su0 MSG1.4s,MSG2.4s,MSG3.4s + + C Rounds 56-59 + sha1h SFP(E1),SFP(ABCD) + sha1m QFP(ABCD),SFP(E0),TMP0.4s + add TMP0.4s,MSG0.4s,CONST3.4s + sha1su1 MSG1.4s,MSG0.4s + sha1su0 MSG2.4s,MSG3.4s,MSG0.4s + + C Rounds 60-63 + sha1h SFP(E0),SFP(ABCD) + sha1p QFP(ABCD),SFP(E1),TMP1.4s + add TMP1.4s,MSG1.4s,CONST3.4s + sha1su1 MSG2.4s,MSG1.4s + sha1su0 MSG3.4s,MSG0.4s,MSG1.4s + + C Rounds 64-67 + sha1h SFP(E1),SFP(ABCD) + sha1p QFP(ABCD),SFP(E0),TMP0.4s + add TMP0.4s,MSG2.4s,CONST3.4s + sha1su1 MSG3.4s,MSG2.4s + sha1su0 MSG0.4s,MSG1.4s,MSG2.4s + + C Rounds 68-71 + sha1h SFP(E0),SFP(ABCD) + sha1p QFP(ABCD),SFP(E1),TMP1.4s + add TMP1.4s,MSG3.4s,CONST3.4s + sha1su1 MSG0.4s,MSG3.4s + + C Rounds 72-75 + sha1h SFP(E1),SFP(ABCD) + sha1p QFP(ABCD),SFP(E0),TMP0.4s + + C Rounds 76-79 + sha1h SFP(E0),SFP(ABCD) + sha1p QFP(ABCD),SFP(E1),TMP1.4s + + C Combine state + add E0.4s,E0.4s,E0_SAVED.4s + add ABCD.4s,ABCD.4s,ABCD_SAVED.4s + + C Store state + st1 {ABCD.4s},[STATE] + st1 {E0.s}[0],[x2] + + ret +EPILOGUE(nettle_sha1_compress) diff --git a/arm64/machine.m4 b/arm64/machine.m4 index e69de29b..7df62bcc 100644 --- a/arm64/machine.m4 +++ b/arm64/machine.m4 @@ -0,0 +1,7 @@ +C Get 32-bit floating-point register from vector register +C SFP(VR) +define(`SFP',``s'substr($1,1,len($1))') + +C Get 128-bit floating-point register from vector register +C QFP(VR) +define(`QFP',``q'substr($1,1,len($1))') -- 2.25.1

3 9

Add AES Key Wrap (RFC 3394) in Nettle
by Nicolas Mora 23 May '21

23 May '21

Hello, I've added a merge request to implement AES key wrap and unwrap in Nettle [1]. The MR is not complete, because the tests haven't been pushed yet and the documentation is missing, but if the new functionality is welcome to Nettle, I'd rather have some feedback on the code first, to make sure it respects the project guidelines. I can add tests based on the tests vectors in the RFC [2], but I'm not sure how the test suites are build, should I need to create test_wrap functions like in aes-test.c or something else? Thanks in advance for your help! /Nicolas [1] https://tools.ietf.org/html/rfc3394 [2] https://tools.ietf.org/html/rfc3394#section-4

5 25

Re: [S390x] Optimize AES modes
by Maamoun TK 22 May '21

22 May '21

Hi, Niels Did you get the credentials of the new VM? I'm thinking after adding the address and ssh key of new VM, we can't get the optimized cores of AES tested since enable-msa isn't triggered. We need to push some sort of hard-coded option in configure.ac to get it tested in the VM during ci job. regards, Mamone On Mon, May 10, 2021 at 6:13 PM Niels Möller <nisse(a)lysator.liu.se> wrote: > David Edelsohn <dje.gcc(a)gmail.com> writes: > > > They are going to create a new VM on a separate Open Source Software > > Cloud for long-term projects. They will contact you directly with the > > credentials. > > Sounds good. Thanks for the update. > > Regards, > /Niels > > -- > Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. > Internet email is subject to wholesale government surveillance. >

2 3

Re: [S390x] Optimize AES modes
by Maamoun TK 10 May '21

10 May '21

I made a new merge request to s390x branch Add AES API for CBC mode (!24) · Merge requests · Nettle / nettle · GitLab (liu.se) <https://git.lysator.liu.se/nettle/nettle/-/merge_requests/24> This api is required to handle the optimized CBC cores which will be added later. regards, Mamone

1 0

Compile issue on Solaris 11.3
by Jeffrey Walton 28 Mar '21

28 Mar '21

Hi Everyone, I bumped to Nettle 3.7. The build is resulting in: gcc -I. -I/export/home/jwalton/tmp/ok2delete/include -DNDEBUG -DHAVE_CONFIG_H -g2 -O2 -m64 -march=native -fPIC -pthread -ggdb3 -Wall -W -Wno-sign-compare -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fPIC -MT sha256-compress-2.o -MD -MP -MF sha256-compress-2.o.d -c sha256-compress-2.s gcc -I. -I/export/home/jwalton/tmp/ok2delete/include -DNDEBUG -DHAVE_CONFIG_H -g2 -O2 -m64 -march=native -fPIC -pthread -ggdb3 -Wall -W -Wno-sign-compare -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fPIC -MT sexp.o -MD -MP -MF sexp.o.d -c sexp.c \ && true sha256-compress-2.ssha1-compress-2.s: Assembler messages: sha1-compress-2.s:73: Error: : no such instruction: `sha1rnds4 $0,%xmm5,%xmm4'Assembler messages: sha256-compress-2.s:87 : Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.s:78sha256-compress-2.s: Error: no such instruction: `sha1nexte %xmm1,%xmm6':89 : Error: no such instruction: `sha256rnds2 %xmm6,%xmm5'sha1-compress-2.s:80 : Error: no such instruction: `sha1rnds4 $0,%xmm6,%xmm4' sha256-compress-2.ssha1-compress-2.s:96:81: Error: : Error: no such instruction: `sha1msg1 %xmm1,%xmm0'no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.s:86sha256-compress-2.s: Error: :98no such instruction: `sha1nexte %xmm2,%xmm5' : Error: sha1-compress-2.s:88: no such instruction: `sha256rnds2 %xmm6,%xmm5'Error: sha256-compress-2.sno such instruction: `sha1rnds4 $0,%xmm5,%xmm4':99 : Error: sha1-compress-2.sno such instruction: `sha256msg1 %xmm2,%xmm1' :89: Error: no such instruction: `sha1msg1 %xmm2,%xmm1' sha256-compress-2.s:106: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.s:96sha256-compress-2.s: Error: no such instruction: `sha1nexte %xmm3,%xmm6' :108sha1-compress-2.s:98: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5': Error: no such instruction: `sha1msg2 %xmm3,%xmm0' sha256-compress-2.ssha1-compress-2.s:109:99: : Error: Error: no such instruction: `sha1rnds4 $0,%xmm6,%xmm4'no such instruction: `sha256msg1 %xmm3,%xmm2' sha256-compress-2.s:117: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:119: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.s:123: Error: no such instruction: `sha256msg2 %xmm4,%xmm1' sha256-compress-2.s:124: sha1-compress-2.sError: no such instruction: `sha256msg1 %xmm4,%xmm3' :100: Error: sha256-compress-2.sno such instruction: `sha1msg1 %xmm3,%xmm2' :129: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.s:104: Error: no such instruction: `sha1nexte %xmm0,%xmm5'sha256-compress-2.s:131: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha1-compress-2.s:106sha256-compress-2.s: :135: Error: Error: no such instruction: `sha1msg2 %xmm0,%xmm1'no such instruction: `sha256msg2 %xmm1,%xmm2' sha256-compress-2.ssha1-compress-2.s:107:136: : Error: no such instruction: `sha256msg1 %xmm1,%xmm4' Error: no such instruction: `sha1rnds4 $0,%xmm5,%xmm4'sha256-compress-2.s :141: sha1-compress-2.sError: no such instruction: `sha256rnds2 %xmm5,%xmm6' :108: sha256-compress-2.sError: no such instruction: `sha1msg1 %xmm0,%xmm3':143: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha1-compress-2.s:113: Error: sha256-compress-2.s:147: Error: no such instruction: `sha1nexte %xmm1,%xmm6'no such instruction: `sha256msg2 %xmm2,%xmm3' sha256-compress-2.ssha1-compress-2.s:148:115: Error: : no such instruction: `sha256msg1 %xmm2,%xmm1' Error: sha256-compress-2.sno such instruction: `sha1msg2 %xmm1,%xmm2':153: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.ssha1-compress-2.s:155: Error: :116: no such instruction: `sha256rnds2 %xmm6,%xmm5' Error: no such instruction: `sha1rnds4 $1,%xmm6,%xmm4' sha1-compress-2.s:117: Error: sha256-compress-2.sno such instruction: `sha1msg1 %xmm1,%xmm0':159: Error: no such instruction: `sha256msg2 %xmm3,%xmm4' sha256-compress-2.s:160sha1-compress-2.s: Error: no such instruction: `sha256msg1 %xmm3,%xmm2' :121: Error: no such instruction: `sha1nexte %xmm2,%xmm5'sha256-compress-2.s :165: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.ssha256-compress-2.s:123: Error: no such instruction: `sha1msg2 %xmm2,%xmm3' sha1-compress-2.s:167: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5':124 : Error: no such instruction: `sha1rnds4 $1,%xmm5,%xmm4' sha256-compress-2.ssha1-compress-2.s:125:171: : Error: no such instruction: `sha256msg2 %xmm4,%xmm1'Error: no such instruction: `sha1msg1 %xmm2,%xmm1' sha256-compress-2.s:172: Error: sha1-compress-2.s:129no such instruction: `sha256msg1 %xmm4,%xmm3' : Error: no such instruction: `sha1nexte %xmm3,%xmm6'sha256-compress-2.s :177: sha1-compress-2.sError: no such instruction: `sha256rnds2 %xmm5,%xmm6' :131: Error: sha256-compress-2.sno such instruction: `sha1msg2 %xmm3,%xmm0':179 : Error: no such instruction: `sha256rnds2 %xmm6,%xmm5'sha1-compress-2.s :132: Error: no such instruction: `sha1rnds4 $1,%xmm6,%xmm4' sha256-compress-2.s:183: Error: sha1-compress-2.s:133no such instruction: `sha256msg2 %xmm1,%xmm2' : sha256-compress-2.sError: :184no such instruction: `sha1msg1 %xmm3,%xmm2' : Error: no such instruction: `sha256msg1 %xmm1,%xmm4' sha1-compress-2.s:137: Error: no such instruction: `sha1nexte %xmm0,%xmm5' sha1-compress-2.s:139: sha256-compress-2.sError: no such instruction: `sha1msg2 %xmm0,%xmm1':189: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha1-compress-2.s:140sha256-compress-2.s:191: : Error: no such instruction: `sha256rnds2 %xmm6,%xmm5'Error: no such instruction: `sha1rnds4 $1,%xmm5,%xmm4' sha1-compress-2.ssha256-compress-2.s:141: :195: Error: Error: no such instruction: `sha1msg1 %xmm0,%xmm3'no such instruction: `sha256msg2 %xmm2,%xmm3' sha256-compress-2.s:196sha1-compress-2.s:145: : Error: no such instruction: `sha256msg1 %xmm2,%xmm1' Error: no such instruction: `sha1nexte %xmm1,%xmm6' sha256-compress-2.s:201: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6'sha1-compress-2.s:147 : Error: sha256-compress-2.s:203: Error: no such instruction: `sha1msg2 %xmm1,%xmm2'no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.ssha1-compress-2.s:148:207: : Error: Error: no such instruction: `sha256msg2 %xmm3,%xmm4' sha256-compress-2.s:208: Error: no such instruction: `sha256msg1 %xmm3,%xmm2' sha256-compress-2.s:213: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:215: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.s:219: Error: no such instruction: `sha256msg2 %xmm4,%xmm1' sha256-compress-2.s:220: Error: no such instruction: `sha256msg1 %xmm4,%xmm3' sha256-compress-2.s:225: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:227: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.s:231: Error: no such instruction: `sha256msg2 %xmm1,%xmm2' sha256-compress-2.s:232: Error: no such instruction: `sha256msg1 %xmm1,%xmm4' sha256-compress-2.s:237: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:239: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.s:243: Error: no such instruction: `sha256msg2 %xmm2,%xmm3' sha256-compress-2.s:247: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:249: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.s:253: Error: no such instruction: `sha256msg2 %xmm3,%xmm4' sha256-compress-2.s:257: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:259: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' no such instruction: `sha1rnds4 $1,%xmm6,%xmm4' sha1-compress-2.s:149: Error: no such instruction: `sha1msg1 %xmm1,%xmm0' sha1-compress-2.s:154: Error: no such instruction: `sha1nexte %xmm2,%xmm5' sha1-compress-2.s:156: Error: no such instruction: `sha1msg2 %xmm2,%xmm3' sha1-compress-2.s:157: Error: no such instruction: `sha1rnds4 $2,%xmm5,%xmm4' sha1-compress-2.s:158: Error: no such instruction: `sha1msg1 %xmm2,%xmm1' sha1-compress-2.s:162: Error: no such instruction: `sha1nexte %xmm3,%xmm6' sha1-compress-2.s:164: Error: no such instruction: `sha1msg2 %xmm3,%xmm0' sha1-compress-2.s:165: Error: no such instruction: `sha1rnds4 $2,%xmm6,%xmm4' sha1-compress-2.s:166: Error: no such instruction: `sha1msg1 %xmm3,%xmm2' sha1-compress-2.s:170: Error: no such instruction: `sha1nexte %xmm0,%xmm5' sha1-compress-2.s:172: Error: no such instruction: `sha1msg2 %xmm0,%xmm1' sha1-compress-2.s:173: Error: no such instruction: `sha1rnds4 $2,%xmm5,%xmm4' sha1-compress-2.s:174: Error: no such instruction: `sha1msg1 %xmm0,%xmm3' sha1-compress-2.s:178: Error: no such instruction: `sha1nexte %xmm1,%xmm6' sha1-compress-2.s:180: Error: no such instruction: `sha1msg2 %xmm1,%xmm2' sha1-compress-2.s:181: Error: no such instruction: `sha1rnds4 $2,%xmm6,%xmm4' sha1-compress-2.s:182: Error: no such instruction: `sha1msg1 %xmm1,%xmm0' sha1-compress-2.s:186: Error: no such instruction: `sha1nexte %xmm2,%xmm5' sha1-compress-2.s:188: Error: no such instruction: `sha1msg2 %xmm2,%xmm3' sha1-compress-2.s:189: Error: no such instruction: `sha1rnds4 $2,%xmm5,%xmm4' sha1-compress-2.s:190: Error: no such instruction: `sha1msg1 %xmm2,%xmm1' sha1-compress-2.s:195: Error: no such instruction: `sha1nexte %xmm3,%xmm6' sha1-compress-2.s:197: Error: no such instruction: `sha1msg2 %xmm3,%xmm0' sha1-compress-2.s:198: Error: no such instruction: `sha1rnds4 $3,%xmm6,%xmm4' sha1-compress-2.s:199: Error: no such instruction: `sha1msg1 %xmm3,%xmm2' sha1-compress-2.s:203: Error: no such instruction: `sha1nexte %xmm0,%xmm5' sha1-compress-2.s:205: Error: no such instruction: `sha1msg2 %xmm0,%xmm1' sha1-compress-2.s:206: Error: no such instruction: `sha1rnds4 $3,%xmm5,%xmm4' sha1-compress-2.s:207: Error: no such instruction: `sha1msg1 %xmm0,%xmm3' sha1-compress-2.s:211: Error: no such instruction: `sha1nexte %xmm1,%xmm6' sha1-compress-2.s:213: Error: no such instruction: `sha1msg2 %xmm1,%xmm2' sha1-compress-2.s:214: Error: no such instruction: `sha1rnds4 $3,%xmm6,%xmm4' sha1-compress-2.s:217: Error: no such instruction: `sha1nexte %xmm2,%xmm5' sha1-compress-2.s:219: Error: no such instruction: `sha1msg2 %xmm2,%xmm3' sha1-compress-2.s:220: Error: no such instruction: `sha1rnds4 $3,%xmm5,%xmm4' sha1-compress-2.s:222: Error: no such instruction: `sha1nexte %xmm3,%xmm6' sha1-compress-2.s:224: Error: no such instruction: `sha1rnds4 $3,%xmm6,%xmm4' sha1-compress-2.s:226: Error: no such instruction: `sha1nexte %xmm8,%xmm5' gmake[1]: *** [sha1-compress-2.o] Error 1 gmake[1]: *** Waiting for unfinished jobs.... Jeff

2 6

(no subject)
by Jeffrey Walton 25 Mar '21

25 Mar '21

Hi Everyone, Here's the result of building Nettle 3.7.2 on Solaris 11.3, i86pc: /bin/gcc -I. -I/opt/ssh/include -DNDEBUG -DHAVE_CONFIG_H -g2 -O2 -m64 -march=native -fPIC -pthread -ggdb3 -Wall -W -Wno-sign-compare -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fPIC -MT sexp-format.o -MD -MP -MF sexp-format.o.d -c sexp-format.c \ && true sha256-compress-2.s: Assembler messages: sha256-compress-2.s:87: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:89: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' sha256-compress-2.s:96: Error: no such instruction: `sha256rnds2 %xmm5,%xmm6' sha256-compress-2.s:98: Error: no such instruction: `sha256rnds2 %xmm6,%xmm5' --enable-aes, --enable-sha, --enable-fat were _not_ provided to configure. Attached is config.log. Jeff

1 0

xts.c:59: warning: integer constant is too large for ‘long’ type
by Jeffrey Walton 25 Mar '21

25 Mar '21

This is building Nettle 3.7.2 on a PowerMac with OS X 10.5: /usr/bin/cc -I. -I/usr/local/include -DNDEBUG -DHAVE_CONFIG_H -g2 -O2 -mlong-double-64 -fno-common -maltivec -fPIC -pthread -ggdb3 -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fPIC -MT xts-aes128.o -MD -MP -MF xts-aes128.o.d -c xts-aes128.c \ && true xts.c: In function ‘xts_shift’: xts.c:59: warning: integer constant is too large for ‘long’ type xts.c:59: warning: integer constant is too large for ‘long’ type xts.c:60: warning: integer constant is too large for ‘long’ type xts.c:60: warning: integer constant is too large for ‘long’ type xts.c:60: warning: integer constant is too large for ‘long’ type On OS X 10.5, you have to use unsigned long long and the ull suffix. Maybe you should add a configure test to see whether you need the ull suffix. Jeff

2 2

libhgwwed has gone missing...
by Jeffrey Walton 25 Mar '21

25 Mar '21

It looks like Nettle is no longer building or installing hogweed on some Apple platforms. This is from a PowerMac G5 running OS X 10.5: $ ls /usr/local/lib | grep -E 'gmp|nettle|hogweed' libgmp.10.dylib libgmp.a libgmp.dylib libgmp.la libnettle.8.2.dylib libnettle.8.3.dylib libnettle.8.dylib libnettle.a libnettle.dylib libpari-gmp.dylib It is causing a failure in GnuTLS: checking for NETTLE... yes checking for HOGWEED... no configure: error: *** *** Libhogweed (nettle's companion library) 3.4.1 was not found. Note that you must compile nettle with gmp support. Jeff

2 4

Re: bug#47222: Serious bug in Nettle's ecdsa_verify
by nisse＠lysator.liu.se 25 Mar '21

25 Mar '21

Ludovic Courtès <ludo(a)gnu.org> writes: > Are there plans to make a new 3.5 release including these fixes? No, I don't plan any 3.5.x release. > Alternatively, could you provide guidance as to which commits should be > cherry-picked in 3.5 for downstream distros? Look at the branch release-3.7-fixes (https://git.lysator.liu.se/nettle/nettle/-/commits/release-3.7-fixes/). The commits since 3.7.1 are the ones you need. Changes to gostdsa and ed448 will not apply, since those curves didn't exist in nettle-3.5. Changes to ed25519 might not apply cleanly, due to refactoring when adding ed448. > I’m asking because in Guix, the easiest way for us to deploy the fixes > on the ‘master’ branch would be by “grafting” a new Nettle variant > ABI-compatible with 3.5.1, which is the one packages currently depend on. I still recommend upgrading to the latest version. There were an abi break in 3.6 (so you'd need to recompile lots of guix packages), but no incompatible changes to the (source level) api. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

[AArch64] Fat build support for GCM optimization and syntax improvements
by Maamoun TK 22 Mar '21

22 Mar '21

I made a merge request #21 <https://git.lysator.liu.se/nettle/nettle/-/merge_requests/21> that adds fat build support for GCM implementation on arm64, the patch also updates the README file to stay on par with the other architectures and use m4 macros in gcm-hash.asm (patch provided by Niels Möller), in addition to add documentation comments. regards, Mamone

2 1

Nettle 3.7.2 and OS X 10.12.6
by Jeffrey Walton 22 Mar '21

22 Mar '21

And it looks like examples are not quite working either: $ make check ... ==================== All 110 tests passed ==================== Making check in examples TEST_SHLIB_DIR="/Users/jwalton/Build-Scripts/nettle-3.7.2/.lib" \ srcdir="." EMULATOR="" EXEEXT="" \ ".."/run-tests rsa-sign-test rsa-verify-test rsa-encrypt-test Opening `testkey' failed: No such file or directory Invalid key FAIL: rsa-sign Opening `testkey' failed: No such file or directory Invalid key FAIL: rsa-verify Opening `testkey.pub' failed: No such file or directory Invalid key FAIL: rsa-encrypt =================== 3 of 3 tests failed =================== make[1]: *** [check] Error 1 make: *** [check] Error 2 $ find . -name testkey.pub $ find . -name testkey $ Examples have been breaking the build for years. Why are examples even built during 'make check'? Can they be moved to their own recipe so users can get on with their work? Jeff

2 1

Nettle 3.7.2 and OS X 10.5
by Jeffrey Walton 22 Mar '21

22 Mar '21

Hi Everyone, I'm testing Nettle 3.7.2 on a PowerMac with OS X 10.5 . I added -maltivec to CFLAGS and CXXFLAGS. I enabled Altivec builds with --enable-power-altivec and --enable-fat. Auditing the dylib it appears Altivec was not engaged: $ otool -tV /usr/local/lib/libnettle.dylib | grep perm 0001f124 b _nettle_sha3_permute _nettle_sha3_permute: 000204ec bl _nettle_sha3_permute I think there's something a bit sideways here. Jeff

2 1

Nettle 3.7.2 and OS X 10.12.6
by Jeffrey Walton 21 Mar '21

21 Mar '21

$ make check ... ../run-tests aes-test arcfour-test arctwo-test blowfish-test bcrypt-test cast128-test base16-test base64-test camellia-test chacha-test cnd-memcpy-test des-test des3-test md2-test md4-test md5-test md5-compat-test memeql-test memxor-test gosthash94-test ripemd160-test hkdf-test salsa20-test sha1-test sha224-test sha256-test sha384-test sha512-test sha512-224-test sha512-256-test sha3-permute-test sha3-224-test sha3-256-test sha3-384-test sha3-512-test shake256-test streebog-test serpent-test twofish-test version-test knuth-lfib-test cbc-test cfb-test ctr-test gcm-test eax-test ccm-test cmac-test siv-test poly1305-test chacha-poly1305-test hmac-test umac-test meta-hash-test meta-cipher-test meta-aead-test meta-armor-test meta-mac-test buffer-test yarrow-test xts-test pbkdf2-test x86-ibt-test sexp-test sexp-format-test rsa2sexp-test sexp2rsa-test bignum-test random-prime-test pkcs1-test pkcs1-sec-decrypt-test pss-test rsa-sign-tr-test pss-mgf1-test rsa-pss-sign-tr-test rsa-test rsa-encrypt-test rsa-keygen-test rsa-sec-decrypt-test rsa-compute-root-test dsa-test dsa-keygen-test curve25519-dh-test curve448-dh-test ecc-mod-test ecc-modinv-test ecc-redc-test ecc-sqrt-test ecc-dup-test ecc-add-test ecc-mul-g-test ecc-mul-a-test ecdsa-sign-test ecdsa-verify-test ecdsa-keygen-test ecdh-test eddsa-compress-test eddsa-sign-test eddsa-verify-test ed25519-test ed448-test gostdsa-sign-test gostdsa-verify-test gostdsa-keygen-test gostdsa-vko-test cxx-test sexp-conv-test pkcs1-conv-test nettle-pbkdf2-test symbols-test dlopen-test /bin/sh: ../run-tests: Permission denied make[1]: *** [check] Error 126 make: *** [check] Error 2 $ cd testsuite/ $ ../run-tests aes-test -bash: ../run-tests: Permission denied $ ls -Al ../run-tests -rw-r--r-- 1 jwalton staff 2777 Mar 21 04:32 ../run-tests

1 1

[S390x] Optimize SHA functions
by Maamoun TK 21 Mar '21

21 Mar '21

I made a patch that optimizes SHA functions on S390x architecture. the patch implements the optimized cores using cipher instructions that have been added to s390x arch in message security assist extensions. The patch uses the following functions: KIMD-SHA-1, KLMD-SHA-1 (SHA1) KIMD-SHA-256, KLMD-SHA-256 (SHA256) KIMD-SHA-512, KLMD-SHA-512 (SHA512) KIMD-SHA3-224, KLMD-SHA3-224 (SHA3-224) KIMD-SHA3-256, KLMD-SHA3-224 (SHA3-256) KIMD-SHA3-384, KLMD-SHA3-224 (SHA3-384) KIMD-SHA3-512, KLMD-SHA3-224 (SHA3-512) KLMD-SHAKE-256 (SHA3-256-SHAKE) The patch built on top of AES patch of s390x so I can't make a merge request until the previous patch got merged. However, the code can be found in my fork s390x-sha <https://git.lysator.liu.se/mamonet/nettle/-/tree/s390x-sha>. The optimized core can be enabled by either fat build or enabling the corresponding configuration options (MSA, MSA-X1, MSA-X2, MSA-X6). Benchmark of this patch using nettle-benchmark (Tested on z15 5.2GHZ): *---------------------------------------------------------------------------* | Algorithm | C | Hardware-accelerated | | sha1 | 360.69 | 1735.34 | | sha224 | 244.63 | 2179.60 | | sha256 | 244.63 | 2179.74 | | sha384 | 372.57 | 3464.84 | | sha512 | 370.82 | 3463.66 | | sha512-224 | 364.93 | 3382.58 | | sha512-256 | 373.19 | 3463.23 | | sha3-224 | 236.50 | 6859.54 | | sha3-256 | 224.76 | 6656.05 | | sha3-384 | 173.21 | 5818.89 | | sha3-512 | 119.79 | 4693.53 | *---------------------------------------------------------------------------* I have a couple of questions for this patch: Is packing the configuration MSA options in single option is more convenient than spamming the options with MSA extensions? The optimized functions of sha3_update store the state buffer in big-endian order, while C implementation store each 64-bit of state buffer in little-endian order, I see the state buffer is used internally and since both sha3_update and sha3_digest are optimized so both have the same convention I think it's okay to keep it up like that, any opinions here? regards, Mamone

1 0

ANNOUNCE: Nettle-3.7.2
by nisse＠lysator.liu.se 21 Mar '21

21 Mar '21

I've prepared a new bug-fix release of Nettle, a low-level cryptographics library, to fix a serious bug in the function to verify ECDSA signatures. Implications include an assertion failure, which could be used for denial-of-service, when verifying signatures on the secp_224r1 and secp521_r1 curves. More details in NEWS file below. Upgrading is strongly recomended. The Nettle home page can be found at https://www.lysator.liu.se/~nisse/nettle/, and the manual at https://www.lysator.liu.se/~nisse/nettle/nettle.html. The release can be downloaded from https://ftp.gnu.org/gnu/nettle/nettle-3.7.2.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-3.7.2.tar.gz https://www.lysator.liu.se/~nisse/archive/nettle-3.7.2.tar.gz Regards, /Niels NEWS for the Nettle 3.7.2 release This is a bugfix release, fixing a bug in ECDSA signature verification that could lead to a denial of service attack (via an assertion failure) or possibly incorrect results. It also fixes a few related problems where scalars are required to be canonically reduced modulo the ECC group order, but in fact may be slightly larger. Upgrading to the new version is strongly recommended. Even when no assert is triggered in ecdsa_verify, ECC point multiplication may get invalid intermediate values as input, and produce incorrect results. It's trivial to construct alleged signatures that result in invalid intermediate values. It appears difficult to construct an alleged signature that makes the function misbehave in such a way that an invalid signature is accepted as valid, but such attacks can't be ruled out without further analysis. Thanks to Guido Vranken for setting up the fuzzer tests that uncovered this problem. The new version is intended to be fully source and binary compatible with Nettle-3.6. The shared library names are libnettle.so.8.3 and libhogweed.so.6.3, with sonames libnettle.so.8 and libhogweed.so.6. Bug fixes: * Fixed bug in ecdsa_verify, and added a corresponding test case. * Similar fixes to ecc_gostdsa_verify and gostdsa_vko. * Similar fixes to eddsa signatures. The problem is less severe for these curves, because (i) the potentially out or range value is derived from output of a hash function, making it harder for the attacker to to hit the narrow range of problematic values, and (ii) the ecc operations are inherently more robust, and my current understanding is that unless the corresponding assert is hit, the verify operation should complete with a correct result. * Fix to ecdsa_sign, which with a very low probability could return out of range signature values, which would be rejected immediately by a verifier. -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

ANNOUNCE: Serious bug in Nettle's ecdsa_verify
by nisse＠lysator.liu.se 16 Mar '21

16 Mar '21

I've been made aware of a bug in Nettle's code to verify ECDSA signatures. Certain signatures result in the ecc point multiply function being called with out-of-range scalars, which may give incorrect results, or crash in an assertion failure. It's an old bug, probably since Nettle's initial implementation of ECDSA. I've just pushed fixes for ecdsa_verify, as well as a few other cases of potentially out-of-range scalars, to the master-updates branch. I haven't fully analysed the implications, but I'll describe my current understanding. I think an assertion failure, useful for a denial-of-service attack, is easy on the curves where the bitsize of q, the group order, is not an integral number of words. That's secp224r1, on 64-bit platforms, and secp521r1. Even when it's not possible to trigger an assertion failure, it's easy to produce valid-looking input "signatures" that hit out-of range intermediate scalar values where point multiplication may misbehave. This applies to all the NIST secp* curves as well as the GOST curves. To me, it looks very difficult to make it misbehave in such a way that ecdsa_verify will think an invalid signature is valid, but it might be possible; further analysis is needed. I will not be able to analyze it properly now, if anyone else would like to look into it, I can provide a bit more background. ed25519 and ed448 may be affected too, but it appears a bit harder to find inputs that hit out of range values. And since point operations are inherently more robust on these curves, I think they will produce correct results as long as they don't hit the assert. Advise on how to deal best with this? My current plan is to prepare a 3.7.2 bugfix release (from a new bugfix-only branch, without the new arm64 code). Maybe as soon as tomorrow (Wednesday, european time), or in the weekend. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

Status update
by nisse＠lysator.liu.se 07 Mar '21

07 Mar '21

I've haven't had much hacking time since the 3.7.1 bug fix rel1ease. I'm aware of the following recent issues that need review/work: 1. New Arm64 code (don't recall current status off the top of my head). 2. s390x testing. I'd prefer to not run a git checkout on the s390x test machine, but have the ci job make a tarball, ssh it over to the test machine, unpack in a fresh directory for build and test. This needs to be in place before adding s390x specific code. When done, could likely be reused for remote testing on any other platforms of interest, which aren't directly available in the ci system. 3. AES-keywrap merge request, https://git.lysator.liu.se/nettle/nettle/-/merge_requests/19 4. RSA-OAEP merge request. I intend to attend to (3) first, and will not pay much attention to this one at the moment. If anyone else would like to help out with review, maybe have alook at this one? https://git.lysator.liu.se/nettle/nettle/-/merge_requests/20 Anything else? There are other projects that's been on hold for a while, e.g., support for compact representation (aka "point compression") on the NIST curves, that I don't give high priority at the moment. I often get some hacking time on Wednesdays and weekends, but not every week. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

3 6

ANNOUNCE: Nettle-3.7.1
by nisse＠lysator.liu.se 17 Feb '21

17 Feb '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 I'd like to announce a new release of GNU Nettle, a low-level cryptographics library. This release fixes a few problem in Nettle-3.7, in particular, a bug affecting GnuTLS on powerpc64 platforms. See NEWS entries below. The Nettle home page can be found at https://www.lysator.liu.se/~nisse/nettle/, and the manual at https://www.lysator.liu.se/~nisse/nettle/nettle.html. The release can be downloaded from https://ftp.gnu.org/gnu/nettle/nettle-3.7.1.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-3.7.1.tar.gz https://www.lysator.liu.se/~nisse/archive/nettle-3.7.1.tar.gz Happy hacking, /Niels Möller NEWS for the Nettle 3.7.1 release This is primarily a bug fix release, fixing a couple of problems found in Nettle-3.7. The new version is intended to be fully source and binary compatible with Nettle-3.6. The shared library names are libnettle.so.8.2 and libhogweed.so.6.2, with sonames libnettle.so.8 and libhogweed.so.6. Bug fixes: * Fix bug in chacha counter update logic. The problem affected ppc64 and ppc64el, with the new altivec assembly code enabled. Reported by Andreas Metzler, after breakage in GnuTLS tests on ppc64. * Support for big-endian ARM platforms has been restored. Fixes contributed by Michael Weiser. * Fix build problem on OpenBSD/powerpc64, reported by Jasper Lievisse Adriaanse. * Fix corner case bug in ECDSA verify, it would produce incorrect result in the unlikely case of an all-zero message hash. Reported by Guido Vranken. New features: * Support for pbkdf2_hmac_sha384 and pbkdf2_hmac_sha512, contributed by Nicolas Mora. Miscellaneous: * Poorly performing ARM Neon code for doing single-block Salsa20 and Chacha has been deleted. The code to do two or three blocks in parallel, introduced in Nettle-3.7, is unchanged. - -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance. -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEy0li0HDXfX/Li6Nicdjx/zaMZncFAmAtgJMACgkQcdjx/zaM ZnfTEQf+KdzEoCkSHZfOFQ9qreKfY4ZVzxO3Nbh8wBiQYbueUw2X9kNxh+ErL4M7 FL2ovRbE3vLsWft5Y+rWg7wmDPUCwOdVsovURwENB6l+kbynksG+DWhIfg6hcjQ4 qqlhSArW/2UtIlswMj1hfh/g//aUDl0gigZX0C1LmCIlr4IzZvmMk5+9ZsR+9cXT +R/gdh2Hxw/DzMT8yB/J5wP5/5IzA5xkV2LhBKqS538bFEVsE7t+DInEjoUYhmtv st5VuyUxstKxqtp6RB+RfVcWDwpyyMi6/wn8fKfv5UkdVVgOHsXwY2Ls2YG6oKvs XswtEhTV17sYMTlVNtLKm8vOLnLYPA== =E0qp -----END PGP SIGNATURE-----

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs