- nettle-bugs - lists.lysator.liu.se

sec_powm.c:293: GNU MP assertion failed: enb >= windowsize
by Jeffrey Walton 01 Feb '19

01 Feb '19

Hi Everyone, I'm trying to build Nettle 3.4.1 on Fedora 29, x64 (fully patched). Self tests are failing at: PASS: rsa-sec-decrypt sec_powm.c:293: GNU MP assertion failed: enb >= windowsize ../run-tests: line 57: 22997 Aborted (core dumped) "$1" $testflags FAIL: rsa-compute-root PASS: dsa PASS: dsa-keygen GMP is 6.1.2, which is the latest version. Could someone please advise. Thanks.

5 16

Nettle-3.4.1rc1, addressing PKCS#1 side-channel leaks
by nisse＠lysator.liu.se 22 Jan '19

22 Jan '19

A release candidate for nettle-3.4.1 is now available, as https://www.lysator.liu.se/~nisse/archive/nettle-3.4.1rc1.tar.gz https://www.lysator.liu.se/~nisse/archive/nettle-3.4.1rc1.tar.gz.sig Corresponding changes are also pushed to the branch https://git.lysator.liu.se/nettle/nettle/tree/release-3.4-fixes Release timing is prompted by the publication of http://cat.eyalro.net/. Nettle and GnuTLS authors (as well as developers of other TLS implementations) were notified by the research team a few months ago. Related CVE ids: CVE-2018-16868 gnutls: Bleichenbacher-like side channel leakage in PKCS#1 1.5 verification and padding oracle verification CVE-2018-16869 nettle: Leaky data conversion exposing a manager oracle For Nettle, the RSA code, which I wrote some 15 years ago, have seen an overhawl. Not only making the handling of PKCS#1 on decryption side-channel silent (the vulnerabilities that could be exploited by the methods of the above paper), but also ensuring that we use side-channel silent functions for the needed bignum arithmetic. This has been a lot of work, and most of it not done by me, but by Simo Sorce, at Red Hat Inc. Without this help, it would have been difficult to get a good release out on time. Testing of the release candidate is highly appreciated. I intend to make and announce the non-candidate release soon, possibly as early as tomorrow morning (i.e., December 1, in European timezone). A GnuTLS release, depending on the new rsa_sec_decrypt function in Nettle-3.4.1, is also being made about now. My understanding is that there's no need to panic. The attack directly affects RSA decryption, not signatures. And it requires some resources to be pulled off. As far as I understand, a successful attack lets the attacker decrypt or sign a targeted message, e.g., compromising the TLS "premaster secret", corresponding session keys, and any transmitted passwords or login cookies sent in a single TLS session, but it does not expose the private key itself. However, if you operate a TLS server, you should consider if you can completely disable key exchange based on RSA decryption. If you need to keep it for backwards compatibility, it is *strongly* encouraged to use a separate RSA key for this purpose, *not* reused or authorized for any other purpose. Regards, /Niels NEWS for the Nettle 3.4.1 release This release fixes a few bugs, and makes the RSA private key operations side channel silent. The RSA improvements are contributed by Simo Sorce and Red Hat, and include one new public function, rsa_sec_decrypt, see below. All functions using RSA private keys are now side-channel silent, meaning that they try hard to avoid any branches or memory accesses depending on secret data. This applies both to the bignum calculations, which now use GMP's mpn_sec_* family of functions, and the processing of PKCS#1 padding needed for RSA decryption. Nettle's ECC functions were already side-channel silent, while the DSA functions still aren't. There's also one caveat regarding the improved RSA functions: due to small table lookups in relevant mpn_sec_* functions in GMP-6.1.2, the lowest and highest few bits of the secret factors p and q may still leak. I'm not aware of any attacks on RSA where knowing a few bits of the factors makes a significant difference. This leak will likely be plugged in later GMP versions. Changes in behavior: * The functions rsa_decrypt and rsa_decrypt_tr may now clobber all of the provided message buffer, independent of the actual message length. They are side-channel silent, in that branches and memory accesses don't depend on the validity or length of the message. Side-channel leakage from the caller's use of length and return value may still provide an oracle useable for a Bleichenbacher-style chosen ciphertext attack. Which is why the new function rsa_sec_decrypt is recommended. New features: * A new function rsa_sec_decrypt. It differs from rsa_decrypt_tr in that the length of the decrypted message is given a priori, and PKCS#1 padding indicating a different length is treated as an error. For applications that may be subject to chosen ciphertext attacks, it is recommended to initialize the message area with random data, call this function, and ignore the return value. This applies in particular to RSA-based key exchange in the TLS protocol. Bug fixes: * Fix bug in pkcs1-conv, missing break statements in the parsing of PEM input files. * Fix link error on the pss-mgf1-test test, affecting builds without public key support. Performance regression: * All RSA private key operations employing RSA blinding, i.e., rsa_decrypt_tr, rsa_*_sign_tr, the new rsa_sec_decrypt, and rsa_compute_root_tr, are significantly slower. This is because (i) RSA blinding now use side-channel silent operations, (ii) blinding includes a modular inversion, and (iii) side-channel silent modular inversion, implemented as mpn_sec_invert, is very expensive. A 60% slowdown for 2048-bit RSA keys have been measured. Miscellaneous: * Building the public key support of nettle now requires GMP version 6.0 or later (unless --enable-mini-gmp is used). The shared library names are libnettle.so.6.5 and libhogweed.so.4.5, with sonames still libnettle.so.6 and libhogweed.so.4. It is intended to be fully binary compatible with nettle-3.1. -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

5 20

[repost] [PATCH] Add --enable-fat support for arm neon chacha20
by Yuriy M. Kaminskiy 19 Jan '19

19 Jan '19

> From e86ec9188319ef08d635da38c2f8bf891e56f995 Mon Sep 17 00:00:00 2001 From: "Yuriy M. Kaminskiy" <yumkam(a)gmail.com> Date: Wed, 2 Jan 2019 19:41:32 +0300 Subject: [PATCH] Add --enable-fat support for arm neon chacha20 On BCM2837B0 (Cortex-A53) @1.4GHz (Raspberry Pi 3B+), Before: `gnutls-cli --benchmark-ciphers` CHACHA20-POLY1305 (16384) 51.54 MB/sec `gnutls-cli --benchmark-tls-ciphers`: ECDHE_RSA_CHACHA20_POLY1305 (payload 1400) 21.31 MB/sec ECDHE_RSA_CHACHA20_POLY1305 (payload 15360) 24.60 MB/sec `nettle-benchmark` chacha encrypt 71.90 chacha decrypt 71.89 chacha_poly1305 encrypt 48.17 chacha_poly1305 decrypt 48.17 chacha_poly1305 update 146.03 After: `gnutls-cli --benchmark-ciphers` CHACHA20-POLY1305 (16384) 68.44 MB/sec `gnutls-cli --benchmark-tls-ciphers`: ECDHE_RSA_CHACHA20_POLY1305 (payload 1400) 27.25 MB/sec ECDHE_RSA_CHACHA20_POLY1305 (payload 15360) 32.41 MB/sec `nettle-benchmark` chacha encrypt 106.00 chacha decrypt 105.94 chacha_poly1305 encrypt 65.94 chacha_poly1305 decrypt 65.96 chacha_poly1305 update 175.24 --- arm/fat/chacha-core-internal-2.asm | 37 +++++++++++++++++++++++++++++++++++++ chacha-core-internal.c | 7 +++++++ configure.ac | 2 ++ fat-arm.c | 10 ++++++++++ fat-setup.h | 2 ++ 5 files changed, 58 insertions(+) create mode 100644 arm/fat/chacha-core-internal-2.asm P.S. for reference, on same machine, openssl chacha20 encrypt 236.08 openssl chacha20 decrypt 236.14 openssl chacha20-poly1305 encrypt 181.26 openssl chacha20-poly1305 decrypt 182.09 openssl chacha20-poly1305 update 782.67 (with openssl 1.1.0j-1~deb9u1 from debian-stretch/armhf) diff --git a/arm/fat/chacha-core-internal-2.asm b/arm/fat/chacha-core-internal-2.asm new file mode 100644 index 00000000..66a5c145 --- /dev/null +++ b/arm/fat/chacha-core-internal-2.asm @@ -0,0 +1,37 @@ +C arm/fat/chacha-core-internal-2.asm + + +ifelse(< + Copyright (C) 2015 Niels Möller + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +>) + +dnl PROLOGUE(_nettle_chacha_core) picked up by configure + +define(<fat_transform>, <$1_neon>) +include_src(<arm/neon/chacha-core-internal.asm>) diff --git a/chacha-core-internal.c b/chacha-core-internal.c index af278bb0..0905834e 100644 --- a/chacha-core-internal.c +++ b/chacha-core-internal.c @@ -51,6 +51,13 @@ #include "macros.h" +/* For fat builds */ +#if HAVE_NATIVE_chacha_core +void +_nettle_chacha_core_c(uint32_t *dst, const uint32_t *src, unsigned rounds); +#define _nettle_chacha_core _nettle_chacha_core_c +#endif + #ifndef CHACHA_DEBUG # define CHACHA_DEBUG 0 #endif diff --git a/configure.ac b/configure.ac index 305977d1..3f409fa4 100644 --- a/configure.ac +++ b/configure.ac @@ -472,6 +472,7 @@ asm_replace_list="aes-encrypt-internal.asm aes-decrypt-internal.asm \ # Assembler files which generate additional object files if they are used. asm_nettle_optional_list="gcm-hash8.asm cpuid.asm \ aes-encrypt-internal-2.asm aes-decrypt-internal-2.asm memxor-2.asm \ + chacha-core-internal-2.asm \ salsa20-core-internal-2.asm sha1-compress-2.asm sha256-compress-2.asm \ sha3-permute-2.asm sha512-compress-2.asm \ umac-nh-n-2.asm umac-nh-2.asm" @@ -573,6 +574,7 @@ AC_SUBST([IF_ASM]) AH_VERBATIM([HAVE_NATIVE], [/* Define to 1 each of the following for which a native (ie. CPU specific) implementation of the corresponding routine exists. */ +#undef HAVE_NATIVE_chacha_core #undef HAVE_NATIVE_ecc_192_modp #undef HAVE_NATIVE_ecc_192_redc #undef HAVE_NATIVE_ecc_224_modp diff --git a/fat-arm.c b/fat-arm.c index 5e656359..56099e6f 100644 --- a/fat-arm.c +++ b/fat-arm.c @@ -171,6 +171,10 @@ DECLARE_FAT_FUNC(_nettle_umac_nh_n, umac_nh_n_func) DECLARE_FAT_FUNC_VAR(umac_nh_n, umac_nh_n_func, c); DECLARE_FAT_FUNC_VAR(umac_nh_n, umac_nh_n_func, neon); +DECLARE_FAT_FUNC(_nettle_chacha_core, chacha_core_func) +DECLARE_FAT_FUNC_VAR(_chacha_core, chacha_core_func, c); +DECLARE_FAT_FUNC_VAR(_chacha_core, chacha_core_func, neon); + static void CONSTRUCTOR fat_init (void) { @@ -212,6 +216,7 @@ fat_init (void) nettle_sha3_permute_vec = _nettle_sha3_permute_neon; _nettle_umac_nh_vec = _nettle_umac_nh_neon; _nettle_umac_nh_n_vec = _nettle_umac_nh_n_neon; + _nettle_chacha_core_vec = _nettle_chacha_core_neon; } else { @@ -222,6 +227,7 @@ fat_init (void) nettle_sha3_permute_vec = _nettle_sha3_permute_c; _nettle_umac_nh_vec = _nettle_umac_nh_c; _nettle_umac_nh_n_vec = _nettle_umac_nh_n_c; + _nettle_chacha_core_vec = _nettle_chacha_core_c; } } @@ -267,3 +273,7 @@ DEFINE_FAT_FUNC(_nettle_umac_nh_n, void, unsigned length, const uint8_t *msg), (out, n, key, length, msg)) +DEFINE_FAT_FUNC(_nettle_chacha_core, void, + (uint32_t *dst, const uint32_t *src, unsigned rounds), + (dst, src, rounds)) + diff --git a/fat-setup.h b/fat-setup.h index eb7166a7..b623ebf9 100644 --- a/fat-setup.h +++ b/fat-setup.h @@ -174,3 +174,5 @@ typedef void sha512_compress_func (uint64_t *state, const uint8_t *input, const typedef uint64_t umac_nh_func (const uint32_t *key, unsigned length, const uint8_t *msg); typedef void umac_nh_n_func (uint64_t *out, unsigned n, const uint32_t *key, unsigned length, const uint8_t *msg); + +typedef void chacha_core_func(uint32_t *dst, const uint32_t *src, unsigned rounds); -- 2.11.0

2 3

error: ‘for’ loop initial declarations are only allowed in C99 or C11 mode
by Jeffrey Walton 30 Dec '18

30 Dec '18

Building on my HiKey, which is Aarch64. ========== $ gcc --version gcc (Debian/Linaro 4.9.2-10+deb8u1) 4.9.2 Copyright (C) 2014 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. ========== gcc -I. -I/usr/local/include -DNDEBUG -DHAVE_CONFIG_H -g2 -O2 -fPIC -ggdb3 -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT rsa-sign-tr.o -MD -MP -MF rsa-sign-tr.o.d -c rsa-sign-tr.c \ && true gcc -I. -I/usr/local/include -DNDEBUG -DHAVE_CONFIG_H -g2 -O2 -fPIC -ggdb3 -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT rsa-verify.o -MD -MP -MF rsa-verify.o.d -c rsa-verify.c \ && true rsa-sign-tr.c: In function ‘sec_equal’: rsa-sign-tr.c:243:3: error: ‘for’ loop initial declarations are only allowed in C99 or C11 mode for (size_t i = 0; i < limbs; i++) ^ rsa-sign-tr.c:243:3: note: use option -std=c99, -std=gnu99, -std=c11 or -std=gnu11 to compile your code Makefile:260: recipe for target 'rsa-sign-tr.o' failed make[1]: *** [rsa-sign-tr.o] Error 1 make[1]: *** Waiting for unfinished jobs.... make[1]: Leaving directory '/home/build/nettle-3.4.1' Makefile:49: recipe for target 'all' failed make: *** [all] Error 2

2 1

ANNOUNCE: Nettle-3.4.1
by nisse＠lysator.liu.se 04 Dec '18

04 Dec '18

I'm happy to announce a new release of GNU Nettle, a low-level cryptographics library. The main change in this release is that RSA private key operations are now side-channel silent, thanks to contributions by Simo Sorce, at Red Hat Inc. The release also includes a few smaller bugfixes. The Nettle home page can be found at https://www.lysator.liu.se/~nisse/nettle/, and the manual at https://www.lysator.liu.se/~nisse/nettle/nettle.html. The release can be downloaded from https://ftp.gnu.org/gnu/nettle/nettle-3.4.1.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-3.4.tar.gz https://www.lysator.liu.se/~nisse/archive/nettle-3.4.1.tar.gz There are no code changes since the release candidate announced on the Nettle mailing list November 30. Release timing is prompted by the publication of http://cat.eyalro.net/. Nettle and GnuTLS authors (as well as developers of other TLS implementations) were notified by the research team a few months ago. Related CVE ids: CVE-2018-16868 gnutls: Bleichenbacher-like side channel leakage in PKCS#1 1.5 verification and padding oracle verification CVE-2018-16869 nettle: Leaky data conversion exposing a manager oracle For Nettle, the RSA code, which was written some 15 years ago, have seen an overhawl. Not only making the handling of PKCS#1 on decryption side-channel silent (the vulnerabilities that could be exploited by the methods of the above paper), but also ensuring that underlying bignum arithmetic uses side-channel silent functions. The attack directly affects RSA decryption, not signatures. And it requires some resources to be pulled off. As far as I understand it, a successful attack lets the attacker decrypt or sign a targeted message, e.g., compromising the TLS "premaster secret" of a particular session, corresponding session keys, and any transmitted passwords or login cookies supposedly protected by those session keys, but it does not expose the private key itself. Upgrading the Nettle and GnuTLS libraries is recommended. If you operate a TLS server, you should consider if you can completely disable key exchange based on RSA decryption. If you need to keep it for backwards compatibility, it is *strongly* encouraged to use a separate RSA key for this purpose, *not* reused or authorized for any other purpose. Regards, /Niels NEWS for the Nettle 3.4.1 release This release fixes a few bugs, and makes the RSA private key operations side channel silent. The RSA improvements are contributed by Simo Sorce and Red Hat, and include one new public function, rsa_sec_decrypt, see below. All functions using RSA private keys are now side-channel silent, meaning that they try hard to avoid any branches or memory accesses depending on secret data. This applies both to the bignum calculations, which now use GMP's mpn_sec_* family of functions, and the processing of PKCS#1 padding needed for RSA decryption. Nettle's ECC functions were already side-channel silent, while the DSA functions still aren't. There's also one caveat regarding the improved RSA functions: due to small table lookups in relevant mpn_sec_* functions in GMP-6.1.2, the lowest and highest few bits of the secret factors p and q may still leak. I'm not aware of any attacks on RSA where knowing a few bits of the factors makes a significant difference. This leak will likely be plugged in later GMP versions. Changes in behavior: * The functions rsa_decrypt and rsa_decrypt_tr may now clobber all of the provided message buffer, independent of the actual message length. They are side-channel silent, in that branches and memory accesses don't depend on the validity or length of the message. Side-channel leakage from the caller's use of length and return value may still provide an oracle useable for a Bleichenbacher-style chosen ciphertext attack. Which is why the new function rsa_sec_decrypt is recommended. New features: * A new function rsa_sec_decrypt. It differs from rsa_decrypt_tr in that the length of the decrypted message is given a priori, and PKCS#1 padding indicating a different length is treated as an error. For applications that may be subject to chosen ciphertext attacks, it is recommended to initialize the message area with random data, call this function, and ignore the return value. This applies in particular to RSA-based key exchange in the TLS protocol. Bug fixes: * Fix bug in pkcs1-conv, missing break statements in the parsing of PEM input files. * Fix link error on the pss-mgf1-test test, affecting builds without public key support. Performance regression: * All RSA private key operations employing RSA blinding, i.e., rsa_decrypt_tr, rsa_*_sign_tr, the new rsa_sec_decrypt, and rsa_compute_root_tr, are significantly slower. This is because (i) RSA blinding now use side-channel silent operations, (ii) blinding includes a modular inversion, and (iii) side-channel silent modular inversion, implemented as mpn_sec_invert, is very expensive. A 60% slowdown for 2048-bit RSA keys have been measured. Miscellaneous: * Building the public key support of nettle now requires GMP version 6.0 or later (unless --enable-mini-gmp is used). The shared library names are libnettle.so.6.5 and libhogweed.so.4.5, with sonames still libnettle.so.6 and libhogweed.so.4. It is intended to be fully binary compatible with nettle-3.1. -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

nettle-3.4.1
by nisse＠lysator.liu.se 19 Nov '18

19 Nov '18

It turns out there's a need for a bugfix-only release nettle-3.4.1, to be released in a few weeks. I've created a branch release-3.4-fixes, and backported a few bugfixes (see commit history or ChangeLog on that branch), https://git.lysator.liu.se/nettle/nettle/blob/release-3.4-fixes/ChangeLog I'm sorry I haven't been able to respond to the recently posted patches on this list. I'll get back to that after 3.4.1. If you think I've missed some important bugfixes, please speak up. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

2 1

[PATCH] ctr16: fix encryption if src == dst
by Dmitry Eremin-Solenikov 11 Oct '18

11 Oct '18

If src == dst, ctr16 code will fail to increment src and dst pointers, always overwriting first block. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- ctr16.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ctr16.c b/ctr16.c index 60418e8b9032..7e1c23d20832 100644 --- a/ctr16.c +++ b/ctr16.c @@ -91,7 +91,7 @@ _ctr_crypt16(const void *ctx, nettle_cipher_func *f, f(ctx, CTR_BUFFER_LIMIT, buffer->b, buffer->b); if (length - i < CTR_BUFFER_LIMIT) goto done; - memxor3 (dst, src, buffer->b, CTR_BUFFER_LIMIT); + memxor3 (dst + i, src + i, buffer->b, CTR_BUFFER_LIMIT); } if (blocks > 0) -- 2.18.0

2 4

[PATCH 0/3] Add CMAC-64 and CMAC-DES3 support
by Dmitry Eremin-Solenikov 21 Sep '18

21 Sep '18

To further improve GOST ciphers support in GnuTLS I need 64-bit CMAC variant (since one of GOST ciphers is 64-bit one). Implement CMAC-64 and CMAC-DES3 as a way to prove CMAC-64 correctness. -- With best wishes Dmitry

1 3

Deprecation
by nisse＠lysator.liu.se 13 Aug '18

13 Aug '18

I've looked into using __attribute__ ((deprecated)). See branch attribute-deprecated. I define _NETTLE_ATTRIBUTE_DEPRECATED in nettle-types.h (and _NETTLE_ATTRIBUTE_PURE, needed in a few places). For a start, I've marked the old aes and gcm-aes interfaces as deprecated, as discussed earlier, and the obsolete _rsa_blind and _rsa_unblind functions. Some more functions are candidates for deprecation: 1. Everything in des-compat.h and md5-compat.h. Unless we think it can be deleted without deprecation; I'm not aware of any usage, and they made more sense back in 2001 when Nettle-1.0 was brand new. 2. The "general" hmac functions: hmac_set_key, hmac_update, hmac_digest. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

2 3

[RFC 1/4] hmac: provide alternative HMAC interface
by Dmitry Eremin-Solenikov 30 Jul '18

30 Jul '18

Provide alternative HMAC interface, with context struct having just derived key and single hash state instead of three hash states at once. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- hmac.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ hmac.h | 34 ++++++++++++++++++++++++++++- 2 files changed, 101 insertions(+), 1 deletion(-) diff --git a/hmac.c b/hmac.c index 6ac5e11a0686..44ac705856ad 100644 --- a/hmac.c +++ b/hmac.c @@ -115,3 +115,71 @@ hmac_digest(const void *outer, const void *inner, void *state, memcpy(state, inner, hash->context_size); } + +void +hmac2_set_key(void *outer, void *inner, void *state, + const struct nettle_hash *hash, + size_t key_length, const uint8_t *key) +{ + TMP_DECL(pad, uint8_t, NETTLE_MAX_HASH_BLOCK_SIZE); + TMP_ALLOC(pad, hash->block_size); + + hash->init(state); + if (key_length > hash->block_size) + { + /* Reduce key to the algorithm's hash size. Use the area pointed + * to by state for the temporary state. */ + + TMP_DECL(digest, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE); + TMP_ALLOC(digest, hash->digest_size); + + hash->update(state, key_length, key); + hash->digest(state, hash->digest_size, digest); + + key = digest; + key_length = hash->digest_size; + } + + assert(key_length <= hash->block_size); + + memset(pad, OPAD, hash->block_size); + memxor(pad, key, key_length); + + /* Init happened before */ + hash->update(state, hash->block_size, pad); + memcpy(outer, state, hash->state_size); + + memset(pad, IPAD, hash->block_size); + memxor(pad, key, key_length); + + hash->init(state); + hash->update(state, hash->block_size, pad); + + memcpy(inner, state, hash->state_size); +} + +void +hmac2_update(void *state, + const struct nettle_hash *hash, + size_t length, const uint8_t *data) +{ + hash->update(state, length, data); +} + +void +hmac2_digest(const void *outer, const void *inner, void *state, + const struct nettle_hash *hash, + size_t length, uint8_t *dst) +{ + TMP_DECL(digest, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE); + TMP_ALLOC(digest, hash->digest_size); + + hash->digest(state, hash->digest_size, digest); + + memcpy(state, outer, hash->state_size); + + hash->update(state, hash->digest_size, digest); + hash->digest(state, length, dst); + + memcpy(state, inner, hash->state_size); +} diff --git a/hmac.h b/hmac.h index 40a8e77aab6d..e6519023d259 100644 --- a/hmac.h +++ b/hmac.h @@ -49,6 +49,9 @@ extern "C" { #define hmac_set_key nettle_hmac_set_key #define hmac_update nettle_hmac_update #define hmac_digest nettle_hmac_digest +#define hmac2_set_key nettle_hmac2_set_key +#define hmac2_update nettle_hmac2_update +#define hmac2_digest nettle_hmac2_digest #define hmac_md5_set_key nettle_hmac_md5_set_key #define hmac_md5_update nettle_hmac_md5_update #define hmac_md5_digest nettle_hmac_md5_digest @@ -87,6 +90,24 @@ hmac_digest(const void *outer, const void *inner, void *state, size_t length, uint8_t *digest); +void +hmac2_set_key(void *outer, void *inner, void *state, + const struct nettle_hash *hash, + size_t length, const uint8_t *key); + +/* This function is not strictly needed, it's s just the same as the + * hash update or hmac2_update functions. */ +void +hmac2_update(void *state, + const struct nettle_hash *hash, + size_t length, const uint8_t *data); + +void +hmac2_digest(const void *outer, const void *inner, void *state, + const struct nettle_hash *hash, + size_t length, uint8_t *digest); + + #define HMAC_CTX(type) \ { type outer; type inner; type state; } @@ -98,10 +119,21 @@ hmac_digest(const void *outer, const void *inner, void *state, hmac_digest( &(ctx)->outer, &(ctx)->inner, &(ctx)->state, \ (hash), (length), (digest) ) +#define HMAC2_CTX(ctx_type, type) \ +{ type outer; type inner; ctx_type state; } + +#define HMAC2_SET_KEY(ctx, hash, length, key) \ + hmac2_set_key( &(ctx)->outer, &(ctx)->inner, &(ctx)->state, \ + (hash), (length), (key) ) + +#define HMAC2_DIGEST(ctx, hash, length, digest) \ + hmac2_digest( &(ctx)->outer, &(ctx)->inner, &(ctx)->state, \ + (hash), (length), (digest) ) + /* HMAC using specific hash functions */ /* hmac-md5 */ -struct hmac_md5_ctx HMAC_CTX(struct md5_ctx); +struct hmac_md5_ctx HMAC2_CTX(struct md5_ctx, struct md5_state); void hmac_md5_set_key(struct hmac_md5_ctx *ctx, -- 2.18.0

2 4

[PATCH] Add benchmarking for HMAC functions
by Dmitry Eremin-Solenikov 30 Jul '18

30 Jul '18

In preparation of changing internal HMAC interface add benchmarking for HMAC functions. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- examples/nettle-benchmark.c | 154 ++++++++++++++++++++++++++++++++++++ 1 file changed, 154 insertions(+) diff --git a/examples/nettle-benchmark.c b/examples/nettle-benchmark.c index 5a88e72dd678..101ba7d4abcc 100644 --- a/examples/nettle-benchmark.c +++ b/examples/nettle-benchmark.c @@ -67,6 +67,7 @@ #include "umac.h" #include "cmac.h" #include "poly1305.h" +#include "hmac.h" #include "nettle-meta.h" #include "nettle-internal.h" @@ -476,6 +477,147 @@ time_poly1305_aes(void) time_function(bench_hash, &info)); } +struct bench_hmac_info +{ + void *ctx; + nettle_hash_update_func *update; + nettle_hash_digest_func *digest; + size_t length; + size_t digest_length; + const uint8_t *data; +}; + +static void +bench_hmac(void *arg) +{ + struct bench_hmac_info *info = arg; + uint8_t digest[NETTLE_MAX_HASH_DIGEST_SIZE]; + size_t pos, length; + + length = info->length; + for (pos = 0; pos < BENCH_BLOCK; pos += length) + { + size_t single = pos + length < BENCH_BLOCK ? + length : + BENCH_BLOCK - pos; + info->update(info->ctx, single, info->data + pos); + info->digest(info->ctx, info->digest_length, digest); + } +} + +static const struct +{ + size_t length; + const char *msg; +} hmac_tests[] = { + { 64, "64 bytes" }, + { 256, "256 bytes" }, + { 1024, "1024 bytes" }, + { 4096, "4096 bytes" }, + { BENCH_BLOCK, "single msg" }, + { 0, NULL }, +}; + +static void +time_hmac_md5(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_md5_ctx md5_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_md5_set_key(&md5_ctx, MD5_BLOCK_SIZE, data); + info.ctx = &md5_ctx; + info.update = (nettle_hash_update_func *) hmac_md5_update; + info.digest = (nettle_hash_digest_func *) hmac_md5_digest; + info.digest_length = MD5_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-md5", hmac_tests[pos].msg, MD5_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + +static void +time_hmac_sha1(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_sha1_ctx sha1_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_sha1_set_key(&sha1_ctx, SHA1_BLOCK_SIZE, data); + info.ctx = &sha1_ctx; + info.update = (nettle_hash_update_func *) hmac_sha1_update; + info.digest = (nettle_hash_digest_func *) hmac_sha1_digest; + info.digest_length = SHA1_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-sha1", hmac_tests[pos].msg, SHA1_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + +static void +time_hmac_sha256(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_sha256_ctx sha256_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_sha256_set_key(&sha256_ctx, SHA256_BLOCK_SIZE, data); + info.ctx = &sha256_ctx; + info.update = (nettle_hash_update_func *) hmac_sha256_update; + info.digest = (nettle_hash_digest_func *) hmac_sha256_digest; + info.digest_length = SHA256_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-sha256", hmac_tests[pos].msg, SHA256_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + +static void +time_hmac_sha512(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_sha512_ctx sha512_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_sha512_set_key(&sha512_ctx, SHA512_BLOCK_SIZE, data); + info.ctx = &sha512_ctx; + info.update = (nettle_hash_update_func *) hmac_sha512_update; + info.digest = (nettle_hash_digest_func *) hmac_sha512_digest; + info.digest_length = SHA512_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-sha512", hmac_tests[pos].msg, SHA512_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + static int prefix_p(const char *prefix, const char *s) { @@ -883,6 +1025,18 @@ main(int argc, char **argv) if (!alg || strstr(aeads[i]->name, alg)) time_aead(aeads[i]); + if (!alg || strstr ("hmac-md5", alg)) + time_hmac_md5(); + + if (!alg || strstr ("hmac-sha1", alg)) + time_hmac_sha1(); + + if (!alg || strstr ("hmac-sha256", alg)) + time_hmac_sha256(); + + if (!alg || strstr ("hmac-sha512", alg)) + time_hmac_sha512(); + optind++; } while (alg && argv[optind]); -- 2.18.0

2 1

[PATCH 0/2] Rework HMAC interface
by Dmitry Eremin-Solenikov 25 Jul '18

25 Jul '18

Hello colleagues, I gave a little thought to Niels' idea: 5. Revamp hmac and underlying hash functions with a separate state struct. Probably low priority, but it is a bit silly that, e.g., hmac_sha512_ctx includes three 128-byte large block buffers. I've implemented new approach using hmac2 prefix, but if you like this approach I can switch hmac2 prefix to just hmac and drop older API. -- With best wishes Dmitry

3 6

nettle symbols: improve map files
by Nikos Mavrogiannopoulos 16 Jul '18

16 Jul '18

Hi, This patch makes the exported symbols explicit in the map file. Furthermore it moves symbols only listed in internal headers in a special section which makes them valid only for testing. I've tested it with abi-compliance-checker and it detects the following missing from nettle: nettle_aeads, nettle_armors, nettle_ciphers, nettle_hashes and from hogweed the nettle_secp_*r1, which seem expected. Niels, I'm not sure however if that was your intention. Didn't you want to deprecate some of the _nettle symbols as well like _nettle_secp_256r1? These are however still present in the exported headers and unless we remove them, they seem to be part of the API and ABI. I also attach the script which generated the files in case you'd like to play with it. regards, Nikos

3 26

Xcode/CLT 10+ Patch
by Dominyk Tiller 19 Jun '18

19 Jun '18

Hey folks, With the obvious enough disclaimer that Xcode/CLT 10 are very much beta releases at this point and will remain so for several months yet, I've attached a diff to fix the only current build issue with the new developer tools available for macOS 10.13/10.14. The new Apple LLVM (10.0.0) ships with a new stack probing function, which embeds the symbol `____chkstk_darwin` into seemingly the vast majority of libraries & binaries, including both libnettle.a & libhogweed.a, which in turn currently blows up nettle's `make check` stage on the symbol check: ---------------------- PASS: sexp-conv PASS: pkcs1-conv PASS: nettle-pbkdf2 Exported symbols in libnettle.a, lacking the nettle prefix: 00000000000001b0 T ____chkstk_darwin 0000000000000230 T ____chkstk_darwin 0000000000000350 T ____chkstk_darwin 0000000000000360 T ____chkstk_darwin 0000000000000380 T ____chkstk_darwin FAIL: symbols PASS: dlopen ==================== 1 of 94 tests failed ==================== make[1]: *** [check] Error 1 make: *** [check] Error 2 ---------------------- The attached diff simply scopes out an exception to the check, with a short explanatory note. I appreciate fully y'all may decide it's too soon to be accepting patches for prerelease developer tools, but the chances of Apple removing the new function or disabling it by default seem pretty low. Let me know if anything further is needed. Thanks, Dominyk -- Sent from macOS. If you wish to communicate more securely my PGP Public Key is at: https://pgp.mit.edu/pks/lookup?search=0xE5F21DD98E4DF470&op=index

2 2

[PATCH] Add support for reading/writing integers in Little Endian format
by Dmitry Eremin-Solenikov 17 Jun '18

17 Jun '18

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- bignum.c | 35 +++++++++++++++++++++++++++++++++++ bignum.h | 17 +++++++++++++++++ testsuite/bignum-test.c | 29 +++++++++++++++++++++++++++++ 3 files changed, 81 insertions(+) diff --git a/bignum.c b/bignum.c index 335252876544..413a630cb3aa 100644 --- a/bignum.c +++ b/bignum.c @@ -133,12 +133,32 @@ nettle_mpz_get_str_256(size_t length, uint8_t *s, const mpz_t x) } } +void +nettle_mpz_get_str_256_u_le(size_t length, uint8_t *s, const mpz_t x) +{ + if (!length) + { + /* x must be zero */ + assert(!mpz_sgn(x)); + return; + } + + size_t count; + + assert(nettle_mpz_sizeinbase_256_u(x) <= length); + mpz_export(s, &count, -1, 1, 0, 0, x); + memset(s + count, 0, length - count); +} + /* Converting from strings */ /* mpz_import was introduced in GMP-4.1 */ #define nettle_mpz_from_octets(x, length, s) \ mpz_import((x), (length), 1, 1, 0, 0, (s)) +#define nettle_mpz_from_octets_le(x, length, s) \ + mpz_import((x), (length), -1, 1, 0, 0, (s)) + void nettle_mpz_set_str_256_u(mpz_t x, size_t length, const uint8_t *s) @@ -154,6 +174,21 @@ nettle_mpz_init_set_str_256_u(mpz_t x, nettle_mpz_from_octets(x, length, s); } +void +nettle_mpz_set_str_256_u_le(mpz_t x, + size_t length, const uint8_t *s) +{ + nettle_mpz_from_octets_le(x, length, s); +} + +void +nettle_mpz_init_set_str_256_u_le(mpz_t x, + size_t length, const uint8_t *s) +{ + mpz_init(x); + nettle_mpz_from_octets_le(x, length, s); +} + void nettle_mpz_set_str_256_s(mpz_t x, size_t length, const uint8_t *s) diff --git a/bignum.h b/bignum.h index 7871d843168c..42a97e63d6b6 100644 --- a/bignum.h +++ b/bignum.h @@ -68,11 +68,19 @@ nettle_mpz_sizeinbase_256_s(const mpz_t x); size_t nettle_mpz_sizeinbase_256_u(const mpz_t x); +#define nettle_mpz_sizeinbase_256_u_le nettle_mpz_sizeinbase_256_u + /* Writes an integer as length octets, using big endian byte order, * and two's complement for negative numbers. */ void nettle_mpz_get_str_256(size_t length, uint8_t *s, const mpz_t x); +/* Writes an integer as length octets, using big endian byte order, + * and unsigned number format. */ +void +nettle_mpz_get_str_256_u_le(size_t length, uint8_t *s, const mpz_t x); + + /* Reads a big endian, two's complement, integer. */ void nettle_mpz_set_str_256_s(mpz_t x, @@ -92,6 +100,15 @@ void nettle_mpz_init_set_str_256_u(mpz_t x, size_t length, const uint8_t *s); +/* Similar, but for little endian byte order. */ +void +nettle_mpz_set_str_256_u_le(mpz_t x, + size_t length, const uint8_t *s); + +void +nettle_mpz_init_set_str_256_u_le(mpz_t x, + size_t length, const uint8_t *s); + /* Returns a uniformly distributed random number 0 <= x < 2^n */ void nettle_mpz_random_size(mpz_t x, diff --git a/testsuite/bignum-test.c b/testsuite/bignum-test.c index 602554b53941..79fd92e2d37d 100644 --- a/testsuite/bignum-test.c +++ b/testsuite/bignum-test.c @@ -34,6 +34,30 @@ test_bignum(const char *hex, const struct tstring *base256) free(buf); } +static void +test_bignum_le(const char *hex, const struct tstring *base256) +{ + mpz_t a; + mpz_t b; + uint8_t *buf; + + mpz_init_set_str(a, hex, 16); + nettle_mpz_init_set_str_256_u_le(b, base256->length, base256->data); + + ASSERT(mpz_cmp(a, b) == 0); + + buf = xalloc(base256->length + 1); + memset(buf, 17, base256->length + 1); + + nettle_mpz_get_str_256_u_le(base256->length, buf, a); + ASSERT(MEMEQ(base256->length, buf, base256->data)); + + ASSERT(buf[base256->length] == 17); + + mpz_clear(a); mpz_clear(b); + free(buf); +} + static void test_size(long x, unsigned size) { @@ -86,6 +110,11 @@ test_main(void) test_bignum("-7fff", SHEX( "8001")); test_bignum("-8000", SHEX( "8000")); test_bignum("-8001", SHEX("ff7fff")); + + test_bignum_le("0", SHEX("00")); + test_bignum_le("010203040506", SHEX("060504030201")); + test_bignum_le("80010203040506", SHEX("06050403020180")); + test_bignum_le("01020304050680", SHEX("80060504030201")); #else /* !WITH_HOGWEED */ SKIP(); -- 2.17.1

2 2

[PATCH] Fix quoting in autoconf ifunc test
by Dmitry Eremin-Solenikov 17 Jun '18

17 Jun '18

* aclocal.m4 (NETTLE_CHECK_IFUNC): fix quoting so that AC_LINK_IFELSE/AC_TRY_LINK is defined outside of this test. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- aclocal.m4 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/aclocal.m4 b/aclocal.m4 index 783dbc492b5c..772f68e8eb9d 100644 --- a/aclocal.m4 +++ b/aclocal.m4 @@ -650,7 +650,7 @@ AC_DEFUN([NETTLE_CHECK_IFUNC], [AC_REQUIRE([AC_PROG_CC]) AC_CACHE_CHECK([for ifunc support], nettle_cv_link_ifunc, - AC_LINK_IFELSE([AC_LANG_PROGRAM([ + [AC_LINK_IFELSE([AC_LANG_PROGRAM([ static int foo_imp(int x) { @@ -671,7 +671,7 @@ int foo (int x) __attribute__ ((ifunc("foo_resolv"))); ])], [nettle_cv_link_ifunc=yes], -[nettle_cv_link_ifunc=no])) +[nettle_cv_link_ifunc=no])]) AH_TEMPLATE([HAVE_LINK_IFUNC], [Define if compiler and linker supports __attribute__ ifunc]) if test "x$nettle_cv_link_ifunc" = xyes ; then AC_DEFINE(HAVE_LINK_IFUNC) -- 2.17.1

2 2

[Dominyk Tiller] Fwd: Xcode/CLT 10+ Patch
by nisse＠lysator.liu.se 14 Jun '18

14 Jun '18

-- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

API for new AEAD modes
by Nikos Mavrogiannopoulos 31 May '18

31 May '18

Hi, As it is now AEAD ciphers in nettle are supported with their own API. AES-CCM provides: ccm_aes128_set_key ccm_aes128_set_nonce ccm_aes128_update ccm_aes128_encrypt ccm_aes128_decrypt ccm_aes128_digest ccm_aes128_encrypt_message ccm_aes128_decrypt_message AES-GCM: gcm_aes128_set_key gcm_aes128_update gcm_aes128_set_iv gcm_aes128_encrypt gcm_aes128_decrypt gcm_aes128_digest chacha-poly1305: chacha_poly1305_set_key chacha_poly1305_set_nonce chacha_poly1305_update chacha_poly1305_encrypt chacha_poly1305_decrypt chacha_poly1305_digest ccm_aes128_set_nonce takes different parameters from the chacha and gcm equivalent function. Furthermore the AEAD modes for block ciphers include an abstract layer which can be re-used of other ciphers. For example the GCM mode abstraction is re-used for camellia as well. So overall there is a kind of "abstract" API followed with the set_key, set_nonce, update, encrypt/decrypt, however these have not always the same parameters as in the CCM case. I'm checking the AES-SIV-CMAC mode which cannot even be put in that abstraction as the MAC in SIV is the IV and thus the MAC-style API doesn't really suit it. My understanding is that AEAD modes according to RFC5116 need to have 4 inputs: key, nonce, associated data, plaintext so the CCM encrypt and decrypt message seem to be the closer to that API. Would it make sense to standardize on these, and only provide that API for AEAD modes? The reason I'm asking is because SIV could benefit of a very custom API as well because it can take advantage of multiple associated data, but in the end I believe AEAD is about simplicity. Providing a unique API per AEAD cipher seems to me quite contradictory to that goal. regards, Nikos

4 6

https://git.lysator.liu.se/ seems to be offline...
by Tim Rühsen 14 Apr '18

14 Apr '18

1 0

symbol versioning update
by Nikos Mavrogiannopoulos 03 Apr '18

03 Apr '18

Hi, When we initially introduced symbol versioning in nettle we bundled all symbols from the library in a single version. That means that new symbols added to a release like nettle_get_hashes() may cause issues like this: https://bugzilla.redhat.com/show_bug.cgi?id=1549190 The underlying issue is in rpm-based systems which detect which symbols exist in which library version based on the version. That way, when a dependency is tracked, the version with the right symbol will be retrieved. Debian-based systems work differently so that shouldn't affect it. To address these problems in gnutls, I follow these additional rules in to having a map file: https://gitlab.com/gnutls/gnutls/blob/master/CONTRIBUTING.md#symbol-and-lib… which in turn comes from libvirt: https://www.berrange.com/posts/2011/01/13/versioning-in-the-libvirt-library/ That of course adds overhead on releases. nettle doesn't necessarily need to follow that process, I send that issue in order to spark discussion on whether that's desirable to have. regards, Nikos

3 6

What should nettle-3.5 be like?
by nisse＠lysator.liu.se 27 Mar '18

27 Mar '18

I used to think that next Nettle release should be focused on performance and add a few more features, no incompatible changes. But since the gcm changes breaks gnutls (fix in https://gitlab.com/gnutls/gnutls/commit/176aa191380e5d63a981f08f537deffdd78…), best way to reduce damage might be to bump the nettle soname. And if we do that, there are a couple of other things that could be done at the same time. Some changes to consider: 1. Remove the the symbols nettle_hashes and nettle_secp_384r1 and friends from the interface. They should be renamed with leading underscore. Important to be able to merge ed448 work without breaking the abi again. 2. Delete the old aes_* interface, in favor of aes128_, aes192_* and aes256_*. This could help aesni performance, where it might be nice with separately completely unrolled code for each key size. 3. Change struct nettle_aead to be more message-oriented. 4. Hide undocumented and internal symbols (the ones with leading underscore) more. Move declarations to internal uninstalled headers, possible tweak linker script to not expose at all in the shared library. 5. Revamp hmac and underlying hash functions with a separate state struct. Probably low priority, but it is a bit silly that, e.g., hmac_sha512_ctx includes three 128-byte large block buffers. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

5 22

Re: [PATCH 1/3] Add arm endianness-aware assembly infrastructure
by nisse＠lysator.liu.se 25 Mar '18

25 Mar '18

Michael Weiser <michael.weiser(a)gmx.de> writes: > Introduce m4 macros to conditionally handle differences of little- and > big-endian arm in assembler code. This and the next two patches now merged to master-updates for some final testing. At the moment, I'm only able to test that plain little-endian arm is still working. Thanks! /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

2 1

mailing list archives
by Nikos Mavrogiannopoulos 20 Mar '18

20 Mar '18

Hi, On certain occasions I was trying to link to posts in that list however it seems that the official archives are not updated on a reasonable frequency. For example the current archives [0] were last updated on January 4. Is it possible to increase the archive generation frequency to weekly or sooner? regards, Nikos [0]. https://lists.lysator.liu.se/pipermail/nettle-bugs/2018/date.html

2 3

Efficient ED25519 on microcontrollers
by nisse＠lysator.liu.se 13 Mar '18

13 Mar '18

This is vaguely related to Nettle, but may be of interest to some people on the list. I've tried to summarize how to implement ed25519 efficiently on low-end hardware, with MSP430 as a concrete example. Most of the tricks are used by Nettle's implementation as well. Not sure if it would make any sense to try to port Nettle to such systems, but might be doable if there's interest in it. I would imagine that the need for good crypto on cheap devices is only going to increase in coming years. See https://www.lysator.liu.se/~nisse/misc/ed25519-msp430.html. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

x86 sha_ni
by nisse＠lysator.liu.se 12 Mar '18

12 Mar '18

Hi, I've been trying out the sha_ni instructions available on some newer x86_64 processors. Below replacement for sha1-compress.asm seems to run on roughly 2 cycles/byte when I benchmark it on an "AMD Ryzen 7 1700X" cpu in the gcc compile farm. Still sligthly slower than openssl, to squeeze out a few more cycles, it might help to change the sha1_compress interface to let it process more than one 64-byte block at a time. I hope to be able to wire it up via fat-x86_64.c reasonably soon. In the mean time, if anyone wants to try it out, just change the sha1-compress.asm symlink to point to this file. Regards, /Niels -----8<-------- C x86_64/sha_ni/sha1-compress.asm ifelse(< Copyright (C) 2018 Niels Möller This file is part of GNU Nettle. GNU Nettle is free software: you can redistribute it and/or modify it under the terms of either: * the GNU Lesser General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. or * the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. or both in parallel, as here. GNU Nettle is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received copies of the GNU General Public License and the GNU Lesser General Public License along with this program. If not, see http://www.gnu.org/licenses/. >) C Register usage. C Arguments define(<STATE>,<%rdi>)dnl define(<INPUT>,<%rsi>)dnl define(<MSG0>,<%xmm0>) define(<MSG1>,<%xmm1>) define(<MSG2>,<%xmm2>) define(<MSG3>,<%xmm3>) define(<ABCD>,<%xmm4>) define(<E0>,<%xmm5>) define(<E1>,<%xmm6>) define(<ABCD_ORIG>, <%xmm7>) define(<E_ORIG>, <%xmm8>) define(<SWAP_MASK>,<%xmm9>) C QROUND(M0, M1, M2, M3, E0, E1, TYPE) define(<QROUND>, < sha1nexte $1, $5 movdqa ABCD, $6 sha1msg2 $1, $2 sha1rnds4 <$>$7, $5, ABCD sha1msg1 $1, $4 pxor $1, $3 >) .file "sha1-compress.asm" C _nettle_sha1_compress(uint32_t *state, uint8_t *input) .text ALIGN(16) .Lswap_mask: .byte 15,14,13,12,11,10,9,8,7,6,5,4,3,2,1,0 PROLOGUE(_nettle_sha1_compress) C save all registers that need to be saved W64_ENTRY(2, 10) movups (STATE), ABCD movd 16(STATE), E0 movups (INPUT), MSG0 movdqa .Lswap_mask(%rip), SWAP_MASK pshufd $0x1b, ABCD, ABCD pshufd $0x1b, E0, E0 movdqa ABCD, ABCD_ORIG movdqa E0, E_ORIG pshufb SWAP_MASK, MSG0 paddd MSG0, E0 movdqa ABCD, E1 sha1rnds4 $0, E0, ABCD C Rounds 0-3 movups 16(INPUT), MSG1 pshufb SWAP_MASK, MSG1 sha1nexte MSG1, E1 movdqa ABCD, E0 sha1rnds4 $0, E1, ABCD C Rounds 4-7 sha1msg1 MSG1, MSG0 movups 32(INPUT), MSG2 pshufb SWAP_MASK, MSG2 sha1nexte MSG2, E0 movdqa ABCD, E1 sha1rnds4 $0, E0, ABCD C Rounds 8-11 sha1msg1 MSG2, MSG1 pxor MSG2, MSG0 movups 48(INPUT), MSG3 pshufb SWAP_MASK, MSG3 QROUND(MSG3, MSG0, MSG1, MSG2, E1, E0, 0) C Rounds 12-15 QROUND(MSG0, MSG1, MSG2, MSG3, E0, E1, 0) C Rounds 16-19 QROUND(MSG1, MSG2, MSG3, MSG0, E1, E0, 1) C Rounds 20-23 QROUND(MSG2, MSG3, MSG0, MSG1, E0, E1, 1) C Rounds 24-27 QROUND(MSG3, MSG0, MSG1, MSG2, E1, E0, 1) C Rounds 28-31 QROUND(MSG0, MSG1, MSG2, MSG3, E0, E1, 1) C Rounds 32-35 QROUND(MSG1, MSG2, MSG3, MSG0, E1, E0, 1) C Rounds 36-39 QROUND(MSG2, MSG3, MSG0, MSG1, E0, E1, 2) C Rounds 40-43 QROUND(MSG3, MSG0, MSG1, MSG2, E1, E0, 2) C Rounds 44-47 QROUND(MSG0, MSG1, MSG2, MSG3, E0, E1, 2) C Rounds 48-51 QROUND(MSG1, MSG2, MSG3, MSG0, E1, E0, 2) C Rounds 52-55 QROUND(MSG2, MSG3, MSG0, MSG1, E0, E1, 2) C Rounds 56-59 QROUND(MSG3, MSG0, MSG1, MSG2, E1, E0, 3) C Rounds 60-63 QROUND(MSG0, MSG1, MSG2, MSG3, E0, E1, 3) C Rounds 64-67 sha1nexte MSG1, E1 movdqa ABCD, E0 sha1msg2 MSG1, MSG2 sha1rnds4 $3, E1, ABCD C Rounds 68-71 pxor MSG1, MSG3 sha1nexte MSG2, E0 movdqa ABCD, E1 sha1msg2 MSG2, MSG3 sha1rnds4 $3, E0, ABCD C Rounds 72-75 sha1nexte MSG3, E1 movdqa ABCD, E0 sha1rnds4 $3, E1, ABCD C Rounds 76-79 sha1nexte E_ORIG, E0 paddd ABCD_ORIG, ABCD pshufd $0x1b, ABCD, ABCD movups ABCD, (STATE) pshufd $0x1b, E0, E0 movd E0, 16(STATE) W64_EXIT(2, 10) ret EPILOGUE(_nettle_sha1_compress) -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

3 9

Improved ECC tables
by nisse＠lysator.liu.se 10 Mar '18

10 Mar '18

Nettle uses precomputed tables for ecc scalar multiplication involving the fixed base point. I've found that parameters for those tables were somewhat poorly chosen. Updated parameters just pushed to branch ecc-params-tweak. The size of the tables is unchanged (except for the 192-bit curve, where they are reduced from 15 KB to 12 KB). In my benchmarking, 10%-15% speedup of ecdsa with the 256-, 384- and 521-bit curves, and 24% speedup of eddsa25519 (all for the signature operation, changes for the verify operation are more modest). I target table sizes of around 16 KB per curve. Would it be useful with a configure option to use smaller or larger table size? For the larger curves, one could perhaps get an additional 50% speedup with considerable larger curves. (But due to the requirements for side-channel silence, huge tables are impractical, since each access reads the entire table.) Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

cmac
by Nikos Mavrogiannopoulos 21 Feb '18

21 Feb '18

Hi, The attached patch brings support for AES-128-CMAC. The code is based on the samba code. The rshift and lshift functions come from the AES implementation bundled with samba. regards, Nikos

3 14

[PATCH v2 1/2] Implement PSS encoding functions
by Daiki Ueno 19 Feb '18

19 Feb '18

From: Daiki Ueno <dueno(a)redhat.com> Signed-off-by: Daiki Ueno <dueno(a)redhat.com> --- There was an obvious buffer overrun in mgf1-test.c, which should be fixed in this version. --- Makefile.in | 5 +- mgf1-sha256.c | 47 +++++++++++ mgf1-sha384.c | 47 +++++++++++ mgf1-sha512.c | 47 +++++++++++ mgf1.c | 72 +++++++++++++++++ mgf1.h | 70 ++++++++++++++++ nettle-types.h | 3 + pss-sha256.c | 64 +++++++++++++++ pss-sha512.c | 90 +++++++++++++++++++++ pss.c | 195 +++++++++++++++++++++++++++++++++++++++++++++ pss.h | 105 ++++++++++++++++++++++++ testsuite/.test-rules.make | 6 ++ testsuite/Makefile.in | 4 +- testsuite/mgf1-test.c | 23 ++++++ testsuite/pss-test.c | 35 ++++++++ 15 files changed, 810 insertions(+), 3 deletions(-) create mode 100644 mgf1-sha256.c create mode 100644 mgf1-sha384.c create mode 100644 mgf1-sha512.c create mode 100644 mgf1.c create mode 100644 mgf1.h create mode 100644 pss-sha256.c create mode 100644 pss-sha512.c create mode 100644 pss.c create mode 100644 pss.h create mode 100644 testsuite/mgf1-test.c create mode 100644 testsuite/pss-test.c diff --git a/Makefile.in b/Makefile.in index 135542f..035074c 100644 --- a/Makefile.in +++ b/Makefile.in @@ -110,6 +110,7 @@ nettle_SOURCES = aes-decrypt-internal.c aes-decrypt.c \ md2.c md2-meta.c md4.c md4-meta.c \ md5.c md5-compress.c md5-compat.c md5-meta.c \ memeql-sec.c memxor.c memxor3.c \ + mgf1.c mgf1-sha256.c mgf1-sha384.c mgf1-sha512.c \ nettle-meta-aeads.c nettle-meta-armors.c \ nettle-meta-ciphers.c nettle-meta-hashes.c \ pbkdf2.c pbkdf2-hmac-sha1.c pbkdf2-hmac-sha256.c \ @@ -144,6 +145,7 @@ hogweed_SOURCES = sexp.c sexp-format.c \ pkcs1.c pkcs1-encrypt.c pkcs1-decrypt.c \ pkcs1-rsa-digest.c pkcs1-rsa-md5.c pkcs1-rsa-sha1.c \ pkcs1-rsa-sha256.c pkcs1-rsa-sha512.c \ + pss.c pss-sha256.c pss-sha512.c \ rsa.c rsa-sign.c rsa-sign-tr.c rsa-verify.c \ rsa-pkcs1-sign.c rsa-pkcs1-sign-tr.c rsa-pkcs1-verify.c \ rsa-md5-sign.c rsa-md5-sign-tr.c rsa-md5-verify.c \ @@ -194,9 +196,10 @@ HEADERS = aes.h arcfour.h arctwo.h asn1.h blowfish.h \ md2.h md4.h \ md5.h md5-compat.h \ memops.h memxor.h \ + mgf1.h \ nettle-meta.h nettle-types.h \ pbkdf2.h \ - pgp.h pkcs1.h realloc.h ripemd160.h rsa.h \ + pgp.h pkcs1.h pss.h realloc.h ripemd160.h rsa.h \ salsa20.h sexp.h \ serpent.h sha.h sha1.h sha2.h sha3.h twofish.h \ umac.h yarrow.h poly1305.h diff --git a/mgf1-sha256.c b/mgf1-sha256.c new file mode 100644 index 0000000..11e908c --- /dev/null +++ b/mgf1-sha256.c @@ -0,0 +1,47 @@ +/* mgf1-sha256.c + + PKCS#1 mask generation function 1, based on SHA-256. + + Copyright (C) 2017 Daiki Ueno + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include "mgf1.h" + +#include "nettle-meta.h" + +int +mgf1_sha256(const struct sha256_ctx *hash, size_t mask_length, uint8_t *mask) +{ + struct sha256_ctx state; + return mgf1(hash, &state, &nettle_sha256, mask_length, mask); +} diff --git a/mgf1-sha384.c b/mgf1-sha384.c new file mode 100644 index 0000000..5dd2b07 --- /dev/null +++ b/mgf1-sha384.c @@ -0,0 +1,47 @@ +/* mgf1-sha384.c + + PKCS#1 mask generation function 1, based on SHA-384. + + Copyright (C) 2017 Daiki Ueno + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include "mgf1.h" + +#include "nettle-meta.h" + +int +mgf1_sha384(const struct sha384_ctx *hash, size_t mask_length, uint8_t *mask) +{ + struct sha384_ctx state; + return mgf1(hash, &state, &nettle_sha384, mask_length, mask); +} diff --git a/mgf1-sha512.c b/mgf1-sha512.c new file mode 100644 index 0000000..d1fba5f --- /dev/null +++ b/mgf1-sha512.c @@ -0,0 +1,47 @@ +/* mgf1-sha512.c + + PKCS#1 mask generation function 1, based on SHA-512. + + Copyright (C) 2017 Daiki Ueno + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include "mgf1.h" + +#include "nettle-meta.h" + +int +mgf1_sha512(const struct sha512_ctx *hash, size_t mask_length, uint8_t *mask) +{ + struct sha512_ctx state; + return mgf1(hash, &state, &nettle_sha512, mask_length, mask); +} diff --git a/mgf1.c b/mgf1.c new file mode 100644 index 0000000..a96b086 --- /dev/null +++ b/mgf1.c @@ -0,0 +1,72 @@ +/* mgf1.c + + PKCS#1 mask generation function 1 (RFC-3447). + + Copyright (C) 2017 Daiki Ueno + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include "mgf1.h" + +#include <assert.h> +#include <string.h> + +#include "nettle-internal.h" + +#define MGF1_MIN(a,b) ((a) < (b) ? (a) : (b)) + +int +mgf1(void *seed, void *state, const struct nettle_hash *hash, + size_t mask_length, uint8_t *mask) +{ + TMP_DECL(h, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE); + size_t i, blocks; + uint8_t c[4], *p; + + TMP_ALLOC(h, hash->digest_size); + + blocks = (mask_length + hash->digest_size - 1) / hash->digest_size; + for (i = 0, p = mask; i < blocks; i++, p += hash->digest_size) + { + c[0] = (i >> 24) & 0xFF; + c[1] = (i >> 16) & 0xFF; + c[2] = (i >> 8) & 0xFF; + c[3] = i & 0xFF; + + memcpy(state, seed, hash->context_size); + hash->update(state, 4, c); + hash->digest(state, hash->digest_size, h); + memcpy(p, h, MGF1_MIN(hash->digest_size, mask_length - (p - mask))); + } + + return 1; +} diff --git a/mgf1.h b/mgf1.h new file mode 100644 index 0000000..bbaffce --- /dev/null +++ b/mgf1.h @@ -0,0 +1,70 @@ +/* mgf1.h + + PKCS#1 mask generation function 1 (RFC-3447). + + Copyright (C) 2017 Daiki Ueno + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#ifndef NETTLE_MGF1_H_INCLUDED +#define NETTLE_MGF1_H_INCLUDED + +#include "nettle-meta.h" + +#include "sha1.h" +#include "sha2.h" + +#ifdef __cplusplus +extern "C" +{ +#endif + +/* Namespace mangling */ +#define mgf1 nettle_mgf1 +#define mgf1_sha256 nettle_mgf1_sha256 +#define mgf1_sha384 nettle_mgf1_sha384 +#define mgf1_sha512 nettle_mgf1_sha512 + +int +mgf1(void *seed, void *state, const struct nettle_hash *hash, + size_t mask_length, uint8_t *mask); + +int +mgf1_sha256(const struct sha256_ctx *hash, size_t mask_length, uint8_t *mask); + +int +mgf1_sha384(const struct sha384_ctx *hash, size_t mask_length, uint8_t *mask); + +int +mgf1_sha512(const struct sha512_ctx *hash, size_t mask_length, uint8_t *mask); + +#ifdef __cplusplus +} +#endif + +#endif /* NETTLE_MGF1_H_INCLUDED */ diff --git a/nettle-types.h b/nettle-types.h index 475937d..b687958 100644 --- a/nettle-types.h +++ b/nettle-types.h @@ -103,6 +103,9 @@ typedef int nettle_armor_decode_update_func(void *ctx, typedef int nettle_armor_decode_final_func(void *ctx); +typedef int nettle_mgf_func(void *ctx, size_t mask_length, uint8_t *mask); + + #ifdef __cplusplus } #endif diff --git a/pss-sha256.c b/pss-sha256.c new file mode 100644 index 0000000..9c12037 --- /dev/null +++ b/pss-sha256.c @@ -0,0 +1,64 @@ +/* pss.c + + PKCS#1 RSA-PSS padding, using SHA-256 (RFC-3447). + + Copyright (C) 2017 Daiki Ueno + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include "pss.h" + +int +pss_sha256_encode(mpz_t m, size_t bits, + size_t salt_length, const uint8_t *salt, + const uint8_t *digest) +{ + struct sha256_ctx state; + return pss_encode(m, bits, + &state, &nettle_sha256, + (nettle_mgf_func *) mgf1_sha256, + salt_length, salt, + digest); +} + +int +pss_sha256_verify(mpz_t m, size_t bits, + size_t salt_length, + const uint8_t *digest) +{ + struct sha256_ctx state; + return pss_verify(m, bits, + &state, &nettle_sha256, + (nettle_mgf_func *) mgf1_sha256, + salt_length, + digest); +} diff --git a/pss-sha512.c b/pss-sha512.c new file mode 100644 index 0000000..e24b45d --- /dev/null +++ b/pss-sha512.c @@ -0,0 +1,90 @@ +/* pss.c + + PKCS#1 RSA-PSS padding, using SHA-384 and SHA-512 (RFC-3447). + + Copyright (C) 2017 Daiki Ueno + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include "pss.h" + +int +pss_sha384_encode(mpz_t m, size_t bits, + size_t salt_length, const uint8_t *salt, + const uint8_t *digest) +{ + struct sha384_ctx state; + return pss_encode(m, bits, + &state, &nettle_sha384, + (nettle_mgf_func *) mgf1_sha384, + salt_length, salt, + digest); +} + +int +pss_sha384_verify(mpz_t m, size_t bits, + size_t salt_length, + const uint8_t *digest) +{ + struct sha384_ctx state; + return pss_verify(m, bits, + &state, &nettle_sha384, + (nettle_mgf_func *) mgf1_sha384, + salt_length, + digest); +} + +int +pss_sha512_encode(mpz_t m, size_t bits, + size_t salt_length, const uint8_t *salt, + const uint8_t *digest) +{ + struct sha512_ctx state; + return pss_encode(m, bits, + &state, &nettle_sha512, + (nettle_mgf_func *) mgf1_sha512, + salt_length, salt, + digest); +} + +int +pss_sha512_verify(mpz_t m, size_t bits, + size_t salt_length, + const uint8_t *digest) +{ + struct sha512_ctx state; + return pss_verify(m, bits, + &state, &nettle_sha512, + (nettle_mgf_func *) mgf1_sha512, + salt_length, + digest); +} diff --git a/pss.c b/pss.c new file mode 100644 index 0000000..5dd23a7 --- /dev/null +++ b/pss.c @@ -0,0 +1,195 @@ +/* pss.c + + PKCS#1 RSA-PSS padding (RFC-3447). + + Copyright (C) 2017 Daiki Ueno + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include <assert.h> +#include <string.h> + +#include "pss.h" + +#include "bignum.h" +#include "gmp-glue.h" + +#include "memxor.h" +#include "nettle-internal.h" + +static const uint8_t pss_masks[8] = { + 0xFF, 0x7F, 0x3F, 0x1F, 0xF, 0x7, 0x3, 0x1 +}; + +int +pss_encode(mpz_t m, size_t bits, + void *state, const struct nettle_hash *hash, + nettle_mgf_func mgf, + size_t salt_length, const uint8_t *salt, + const uint8_t *digest) +{ + TMP_GMP_DECL(em, uint8_t); + uint8_t pad[8]; + size_t key_size = (bits + 7) / 8; + size_t j; + + TMP_GMP_ALLOC(em, key_size); + + if (key_size < hash->digest_size + salt_length + 2) + { + TMP_GMP_FREE(em); + return 0; + } + + /* Compute M'. */ + hash->init(state); + memset(pad, 0, 8); + hash->update(state, 8, pad); + hash->update(state, hash->digest_size, digest); + hash->update(state, salt_length, salt); + + /* Store H in EM, right after maskedDB. */ + hash->digest(state, hash->digest_size, em + key_size - hash->digest_size - 1); + + /* Compute dbMask. */ + hash->init(state); + hash->update(state, hash->digest_size, em + key_size - hash->digest_size - 1); + + mgf(state, key_size - hash->digest_size - 1, em); + + /* Compute maskedDB and store it in front of H in EM. */ + for (j = 0; j < key_size - salt_length - hash->digest_size - 2; j++) + em[j] ^= 0; + em[j++] ^= 1; + memxor(em + j, salt, salt_length); + j += salt_length; + + /* Store the trailer field following H. */ + j += hash->digest_size; + *(em + j) = 0xbc; + + /* Clear the leftmost 8 * emLen - emBits of the leftmost octet in EM. */ + *em &= pss_masks[(8 * key_size - bits)]; + + nettle_mpz_set_str_256_u(m, key_size, em); + TMP_GMP_FREE(em); + return 1; +} + +int +pss_verify(mpz_t m, size_t bits, + void *state, const struct nettle_hash *hash, + nettle_mgf_func mgf, + size_t salt_length, + const uint8_t *digest) +{ + TMP_GMP_DECL(em, uint8_t); + TMP_DECL(h2, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE); + uint8_t pad[8], *h, *db, *salt; + size_t key_size = (bits + 7) / 8; + size_t j; + + /* Allocate twice the key size to store the intermediate data DB + * following the EM value. */ + TMP_GMP_ALLOC(em, key_size * 2); + + TMP_ALLOC(h2, hash->digest_size); + + if (key_size < hash->digest_size + salt_length + 2) + { + TMP_GMP_FREE(em); + return 0; + } + + nettle_mpz_get_str_256(key_size, em, m); + + /* Check the trailer field. */ + if (em[key_size - 1] != 0xbc) + { + TMP_GMP_FREE(em); + return 0; + } + + /* Extract H. */ + h = em + (key_size - hash->digest_size - 1); + + /* Check if the leftmost 8 * emLen - emBits bits of the leftmost + * octet of EM are all equal to zero. */ + if ((*em & ~pss_masks[(8 * key_size - bits)]) != 0) + { + TMP_GMP_FREE(em); + return 0; + } + + /* Compute dbMask. */ + hash->init(state); + hash->update(state, hash->digest_size, h); + + db = em + key_size; + mgf(state, key_size - hash->digest_size - 1, db); + + /* Compute DB. */ + memxor(db, em, key_size - hash->digest_size - 1); + + *db &= pss_masks[(8 * key_size - bits)]; + for (j = 0; j < key_size - salt_length - hash->digest_size - 2; j++) + if (db[j] != 0) { + TMP_GMP_FREE(em); + return 0; + } + + /* Check the octet right after PS is 0x1. */ + if (db[j] != 0x1) + { + TMP_GMP_FREE(em); + return 0; + } + salt = db + j + 1; + + /* Compute H'. */ + memset(pad, 0, 8); + hash->init(state); + hash->update(state, 8, pad); + hash->update(state, hash->digest_size, digest); + hash->update(state, salt_length, salt); + hash->digest(state, hash->digest_size, h2); + + /* Check if H' = H. */ + if (memcmp(h2, h, hash->digest_size) != 0) + { + TMP_GMP_FREE(em); + return 0; + } + + TMP_GMP_FREE(em); + return 1; +} diff --git a/pss.h b/pss.h new file mode 100644 index 0000000..1ebe1eb --- /dev/null +++ b/pss.h @@ -0,0 +1,105 @@ +/* pss.h + + PKCS#1 RSA-PSS (RFC-3447). + + Copyright (C) 2017 Daiki Ueno + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#ifndef NETTLE_PSS_H_INCLUDED +#define NETTLE_PSS_H_INCLUDED + +#include "nettle-types.h" +#include "bignum.h" + +#include "mgf1.h" + +#ifdef __cplusplus +extern "C" +{ +#endif + +/* Namespace mangling */ +#define pss_encode nettle_pss_encode +#define pss_verify nettle_pss_verify +#define pss_sha256_encode nettle_pss_sha256_encode +#define pss_sha256_verify nettle_pss_sha256_verify +#define pss_sha384_encode nettle_pss_sha384_encode +#define pss_sha384_verify nettle_pss_sha384_verify +#define pss_sha512_encode nettle_pss_sha512_encode +#define pss_sha512_verify nettle_pss_sha512_verify + +int +pss_encode(mpz_t m, size_t bits, + void *state, const struct nettle_hash *hash, + nettle_mgf_func mgf, + size_t salt_length, const uint8_t *salt, + const uint8_t *digest); + +int +pss_verify(mpz_t m, size_t bits, + void *state, const struct nettle_hash *hash, + nettle_mgf_func mgf, + size_t salt_length, + const uint8_t *digest); + +int +pss_sha256_encode(mpz_t m, size_t bits, + size_t salt_length, const uint8_t *salt, + const uint8_t *digest); + +int +pss_sha256_verify(mpz_t m, size_t bits, + size_t salt_length, + const uint8_t *digest); + +int +pss_sha384_encode(mpz_t m, size_t bits, + size_t salt_length, const uint8_t *salt, + const uint8_t *digest); + +int +pss_sha384_verify(mpz_t m, size_t bits, + size_t salt_length, + const uint8_t *digest); + +int +pss_sha512_encode(mpz_t m, size_t bits, + size_t salt_length, const uint8_t *salt, + const uint8_t *digest); + +int +pss_sha512_verify(mpz_t m, size_t bits, + size_t salt_length, + const uint8_t *digest); + +#ifdef __cplusplus +} +#endif + +#endif /* NETTLE_PSS_H_INCLUDED */ diff --git a/testsuite/.test-rules.make b/testsuite/.test-rules.make index b263e1f..2b4499f 100644 --- a/testsuite/.test-rules.make +++ b/testsuite/.test-rules.make @@ -157,6 +157,9 @@ yarrow-test$(EXEEXT): yarrow-test.$(OBJEXT) pbkdf2-test$(EXEEXT): pbkdf2-test.$(OBJEXT) $(LINK) pbkdf2-test.$(OBJEXT) $(TEST_OBJS) -o pbkdf2-test$(EXEEXT) +mgf1-test$(EXEEXT): mgf1-test.$(OBJEXT) + $(LINK) mgf1-test.$(OBJEXT) $(TEST_OBJS) -o mgf1-test$(EXEEXT) + sexp-test$(EXEEXT): sexp-test.$(OBJEXT) $(LINK) sexp-test.$(OBJEXT) $(TEST_OBJS) -o sexp-test$(EXEEXT) @@ -178,6 +181,9 @@ random-prime-test$(EXEEXT): random-prime-test.$(OBJEXT) pkcs1-test$(EXEEXT): pkcs1-test.$(OBJEXT) $(LINK) pkcs1-test.$(OBJEXT) $(TEST_OBJS) -o pkcs1-test$(EXEEXT) +pss-test$(EXEEXT): pss-test.$(OBJEXT) + $(LINK) pss-test.$(OBJEXT) $(TEST_OBJS) -o pss-test$(EXEEXT) + rsa-sign-tr-test$(EXEEXT): rsa-sign-tr-test.$(OBJEXT) $(LINK) rsa-sign-tr-test.$(OBJEXT) $(TEST_OBJS) -o rsa-sign-tr-test$(EXEEXT) diff --git a/testsuite/Makefile.in b/testsuite/Makefile.in index 689d432..4a9604f 100644 --- a/testsuite/Makefile.in +++ b/testsuite/Makefile.in @@ -30,12 +30,12 @@ TS_NETTLE_SOURCES = aes-test.c arcfour-test.c arctwo-test.c \ hmac-test.c umac-test.c \ meta-hash-test.c meta-cipher-test.c\ meta-aead-test.c meta-armor-test.c \ - buffer-test.c yarrow-test.c pbkdf2-test.c + buffer-test.c yarrow-test.c pbkdf2-test.c mgf1-test.c TS_HOGWEED_SOURCES = sexp-test.c sexp-format-test.c \ rsa2sexp-test.c sexp2rsa-test.c \ bignum-test.c random-prime-test.c \ - pkcs1-test.c rsa-sign-tr-test.c \ + pkcs1-test.c pss-test.c rsa-sign-tr-test.c \ rsa-test.c rsa-encrypt-test.c rsa-keygen-test.c \ dsa-test.c dsa-keygen-test.c \ curve25519-dh-test.c \ diff --git a/testsuite/mgf1-test.c b/testsuite/mgf1-test.c new file mode 100644 index 0000000..967be07 --- /dev/null +++ b/testsuite/mgf1-test.c @@ -0,0 +1,23 @@ +#include "testutils.h" +#include "mgf1.h" + +void +test_main(void) +{ + struct sha256_ctx hash; + struct tstring *expected; + uint8_t mask[120]; + int ret; + + expected = SHEX("cf2db1ac9867debdf8ce91f99f141e5544bf26ca36b3fd4f8e4035" + "eec42cab0d46c386ebccef82ba0bb0b095aaa5548b03cdff695187" + "1c6fb505af68af688332f885d324a47d2145a3d8392c37978d7dc9" + "84c95728950c4cf3de6becc59e60ea506951bd40e6de3863095064" + "3ab2edbb47dc66cb54beb2d1"); + + sha256_init(&hash); + sha256_update(&hash, 3, "abc"); + ret = mgf1_sha256(&hash, 120, mask); + ASSERT(ret == 1); + ASSERT(MEMEQ (120, mask, expected->data)); +} diff --git a/testsuite/pss-test.c b/testsuite/pss-test.c new file mode 100644 index 0000000..2d53e03 --- /dev/null +++ b/testsuite/pss-test.c @@ -0,0 +1,35 @@ +#include "testutils.h" + +#include "pss.h" + +void +test_main(void) +{ + struct tstring *salt; + struct tstring *digest; + mpz_t m; + mpz_t expected; + int ret; + + mpz_init(m); + mpz_init(expected); + + salt = SHEX("11223344556677889900"); + /* From sha256-test.c */ + digest = SHEX("ba7816bf8f01cfea 414140de5dae2223" + "b00361a396177a9c b410ff61f20015ad"); + ret = pss_sha256_encode(m, 1024, salt->length, salt->data, digest->data); + ASSERT(ret == 1); + + mpz_set_str(expected, + "76b9a52705c8382c5367732f993184eff340b6305c9f73e7e308c8" + "004fcc15cbbaab01e976bae4b774628595379a2d448a36b3ea6fa8" + "353b97eeea7bdac93b4b7807ac98cd4b3bebfb31f3718e1dd3625f" + "227fbb8696606498e7070e21c3cbbd7386ea20eb81ac7927e0c6d1" + "d7788826a63af767f301bcc05dd65b00da862cbc", 16); + + ASSERT(mpz_cmp(m, expected) == 0); + + ret = pss_sha256_verify(m, 1024, salt->length, digest->data); + ASSERT(ret == 1); +} -- 2.9.3

5 23

[PATCH] Move expressions with side effects out of asserts
by Dmitry Eremin-Solenikov 18 Feb '18

18 Feb '18

It is wrong to use expressions with side-effects in asserts, they can easily be compiled away. Move them out of assert() macro and just compare the result. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- examples/nettle-openssl.c | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/examples/nettle-openssl.c b/examples/nettle-openssl.c index a0b20d3c2a77..bb2e6627514a 100644 --- a/examples/nettle-openssl.c +++ b/examples/nettle-openssl.c @@ -79,8 +79,10 @@ openssl_evp_set_encrypt_key(void *p, const uint8_t *key, const EVP_CIPHER *cipher) { struct openssl_cipher_ctx *ctx = p; + int ret; ctx->evp = EVP_CIPHER_CTX_new(); - assert(EVP_CipherInit_ex(ctx->evp, cipher, NULL, key, NULL, 1) == 1); + ret = EVP_CipherInit_ex(ctx->evp, cipher, NULL, key, NULL, 1); + assert(ret == 1); EVP_CIPHER_CTX_set_padding(ctx->evp, 0); } static void @@ -88,8 +90,10 @@ openssl_evp_set_decrypt_key(void *p, const uint8_t *key, const EVP_CIPHER *cipher) { struct openssl_cipher_ctx *ctx = p; + int ret; ctx->evp = EVP_CIPHER_CTX_new(); - assert(EVP_CipherInit_ex(ctx->evp, cipher, NULL, key, NULL, 0) == 1); + ret = EVP_CipherInit_ex(ctx->evp, cipher, NULL, key, NULL, 0); + assert(ret == 1); EVP_CIPHER_CTX_set_padding(ctx->evp, 0); } @@ -99,7 +103,8 @@ openssl_evp_encrypt(const void *p, size_t length, { const struct openssl_cipher_ctx *ctx = p; int len; - assert(EVP_EncryptUpdate(ctx->evp, dst, &len, src, length) == 1); + int ret = EVP_EncryptUpdate(ctx->evp, dst, &len, src, length); + assert(ret == 1); } static void openssl_evp_decrypt(const void *p, size_t length, @@ -107,14 +112,16 @@ openssl_evp_decrypt(const void *p, size_t length, { const struct openssl_cipher_ctx *ctx = p; int len; - assert(EVP_DecryptUpdate(ctx->evp, dst, &len, src, length) == 1); + int ret = EVP_DecryptUpdate(ctx->evp, dst, &len, src, length); + assert(ret == 1); } static void openssl_evp_set_nonce(void *p, const uint8_t *nonce) { const struct openssl_cipher_ctx *ctx = p; - assert(EVP_CipherInit_ex(ctx->evp, NULL, NULL, NULL, nonce, -1) == 1); + int ret = EVP_CipherInit_ex(ctx->evp, NULL, NULL, NULL, nonce, -1); + assert(ret == 1); } static void @@ -122,7 +129,8 @@ openssl_evp_update(void *p, size_t length, const uint8_t *src) { const struct openssl_cipher_ctx *ctx = p; int len; - assert(EVP_EncryptUpdate(ctx->evp, NULL, &len, src, length) == 1); + int ret = EVP_EncryptUpdate(ctx->evp, NULL, &len, src, length); + assert(ret == 1); } /* This will work for encryption only! */ @@ -130,7 +138,8 @@ static void openssl_evp_gcm_digest(void *p, size_t length, uint8_t *dst) { const struct openssl_cipher_ctx *ctx = p; - assert(EVP_CIPHER_CTX_ctrl(ctx->evp, EVP_CTRL_GCM_GET_TAG, length, dst) == 1); + int ret = EVP_CIPHER_CTX_ctrl(ctx->evp, EVP_CTRL_GCM_GET_TAG, length, dst); + assert(ret == 1); } static void @@ -139,7 +148,8 @@ openssl_evp_aead_encrypt(void *p, size_t length, { const struct openssl_cipher_ctx *ctx = p; int len; - assert(EVP_EncryptUpdate(ctx->evp, dst, &len, src, length) == 1); + int ret = EVP_EncryptUpdate(ctx->evp, dst, &len, src, length); + assert(ret == 1); } static void @@ -148,7 +158,8 @@ openssl_evp_aead_decrypt(void *p, size_t length, { const struct openssl_cipher_ctx *ctx = p; int len; - assert(EVP_DecryptUpdate(ctx->evp, dst, &len, src, length) == 1); + int ret = EVP_DecryptUpdate(ctx->evp, dst, &len, src, length); + assert(ret == 1); } /* AES */ -- 2.16.1

2 1

[PATCH 1/2] Provide wrappers around OpenSSL AES GCM
by Dmitry Eremin-Solenikov 17 Feb '18

17 Feb '18

For benchmarking purposes provide wrappers around OpenSSL AES GCM implementation. Note, digest callback will work only for encryption due to OpenSSL internals. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- examples/nettle-openssl.c | 109 +++++++++++++++++++++++++++++++++++++++++++++- nettle-internal.h | 3 ++ 2 files changed, 110 insertions(+), 2 deletions(-) diff --git a/examples/nettle-openssl.c b/examples/nettle-openssl.c index b549ba54..a0b20d3c 100644 --- a/examples/nettle-openssl.c +++ b/examples/nettle-openssl.c @@ -80,7 +80,7 @@ openssl_evp_set_encrypt_key(void *p, const uint8_t *key, { struct openssl_cipher_ctx *ctx = p; ctx->evp = EVP_CIPHER_CTX_new(); - assert(EVP_EncryptInit_ex(ctx->evp, cipher, NULL, key, NULL) == 1); + assert(EVP_CipherInit_ex(ctx->evp, cipher, NULL, key, NULL, 1) == 1); EVP_CIPHER_CTX_set_padding(ctx->evp, 0); } static void @@ -89,7 +89,7 @@ openssl_evp_set_decrypt_key(void *p, const uint8_t *key, { struct openssl_cipher_ctx *ctx = p; ctx->evp = EVP_CIPHER_CTX_new(); - assert(EVP_DecryptInit_ex(ctx->evp, cipher, NULL, key, NULL) == 1); + assert(EVP_CipherInit_ex(ctx->evp, cipher, NULL, key, NULL, 0) == 1); EVP_CIPHER_CTX_set_padding(ctx->evp, 0); } @@ -110,6 +110,47 @@ openssl_evp_decrypt(const void *p, size_t length, assert(EVP_DecryptUpdate(ctx->evp, dst, &len, src, length) == 1); } +static void +openssl_evp_set_nonce(void *p, const uint8_t *nonce) +{ + const struct openssl_cipher_ctx *ctx = p; + assert(EVP_CipherInit_ex(ctx->evp, NULL, NULL, NULL, nonce, -1) == 1); +} + +static void +openssl_evp_update(void *p, size_t length, const uint8_t *src) +{ + const struct openssl_cipher_ctx *ctx = p; + int len; + assert(EVP_EncryptUpdate(ctx->evp, NULL, &len, src, length) == 1); +} + +/* This will work for encryption only! */ +static void +openssl_evp_gcm_digest(void *p, size_t length, uint8_t *dst) +{ + const struct openssl_cipher_ctx *ctx = p; + assert(EVP_CIPHER_CTX_ctrl(ctx->evp, EVP_CTRL_GCM_GET_TAG, length, dst) == 1); +} + +static void +openssl_evp_aead_encrypt(void *p, size_t length, + uint8_t *dst, const uint8_t *src) +{ + const struct openssl_cipher_ctx *ctx = p; + int len; + assert(EVP_EncryptUpdate(ctx->evp, dst, &len, src, length) == 1); +} + +static void +openssl_evp_aead_decrypt(void *p, size_t length, + uint8_t *dst, const uint8_t *src) +{ + const struct openssl_cipher_ctx *ctx = p; + int len; + assert(EVP_DecryptUpdate(ctx->evp, dst, &len, src, length) == 1); +} + /* AES */ static nettle_set_key_func openssl_aes128_set_encrypt_key; static nettle_set_key_func openssl_aes128_set_decrypt_key; @@ -175,6 +216,70 @@ nettle_openssl_aes256 = { openssl_evp_encrypt, openssl_evp_decrypt }; +/* AES-GCM */ +static void +openssl_gcm_aes128_set_encrypt_key(void *ctx, const uint8_t *key) +{ + openssl_evp_set_encrypt_key(ctx, key, EVP_aes_128_gcm()); +} +static void +openssl_gcm_aes128_set_decrypt_key(void *ctx, const uint8_t *key) +{ + openssl_evp_set_decrypt_key(ctx, key, EVP_aes_128_gcm()); +} + +static void +openssl_gcm_aes192_set_encrypt_key(void *ctx, const uint8_t *key) +{ + openssl_evp_set_encrypt_key(ctx, key, EVP_aes_192_gcm()); +} +static void +openssl_gcm_aes192_set_decrypt_key(void *ctx, const uint8_t *key) +{ + openssl_evp_set_decrypt_key(ctx, key, EVP_aes_192_gcm()); +} + +static void +openssl_gcm_aes256_set_encrypt_key(void *ctx, const uint8_t *key) +{ + openssl_evp_set_encrypt_key(ctx, key, EVP_aes_256_gcm()); +} +static void +openssl_gcm_aes256_set_decrypt_key(void *ctx, const uint8_t *key) +{ + openssl_evp_set_decrypt_key(ctx, key, EVP_aes_256_gcm()); +} + +const struct nettle_aead +nettle_openssl_gcm_aes128 = { + "openssl gcm_aes128", sizeof(struct openssl_cipher_ctx), + 16, 16, 12, 16, + openssl_gcm_aes128_set_encrypt_key, openssl_gcm_aes128_set_decrypt_key, + openssl_evp_set_nonce, openssl_evp_update, + openssl_evp_aead_encrypt, openssl_evp_aead_decrypt, + openssl_evp_gcm_digest +}; + +const struct nettle_aead +nettle_openssl_gcm_aes192 = { + "openssl gcm_aes192", sizeof(struct openssl_cipher_ctx), + 16, 24, 12, 16, + openssl_gcm_aes192_set_encrypt_key, openssl_gcm_aes192_set_decrypt_key, + openssl_evp_set_nonce, openssl_evp_update, + openssl_evp_aead_encrypt, openssl_evp_aead_decrypt, + openssl_evp_gcm_digest +}; + +const struct nettle_aead +nettle_openssl_gcm_aes256 = { + "openssl gcm_aes256", sizeof(struct openssl_cipher_ctx), + 16, 32, 12, 16, + openssl_gcm_aes256_set_encrypt_key, openssl_gcm_aes256_set_decrypt_key, + openssl_evp_set_nonce, openssl_evp_update, + openssl_evp_aead_encrypt, openssl_evp_aead_decrypt, + openssl_evp_gcm_digest +}; + /* Arcfour */ static void openssl_arcfour128_set_encrypt_key(void *ctx, const uint8_t *key) diff --git a/nettle-internal.h b/nettle-internal.h index 0b0d25c9..38c8d2a8 100644 --- a/nettle-internal.h +++ b/nettle-internal.h @@ -76,6 +76,9 @@ extern const struct nettle_aead nettle_arcfour128; extern const struct nettle_aead nettle_chacha; extern const struct nettle_aead nettle_salsa20; extern const struct nettle_aead nettle_salsa20r12; +extern const struct nettle_aead nettle_openssl_gcm_aes128; +extern const struct nettle_aead nettle_openssl_gcm_aes192; +extern const struct nettle_aead nettle_openssl_gcm_aes256; /* Glue to openssl, for comparative benchmarking. Code in * examples/nettle-openssl.c. */ -- 2.11.0

5 16

Re: Miscomputation with big-endian arm asm
by Michael Weiser 13 Feb '18

13 Feb '18

Hi Niels, thanks for getting back to me so quickly. On Tue, Feb 06, 2018 at 07:36:22PM +0100, Niels Möller wrote: > > Is there maybe a problem with the list or my email that you can discern? > None previously known to me (it's a plain mailman installation). I think > the most commonly used way to subscribe is to use the web frontend, and > then go to the link in the confirmation email using a web browser. Mhmm, with another From address and a few more tries I now got myself subscribed. Before that I had a number of confirmation emails leave my server and be accepted by mail.lysator.liu.se but the responses never getting back to my server even with that other From address. Anywho, I'll leave all the quoted text for now so people can myabe still pick up on the conversion. Sorry for the mess. > >> I just ran into a problem where gnutls's certificate verification fails > >> only on big-endian arm Linux boards but not on the otherwise identical > >> little-endian ones. After recompiling nettle with --disable-assembler > >> the problem goes away on big-endian arm as well. Considering that > >> big-endian arm isn't all that common, I suspect nettle's optimised arm > >> asm might have some endianness issues. > I have done no testing on big-endian arm. My recent big-endian tests > have been on the ultrasparc t5 in the gcc compile farm > (gcc202.fsffrance.org), and locally using debian's mips cross compiler > and qemu. So I'm fairly confident that the C code is endian-safe. > Lots of questions, since I'm unfamiliar with such systems: > What board and linux (dist?) are you running this on? I have a number of Cubieboard2s that run Gentoo Linux with a vanilla, mainline Linus kernel. # uname -a Linux b 4.15.0-gentoo #2 SMP Sun Feb 4 18:46:30 CET 2018 armv7b ARMv7 Processor rev 4 (v7b) Allwinner sun7i (A20) Family GNU/Linux The only difference between little- and big-endian boards is the following Linux kernel config options: -# CONFIG_CPU_BIG_ENDIAN is not set +CONFIG_CPU_BIG_ENDIAN=y +CONFIG_CPU_ENDIAN_BE8=y This makes the kernel switch the CPU to big-endian mode on boot. Userland is big-endian as well. Big-endian on ARM is somewhat curious in that instruction encoding stays little-endian but loads and stores use big-endian byte order - if the CPU is in that mode. It can be switched back and forth at will and it basically only changes where it starts loading/storing bytes and in which order it continues. Because that would be too easy, it has two different big-endian operating modes called BE32 and BE8. From what I understand, BE32 actually stores bytes the same order as little-endian in memory but redirects accesses to individual bytes of words to make them appear to be stored big-endian while BE8 actually stores words in big-endian byte order and accesses individual bytes directly. The gory details are here if you're interested: http://infocenter.arm.com/help/topic/com.arm.doc.ddi0290g/ch06s05s01.html. https://blog.richliu.com/2010/04/08/907/arm11-be8-and-be32 BE32 is deprecated, newer cores don't even support it. I'm running BE8, so kernel and userland are BE8: # file /usr/bin/nettle-hash /usr/bin/nettle-hash: ELF 32-bit MSB shared object, ARM, EABI5 BE8 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, for GNU/Linux 3.2.0, stripped > What's the host triplet? armv7veb-hardfloat-linux-gnueabi gcc: Using built-in specs. COLLECT_GCC=gcc COLLECT_LTO_WRAPPER=/usr/libexec/gcc/armv7veb-hardfloat-linux-gnueabi/7.2.0/lto-wrapper Target: armv7veb-hardfloat-linux-gnueabi Configured with: /var/tmp/portage/sys-devel/gcc-7.2.0-r1/work/gcc-7.2.0/configure --host=armv7veb-hardfloat-linux-gnueabi --build=armv7veb-hardfloat-linux-gnueabi --prefix=/usr --bindir=/usr/armv7veb-hardfloat-linux-gnueabi/gcc-bin/7.2.0 --includedir=/usr/lib/gcc/armv7veb-hardfloat-linux-gnueabi/7.2.0/include --datadir=/usr/share/gcc-data/armv7veb-hardfloat-linux-gnueabi/7.2.0 --mandir=/usr/share/gcc-data/armv7veb-hardfloat-linux-gnueabi/7.2.0/man --infodir=/usr/share/gcc-data/armv7veb-hardfloat-linux-gnueabi/7.2.0/info --with-gxx-include-dir=/usr/lib/gcc/armv7veb-hardfloat-linux-gnueabi/7.2.0/include/g++-v7 --with-python-dir=/share/gcc-data/armv7veb-hardfloat-linux-gnueabi/7.2.0/python --enable-languages=c,c++ --enable-obsolete --enable-secureplt --disable-werror --with-system-zlib --disable-nls --enable-checking=release --with-bugurl=https://bugs.gentoo.org/ --with-pkgversion='Gentoo Hardened 7.2.0-r1 p1.1' --enable-esp --enable-libstdcxx-time --disable-libstdcxx-pch --enable-shared --enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu --disable-multilib --disable-altivec --disable-fixed-point --with-float=hard --with-float=hard --with-fpu=vfpv3-d16 --disable-libgcj --disable-libgomp --disable-libmudflap --disable-libssp --disable-libcilkrts --disable-libmpx --enable-vtable-verify --enable-libvtv --disable-libquadmath --enable-lto --without-isl --disable-libsanitizer --enable-default-pie --enable-default-ssp --with-arch=armv7ve Thread model: posix gcc version 7.2.0 (Gentoo Hardened 7.2.0-r1 p1.1) > Are you cross compiling, or compiling natively? It's all native on the board. I have a cross-toolchain and qemu on standby on x86_64 if necessary. > Does configure detect it as big-endian (check for WORDS_BIGENDIAN in config.h)? It seems so: nettle-3.4 # grep WORDS_BIG config.h /* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most # define WORDS_BIGENDIAN 1 # ifndef WORDS_BIGENDIAN # define WORDS_BIGENDIAN 1 > Which of nettle's own tests (make check) fail? With --disable-assembler all checks pass. Here's the make check output with arm asm: PASS: aes PASS: arcfour PASS: arctwo PASS: blowfish PASS: cast128 PASS: base16 PASS: base64 PASS: camellia Error, expected: 3e00ef2f895f40d6 7f5bb8e81f09a5a1 2c840ec3ce9a7f3b 181be188ef711a1e 984ce172b9216f41 9f445367456d5619 314a42a3da86b001 387bfdb80e0cfe42 Got: 4c4389ad2c1a14e5 9a58af4d26f726c8 2beb7f103f529dc2 a8a203e7c69fb546 141dc7988d5106d1 c03d895bb6576d0f 9718ecc1ae929e8d c8dc1f6ee7038bbb ../run-tests: line 57: 7819 Aborted "$1" $testflags FAIL: chacha PASS: des PASS: des3 PASS: des-compat PASS: md2 PASS: md4 PASS: md5 PASS: md5-compat PASS: memeql Assert failed: memxor-test.c:106: MEMEQ (size, dst, c) ../run-tests: line 57: 7865 Aborted "$1" $testflags FAIL: memxor PASS: gosthash94 PASS: ripemd160 Got: f278b7b482ad71f2 83dcb4f9fe864547 5ed675894046fbeb 59de3b76052dfd99 Expected: 077709362c2e32df 0ddc3f0dc47bba63 90b6c73bb50f9c31 22ec844ad7c2b3e5 ../run-tests: line 57: 7881 Aborted "$1" $testflags FAIL: hkdf Encrypt failed: Input: 0000000000000000 Output: 0ab22555fbcab5ce Expected: fc207dbfc76c5e17 ../run-tests: line 57: 7887 Aborted "$1" $testflags FAIL: salsa20 Got: 9844f81e1408f6ec b932137d33bed7cf dcf518a3 Expected: da39a3ee5e6b4b0d 3255bfef95601890 afd80709 ../run-tests: line 57: 7893 Aborted "$1" $testflags FAIL: sha1 Got: 51a8a435f33f1941 a7646a966b9f99e5 095b59c1072c0acd 2a893d99 Expected: 23097d223405d822 8642a477bda255b3 2aadbce4bda0b3f7 e36c9da7 ../run-tests: line 57: 7899 Aborted "$1" $testflags FAIL: sha224 Got: 312892d3e4bda557 75e12e46320ed33a 329b15d73167b830 ec07ba0845c7b4cf Expected: ba7816bf8f01cfea 414140de5dae2223 b00361a396177a9c b410ff61f20015ad ../run-tests: line 57: 7905 Aborted "$1" $testflags FAIL: sha256 PASS: sha384 PASS: sha512 PASS: sha512-224 PASS: sha512-256 PASS: sha3-permute PASS: sha3-224 PASS: sha3-256 PASS: sha3-384 PASS: sha3-512 PASS: serpent PASS: twofish PASS: version PASS: knuth-lfib PASS: cbc PASS: cfb PASS: ctr PASS: gcm PASS: eax CCM digest failed: Adata: 0001020304050607 Input: 20212223 Output: 98055abb Expected: 4dac255d ../run-tests: line 57: 8001 Aborted "$1" $testflags FAIL: ccm PASS: poly1305 Assert failed: testutils.c:619: MEMEQ(length, data, ciphertext->data) ../run-tests: line 57: 8012 Aborted "$1" $testflags FAIL: chacha-poly1305 Assert failed: hmac-test.c:205: MEMEQ ((tstring_hex("b617318655057264 e28bc0b6fb378c8e f146be00"))->length, digest, (tstring_hex("b617318655057264 e28bc0b6fb378c8e f146be00"))->data) ../run-tests: line 57: 8018 Aborted "$1" $testflags FAIL: hmac umac32 failed msg: length: 0 tag: 9f972a17 ref: 113145fb ../run-tests: line 57: 8024 Aborted "$1" $testflags FAIL: umac PASS: meta-hash PASS: meta-cipher PASS: meta-aead PASS: meta-armor PASS: buffer Assert failed: yarrow-test.c:185: memcmp(digest, expected_input, sizeof(digest)) == 0 ../run-tests: line 57: 8055 Aborted "$1" $testflags FAIL: yarrow Assert failed: pbkdf2-test.c:38: MEMEQ ((tstring_hex("0c60c80f961f0e71f3a9b524af6012062fe037a6"))->length, dk, (tstring_hex("0c60c80f961f0e71f3a9b524af6012062fe037a6"))->data) ../run-tests: line 57: 8061 Aborted "$1" $testflags FAIL: pbkdf2 Assert failed: pss-mgf1-test.c:22: MEMEQ (expected->length, mask, expected->data) ../run-tests: line 57: 8067 Aborted "$1" $testflags FAIL: pss-mgf1 PASS: sexp PASS: sexp-format PASS: rsa2sexp PASS: sexp2rsa PASS: bignum PASS: random-prime PASS: pkcs1 Assert failed: pss-test.c:29: mpz_cmp(m, expected) == 0 ../run-tests: line 57: 8108 Aborted "$1" $testflags FAIL: pss PASS: rsa-sign-tr Assert failed: rsa-pss-sign-tr-test.c:72: mpz_cmp(signature, expected) == 0 ../run-tests: line 57: 8119 Aborted "$1" $testflags FAIL: rsa-pss-sign-tr Assert failed: testutils.c:1004: mpz_cmp (signature, expected) == 0 ../run-tests: line 57: 8125 Aborted "$1" $testflags FAIL: rsa PASS: rsa-encrypt Assert failed: testutils.c:1004: mpz_cmp (signature, expected) == 0 ../run-tests: line 57: 8136 Aborted "$1" $testflags FAIL: rsa-keygen Assert failed: testutils.c:1189: mpz_cmp (signature.r, expected->r) == 0 && mpz_cmp (signature.s, expected->s) == 0 ../run-tests: line 57: 8142 Aborted "$1" $testflags FAIL: dsa PASS: dsa-keygen PASS: curve25519-dh PASS: ecc-mod PASS: ecc-modinv PASS: ecc-redc PASS: ecc-sqrt PASS: ecc-dup PASS: ecc-add PASS: ecc-mul-g PASS: ecc-mul-a PASS: ecdsa-sign PASS: ecdsa-verify PASS: ecdsa-keygen PASS: ecdh PASS: eddsa-compress PASS: eddsa-sign PASS: eddsa-verify PASS: ed25519 PASS: cxx PASS: sexp-conv 1c1 < 2de201fee759dffb05a5ff127f4b0b134bf10f466cf174ebff52d387e551225a61e30ec850c38681574a1a8cefa1aa6030481cebc92268863871796ed1afd017969a1d70bb1c936fa1a71a975ddcc07a8d492d6caf5942182b03fa69fea603d904e1cd7c2c9f78e060662d7cf5ec2a5d5af7988e3054513f9f356b749360ec13 --- > 5c96ffe7e925224ce6e98648bf2ed3193cab2fc82af9c7fa7fdc5b623bde1d77c5409129d16d1127ae4fad519c24059fe85f4a4360a900f3dee906e6de2ecd010fa56c02d3f7d0772d43439464a91b025722a6f0b6cb65aee1017b29aff4511f90315caae0be74c2ac496474896e7e3ad200cb7c609ddef5c674272964e4b780 FAIL: pkcs1-conv test1.out test2.out differ: char 1, line 1 FAIL: nettle-pbkdf2 PASS: symbols PASS: dlopen ===================== 21 of 94 tests failed ===================== make[1]: *** [Makefile:136: check] Error 1 Looks bad. > >> I've not narrowed this down to a proper test case yet because I'm > >> wondering if this is even warrants digging into. Might this be an easy > >> fix or do I have to expect this to get so involved that I might just as > >> well just disable asm on big-endian arm and leave it at that? I *am* all > >> set to dive into this to provide a better test case and perhaps even > >> patch - just asking for the odds to solve this with only a beginner's > >> arm asm skills. > >> > >> Note how all the SHA1/256 digests below differ for the same certificate. > >From these symptoms, the main suspect is the data load in > arm/v6/sha1-compress.asm (see the LOAD macro) and > arm/v6/sha256-compress.asm (look at the code after the .Lcopy label). > As a quick test, you could try just deleting all use of the "rev" > instruction in those two files. > I'm not sure what's needed to properly support big-endian there, maybe > deleting rev isn't enough, one might also need to shift differently in > the unaligned case. If you want to use the same assembly source file for > both big- and little-endian, with only some m4 ifelse to do conditional > things in the asm files, you should let configure substitute something > in config.m4.in to test on. Yes, the masking and shifting needs some adjustment, too. I got sha1-test to succeed with below patch. What do you think: Could we go some route like that for the other arm asm code as well? I'd be willing to throw in aarch64 as well because I've got some Pine64s running BE floating around also. :) > The aes code also loads unaligned data, but it reads it byte-by-byte, > without the tricks to use aligned word loads + rotate + sel. > Before attempting to support big-endian arm, I'd need some idea on how > to test it. Any halfway current ARM cross toolchain should be able to also output big-endian arm binaries (-mbig-endian). Then you could test those with qemu-user-armeb, which is very light-weight in that it doesn't need a kernel or emulated system and allows to run binaries directly. > If it's hard for me to test, the safest change may be to > just disable all arm assembly on big-endian. I'm not ready to go there yet. Poking around ARM ASM unexpectedly is fun. :) >From f876368b333c72878808e74a0af5aa631d42d357 Mon Sep 17 00:00:00 2001 From: Michael Weiser <michael.weiser(a)gmx.de> Date: Wed, 7 Feb 2018 00:11:24 +0100 Subject: [PATCH] Support big-endian arm in sha1 armv6 assembly code --- arm/v6/sha1-compress.asm | 10 ++++++++++ asm.m4 | 10 ++++++++++ config.m4.in | 1 + configure.ac | 2 ++ 4 files changed, 23 insertions(+) diff --git a/arm/v6/sha1-compress.asm b/arm/v6/sha1-compress.asm index 59d6297e..116a80f0 100644 --- a/arm/v6/sha1-compress.asm +++ b/arm/v6/sha1-compress.asm @@ -52,7 +52,9 @@ define(<LOAD>, < sel W, WPREV, T0 ror W, W, SHIFT mov WPREV, T0 +NOT_IF_BE(< rev W, W +>) str W, [SP,#eval(4*$1)] >) define(<EXPN>, < @@ -127,8 +129,16 @@ PROLOGUE(_nettle_sha1_compress) lsl SHIFT, SHIFT, #3 mov T0, #0 movne T0, #-1 +IF_BE(< + lsr W, T0, SHIFT +>, < lsl W, T0, SHIFT +>) uadd8 T0, T0, W C Sets APSR.GE bits +IF_BE(< + neg SHIFT, SHIFT C Rotate right by 32-SHIFT bits + add SHIFT, SHIFT, #32 C because there's no rotate left +>, <>) ldr K, .LK1 ldm STATE, {SA,SB,SC,SD,SE} diff --git a/asm.m4 b/asm.m4 index 4018c235..34e39317 100644 --- a/asm.m4 +++ b/asm.m4 @@ -51,6 +51,16 @@ define(<ALIGN>, <.align ifelse(ALIGN_LOG,yes,<m4_log2($1)>,$1) >) +define(<IF_BE>, +<ifelse(WORDS_BIGENDIAN,yes, +<$1>, +<$2>)>) + +define(<NOT_IF_BE>, +<ifelse(WORDS_BIGENDIAN,no, +<$1>, +<>)>) + dnl Struct defining macros dnl STRUCTURE(prefix) diff --git a/config.m4.in b/config.m4.in index e39c880c..11f90a40 100644 --- a/config.m4.in +++ b/config.m4.in @@ -7,6 +7,7 @@ define(<TYPE_PROGBITS>, <@ASM_TYPE_PROGBITS@>)dnl define(<ALIGN_LOG>, <@ASM_ALIGN_LOG@>)dnl define(<W64_ABI>, <@W64_ABI@>)dnl define(<RODATA>, <@ASM_RODATA@>)dnl +define(<WORDS_BIGENDIAN>, <@ASM_WORDS_BIGENDIAN@>)dnl divert(1) @ASM_MARK_NOEXEC_STACK@ divert diff --git a/configure.ac b/configure.ac index 41bf0998..5db72be8 100644 --- a/configure.ac +++ b/configure.ac @@ -691,6 +691,7 @@ ASM_TYPE_FUNCTION='@function' ASM_TYPE_PROGBITS='@progbits' ASM_MARK_NOEXEC_STACK='' ASM_ALIGN_LOG='' +ASM_WORDS_BIGENDIAN="$ac_cv_c_bigendian" if test x$enable_assembler = xyes ; then AC_CACHE_CHECK([if globals are prefixed by underscore], @@ -811,6 +812,7 @@ AC_SUBST(ASM_TYPE_PROGBITS) AC_SUBST(ASM_MARK_NOEXEC_STACK) AC_SUBST(ASM_ALIGN_LOG) AC_SUBST(W64_ABI) +AC_SUBST(ASM_WORDS_BIGENDIAN) AC_SUBST(EMULATOR) AC_SUBST(LIBNETTLE_MAJOR) -- 2.16.1 -- Thanks, Michael

3 7

Re: x86 sha_ni
by nisse＠lysator.liu.se 08 Feb '18

08 Feb '18

Jeffrey Walton <noloader(a)gmail.com> writes: > Looks good on a Celeron J3455, which is a [low-end] Goldmont machine > with the instructions: [...] > goldmont:nettle$ LD_LIBRARY_PATH=.lib:/usr/local/lib64/ > ./examples/nettle-benchmark > sha1_compress: 84.60 cycles 85 cycles is a lot less than than 136 cycles I observed in my testing. The function is 131 instructions long, so it's approximately 1.5 instructions per cycle. > sha1 update 1194.33 > openssl sha1 update 1321.71 And this is a 11% difference (compared to 8% in my benckmarks). Makes sense if the main crunching is fewer cycles, then the per block function call overhead is relatively larger. > A small suggestion may be to update Section 8 Installation > (https://www.lysator.liu.se/~nisse/nettle/nettle.html). It was not > obvious to me how to enable the hardware acceleration. There's an --enable-x86-aesni configure option which should enable the aesni code unconditionally in non-fat builds. And an --enable-arm-neon. But it seems I forgot to add a corresponding --enable-x86-sha-ni. But --enable-fat is the most common way to enable the support. I'm considering enabling it by default in the next release. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

2 1

[Jeffrey Walton] Fwd: x86 sha_ni
by nisse＠lysator.liu.se 08 Feb '18

08 Feb '18

Forwarded to the list. ---------- Forwarded message ---------- From: Jeffrey Walton <noloader(a)gmail.com> To: "Niels Möller" <nisse(a)lysator.liu.se> Cc: nettle-bugs(a)lists.lysator.liu.se Bcc: Date: Thu, 8 Feb 2018 16:34:43 -0500 Subject: Re: x86 sha_ni On Thu, Feb 8, 2018 at 12:18 PM, Niels Möller <nisse(a)lysator.liu.se> wrote: > nisse(a)lysator.liu.se (Niels Möller) writes: > >> Below replacement for sha1-compress.asm seems to run on roughly 2 >> cycles/byte when I benchmark it on an "AMD Ryzen 7 1700X" cpu in the gcc >> compile farm. Still sligthly slower than openssl, to squeeze out a few >> more cycles, it might help to change the sha1_compress interface to let >> it process more than one 64-byte block at a time. >> >> I hope to be able to wire it up via fat-x86_64.c reasonably soon. In the >> mean time, if anyone wants to try it out, just change the >> sha1-compress.asm symlink to point to this file. > > Enabled via fat-x86_64 now, and pushed to a branch named > x86_64-sha_ni-sha1. Looks good on a Celeron J3455, which is a [low-end] Goldmont machine with the instructions: goldmont:nettle$ autoreconf -f -i ... goldmont:nettle$ ./configure --enable-fat ... goldmont:nettle$ make && make check ... goldmont:nettle$ LD_LIBRARY_PATH=.lib:/usr/local/lib64/ ./examples/nettle-benchmark sha1_compress: 84.60 cycles salsa20_core: 282.80 cycles sha3_permute: 1542.60 cycles (64.27 / round) benchmark call overhead: 0.001604 us Algorithm mode Mbyte/s ... md2 update 6.90 md4 update 568.11 md5 update 384.08 openssl md5 update 443.76 sha1 update 1194.33 openssl sha1 update 1321.71 sha224 update 110.31 sha256 update 110.10 sha384 update 174.32 sha512 update 173.99 sha512-224 update 174.35 sha512-256 update 174.16 sha3_224 update 136.77 sha3_256 update 129.46 sha3_384 update 99.23 sha3_512 update 69.25 ripemd160 update 161.00 gosthash94 update 39.48 umac32 update 6560.05 umac64 update 3130.26 umac96 update 2457.21 umac128 update 1936.56 poly1305-aes update 914.79 ... A small suggestion may be to update Section 8 Installation (https://www.lysator.liu.se/~nisse/nettle/nettle.html). It was not obvious to me how to enable the hardware acceleration. A quick sentence on how to enable AES-NI and SHA would make it obvious for future readers. (Thanks for the offline help). Jeff -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

easier version checks
by Nikos Mavrogiannopoulos 08 Feb '18

08 Feb '18

What about extending the macros in version.h with a simple to use combined version number?

2 2

Performance of AESNI impl vs other crypto libraries
by Daniel P. Berrange 01 Feb '18

01 Feb '18

I wrote a crude/simple test program to compare the performance of AES-128-CBC across openssl, gcrypt, nettle and gnutls, and was surprised to find that nettle is consistently ~25% slower than the other libraries for its AESNI implementation. On my Core i7-6820HQ I get nettle: 850 MB/s gcrypt: 1172 MB/s gnutls: 1230 MB/s openssl: 1153 MB/s with versions nettle-3.3-2.fc26.x86_64 libgcrypt-1.7.8-1.fc26.x86_64 gnutls-3.5.14-1.fc26.x86_64 openssl-1.1.0f-7.fc26.x86_64 And on Xeon E5-2609 I get nettle: 325 MB/s gcrypt: 403 MB/s gnutls: 414 MB/s openssl: 414 MB/s with versions nettle-3.3-1.fc25.x86_64 libgcrypt-1.7.8-1.fc25.x86_64 gnutls-3.5.14-1.fc25.x86_64 openssl-1.0.2k-1.fc25.x86_64 Naively I would have expected them all to be pretty much equal given that they're delegating to the same hardware routines. Has anyone else done comparative benchmarks of nettle's impl against others & seen the same kind of results ? I'll attach my test program to this mail, so if I made a mistake in usage there feel free to point it out. FWIW, I also found there is some wierd interaction between nettle and glibc-2.23. If I have that glibc version and run with NETTLE_FAT_VERBOSE=1 it claims it is picking the AESNI impl, but the performance figures clearly show it is actually running the pure software impl because they're 100 MB/s instead of 325 MB/s. I upgraded to glibc 2.24 and this wierdness went away, so I've not investigated that further. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

5 20

Build system bug with assembler and clang
by blargh 23 Jan '18

23 Jan '18

Hi, I've been building nettle with Clang from a generated toolchain with the latest Android NDK (16b). Form architecture with available assembler code (x86 in particular), compilation fails because the generated asm is not compatible with clang. So I use --disable-assembler, thinking it would fix the problem. But it still fails (see log below): The workaround has been to entirely disable (comment) the asm rule in Makefile.in: #.asm.$(OBJEXT): $(srcdir)/asm.m4 machine.m4 config.m4 # $(M4) $(srcdir)/asm.m4 machine.m4 config.m4 $< >$*.s # $(COMPILE) -c $*.s # @echo "$@ : $< $(srcdir)/asm.m4 machine.m4 config.m4" >$@.d For some reason, this rule generates asm files even when --disable-assembler is specified and it gets in the way later in the build. The proper fix would be to make sure this rule never kicks in with --disable-assembler. And also maybe force --disable-assembler when clang is the compiler, or update the asm generation macro (asm.m4) to produce .s files compatible with clang. ///////// Version: nettle 3.4 Host type: x86-unknown-none ABI: standard Assembly files: none Install prefix: /home/bobbie/ffmpeg-android-3.4.1/toolchain-android Library directory: ${exec_prefix}/lib Compiler: /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot Static libraries: yes Shared libraries: no Public key crypto: yes Using mini-gmp: no Documentation: no make install-here make[1]: Entering directory `/home/bobbie/ffmpeg-android-3.4.1/nettle-3.4' /bin/mkdir -p /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include/nettle /usr/bin/m4 ./asm.m4 machine.m4 config.m4 aes-decrypt-internal.asm >aes-decrypt-internal.s /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot -I. -DHAVE_CONFIG_H -I/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-decrypt.o -MD -MP -MF aes-decrypt.o.d -c aes-decrypt.c \ && true for f in aes.h arcfour.h arctwo.h asn1.h blowfish.h base16.h base64.h bignum.h buffer.h camellia.h cast128.h cbc.h ccm.h cfb.h chacha.h chacha-poly1305.h ctr.h curve25519.h des.h des-compat.h dsa.h dsa-compat.h eax.h ecc-curve.h ecc.h ecdsa.h eddsa.h gcm.h gosthash94.h hmac.h knuth-lfib.h hkdf.h macros.h md2.h md4.h md5.h md5-compat.h memops.h memxor.h nettle-meta.h nettle-types.h pbkdf2.h pgp.h pkcs1.h pss.h pss-mgf1.h realloc.h ripemd160.h rsa.h salsa20.h sexp.h serpent.h sha.h sha1.h sha2.h sha3.h twofish.h umac.h yarrow.h poly1305.h nettle-stdint.h version.h ; do \ if [ -f "$f" ] ; then \ /usr/bin/install -c -m 644 "$f" /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include/nettle ; \ else \ /usr/bin/install -c -m 644 "./$f" /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include/nettle ; \ fi ; done /usr/bin/m4 ./asm.m4 machine.m4 config.m4 aes-encrypt-internal.asm >aes-encrypt-internal.s /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot -I. -DHAVE_CONFIG_H -I/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-encrypt.o -MD -MP -MF aes-encrypt.o.d -c aes-encrypt.c \ && true /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot -I. -DHAVE_CONFIG_H -I/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-encrypt-table.o -MD -MP -MF aes-encrypt-table.o.d -c aes-encrypt-table.c \ && true /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot -I. -DHAVE_CONFIG_H -I/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-invert-internal.o -MD -MP -MF aes-invert-internal.o.d -c aes-invert-internal.c \ && true /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot -I. -DHAVE_CONFIG_H -I/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-set-key-internal.o -MD -MP -MF aes-set-key-internal.o.d -c aes-set-key-internal.c \ && true /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot -I. -DHAVE_CONFIG_H -I/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-decrypt-internal.o -MD -MP -MF aes-decrypt-internal.o.d -c aes-decrypt-internal.s /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot -I. -DHAVE_CONFIG_H -I/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-encrypt-internal.o -MD -MP -MF aes-encrypt-internal.o.d -c aes-encrypt-internal.s /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot -I. -DHAVE_CONFIG_H -I/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-set-encrypt-key.o -MD -MP -MF aes-set-encrypt-key.o.d -c aes-set-encrypt-key.c \ && true clang50/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot -I. -DHAVE_CONFIG_H -I/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-set-decrypt-key.o -MD -MP -MF aes-set-decrypt-key.o.d -c aes-set-decrypt-key.c \ && true /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot -I. -DHAVE_CONFIG_H -I/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes128-set-encrypt-key.o -MD -MP -MF aes128-set-encrypt-key.o.d -c aes128-set-encrypt-key.c \ && true : warning: argument unused during compilation: '-D __ANDROID_API__=14' [-Wunused-command-line-argument] clang50: warning: argument unused during compilation: '-D HAVE_CONFIG_H' [-Wunused-command-line-argument] clang50: warning: argument unused during compilation: '-MT aes-decrypt-internal.o' [-Wunused-command-line-argument] clang50: warning: argument unused during compilation: '-MD' [-Wunused-command-line-argument] clang50: warning: argument unused during compilation: '-MP' [-Wunused-command-line-argument] clang50: warning: argument unused during compilation: '-MF aes-decrypt-internal.o.d' [-Wunused-command-line-argument] aes-decrypt-internal.s:67:10: error: unknown token in expression teq r3, #0 ^ aes-decrypt-internal.s:68:2: error: invalid instruction mnemonic 'beq' beq .Lend ^~~ aes-decrypt-internal.s:70:7: error: Unexpected '{' in expression push {r0,r1,r3, r4,r5,r6,r7,r8,r10,r11,lr} ^ clang50: warning: argument unused during compilation: '-D __ANDROID_API__=14' [-Wunused-command-line-argument] /home/bobbie/ffmpeg-android-3.4.1/toolchain-android/bin/i686-linux-android-clang --sysroot=/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/sysroot -I. -DHAVE_CONFIG_H -I/home/bobbie/ffmpeg-android-3.4.1/toolchain-android/include -ggdb3 -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes128-set-decrypt-key.o -MD -MP -MF aes128-set-decrypt-key.o.d -c aes128-set-decrypt-key.c \ && true clang50: warning: argument unused during compilation: '-D HAVE_CONFIG_H' [-Wunused-command-line-argument] clang50: warning: argument unused during compilation: '-MT aes-encrypt-internal.o' [-Wunused-command-line-argument] clang50: warning: argument unused during compilation: '-MD' [-Wunused-command-line-argument] clang50: warning: argument unused during compilation: '-MP' [-Wunused-command-line-argument] clang50: warning: argument unused during compilation: '-MF aes-encrypt-internal.o.d' [-Wunused-command-line-argument] aes-decrypt-internal.s:71:10: error: unknown token in expression mov r0, #0x3fc ^ aes-decrypt-internal.s:75:13: error: expected ']' in brackets expression ldr r1, [sp, #+48] ^ aes-decrypt-internal.s:76:10: error: Unexpected '{' in expression ldm sp, {r10, r11} ^ aes-decrypt-internal.s:79:17: error: unknown token in expression ldrb r4, [r1], #+1

3 3

[PATCH v2] Add CFB8 - Cipher Feedback 8-bit block cipher mode
by Dmitry Eremin-Solenikov 20 Jan '18

20 Jan '18

Add CFB variant with 8-bit segment size. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- cfb.c | 72 ++++++++++++++++++++ cfb.h | 35 ++++++++++ nettle.texinfo | 106 ++++++++++++++++++++++++------ testsuite/cfb-test.c | 103 +++++++++++++++++++++++++++++ testsuite/testutils.c | 178 ++++++++++++++++++++++++++++++++++++++++++++++++++ testsuite/testutils.h | 7 ++ 6 files changed, 482 insertions(+), 19 deletions(-) --- CFB8 support, contributed by Dmitry Eremin-Solenikov. * cfb.c (cfb8_encrypt, cfb8_decrypt): New functions. * cfb.h (CFB8_CTX, CFB8_SET_IV, CFB8_ENCRYPT, CFB8_DECRYPT): New macros. * testsuite/cfb-test.c: CFB8 test cases. * testsuite/testutils.c (test_cipher_cfb8): New function. * nettle.texinfo (CFB8): Documentation. diff --git a/cfb.c b/cfb.c index 805b8c4533a0..19cba4b5ba5d 100644 --- a/cfb.c +++ b/cfb.c @@ -162,3 +162,75 @@ cfb_decrypt(const void *ctx, nettle_cipher_func *f, } } } + +/* CFB-8 uses slight optimization: it encrypts or decrypts up to block_size + * bytes and does memcpy/memxor afterwards */ +void +cfb8_encrypt(const void *ctx, nettle_cipher_func *f, + size_t block_size, uint8_t *iv, + size_t length, uint8_t *dst, + const uint8_t *src) +{ + TMP_DECL(buffer, uint8_t, NETTLE_MAX_CIPHER_BLOCK_SIZE * 2); + TMP_DECL(outbuf, uint8_t, NETTLE_MAX_CIPHER_BLOCK_SIZE); + TMP_ALLOC(buffer, block_size * 2); + TMP_ALLOC(outbuf, block_size); + uint8_t pos; + + memcpy(buffer, iv, block_size); + pos = 0; + while (length) + { + uint8_t t; + + if (pos == block_size) + { + memcpy(buffer, buffer + block_size, block_size); + pos = 0; + } + + f(ctx, block_size, outbuf, buffer + pos); + t = *(dst++) = *(src++) ^ outbuf[0]; + buffer[pos + block_size] = t; + length--; + pos ++; + } + memcpy(iv, buffer + pos, block_size); +} + +void +cfb8_decrypt(const void *ctx, nettle_cipher_func *f, + size_t block_size, uint8_t *iv, + size_t length, uint8_t *dst, + const uint8_t *src) +{ + TMP_DECL(buffer, uint8_t, NETTLE_MAX_CIPHER_BLOCK_SIZE * 2); + TMP_DECL(outbuf, uint8_t, NETTLE_MAX_CIPHER_BLOCK_SIZE * 2); + TMP_ALLOC(buffer, block_size * 2); + TMP_ALLOC(outbuf, block_size * 2); + uint8_t i = 0; + + memcpy(buffer, iv, block_size); + memcpy(buffer + block_size, src, + length < block_size ? length : block_size); + + while (length) + { + + for (i = 0; i < length && i < block_size; i++) + f(ctx, block_size, outbuf + i, buffer + i); + + memxor3(dst, src, outbuf, i); + + length -= i; + src += i; + dst += i; + + memcpy(buffer, buffer + block_size, block_size); + memcpy(buffer + block_size, src, + length < block_size ? length : block_size); + + } + + memcpy(iv, buffer + i, block_size); +} diff --git a/cfb.h b/cfb.h index 16660df9b8ab..782ac133aa1c 100644 --- a/cfb.h +++ b/cfb.h @@ -45,6 +45,9 @@ extern "C" { #define cfb_encrypt nettle_cfb_encrypt #define cfb_decrypt nettle_cfb_decrypt +#define cfb8_encrypt nettle_cfb8_encrypt +#define cfb8_decrypt nettle_cfb8_decrypt + void cfb_encrypt(const void *ctx, nettle_cipher_func *f, size_t block_size, uint8_t *iv, @@ -57,12 +60,28 @@ cfb_decrypt(const void *ctx, nettle_cipher_func *f, size_t length, uint8_t *dst, const uint8_t *src); +void +cfb8_encrypt(const void *ctx, nettle_cipher_func *f, + size_t block_size, uint8_t *iv, + size_t length, uint8_t *dst, + const uint8_t *src); + +void +cfb8_decrypt(const void *ctx, nettle_cipher_func *f, + size_t block_size, uint8_t *iv, + size_t length, uint8_t *dst, + const uint8_t *src); + + #define CFB_CTX(type, size) \ { type ctx; uint8_t iv[size]; } #define CFB_SET_IV(ctx, data) \ memcpy((ctx)->iv, (data), sizeof((ctx)->iv)) +#define CFB8_CTX CFB_CTX +#define CFB8_SET_IV CFB_SET_IV + /* NOTE: Avoid using NULL, as we don't include anything defining it. */ #define CFB_ENCRYPT(self, f, length, dst, src) \ (0 ? ((f)(&(self)->ctx, ~(size_t) 0, \ @@ -80,6 +99,22 @@ memcpy((ctx)->iv, (data), sizeof((ctx)->iv)) sizeof((self)->iv), (self)->iv, \ (length), (dst), (src))) +#define CFB8_ENCRYPT(self, f, length, dst, src) \ + (0 ? ((f)(&(self)->ctx, ~(size_t) 0, \ + (uint8_t *) 0, (const uint8_t *) 0)) \ + : cfb8_encrypt((void *) &(self)->ctx, \ + (nettle_cipher_func *) (f), \ + sizeof((self)->iv), (self)->iv, \ + (length), (dst), (src))) + +#define CFB8_DECRYPT(self, f, length, dst, src) \ + (0 ? ((f)(&(self)->ctx, ~(size_t) 0, \ + (uint8_t *) 0, (const uint8_t *) 0)) \ + : cfb8_decrypt((void *) &(self)->ctx, \ + (nettle_cipher_func *) (f), \ + sizeof((self)->iv), (self)->iv, \ + (length), (dst), (src))) + #ifdef __cplusplus } #endif diff --git a/nettle.texinfo b/nettle.texinfo index aa374449c527..f501cfbeb2d7 100644 --- a/nettle.texinfo +++ b/nettle.texinfo @@ -93,7 +93,7 @@ Cipher modes * CBC:: * CTR:: -* CFB:: +* CFB and CFB8:: * GCM:: * CCM:: @@ -1904,21 +1904,21 @@ Book mode, @acronym{ECB}), leaks information. Besides @acronym{ECB}, Nettle provides several other modes of operation: Cipher Block Chaining (@acronym{CBC}), Counter mode (@acronym{CTR}), Cipher -Feedback (@acronym{CFB}) and a couple of @acronym{AEAD} modes -(@pxref{Authenticated encryption}). @acronym{CBC} is widely used, but +Feedback (@acronym{CFB} and @acronym{CFB8}) and a couple of @acronym{AEAD} +modes (@pxref{Authenticated encryption}). @acronym{CBC} is widely used, but there are a few subtle issues of information leakage, see, e.g., @uref{http://www.kb.cert.org/vuls/id/958563, @acronym{SSH} @acronym{CBC} vulnerability}. Today, @acronym{CTR} is usually preferred over @acronym{CBC}. -Modes like @acronym{CBC}, @acronym{CTR} and @acronym{CFB} provide @emph{no} -message authentication, and should always be used together with a -@acronym{MAC} (@pxref{Keyed hash functions}) or signature to authenticate -the message. +Modes like @acronym{CBC}, @acronym{CTR}, @acronym{CFB} and @acronym{CFB8} +provide @emph{no} message authentication, and should always be used together +with a @acronym{MAC} (@pxref{Keyed hash functions}) or signature to +authenticate the message. @menu * CBC:: * CTR:: -* CFB:: +* CFB and CFB8:: @end menu @node CBC, CTR, Cipher modes, Cipher modes @@ -2014,7 +2014,7 @@ These macros use some tricks to make the compiler display a warning if the types of @var{f} and @var{ctx} don't match, e.g. if you try to use an @code{struct aes_ctx} context with the @code{des_encrypt} function. -@node CTR, CFB, CBC, Cipher modes +@node CTR, CFB and CFB8, CBC, Cipher modes @comment node-name, next, previous, up @subsection Counter mode @@ -2090,18 +2090,21 @@ last three arguments define the source and destination area for the operation. @end deffn -@node CFB, , CTR, Cipher modes +@node CFB and CFB8, , CTR, Cipher modes @comment node-name, next, previous, up @subsection Cipher Feedback mode @cindex Cipher Feedback Mode -@cindex CFB Mode +@cindex Cipher Feedback 8-bit Mode +@cindex CFB Modes +@cindex CFB8 Mode -Cipher Feedback mode (@acronym{CFB}) being a close relative to both -@acronym{CBC} mode and @acronym{CTR} mode borrows some characteristics -from stream ciphers. -The message is divided into @code{n} blocks @code{M_1},@dots{} +Cipher Feedback mode (@acronym{CFB}) and Cipher Feedback 8-bit mode +(@acronym{CFB8}) being close relatives to both @acronym{CBC} mode and +@acronym{CTR} mode borrow some characteristics from stream ciphers. + +For CFB the message is divided into @code{n} blocks @code{M_1},@dots{} @code{M_n}, where @code{M_n} is of size @code{m} which may be smaller than the block size. Except for the last block, all the message blocks must be of size equal to the cipher's block size. @@ -2121,10 +2124,31 @@ C_(n-1) = E_k(C_(n - 2)) XOR M_(n-1) C_n = E_k(C_(n - 1)) [1..m] XOR M_n @end example -Nettle's includes two functions for applying a block cipher in Cipher -Feedback (@acronym{CFB}) mode, one for encryption and one for -decryption. These functions uses @code{void *} to pass cipher contexts -around. +Cipher Feedback 8-bit mode (@acronym{CFB8}) transforms block cipher into a stream +cipher. The message is encrypted byte after byte, not requiring any padding. + +If @code{E_k} is the encryption function of a block cipher, @code{b} is +@code{E_k} block size, @code{IV} is the initialization vector, then the +@code{n} plaintext bytes are transformed into @code{n} ciphertext bytes +@code{C_1},@dots{} @code{C_n} as follows: + +@example +I_1 = IV +C_1 = E_k(I_1) [1..8] XOR M_1 +I_2 = I_1 [9..b] << 8 | C_1 +C_2 = E_k(I_2) [1..8] XOR M_2 + +@dots{} + +I_(n-1) = I_(n-2) [9..b] << 8 | C_(n-2) +C_(n-1) = E_k(I_(n-1)) [1..8] XOR M_(n-1) +I_n = I_(n-1) [9..b] << 8 | C_(n-1) +C_n = E_k(I_n) [1..8] XOR M_n +@end example + +Nettle's includes functions for applying a block cipher in Cipher +Feedback (@acronym{CFB}) and Cipher Feedback 8-bit (@acronym{CFB8}) +modes. These functions uses @code{void *} to pass cipher contexts around. @deftypefun {void} cfb_encrypt (const void *@var{ctx}, nettle_cipher_func *@var{f}, size_t @var{block_size}, uint8_t *@var{iv}, size_t @var{length}, uint8_t *@var{dst}, const uint8_t *@var{src}) @deftypefunx {void} cfb_decrypt (const void *@var{ctx}, nettle_cipher_func *@var{f}, size_t @var{block_size}, uint8_t *@var{iv}, size_t @var{length}, uint8_t *@var{dst}, const uint8_t *@var{src}) @@ -2141,6 +2165,18 @@ When a message is encrypted using a sequence of calls to is a multiple of the block size. @end deftypefun +@deftypefun {void} cfb8_encrypt (const void *@var{ctx}, nettle_cipher_func *@var{f}, size_t @var{block_size}, uint8_t *@var{iv}, size_t @var{length}, uint8_t *@var{dst}, const uint8_t *@var{src}) +@deftypefunx {void} cfb8_decrypt (const void *@var{ctx}, nettle_cipher_func *@var{f}, size_t @var{block_size}, uint8_t *@var{iv}, size_t @var{length}, uint8_t *@var{dst}, const uint8_t *@var{src}) + +Applies the encryption or decryption function @var{f} in @acronym{CFB8} +mode. The final IV block processed is copied into @var{iv} +before returning, so that a large message can be processed by a sequence of +calls to @code{cfb8_encrypt}. Note that for @acronym{CFB8} mode internally +uses encryption only function and hence @var{f} should always be the +encryption function for the underlying block cipher. + +@end deftypefun + Like for @acronym{CBC}, there are also a couple of helper macros. @deffn Macro CFB_CTX (@var{context_type}, @var{block_size}) @@ -2175,6 +2211,38 @@ last three arguments define the source and destination area for the operation. @end deffn +@deffn Macro CFB8_CTX (@var{context_type}, @var{block_size}) +Expands to +@example +@{ + context_type ctx; + uint8_t iv[block_size]; +@} +@end example +@end deffn + +@deffn Macro CFB8_SET_IV(@var{ctx}, @var{iv}) +First argument is a pointer to a context struct as defined by +@code{CFB8_CTX}, and the second is a pointer to an initialization vector +that is copied into that context. +@end deffn + +@deffn Macro CFB8_ENCRYPT (@var{ctx}, @var{f}, @var{length}, @var{dst}, @var{src}) +A simpler way to invoke @code{cfb8_encrypt}. The first argument is a +pointer to a context struct as defined by @code{CFB8_CTX}, and the +second argument is an encryption function following Nettle's +conventions. The last three arguments define the source and destination +area for the operation. +@end deffn + +@deffn Macro CFB8_DECRYPT (@var{ctx}, @var{f}, @var{length}, @var{dst}, @var{src}) +A simpler way to invoke @code{cfb8_decrypt}. The first argument is a +pointer to a context struct as defined by @code{CFB8_CTX}, and the +second argument is an encryption function following Nettle's +conventions. The last three arguments define the source and destination +area for the operation. +@end deffn + @node Authenticated encryption, Keyed hash functions, Cipher modes, Reference @comment node-name, next, previous, up diff --git a/testsuite/cfb-test.c b/testsuite/cfb-test.c index b59bee225bf8..b83233830b5a 100644 --- a/testsuite/cfb-test.c +++ b/testsuite/cfb-test.c @@ -6,6 +6,7 @@ /* Test with more data and inplace decryption, to check that the * cfb_decrypt buffering works. */ #define CFB_BULK_DATA 10000 +#define CFB8_BULK_DATA CFB_BULK_DATA static void test_cfb_bulk(void) @@ -64,9 +65,110 @@ test_cfb_bulk(void) ASSERT (MEMEQ(CFB_BULK_DATA, clear, cipher)); } +static void +test_cfb8_bulk(void) +{ + struct knuth_lfib_ctx random; + + uint8_t clear[CFB8_BULK_DATA]; + + uint8_t cipher[CFB8_BULK_DATA + 1]; + + const uint8_t *key = H("966c7bf00bebe6dc 8abd37912384958a" + "743008105a08657d dcaad4128eee38b3"); + + const uint8_t *start_iv = H("11adbff119749103 207619cfa0e8d13a"); + const uint8_t *end_iv = H("f84bfd48206f5803 6ef86f4e69e9aec0"); + + struct CFB8_CTX(struct aes_ctx, AES_BLOCK_SIZE) aes; + + knuth_lfib_init(&random, CFB8_BULK_DATA); + knuth_lfib_random(&random, CFB8_BULK_DATA, clear); + + /* Byte that should not be overwritten */ + cipher[CFB8_BULK_DATA] = 17; + + aes_set_encrypt_key(&aes.ctx, 32, key); + CFB8_SET_IV(&aes, start_iv); + + CFB8_ENCRYPT(&aes, aes_encrypt, CFB8_BULK_DATA, cipher, clear); + + ASSERT(cipher[CFB8_BULK_DATA] == 17); + + if (verbose) + { + printf("IV after bulk encryption: "); + print_hex(AES_BLOCK_SIZE, aes.iv); + printf("\n"); + } + + ASSERT(MEMEQ(AES_BLOCK_SIZE, aes.iv, end_iv)); + + /* Decrypt, in place */ + aes_set_encrypt_key(&aes.ctx, 32, key); + CFB8_SET_IV(&aes, start_iv); + CFB8_DECRYPT(&aes, aes_encrypt, CFB8_BULK_DATA, cipher, cipher); + + ASSERT(cipher[CFB8_BULK_DATA] == 17); + + if (verbose) + { + printf("IV after bulk decryption: "); + print_hex(AES_BLOCK_SIZE, aes.iv); + printf("\n"); + } + + ASSERT (MEMEQ(AES_BLOCK_SIZE, aes.iv, end_iv)); + ASSERT (MEMEQ(CFB8_BULK_DATA, clear, cipher)); +} + void test_main(void) { + /* From NIST spec 800-38a on AES modes. + * + * F.3 CFB Example Vectors + * F.3.7 CFB8-AES128.Encrypt + */ + + test_cipher_cfb8(&nettle_aes128, + SHEX("2b7e151628aed2a6abf7158809cf4f3c"), + SHEX("6bc1bee22e409f96e93d7e117393172a" + "ae2d"), + SHEX("3b79424c9c0dd436bace9e0ed4586a4f" + "32b9"), + SHEX("000102030405060708090a0b0c0d0e0f")); + + /* From NIST spec 800-38a on AES modes. + * + * F.3 CFB Example Vectors + * F.3.9 CFB8-AES192.Encrypt + */ + + test_cipher_cfb8(&nettle_aes192, + SHEX("8e73b0f7da0e6452c810f32b809079e5" + "62f8ead2522c6b7b"), + SHEX("6bc1bee22e409f96e93d7e117393172a" + "ae2d"), + SHEX("cda2521ef0a905ca44cd057cbf0d47a0" + "678a"), + SHEX("000102030405060708090a0b0c0d0e0f")); + + /* From NIST spec 800-38a on AES modes. + * + * F.3 CFB Example Vectors + * F.3.11 CFB8-AES256.Encrypt + */ + + test_cipher_cfb8(&nettle_aes256, + SHEX("603deb1015ca71be2b73aef0857d7781" + "1f352c073b6108d72d9810a30914dff4"), + SHEX("6bc1bee22e409f96e93d7e117393172a" + "ae2d"), + SHEX("dc1f1a8520a64db55fcc8ac554844e88" + "9700"), + SHEX("000102030405060708090a0b0c0d0e0f")); + /* From NIST spec 800-38a on AES modes. * * F.3 CFB Example Vectors @@ -139,6 +241,7 @@ test_main(void) SHEX("000102030405060708090a0b0c0d0e0f")); test_cfb_bulk(); + test_cfb8_bulk(); } /* diff --git a/testsuite/testutils.c b/testsuite/testutils.c index 08471958fbc0..5ee9eda35264 100644 --- a/testsuite/testutils.c +++ b/testsuite/testutils.c @@ -423,6 +423,184 @@ test_cipher_cfb(const struct nettle_cipher *cipher, free(iv); } +void +test_cipher_cfb8(const struct nettle_cipher *cipher, + const struct tstring *key, + const struct tstring *cleartext, + const struct tstring *ciphertext, + const struct tstring *iiv) +{ + void *ctx = xalloc(cipher->context_size); + uint8_t *data, *data2; + uint8_t *iv = xalloc(cipher->block_size); + size_t length; + + ASSERT (cleartext->length == ciphertext->length); + length = cleartext->length; + + ASSERT (key->length == cipher->key_size); + ASSERT (iiv->length == cipher->block_size); + + data = xalloc(length); + data2 = xalloc(length); + + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_encrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, cleartext->data); + + if (!MEMEQ(length, data, ciphertext->data)) + { + fprintf(stderr, "CFB8 encrypt failed:\nInput:"); + tstring_print_hex(cleartext); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + tstring_print_hex(ciphertext); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_decrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data2, data); + + if (!MEMEQ(length, data2, cleartext->data)) + { + fprintf(stderr, "CFB8 decrypt failed:\nInput:"); + tstring_print_hex(ciphertext); + fprintf(stderr, "\nOutput: "); + print_hex(length, data2); + fprintf(stderr, "\nExpected:"); + tstring_print_hex(cleartext); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + memcpy(data, cleartext->data, length); + + cfb8_encrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, data); + + if (!MEMEQ(length, data, ciphertext->data)) + { + fprintf(stderr, "CFB8 inplace encrypt failed:\nInput:"); + tstring_print_hex(cleartext); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + tstring_print_hex(ciphertext); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_decrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, data); + + if (!MEMEQ(length, data, cleartext->data)) + { + fprintf(stderr, "CFB8 inplace decrypt failed:\nInput:"); + tstring_print_hex(ciphertext); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + tstring_print_hex(cleartext); + fprintf(stderr, "\n"); + FAIL(); + } + + /* Repeat all tests with incomplete last block */ + length -= 1; + + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_encrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, cleartext->data); + + if (!MEMEQ(length, data, ciphertext->data)) + { + fprintf(stderr, "CFB8 encrypt failed:\nInput:"); + print_hex(length, cleartext->data); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + print_hex(length, ciphertext->data); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_decrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data2, data); + + if (!MEMEQ(length, data2, cleartext->data)) + { + fprintf(stderr, "CFB8 decrypt failed:\nInput:"); + print_hex(length, ciphertext->data); + fprintf(stderr, "\nOutput: "); + print_hex(length, data2); + fprintf(stderr, "\nExpected:"); + print_hex(length, cleartext->data); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + memcpy(data, cleartext->data, length); + + cfb8_encrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, data); + + if (!MEMEQ(length, data, ciphertext->data)) + { + fprintf(stderr, "CFB8 inplace encrypt failed:\nInput:"); + print_hex(length, cleartext->data); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + print_hex(length, ciphertext->data); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_decrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, data); + + if (!MEMEQ(length, data, cleartext->data)) + { + fprintf(stderr, "CFB8 inplace decrypt failed:\nInput:"); + print_hex(length, ciphertext->data); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + print_hex(length, cleartext->data); + fprintf(stderr, "\n"); + FAIL(); + } + + free(ctx); + free(data); + free(data2); + free(iv); +} + void test_cipher_ctr(const struct nettle_cipher *cipher, const struct tstring *key, diff --git a/testsuite/testutils.h b/testsuite/testutils.h index fbbba7b9fab5..ded57db6ab4f 100644 --- a/testsuite/testutils.h +++ b/testsuite/testutils.h @@ -129,6 +129,13 @@ test_cipher_cfb(const struct nettle_cipher *cipher, const struct tstring *ciphertext, const struct tstring *iv); +void +test_cipher_cfb8(const struct nettle_cipher *cipher, + const struct tstring *key, + const struct tstring *cleartext, + const struct tstring *ciphertext, + const struct tstring *iv); + void test_cipher_ctr(const struct nettle_cipher *cipher, const struct tstring *key, -- 2.15.1

2 1

[PATCH] Add CFB8 - Cipher Feedback 8-bit block cipher mode
by Dmitry Eremin-Solenikov 15 Jan '18

15 Jan '18

Add CFB variant with 8-bit segment size. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- cfb.c | 75 +++++++++++++++++++++ cfb.h | 35 ++++++++++ nettle.texinfo | 96 +++++++++++++++++++++++++-- testsuite/cfb-test.c | 103 +++++++++++++++++++++++++++++ testsuite/testutils.c | 178 ++++++++++++++++++++++++++++++++++++++++++++++++++ testsuite/testutils.h | 7 ++ 6 files changed, 487 insertions(+), 7 deletions(-) --- CFB8 support, contributed by Dmitry Eremin-Solenikov. * cfb.c (cfb8_encrypt, cfb8_decrypt): New functions. * cfb.h (CFB8_CTX, CFB8_SET_IV, CFB8_ENCRYPT, CFB8_DECRYPT): New macros. * testsuite/cfb-test.c: CFB8 test cases. * testsuite/testutils.c (test_cipher_cfb8): New function. * nettle.texinfo (CFB8): Documentation. diff --git a/cfb.c b/cfb.c index 805b8c4533a0..8e0ca47130d4 100644 --- a/cfb.c +++ b/cfb.c @@ -162,3 +162,78 @@ cfb_decrypt(const void *ctx, nettle_cipher_func *f, } } } + +/* CFB-8 uses slight optimization: it encrypts or decrypts up to block_size + * bytes and does memcpy/memxor afterwards */ +void +cfb8_encrypt(const void *ctx, nettle_cipher_func *f, + size_t block_size, uint8_t *iv, + size_t length, uint8_t *dst, + const uint8_t *src) +{ + TMP_DECL(buffer, uint8_t, NETTLE_MAX_CIPHER_BLOCK_SIZE * 2); + TMP_DECL(outbuf, uint8_t, NETTLE_MAX_CIPHER_BLOCK_SIZE); + TMP_ALLOC(buffer, block_size * 2); + TMP_ALLOC(outbuf, block_size); + uint8_t pos; + + memcpy(buffer, iv, block_size); + pos = 0; + while (length) + { + uint8_t t; + + if (pos == block_size) + { + memcpy(buffer, buffer + block_size, block_size); + pos = 0; + } + + f(ctx, block_size, outbuf, buffer + pos); + t = *(dst++) = *(src++) ^ outbuf[0]; + buffer[pos + block_size] = t; + length--; + pos ++; + } + memcpy(iv, buffer + pos, block_size); +} + +void +cfb8_decrypt(const void *ctx, nettle_cipher_func *f, + size_t block_size, uint8_t *iv, + size_t length, uint8_t *dst, + const uint8_t *src) +{ + TMP_DECL(buffer, uint8_t, NETTLE_MAX_CIPHER_BLOCK_SIZE * 2); + TMP_DECL(outbuf, uint8_t, NETTLE_MAX_CIPHER_BLOCK_SIZE * 2); + TMP_ALLOC(buffer, block_size * 2); + TMP_ALLOC(outbuf, block_size * 2); + uint8_t i = 0; + + memcpy(buffer, iv, block_size); + memcpy(buffer + block_size, src, + length < block_size ? length : block_size); + + while (length) + { + + for (i = 0; i < length && i < block_size; i++) + f(ctx, block_size, outbuf + i, buffer + i); + + if (src != dst) + memxor3(dst, src, outbuf, i); + else + memxor(dst, outbuf, i); + + length -= i; + src += i; + dst += i; + + memcpy(buffer, buffer + block_size, block_size); + memcpy(buffer + block_size, src, + length < block_size ? length : block_size); + + } + + memcpy(iv, buffer + i, block_size); +} diff --git a/cfb.h b/cfb.h index 16660df9b8ab..782ac133aa1c 100644 --- a/cfb.h +++ b/cfb.h @@ -45,6 +45,9 @@ extern "C" { #define cfb_encrypt nettle_cfb_encrypt #define cfb_decrypt nettle_cfb_decrypt +#define cfb8_encrypt nettle_cfb8_encrypt +#define cfb8_decrypt nettle_cfb8_decrypt + void cfb_encrypt(const void *ctx, nettle_cipher_func *f, size_t block_size, uint8_t *iv, @@ -57,12 +60,28 @@ cfb_decrypt(const void *ctx, nettle_cipher_func *f, size_t length, uint8_t *dst, const uint8_t *src); +void +cfb8_encrypt(const void *ctx, nettle_cipher_func *f, + size_t block_size, uint8_t *iv, + size_t length, uint8_t *dst, + const uint8_t *src); + +void +cfb8_decrypt(const void *ctx, nettle_cipher_func *f, + size_t block_size, uint8_t *iv, + size_t length, uint8_t *dst, + const uint8_t *src); + + #define CFB_CTX(type, size) \ { type ctx; uint8_t iv[size]; } #define CFB_SET_IV(ctx, data) \ memcpy((ctx)->iv, (data), sizeof((ctx)->iv)) +#define CFB8_CTX CFB_CTX +#define CFB8_SET_IV CFB_SET_IV + /* NOTE: Avoid using NULL, as we don't include anything defining it. */ #define CFB_ENCRYPT(self, f, length, dst, src) \ (0 ? ((f)(&(self)->ctx, ~(size_t) 0, \ @@ -80,6 +99,22 @@ memcpy((ctx)->iv, (data), sizeof((ctx)->iv)) sizeof((self)->iv), (self)->iv, \ (length), (dst), (src))) +#define CFB8_ENCRYPT(self, f, length, dst, src) \ + (0 ? ((f)(&(self)->ctx, ~(size_t) 0, \ + (uint8_t *) 0, (const uint8_t *) 0)) \ + : cfb8_encrypt((void *) &(self)->ctx, \ + (nettle_cipher_func *) (f), \ + sizeof((self)->iv), (self)->iv, \ + (length), (dst), (src))) + +#define CFB8_DECRYPT(self, f, length, dst, src) \ + (0 ? ((f)(&(self)->ctx, ~(size_t) 0, \ + (uint8_t *) 0, (const uint8_t *) 0)) \ + : cfb8_decrypt((void *) &(self)->ctx, \ + (nettle_cipher_func *) (f), \ + sizeof((self)->iv), (self)->iv, \ + (length), (dst), (src))) + #ifdef __cplusplus } #endif diff --git a/nettle.texinfo b/nettle.texinfo index aa374449c527..e610e74c79ab 100644 --- a/nettle.texinfo +++ b/nettle.texinfo @@ -94,6 +94,7 @@ Cipher modes * CBC:: * CTR:: * CFB:: +* CFB8:: * GCM:: * CCM:: @@ -1904,21 +1905,22 @@ Book mode, @acronym{ECB}), leaks information. Besides @acronym{ECB}, Nettle provides several other modes of operation: Cipher Block Chaining (@acronym{CBC}), Counter mode (@acronym{CTR}), Cipher -Feedback (@acronym{CFB}) and a couple of @acronym{AEAD} modes -(@pxref{Authenticated encryption}). @acronym{CBC} is widely used, but +Feedback (@acronym{CFB} and @acronym{CFB8}) and a couple of @acronym{AEAD} +modes (@pxref{Authenticated encryption}). @acronym{CBC} is widely used, but there are a few subtle issues of information leakage, see, e.g., @uref{http://www.kb.cert.org/vuls/id/958563, @acronym{SSH} @acronym{CBC} vulnerability}. Today, @acronym{CTR} is usually preferred over @acronym{CBC}. -Modes like @acronym{CBC}, @acronym{CTR} and @acronym{CFB} provide @emph{no} -message authentication, and should always be used together with a -@acronym{MAC} (@pxref{Keyed hash functions}) or signature to authenticate -the message. +Modes like @acronym{CBC}, @acronym{CTR}, @acronym{CFB} and @acronym{CFB8} +provide @emph{no} message authentication, and should always be used together +with a @acronym{MAC} (@pxref{Keyed hash functions}) or signature to +authenticate the message. @menu * CBC:: * CTR:: * CFB:: +* CFB8:: @end menu @node CBC, CTR, Cipher modes, Cipher modes @@ -2090,7 +2092,7 @@ last three arguments define the source and destination area for the operation. @end deffn -@node CFB, , CTR, Cipher modes +@node CFB, CFB8, CTR, Cipher modes @comment node-name, next, previous, up @subsection Cipher Feedback mode @@ -2175,6 +2177,86 @@ last three arguments define the source and destination area for the operation. @end deffn +@node CFB8, , CFB, Cipher modes +@comment node-name, next, previous, up +@subsection Cipher Feedback 8-bit mode + +@cindex Cipher Feedback 8-bit Mode +@cindex CFB8 Mode + +Cipher Feedback 8-bit mode (@acronym{CFB8}) transforms block cipher into a stream +cipher. The message is encrypted byte after byte, not requiring any padding. + +If @code{E_k} is the encryption function of a block cipher, @code{b} is +@code{E_k} block size, @code{IV} is the initialization vector, then the +@code{n} plaintext bytes are transformed into @code{n} ciphertext bytes +@code{C_1},@dots{} @code{C_n} as follows: + +@example +I_1 = IV +C_1 = E_k(I_1) [1..8] XOR M_1 +I_2 = I_1 [9..b] << 8 | C_1 +C_2 = E_k(I_2) [1..8] XOR M_2 + +@dots{} + +I_(n-1) = I_(n-2) [9..b] << 8 | C_(n-2) +C_(n-1) = E_k(I_(n-1)) [1..8] XOR M_(n-1) +I_n = I_(n-1) [9..b] << 8 | C_(n-1) +C_n = E_k(I_n) [1..8] XOR M_n +@end example + +Nettle's includes two functions for applying a block cipher in Cipher +Feedback 8-bit (@acronym{CFB8}) mode, one for encryption and one for +decryption. These functions uses @code{void *} to pass cipher contexts +around. + +@deftypefun {void} cfb8_encrypt (const void *@var{ctx}, nettle_cipher_func *@var{f}, size_t @var{block_size}, uint8_t *@var{iv}, size_t @var{length}, uint8_t *@var{dst}, const uint8_t *@var{src}) +@deftypefunx {void} cfb8_decrypt (const void *@var{ctx}, nettle_cipher_func *@var{f}, size_t @var{block_size}, uint8_t *@var{iv}, size_t @var{length}, uint8_t *@var{dst}, const uint8_t *@var{src}) + +Applies the encryption or decryption function @var{f} in @acronym{CFB8} +mode. The final IV block processed is copied into @var{iv} +before returning, so that a large message can be processed by a sequence of +calls to @code{cfb8_encrypt}. Note that for @acronym{CFB8} mode internally +uses encryption only function and hence @var{f} should always be the +encryption function for the underlying block cipher. + +@end deftypefun + +Like for @acronym{CBC}, there are also a couple of helper macros. + +@deffn Macro CFB8_CTX (@var{context_type}, @var{block_size}) +Expands to +@example +@{ + context_type ctx; + uint8_t iv[block_size]; +@} +@end example +@end deffn + +@deffn Macro CFB8_SET_IV(@var{ctx}, @var{iv}) +First argument is a pointer to a context struct as defined by +@code{CFB8_CTX}, and the second is a pointer to an initialization vector +that is copied into that context. +@end deffn + +@deffn Macro CFB8_ENCRYPT (@var{ctx}, @var{f}, @var{length}, @var{dst}, @var{src}) +A simpler way to invoke @code{cfb8_encrypt}. The first argument is a +pointer to a context struct as defined by @code{CFB8_CTX}, and the +second argument is an encryption function following Nettle's +conventions. The last three arguments define the source and destination +area for the operation. +@end deffn + +@deffn Macro CFB8_DECRYPT (@var{ctx}, @var{f}, @var{length}, @var{dst}, @var{src}) +A simpler way to invoke @code{cfb8_decrypt}. The first argument is a +pointer to a context struct as defined by @code{CFB8_CTX}, and the +second argument is an encryption function following Nettle's +conventions. The last three arguments define the source and destination +area for the operation. +@end deffn + @node Authenticated encryption, Keyed hash functions, Cipher modes, Reference @comment node-name, next, previous, up diff --git a/testsuite/cfb-test.c b/testsuite/cfb-test.c index b59bee225bf8..b83233830b5a 100644 --- a/testsuite/cfb-test.c +++ b/testsuite/cfb-test.c @@ -6,6 +6,7 @@ /* Test with more data and inplace decryption, to check that the * cfb_decrypt buffering works. */ #define CFB_BULK_DATA 10000 +#define CFB8_BULK_DATA CFB_BULK_DATA static void test_cfb_bulk(void) @@ -64,9 +65,110 @@ test_cfb_bulk(void) ASSERT (MEMEQ(CFB_BULK_DATA, clear, cipher)); } +static void +test_cfb8_bulk(void) +{ + struct knuth_lfib_ctx random; + + uint8_t clear[CFB8_BULK_DATA]; + + uint8_t cipher[CFB8_BULK_DATA + 1]; + + const uint8_t *key = H("966c7bf00bebe6dc 8abd37912384958a" + "743008105a08657d dcaad4128eee38b3"); + + const uint8_t *start_iv = H("11adbff119749103 207619cfa0e8d13a"); + const uint8_t *end_iv = H("f84bfd48206f5803 6ef86f4e69e9aec0"); + + struct CFB8_CTX(struct aes_ctx, AES_BLOCK_SIZE) aes; + + knuth_lfib_init(&random, CFB8_BULK_DATA); + knuth_lfib_random(&random, CFB8_BULK_DATA, clear); + + /* Byte that should not be overwritten */ + cipher[CFB8_BULK_DATA] = 17; + + aes_set_encrypt_key(&aes.ctx, 32, key); + CFB8_SET_IV(&aes, start_iv); + + CFB8_ENCRYPT(&aes, aes_encrypt, CFB8_BULK_DATA, cipher, clear); + + ASSERT(cipher[CFB8_BULK_DATA] == 17); + + if (verbose) + { + printf("IV after bulk encryption: "); + print_hex(AES_BLOCK_SIZE, aes.iv); + printf("\n"); + } + + ASSERT(MEMEQ(AES_BLOCK_SIZE, aes.iv, end_iv)); + + /* Decrypt, in place */ + aes_set_encrypt_key(&aes.ctx, 32, key); + CFB8_SET_IV(&aes, start_iv); + CFB8_DECRYPT(&aes, aes_encrypt, CFB8_BULK_DATA, cipher, cipher); + + ASSERT(cipher[CFB8_BULK_DATA] == 17); + + if (verbose) + { + printf("IV after bulk decryption: "); + print_hex(AES_BLOCK_SIZE, aes.iv); + printf("\n"); + } + + ASSERT (MEMEQ(AES_BLOCK_SIZE, aes.iv, end_iv)); + ASSERT (MEMEQ(CFB8_BULK_DATA, clear, cipher)); +} + void test_main(void) { + /* From NIST spec 800-38a on AES modes. + * + * F.3 CFB Example Vectors + * F.3.7 CFB8-AES128.Encrypt + */ + + test_cipher_cfb8(&nettle_aes128, + SHEX("2b7e151628aed2a6abf7158809cf4f3c"), + SHEX("6bc1bee22e409f96e93d7e117393172a" + "ae2d"), + SHEX("3b79424c9c0dd436bace9e0ed4586a4f" + "32b9"), + SHEX("000102030405060708090a0b0c0d0e0f")); + + /* From NIST spec 800-38a on AES modes. + * + * F.3 CFB Example Vectors + * F.3.9 CFB8-AES192.Encrypt + */ + + test_cipher_cfb8(&nettle_aes192, + SHEX("8e73b0f7da0e6452c810f32b809079e5" + "62f8ead2522c6b7b"), + SHEX("6bc1bee22e409f96e93d7e117393172a" + "ae2d"), + SHEX("cda2521ef0a905ca44cd057cbf0d47a0" + "678a"), + SHEX("000102030405060708090a0b0c0d0e0f")); + + /* From NIST spec 800-38a on AES modes. + * + * F.3 CFB Example Vectors + * F.3.11 CFB8-AES256.Encrypt + */ + + test_cipher_cfb8(&nettle_aes256, + SHEX("603deb1015ca71be2b73aef0857d7781" + "1f352c073b6108d72d9810a30914dff4"), + SHEX("6bc1bee22e409f96e93d7e117393172a" + "ae2d"), + SHEX("dc1f1a8520a64db55fcc8ac554844e88" + "9700"), + SHEX("000102030405060708090a0b0c0d0e0f")); + /* From NIST spec 800-38a on AES modes. * * F.3 CFB Example Vectors @@ -139,6 +241,7 @@ test_main(void) SHEX("000102030405060708090a0b0c0d0e0f")); test_cfb_bulk(); + test_cfb8_bulk(); } /* diff --git a/testsuite/testutils.c b/testsuite/testutils.c index 08471958fbc0..5ee9eda35264 100644 --- a/testsuite/testutils.c +++ b/testsuite/testutils.c @@ -423,6 +423,184 @@ test_cipher_cfb(const struct nettle_cipher *cipher, free(iv); } +void +test_cipher_cfb8(const struct nettle_cipher *cipher, + const struct tstring *key, + const struct tstring *cleartext, + const struct tstring *ciphertext, + const struct tstring *iiv) +{ + void *ctx = xalloc(cipher->context_size); + uint8_t *data, *data2; + uint8_t *iv = xalloc(cipher->block_size); + size_t length; + + ASSERT (cleartext->length == ciphertext->length); + length = cleartext->length; + + ASSERT (key->length == cipher->key_size); + ASSERT (iiv->length == cipher->block_size); + + data = xalloc(length); + data2 = xalloc(length); + + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_encrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, cleartext->data); + + if (!MEMEQ(length, data, ciphertext->data)) + { + fprintf(stderr, "CFB8 encrypt failed:\nInput:"); + tstring_print_hex(cleartext); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + tstring_print_hex(ciphertext); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_decrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data2, data); + + if (!MEMEQ(length, data2, cleartext->data)) + { + fprintf(stderr, "CFB8 decrypt failed:\nInput:"); + tstring_print_hex(ciphertext); + fprintf(stderr, "\nOutput: "); + print_hex(length, data2); + fprintf(stderr, "\nExpected:"); + tstring_print_hex(cleartext); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + memcpy(data, cleartext->data, length); + + cfb8_encrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, data); + + if (!MEMEQ(length, data, ciphertext->data)) + { + fprintf(stderr, "CFB8 inplace encrypt failed:\nInput:"); + tstring_print_hex(cleartext); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + tstring_print_hex(ciphertext); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_decrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, data); + + if (!MEMEQ(length, data, cleartext->data)) + { + fprintf(stderr, "CFB8 inplace decrypt failed:\nInput:"); + tstring_print_hex(ciphertext); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + tstring_print_hex(cleartext); + fprintf(stderr, "\n"); + FAIL(); + } + + /* Repeat all tests with incomplete last block */ + length -= 1; + + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_encrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, cleartext->data); + + if (!MEMEQ(length, data, ciphertext->data)) + { + fprintf(stderr, "CFB8 encrypt failed:\nInput:"); + print_hex(length, cleartext->data); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + print_hex(length, ciphertext->data); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_decrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data2, data); + + if (!MEMEQ(length, data2, cleartext->data)) + { + fprintf(stderr, "CFB8 decrypt failed:\nInput:"); + print_hex(length, ciphertext->data); + fprintf(stderr, "\nOutput: "); + print_hex(length, data2); + fprintf(stderr, "\nExpected:"); + print_hex(length, cleartext->data); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + memcpy(data, cleartext->data, length); + + cfb8_encrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, data); + + if (!MEMEQ(length, data, ciphertext->data)) + { + fprintf(stderr, "CFB8 inplace encrypt failed:\nInput:"); + print_hex(length, cleartext->data); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + print_hex(length, ciphertext->data); + fprintf(stderr, "\n"); + FAIL(); + } + cipher->set_encrypt_key(ctx, key->data); + memcpy(iv, iiv->data, cipher->block_size); + + cfb8_decrypt(ctx, cipher->encrypt, + cipher->block_size, iv, + length, data, data); + + if (!MEMEQ(length, data, cleartext->data)) + { + fprintf(stderr, "CFB8 inplace decrypt failed:\nInput:"); + print_hex(length, ciphertext->data); + fprintf(stderr, "\nOutput: "); + print_hex(length, data); + fprintf(stderr, "\nExpected:"); + print_hex(length, cleartext->data); + fprintf(stderr, "\n"); + FAIL(); + } + + free(ctx); + free(data); + free(data2); + free(iv); +} + void test_cipher_ctr(const struct nettle_cipher *cipher, const struct tstring *key, diff --git a/testsuite/testutils.h b/testsuite/testutils.h index fbbba7b9fab5..ded57db6ab4f 100644 --- a/testsuite/testutils.h +++ b/testsuite/testutils.h @@ -129,6 +129,13 @@ test_cipher_cfb(const struct nettle_cipher *cipher, const struct tstring *ciphertext, const struct tstring *iv); +void +test_cipher_cfb8(const struct nettle_cipher *cipher, + const struct tstring *key, + const struct tstring *cleartext, + const struct tstring *ciphertext, + const struct tstring *iv); + void test_cipher_ctr(const struct nettle_cipher *cipher, const struct tstring *key, -- 2.15.1

2 1

[PATCH] Allow user to specify multiple algorithms to nettle-benchmark
by Dmitry Eremin-Solenikov 13 Jan '18

13 Jan '18

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- examples/nettle-benchmark.c | 47 +++++++++++++++++++++++++-------------------- 1 file changed, 26 insertions(+), 21 deletions(-) diff --git a/examples/nettle-benchmark.c b/examples/nettle-benchmark.c index 53c4e5f9..e0578c31 100644 --- a/examples/nettle-benchmark.c +++ b/examples/nettle-benchmark.c @@ -794,7 +794,7 @@ main(int argc, char **argv) break; case OPT_HELP: - printf("Usage: nettle-benchmark [-f clock frequency] [alg]\n"); + printf("Usage: nettle-benchmark [-f clock frequency] [alg...]\n"); return EXIT_SUCCESS; case '?': @@ -804,8 +804,6 @@ main(int argc, char **argv) abort(); } - alg = argv[optind]; - time_init(); bench_sha1_compress(); bench_salsa20_core(); @@ -815,29 +813,36 @@ main(int argc, char **argv) header(); - if (!alg || strstr ("memxor", alg)) + do { - time_memxor(); - printf("\n"); - } - - for (i = 0; hashes[i]; i++) - if (!alg || strstr(hashes[i]->name, alg)) - time_hash(hashes[i]); + alg = argv[optind]; + + if (!alg || strstr ("memxor", alg)) + { + time_memxor(); + printf("\n"); + } + + for (i = 0; hashes[i]; i++) + if (!alg || strstr(hashes[i]->name, alg)) + time_hash(hashes[i]); + + if (!alg || strstr ("umac", alg)) + time_umac(); - if (!alg || strstr ("umac", alg)) - time_umac(); + if (!alg || strstr ("poly1305-aes", alg)) + time_poly1305_aes(); - if (!alg || strstr ("poly1305-aes", alg)) - time_poly1305_aes(); + for (i = 0; ciphers[i]; i++) + if (!alg || strstr(ciphers[i]->name, alg)) + time_cipher(ciphers[i]); - for (i = 0; ciphers[i]; i++) - if (!alg || strstr(ciphers[i]->name, alg)) - time_cipher(ciphers[i]); + for (i = 0; aeads[i]; i++) + if (!alg || strstr(aeads[i]->name, alg)) + time_aead(aeads[i]); - for (i = 0; aeads[i]; i++) - if (!alg || strstr(aeads[i]->name, alg)) - time_aead(aeads[i]); + optind++; + } while (alg && argv[optind]); return 0; } -- 2.11.0

2 1

possible new modes (was: [PATCH v3 0/1] Add Cipher FeedBack mode support)
by Nikos Mavrogiannopoulos 05 Jan '18

05 Jan '18

On Thu, Jan 4, 2018 at 2:57 AM, Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> wrote: > 2018-01-03 12:44 GMT+03:00 Nikos Mavrogiannopoulos > <n.mavrogiannopoulos(a)gmail.com>: >> On Sat, Oct 7, 2017 at 8:55 PM, Dmitry Eremin-Solenikov >> <dbaryshkov(a)gmail.com> wrote: >>> Add CFB mode support. CFB uses segment size = block size. >>> >>> Changes since V2: >>> >>> - Dropped CFB8, isn't widely used. >> >> I'm getting late into this discussion, but it seems that samba (which >> uses nettle and gnutls), could benefit from an 8-bit CFB mode as well. >> They are already implementing it on top of nettle, and it is being >> used on the newer samba versions: >> >> https://git.samba.org/?p=samba.git;a=blob;f=lib/crypto/REQUIREMENTS;h=351c2… > > Hmm, interesting. It looks like they miss CFB8 and CMAC. However > from the first glance I could not understand, do they reference nettle/ > GNUTLS as code reference, or are they using them as crypto backends? > Skimming over WAF scripts did not give me the answer. They are used as backends, though they also re-implement quite few stuff. My understanding is that they would like to get rid of their crypto implementations, and rely on nettle and gnutls for that. > I can (re-)post CFB8 if that will be helpful to Samba (or other parties). > CMAC also sounds like and interesting topic. Niels what do think about CFB8? On that view, I've compiled a list of new modes which seem to be useful in other applications: AES-CMAC: fast MAC used in samba and there is a draft for NTP protocol. There is implementation in samba at [1]. AES-XTS: it is a mode used in disk volume encryption when no authentication is to be present (ntfs and luks can use it). It is implemented in qemu [0] which already has a nettle back-end. AES-SIV-CMAC: An AES AEAD mode which does not fail secrecy/catastrophically when a nonce is repeated. There is a draft for its use under NTP (draft-ietf-ntp-using-nts-for-ntp-10). regards, Nikos [0]. https://github.com/qemu/qemu/blob/507e4ddc3abf67391bcbc9624fd60b969c159b78/… [1]. https://github.com/samba-team/samba/blob/d8a5565ae647352d11d622bd4e73ff4568…

4 6

[PATCH v3 0/1] Add Cipher FeedBack mode support
by Dmitry Eremin-Solenikov 04 Jan '18

04 Jan '18

Add CFB mode support. CFB uses segment size = block size. Changes since V2: - Dropped CFB8, isn't widely used. - Simplified cfb_encrypt code. - Dropped code handling IV for last-partial-segment. One should set IV for new message anyway, so there little point in adding additional complexity there. Changes since V1: - Add CFB8 support - Minor corrections in documentation. Dmitry Eremin-Solenikov (1): Add CFB block mode support Makefile.in | 4 +- cfb.c | 165 ++++++++++++++++++++++++++ cfb.h | 87 ++++++++++++++ nettle.texinfo | 106 +++++++++++++++-- testsuite/.gitignore | 1 + testsuite/.test-rules.make | 3 + testsuite/Makefile.in | 2 +- testsuite/cfb-test.c | 287 +++++++++++++++++++++++++++++++++++++++++++++ testsuite/testutils.c | 179 ++++++++++++++++++++++++++++ testsuite/testutils.h | 7 ++ 10 files changed, 829 insertions(+), 12 deletions(-) create mode 100644 cfb.c create mode 100644 cfb.h create mode 100644 testsuite/cfb-test.c -- 2.14.2

3 6

Skein status
by nisse＠lysator.liu.se 01 Jan '18

01 Jan '18

I'm looking at the skein code I wrote a while ago, and I might merge it pretty soon, just need a little cleanup. I'm doing skein256 and skein512 (other variants, in particular, skein512-256, mey be of interest). For skein256, it works quite well with two-way unrolling (by which I mean that each loop iteration performs 8 mixing rounds, adding in subkeys twice). I did an x86_64 assembly version, but I'm not being able to beat C code compiled by gcc, so I think I'll scrap that. Which isn't so surprising, since skein uses only operations that the C compiler knows well, and I'm not trying anything clever with scheduling or register allocation. For skein512, subkeys are accessed with mod 9 indexing, which is challenging to do with high performance, if indexes need to be constructed at runtime. I get pretty good performance with full unrolling (so indices are constant), and I'm afraid we have to do either that, or copy subkeys into an area where they are repeated multiple times. As I think I wrote earlier, skein looks similar in spirit to salsa20 and chacha, but unlike those, it's doesn't fit well with simd instructions. To use simd instructions for skein, one would like to put put 2 64-bit values in one xmm register, but one then needs a way to rotate the two halves with different shift counts, which I haven't found any good way to do. Also the odd number of subkeys (five for skein256, and nine for skein512, with the last subkey being the xor of all the other keys and a magic constant), usued in a rotationg fashion, doesn't fit well with storing keys in simd registers. I'm benchmarking on a intel broadwell cpu (marketing name "core i3-5010U") running at 2.1 GHz. Algorithm mode Mbyte/s cycles/byte cycles/block skein256 update 242.45 8.26 264.33 skein512 update 350.44 5.71 365.75 For comparison, timing for sha1, sha2 and sha3: Algorithm mode Mbyte/s cycles/byte cycles/block sha1 update 326.40 6.14 392.69 openssl sha1 update 560.98 3.57 228.48 sha256 update 156.07 12.83 821.24 sha512 update 252.54 7.93 1015.10 sha3_224 update 161.90 12.37 1781.33 sha3_256 update 152.83 13.10 1782.18 sha3_384 update 117.06 17.11 1779.22 sha3_512 update 80.52 24.87 1790.77 So skein512 is faster than both sha2 and sha3 (and one can also see that for sha1 we currently lose to openssl). skein256 is fastet than sha3, but slightly slower than sha512. So maybe we shouldn't do skein256 at all, but skein512-256 (skein can be used with arbitrary output size). Code size for is 408 bytes for skein256, and 3992 bytes for skein512 (which is completely unrolled). Counting only the main block processing function. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

ANNOUNCE: Nettle-3.4
by nisse＠lysator.liu.se 19 Nov '17

19 Nov '17

I'm happy to announce a new release of GNU Nettle, a low-level cryptographics library. This release includes a couple of bugfixes and new features. Next release is likely to break ABI compatibility, to make that transition easier, applications are encourraged to adopt the new accessor functions introduced in this release. The Nettle home page can be found at https://www.lysator.liu.se/~nisse/nettle/, and the manual at https://www.lysator.liu.se/~nisse/nettle/nettle.html. The release can be downloaded from https://ftp.gnu.org/gnu/nettle/nettle-3.4.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-3.4.tar.gz https://www.lysator.liu.se/~nisse/archive/nettle-3.4.tar.gz Happy hacking, /Niels möller NEWS for the Nettle 3.4 release This release fixes bugs and adds a few new features. It also addresses an ABI compatibility issue affecting Nettle-3.1 and later, see below. Bug fixes: * Fixed an improper use of GMP mpn_mul, breaking curve2559 and eddsa on certain platforms. Reported by Sergei Trofimovich. * Fixed memory leak when handling invalid signatures in ecdsa_verify. Fix contributed by Nikos Mavrogiannopoulos. * Fix compilation error with --enable-fat om ARM. Fix contributed by Andreas Schneider. * Reorganized the way certain data items are made available. Short version: Nettle header files now define the symbols nettle_hashes, nettle_ciphers, and nettle_aeads, as preprocessor macros invoking a corresponding accessor function. For backwards ABI compatibility, the symbols are still present in the compiled libraries, and with the same sizes as in nettle-3.3. New features: * Support for RSA-PSS signatures, contributed by Daiki Ueno. * Support for the HKDF key derivation function, defined by RFC 5869. Contributed by Nikos Mavrogiannopoulos. * Support for the Cipher Feedback Mode (CFB), contributed by Dmitry Eremin-Solenikov. * New accessor functions: nettle_get_hashes, nettle_get_ciphers, nettle_get_aeads, nettle_get_secp_192r1, nettle_get_secp_224r1, nettle_get_secp_256r1, nettle_get_secp_384r1, nettle_get_secp_521r1. For source-level compatibility with future versions, applications are encouraged to migrate to using these functions instead of referring to the corresponding data items directly. Miscellaneous: * The base16 and base64 functions now use the type char * for ascii data, rather than uint8_t *. This eliminates the last pointer-signedness warnings when building Nettle. This is a minor API change, and applications may need to be adjusted, but the ABI is unaffected on all platforms I'm aware of. * The contents of the header file nettle/version.h is now architecture independent, except in --enable-mini-gmp configurations. ABI issue: Since the breakage was a bit subtle, let me document it here. The nettle and hogweed libraries export a couple of data symbols, and for some of these, the size was never intended to be part of the ABI. E.g., extern const struct nettle_hash * const nettle_hashes[]; which is an NULL-terminated array. It turns out the sizes nevertheless may leak into the ABI, and that increasing the sizes can break old executables linked with a newer version of the library. When linking a classic non-PIE executable with a shared library, we get ELF relocations of type R_X86_64_COPY for references to data items. These mean that the linker allocates space for the data item in the data segment of executable, at a fixed address determined at link-time, and with size extracted from the version of the .so-file seen when linking. At load time, the run time linker then copies the contents of the symbol from the .so file to that location, and uses the copy instead of the version loaded with the .so-file. And if the data item in the .so file used at load time is larger than the data item seen at link time, it is silently truncated in the process. So when SHA3 hashes were was added to the nettle_hashes array in the nettle-3.3 release, this way of linking produces a truncated array at load time, no longer NULL-terminated. We will get similar problems for planned extensions of the internal struct ecc_curve, and exported data items like extern const struct ecc_curve nettle_secp_256r1; where the ecc_curve struct is only forward declared in the public headers. To prepare, applications should migrate to using the new function nettle_get_secp_256r1, and similarly for the other curves. In some future version, the plan is to add a leading underscore to the name of the actual data items. E.g., nettle_hashes --> _nettle_hashes, breaking the ABI, while keeping the nettle_get_hashes function and the nettle_hashes macro as the supported ways to access it. We will also rename nettle_secp_256r1 --> _nettle_secp_256r1, breaking both ABI and API. Note that data items like nettle_sha256 are *not* affected, since the size and layout of this struct is considered part of the ABI, and R_X86_64_COPY-relocations then work fine. The shared library names are libnettle.so.6.4 and libhogweed.so.4.4, with sonames still libnettle.so.6 and libhogweed.so.4. It is intended to be fully binary compatible with nettle-3.1. -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

Nettle-3.4 rc2
by nisse＠lysator.liu.se 15 Nov '17

15 Nov '17

Hi, I've prepared a "release candidate" tarball, https://www.lysator.liu.se/~nisse/archive/nettle-3.4rc2.tar.gz All testing appreciated, in particular on non-x86 or non-gnu/linux platforms. If all goes well, I might make the release next weekend. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

2 7

Fix UBSAN issue
by Tim Rühsen 09 Nov '17

09 Nov '17

Nothing with a real impact, just to silence sanitizers. From OSS-Fuzz: SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /src/libfuzzer/FuzzerSHA1.cpp:132:14 in sec-tabselect.c:58:24: runtime error: negation of 1 cannot be represented in type 'mp_limb_t' (aka 'unsigned long') Patch attached. With Best Regards, Tim

2 5

Release plan?
by nisse＠lysator.liu.se 09 Nov '17

09 Nov '17

There are several unfinished projects, curve448, gost cryptos, skein,... But there are also a few new features completed since the nettle-3.3 release: rsa-pss, and hkdf. And a couple of bugfixes. And we have the ABI problems which are only half way fixed, and which I think are pretty important. So I'm thinking, maybe we should try to fix the ABI issue and get in shape for release, and not try to get more new features in 3.4? To get minimal ABI breakage, I also suspect we would need a release branch where I revert recent changes that grow the size of struct ecc_curve; my idea is to introduce functions returning pointers to the instances of this struct. But as long as applications are using the data symbols directly as advertised in ecc-curves.h, executables with R_X86_64_COPY relocations will break, in the same way as arrays like nettle_hashes. What do you think? See https://www.lysator.liu.se/~nisse/nettle/plan.html for current list. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

3 12

[PATCH 0/5] Improve GOST R 34.11-94 hash function support
by Dmitry Eremin-Solenikov 25 Oct '17

25 Oct '17

This in an excerpt from previously sent patch set [PATCH 00/13] GOST cipher/MAC/hash algorithms support This patch series concentrates on gosthash94 support. It adds gosthash94cp -- GOST R 34.11-94 variant using more popular S-Box and implements HMAC and PBKDF2 interfaes for GOST hashing algorithms. References: - GOST R 34.11-94: RFC 5831 https://tools.ietf.org/html/rfc5831 - GOST 28147-89: RFC 5830 https://tools.ietf.org/html/rfc5830 - S-Boxes: RFC 4357 https://tools.ietf.org/html/rfc4357 Dmitry Eremin-Solenikov (5): Add GOST R 34.11 to nettle_hashes Start separating GOST 28147-89 from GOST R 34.11-94 Add support for GOSTHASH94CP: GOST R 34.11-94 hash with CryptoPro S-box Add HMAC functions for GOSTHASH94 and GOSTHASH94CP Add PBKDF2 support for gosthash94cp Makefile.in | 8 +- examples/nettle-benchmark.c | 1 + gost28147.c | 607 ++++++++++++++++++++++++++++++++++++++++++++ gost28147.h | 66 +++++ gosthash94-meta.c | 3 + gosthash94.c | 321 +++++------------------ gosthash94.h | 13 + hmac-gosthash94.c | 79 ++++++ hmac.h | 37 +++ nettle-meta-hashes.c | 2 + nettle-meta.h | 1 + nettle.texinfo | 41 ++- pbkdf2-hmac-gosthash94.c | 54 ++++ pbkdf2.h | 7 + testsuite/gosthash94-test.c | 12 + testsuite/hmac-test.c | 14 + testsuite/meta-hash-test.c | 2 + testsuite/pbkdf2-test.c | 24 ++ 18 files changed, 1033 insertions(+), 259 deletions(-) create mode 100644 gost28147.c create mode 100644 gost28147.h create mode 100644 hmac-gosthash94.c create mode 100644 pbkdf2-hmac-gosthash94.c -- 2.13.2

1 6

[PATCH 0/6] Secp256k1 curve support
by Dmitry Eremin-Solenikov 16 Oct '17

16 Oct '17

This is the set of patches to add secp256k1 support. They apply on top of curve448 patches, because they reuse ecc->dup field added in that patchset. Dmitry Eremin-Solenikov (6): ecc: use dup fiels for all the curves eccdata: use 'a' coefficient eccdata: switch to using curve name instead of just bits ecc: include coefficient 'a' into the ecc_curve struct ecdsa-keygen-test: make use of ecc->a ecc: support secp256k1 curve Makefile.in | 26 ++++++---- ecc-192.c | 1 + ecc-224.c | 1 + ecc-25519.c | 1 + ecc-256.c | 1 + ecc-384.c | 1 + ecc-521.c | 1 + ecc-curve.h | 1 + ecc-dup-jj-0.c | 108 ++++++++++++++++++++++++++++++++++++++++++ ecc-internal.h | 11 ++++- ecc-mul-a.c | 6 +-- ecc-mul-g.c | 2 +- eccdata.c | 103 +++++++++++++++++++++++++++++----------- testsuite/ecc-add-test.c | 2 +- testsuite/ecc-dup-test.c | 2 +- testsuite/ecdsa-keygen-test.c | 5 +- testsuite/testutils.c | 12 ++++- 17 files changed, 238 insertions(+), 46 deletions(-) create mode 100644 ecc-dup-jj-0.c -- 2.14.2

1 6

[PATCH v2 0/2] Add Cipher FeedBack mode support
by Dmitry Eremin-Solenikov 05 Oct '17

05 Oct '17

Add support for CFB and CFB8 modes support. CFB uses segment size = block size, CFB8 uses 8-bit segments. Changes since V1: - Add CFB8 support - Minor corrections in documentation. Dmitry Eremin-Solenikov (2): Add CFB block mode support Add CFB8 - Cipher Feedback 8-bit block cipher mode Makefile.in | 4 +- cfb.c | 257 +++++++++++++++++++++++++++++ cfb.h | 122 ++++++++++++++ nettle.texinfo | 188 ++++++++++++++++++++-- testsuite/.gitignore | 1 + testsuite/.test-rules.make | 3 + testsuite/Makefile.in | 2 +- testsuite/cfb-test.c | 390 +++++++++++++++++++++++++++++++++++++++++++++ testsuite/testutils.c | 357 +++++++++++++++++++++++++++++++++++++++++ testsuite/testutils.h | 14 ++ 10 files changed, 1326 insertions(+), 12 deletions(-) create mode 100644 cfb.c create mode 100644 cfb.h create mode 100644 testsuite/cfb-test.c -- 2.14.1

2 10

Cannot build nettle with local GMP on CentOS 6
by Robert Paprocki 01 Oct '17

01 Oct '17

Hello, I have compiled Nettle 3.3 with GMP 6.1.2 on a variety of systems (various Ubuntu/Debian distros, CentOS 7, Alpine) with success: ##### build GMP # pwd /tmp/gmp-6.1.2 # ./configure && make [...snip...] # find . -name "*.so" ./.libs/libgmp.so ###### build nettle # pwd /tmp/nettle-3.3 # CPPFLAGS="-I../gmp-6.1.2/" LDFLAGS="-L../gmp-6.1.2/.libs" ./configure && make Again this works as expected on a variety of systems, except for CentOS 6 (using the centos:6 docker image). On CentOS 6 nettle configure fails with the following: checking for GMP limb size... configure: error: in `/tmp/nettle-3.3': configure: error: cannot find value of GMP_NUMB_BITS Full configure output: https://pastebin.com/9s3nfA8G Oddly enough, if I install GMP (via 'make install') to a default search path, configure/make works as expected. Additionally, if I define LD_LIBRARY_PATH to the GMP lib build path (/tmp/gmp-6.1.2/.libs), the configure process works as expected, but we then encounter further errors when building (during the hogweed build process): gcc -I.. -I.. -I../gmp-6.1.2/ -DHAVE_CONFIG_H -g -O2 -ggdb3 -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -MT pkcs1-conv.o -MD -MP -MF pkcs1-conv.o.d -c pkcs1-conv.c && true In file included from ../rsa.h:38, from pkcs1-conv.c:47: ../bignum.h:54:18: error: gmp.h: No such file or directory Which is very odd because we gmp.h definitely does exist (our gcc call has the following: -I../gmp-6.1.2/): # file ../gmp-6.1.2/gmp.h ../gmp-6.1.2/gmp.h: ASCII C program text FWIW, the gcc/m4 versions on CentOS 6 are fairly old: [root@56de37e1bc78 nettle-3.3]# gcc --version gcc (GCC) 4.4.7 20120313 (Red Hat 4.4.7-18) [root@56de37e1bc78 nettle-3.3]# m4 --version m4 (GNU M4) 1.4.13 I tried upgrading GCC to 4.8 with no change; trying to update m4 was more than I wanted to chew off as it involved a libc change. Has anyone run into this behavior before? I wonder if this is potentially a bug with m4, but I'm not quite sure where to look at this point. Again we can work around our problem by installing GMP to a system dir (/usr/local/lib), but would like to avoid this if we can. One other thing I noted is that when running 'make install' in this environment, gmp installs to /usr/local/lib while nettle installs to /usr/local/lib64. Not sure if this is meaningful, or indicative of a compiler/configure flag that needs be adjusted for CentOS specifically (or any other

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs