nettle-bugs

nettle-bugs@lists.lysator.liu.se

2196 discussions

Nettle-3.4.1rc1, addressing PKCS#1 side-channel leaks
by nisse＠lysator.liu.se 22 Jan '19

22 Jan '19

A release candidate for nettle-3.4.1 is now available, as https://www.lysator.liu.se/~nisse/archive/nettle-3.4.1rc1.tar.gz https://www.lysator.liu.se/~nisse/archive/nettle-3.4.1rc1.tar.gz.sig Corresponding changes are also pushed to the branch https://git.lysator.liu.se/nettle/nettle/tree/release-3.4-fixes Release timing is prompted by the publication of http://cat.eyalro.net/. Nettle and GnuTLS authors (as well as developers of other TLS implementations) were notified by the research team a few months ago. Related CVE ids: CVE-2018-16868 gnutls: Bleichenbacher-like side channel leakage in PKCS#1 1.5 verification and padding oracle verification CVE-2018-16869 nettle: Leaky data conversion exposing a manager oracle For Nettle, the RSA code, which I wrote some 15 years ago, have seen an overhawl. Not only making the handling of PKCS#1 on decryption side-channel silent (the vulnerabilities that could be exploited by the methods of the above paper), but also ensuring that we use side-channel silent functions for the needed bignum arithmetic. This has been a lot of work, and most of it not done by me, but by Simo Sorce, at Red Hat Inc. Without this help, it would have been difficult to get a good release out on time. Testing of the release candidate is highly appreciated. I intend to make and announce the non-candidate release soon, possibly as early as tomorrow morning (i.e., December 1, in European timezone). A GnuTLS release, depending on the new rsa_sec_decrypt function in Nettle-3.4.1, is also being made about now. My understanding is that there's no need to panic. The attack directly affects RSA decryption, not signatures. And it requires some resources to be pulled off. As far as I understand, a successful attack lets the attacker decrypt or sign a targeted message, e.g., compromising the TLS "premaster secret", corresponding session keys, and any transmitted passwords or login cookies sent in a single TLS session, but it does not expose the private key itself. However, if you operate a TLS server, you should consider if you can completely disable key exchange based on RSA decryption. If you need to keep it for backwards compatibility, it is *strongly* encouraged to use a separate RSA key for this purpose, *not* reused or authorized for any other purpose. Regards, /Niels NEWS for the Nettle 3.4.1 release This release fixes a few bugs, and makes the RSA private key operations side channel silent. The RSA improvements are contributed by Simo Sorce and Red Hat, and include one new public function, rsa_sec_decrypt, see below. All functions using RSA private keys are now side-channel silent, meaning that they try hard to avoid any branches or memory accesses depending on secret data. This applies both to the bignum calculations, which now use GMP's mpn_sec_* family of functions, and the processing of PKCS#1 padding needed for RSA decryption. Nettle's ECC functions were already side-channel silent, while the DSA functions still aren't. There's also one caveat regarding the improved RSA functions: due to small table lookups in relevant mpn_sec_* functions in GMP-6.1.2, the lowest and highest few bits of the secret factors p and q may still leak. I'm not aware of any attacks on RSA where knowing a few bits of the factors makes a significant difference. This leak will likely be plugged in later GMP versions. Changes in behavior: * The functions rsa_decrypt and rsa_decrypt_tr may now clobber all of the provided message buffer, independent of the actual message length. They are side-channel silent, in that branches and memory accesses don't depend on the validity or length of the message. Side-channel leakage from the caller's use of length and return value may still provide an oracle useable for a Bleichenbacher-style chosen ciphertext attack. Which is why the new function rsa_sec_decrypt is recommended. New features: * A new function rsa_sec_decrypt. It differs from rsa_decrypt_tr in that the length of the decrypted message is given a priori, and PKCS#1 padding indicating a different length is treated as an error. For applications that may be subject to chosen ciphertext attacks, it is recommended to initialize the message area with random data, call this function, and ignore the return value. This applies in particular to RSA-based key exchange in the TLS protocol. Bug fixes: * Fix bug in pkcs1-conv, missing break statements in the parsing of PEM input files. * Fix link error on the pss-mgf1-test test, affecting builds without public key support. Performance regression: * All RSA private key operations employing RSA blinding, i.e., rsa_decrypt_tr, rsa_*_sign_tr, the new rsa_sec_decrypt, and rsa_compute_root_tr, are significantly slower. This is because (i) RSA blinding now use side-channel silent operations, (ii) blinding includes a modular inversion, and (iii) side-channel silent modular inversion, implemented as mpn_sec_invert, is very expensive. A 60% slowdown for 2048-bit RSA keys have been measured. Miscellaneous: * Building the public key support of nettle now requires GMP version 6.0 or later (unless --enable-mini-gmp is used). The shared library names are libnettle.so.6.5 and libhogweed.so.4.5, with sonames still libnettle.so.6 and libhogweed.so.4. It is intended to be fully binary compatible with nettle-3.1. -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

5 20

[repost] [PATCH] Add --enable-fat support for arm neon chacha20
by Yuriy M. Kaminskiy 19 Jan '19

19 Jan '19

> From e86ec9188319ef08d635da38c2f8bf891e56f995 Mon Sep 17 00:00:00 2001 From: "Yuriy M. Kaminskiy" <yumkam(a)gmail.com> Date: Wed, 2 Jan 2019 19:41:32 +0300 Subject: [PATCH] Add --enable-fat support for arm neon chacha20 On BCM2837B0 (Cortex-A53) @1.4GHz (Raspberry Pi 3B+), Before: `gnutls-cli --benchmark-ciphers` CHACHA20-POLY1305 (16384) 51.54 MB/sec `gnutls-cli --benchmark-tls-ciphers`: ECDHE_RSA_CHACHA20_POLY1305 (payload 1400) 21.31 MB/sec ECDHE_RSA_CHACHA20_POLY1305 (payload 15360) 24.60 MB/sec `nettle-benchmark` chacha encrypt 71.90 chacha decrypt 71.89 chacha_poly1305 encrypt 48.17 chacha_poly1305 decrypt 48.17 chacha_poly1305 update 146.03 After: `gnutls-cli --benchmark-ciphers` CHACHA20-POLY1305 (16384) 68.44 MB/sec `gnutls-cli --benchmark-tls-ciphers`: ECDHE_RSA_CHACHA20_POLY1305 (payload 1400) 27.25 MB/sec ECDHE_RSA_CHACHA20_POLY1305 (payload 15360) 32.41 MB/sec `nettle-benchmark` chacha encrypt 106.00 chacha decrypt 105.94 chacha_poly1305 encrypt 65.94 chacha_poly1305 decrypt 65.96 chacha_poly1305 update 175.24 --- arm/fat/chacha-core-internal-2.asm | 37 +++++++++++++++++++++++++++++++++++++ chacha-core-internal.c | 7 +++++++ configure.ac | 2 ++ fat-arm.c | 10 ++++++++++ fat-setup.h | 2 ++ 5 files changed, 58 insertions(+) create mode 100644 arm/fat/chacha-core-internal-2.asm P.S. for reference, on same machine, openssl chacha20 encrypt 236.08 openssl chacha20 decrypt 236.14 openssl chacha20-poly1305 encrypt 181.26 openssl chacha20-poly1305 decrypt 182.09 openssl chacha20-poly1305 update 782.67 (with openssl 1.1.0j-1~deb9u1 from debian-stretch/armhf) diff --git a/arm/fat/chacha-core-internal-2.asm b/arm/fat/chacha-core-internal-2.asm new file mode 100644 index 00000000..66a5c145 --- /dev/null +++ b/arm/fat/chacha-core-internal-2.asm @@ -0,0 +1,37 @@ +C arm/fat/chacha-core-internal-2.asm + + +ifelse(< + Copyright (C) 2015 Niels Möller + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +>) + +dnl PROLOGUE(_nettle_chacha_core) picked up by configure + +define(<fat_transform>, <$1_neon>) +include_src(<arm/neon/chacha-core-internal.asm>) diff --git a/chacha-core-internal.c b/chacha-core-internal.c index af278bb0..0905834e 100644 --- a/chacha-core-internal.c +++ b/chacha-core-internal.c @@ -51,6 +51,13 @@ #include "macros.h" +/* For fat builds */ +#if HAVE_NATIVE_chacha_core +void +_nettle_chacha_core_c(uint32_t *dst, const uint32_t *src, unsigned rounds); +#define _nettle_chacha_core _nettle_chacha_core_c +#endif + #ifndef CHACHA_DEBUG # define CHACHA_DEBUG 0 #endif diff --git a/configure.ac b/configure.ac index 305977d1..3f409fa4 100644 --- a/configure.ac +++ b/configure.ac @@ -472,6 +472,7 @@ asm_replace_list="aes-encrypt-internal.asm aes-decrypt-internal.asm \ # Assembler files which generate additional object files if they are used. asm_nettle_optional_list="gcm-hash8.asm cpuid.asm \ aes-encrypt-internal-2.asm aes-decrypt-internal-2.asm memxor-2.asm \ + chacha-core-internal-2.asm \ salsa20-core-internal-2.asm sha1-compress-2.asm sha256-compress-2.asm \ sha3-permute-2.asm sha512-compress-2.asm \ umac-nh-n-2.asm umac-nh-2.asm" @@ -573,6 +574,7 @@ AC_SUBST([IF_ASM]) AH_VERBATIM([HAVE_NATIVE], [/* Define to 1 each of the following for which a native (ie. CPU specific) implementation of the corresponding routine exists. */ +#undef HAVE_NATIVE_chacha_core #undef HAVE_NATIVE_ecc_192_modp #undef HAVE_NATIVE_ecc_192_redc #undef HAVE_NATIVE_ecc_224_modp diff --git a/fat-arm.c b/fat-arm.c index 5e656359..56099e6f 100644 --- a/fat-arm.c +++ b/fat-arm.c @@ -171,6 +171,10 @@ DECLARE_FAT_FUNC(_nettle_umac_nh_n, umac_nh_n_func) DECLARE_FAT_FUNC_VAR(umac_nh_n, umac_nh_n_func, c); DECLARE_FAT_FUNC_VAR(umac_nh_n, umac_nh_n_func, neon); +DECLARE_FAT_FUNC(_nettle_chacha_core, chacha_core_func) +DECLARE_FAT_FUNC_VAR(_chacha_core, chacha_core_func, c); +DECLARE_FAT_FUNC_VAR(_chacha_core, chacha_core_func, neon); + static void CONSTRUCTOR fat_init (void) { @@ -212,6 +216,7 @@ fat_init (void) nettle_sha3_permute_vec = _nettle_sha3_permute_neon; _nettle_umac_nh_vec = _nettle_umac_nh_neon; _nettle_umac_nh_n_vec = _nettle_umac_nh_n_neon; + _nettle_chacha_core_vec = _nettle_chacha_core_neon; } else { @@ -222,6 +227,7 @@ fat_init (void) nettle_sha3_permute_vec = _nettle_sha3_permute_c; _nettle_umac_nh_vec = _nettle_umac_nh_c; _nettle_umac_nh_n_vec = _nettle_umac_nh_n_c; + _nettle_chacha_core_vec = _nettle_chacha_core_c; } } @@ -267,3 +273,7 @@ DEFINE_FAT_FUNC(_nettle_umac_nh_n, void, unsigned length, const uint8_t *msg), (out, n, key, length, msg)) +DEFINE_FAT_FUNC(_nettle_chacha_core, void, + (uint32_t *dst, const uint32_t *src, unsigned rounds), + (dst, src, rounds)) + diff --git a/fat-setup.h b/fat-setup.h index eb7166a7..b623ebf9 100644 --- a/fat-setup.h +++ b/fat-setup.h @@ -174,3 +174,5 @@ typedef void sha512_compress_func (uint64_t *state, const uint8_t *input, const typedef uint64_t umac_nh_func (const uint32_t *key, unsigned length, const uint8_t *msg); typedef void umac_nh_n_func (uint64_t *out, unsigned n, const uint32_t *key, unsigned length, const uint8_t *msg); + +typedef void chacha_core_func(uint32_t *dst, const uint32_t *src, unsigned rounds); -- 2.11.0

2 3

error: ‘for’ loop initial declarations are only allowed in C99 or C11 mode
by Jeffrey Walton 30 Dec '18

30 Dec '18

Building on my HiKey, which is Aarch64. ========== $ gcc --version gcc (Debian/Linaro 4.9.2-10+deb8u1) 4.9.2 Copyright (C) 2014 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. ========== gcc -I. -I/usr/local/include -DNDEBUG -DHAVE_CONFIG_H -g2 -O2 -fPIC -ggdb3 -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT rsa-sign-tr.o -MD -MP -MF rsa-sign-tr.o.d -c rsa-sign-tr.c \ && true gcc -I. -I/usr/local/include -DNDEBUG -DHAVE_CONFIG_H -g2 -O2 -fPIC -ggdb3 -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT rsa-verify.o -MD -MP -MF rsa-verify.o.d -c rsa-verify.c \ && true rsa-sign-tr.c: In function ‘sec_equal’: rsa-sign-tr.c:243:3: error: ‘for’ loop initial declarations are only allowed in C99 or C11 mode for (size_t i = 0; i < limbs; i++) ^ rsa-sign-tr.c:243:3: note: use option -std=c99, -std=gnu99, -std=c11 or -std=gnu11 to compile your code Makefile:260: recipe for target 'rsa-sign-tr.o' failed make[1]: *** [rsa-sign-tr.o] Error 1 make[1]: *** Waiting for unfinished jobs.... make[1]: Leaving directory '/home/build/nettle-3.4.1' Makefile:49: recipe for target 'all' failed make: *** [all] Error 2

2 1

ANNOUNCE: Nettle-3.4.1
by nisse＠lysator.liu.se 04 Dec '18

04 Dec '18

I'm happy to announce a new release of GNU Nettle, a low-level cryptographics library. The main change in this release is that RSA private key operations are now side-channel silent, thanks to contributions by Simo Sorce, at Red Hat Inc. The release also includes a few smaller bugfixes. The Nettle home page can be found at https://www.lysator.liu.se/~nisse/nettle/, and the manual at https://www.lysator.liu.se/~nisse/nettle/nettle.html. The release can be downloaded from https://ftp.gnu.org/gnu/nettle/nettle-3.4.1.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-3.4.tar.gz https://www.lysator.liu.se/~nisse/archive/nettle-3.4.1.tar.gz There are no code changes since the release candidate announced on the Nettle mailing list November 30. Release timing is prompted by the publication of http://cat.eyalro.net/. Nettle and GnuTLS authors (as well as developers of other TLS implementations) were notified by the research team a few months ago. Related CVE ids: CVE-2018-16868 gnutls: Bleichenbacher-like side channel leakage in PKCS#1 1.5 verification and padding oracle verification CVE-2018-16869 nettle: Leaky data conversion exposing a manager oracle For Nettle, the RSA code, which was written some 15 years ago, have seen an overhawl. Not only making the handling of PKCS#1 on decryption side-channel silent (the vulnerabilities that could be exploited by the methods of the above paper), but also ensuring that underlying bignum arithmetic uses side-channel silent functions. The attack directly affects RSA decryption, not signatures. And it requires some resources to be pulled off. As far as I understand it, a successful attack lets the attacker decrypt or sign a targeted message, e.g., compromising the TLS "premaster secret" of a particular session, corresponding session keys, and any transmitted passwords or login cookies supposedly protected by those session keys, but it does not expose the private key itself. Upgrading the Nettle and GnuTLS libraries is recommended. If you operate a TLS server, you should consider if you can completely disable key exchange based on RSA decryption. If you need to keep it for backwards compatibility, it is *strongly* encouraged to use a separate RSA key for this purpose, *not* reused or authorized for any other purpose. Regards, /Niels NEWS for the Nettle 3.4.1 release This release fixes a few bugs, and makes the RSA private key operations side channel silent. The RSA improvements are contributed by Simo Sorce and Red Hat, and include one new public function, rsa_sec_decrypt, see below. All functions using RSA private keys are now side-channel silent, meaning that they try hard to avoid any branches or memory accesses depending on secret data. This applies both to the bignum calculations, which now use GMP's mpn_sec_* family of functions, and the processing of PKCS#1 padding needed for RSA decryption. Nettle's ECC functions were already side-channel silent, while the DSA functions still aren't. There's also one caveat regarding the improved RSA functions: due to small table lookups in relevant mpn_sec_* functions in GMP-6.1.2, the lowest and highest few bits of the secret factors p and q may still leak. I'm not aware of any attacks on RSA where knowing a few bits of the factors makes a significant difference. This leak will likely be plugged in later GMP versions. Changes in behavior: * The functions rsa_decrypt and rsa_decrypt_tr may now clobber all of the provided message buffer, independent of the actual message length. They are side-channel silent, in that branches and memory accesses don't depend on the validity or length of the message. Side-channel leakage from the caller's use of length and return value may still provide an oracle useable for a Bleichenbacher-style chosen ciphertext attack. Which is why the new function rsa_sec_decrypt is recommended. New features: * A new function rsa_sec_decrypt. It differs from rsa_decrypt_tr in that the length of the decrypted message is given a priori, and PKCS#1 padding indicating a different length is treated as an error. For applications that may be subject to chosen ciphertext attacks, it is recommended to initialize the message area with random data, call this function, and ignore the return value. This applies in particular to RSA-based key exchange in the TLS protocol. Bug fixes: * Fix bug in pkcs1-conv, missing break statements in the parsing of PEM input files. * Fix link error on the pss-mgf1-test test, affecting builds without public key support. Performance regression: * All RSA private key operations employing RSA blinding, i.e., rsa_decrypt_tr, rsa_*_sign_tr, the new rsa_sec_decrypt, and rsa_compute_root_tr, are significantly slower. This is because (i) RSA blinding now use side-channel silent operations, (ii) blinding includes a modular inversion, and (iii) side-channel silent modular inversion, implemented as mpn_sec_invert, is very expensive. A 60% slowdown for 2048-bit RSA keys have been measured. Miscellaneous: * Building the public key support of nettle now requires GMP version 6.0 or later (unless --enable-mini-gmp is used). The shared library names are libnettle.so.6.5 and libhogweed.so.4.5, with sonames still libnettle.so.6 and libhogweed.so.4. It is intended to be fully binary compatible with nettle-3.1. -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

1 0

nettle-3.4.1
by nisse＠lysator.liu.se 19 Nov '18

19 Nov '18

It turns out there's a need for a bugfix-only release nettle-3.4.1, to be released in a few weeks. I've created a branch release-3.4-fixes, and backported a few bugfixes (see commit history or ChangeLog on that branch), https://git.lysator.liu.se/nettle/nettle/blob/release-3.4-fixes/ChangeLog I'm sorry I haven't been able to respond to the recently posted patches on this list. I'll get back to that after 3.4.1. If you think I've missed some important bugfixes, please speak up. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

2 1

[PATCH] ctr16: fix encryption if src == dst
by Dmitry Eremin-Solenikov 11 Oct '18

11 Oct '18

If src == dst, ctr16 code will fail to increment src and dst pointers, always overwriting first block. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- ctr16.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ctr16.c b/ctr16.c index 60418e8b9032..7e1c23d20832 100644 --- a/ctr16.c +++ b/ctr16.c @@ -91,7 +91,7 @@ _ctr_crypt16(const void *ctx, nettle_cipher_func *f, f(ctx, CTR_BUFFER_LIMIT, buffer->b, buffer->b); if (length - i < CTR_BUFFER_LIMIT) goto done; - memxor3 (dst, src, buffer->b, CTR_BUFFER_LIMIT); + memxor3 (dst + i, src + i, buffer->b, CTR_BUFFER_LIMIT); } if (blocks > 0) -- 2.18.0

2 4

[PATCH 0/3] Add CMAC-64 and CMAC-DES3 support
by Dmitry Eremin-Solenikov 21 Sep '18

21 Sep '18

To further improve GOST ciphers support in GnuTLS I need 64-bit CMAC variant (since one of GOST ciphers is 64-bit one). Implement CMAC-64 and CMAC-DES3 as a way to prove CMAC-64 correctness. -- With best wishes Dmitry

1 3

Deprecation
by nisse＠lysator.liu.se 13 Aug '18

13 Aug '18

I've looked into using __attribute__ ((deprecated)). See branch attribute-deprecated. I define _NETTLE_ATTRIBUTE_DEPRECATED in nettle-types.h (and _NETTLE_ATTRIBUTE_PURE, needed in a few places). For a start, I've marked the old aes and gcm-aes interfaces as deprecated, as discussed earlier, and the obsolete _rsa_blind and _rsa_unblind functions. Some more functions are candidates for deprecation: 1. Everything in des-compat.h and md5-compat.h. Unless we think it can be deleted without deprecation; I'm not aware of any usage, and they made more sense back in 2001 when Nettle-1.0 was brand new. 2. The "general" hmac functions: hmac_set_key, hmac_update, hmac_digest. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

2 3

[RFC 1/4] hmac: provide alternative HMAC interface
by Dmitry Eremin-Solenikov 30 Jul '18

30 Jul '18

Provide alternative HMAC interface, with context struct having just derived key and single hash state instead of three hash states at once. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- hmac.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ hmac.h | 34 ++++++++++++++++++++++++++++- 2 files changed, 101 insertions(+), 1 deletion(-) diff --git a/hmac.c b/hmac.c index 6ac5e11a0686..44ac705856ad 100644 --- a/hmac.c +++ b/hmac.c @@ -115,3 +115,71 @@ hmac_digest(const void *outer, const void *inner, void *state, memcpy(state, inner, hash->context_size); } + +void +hmac2_set_key(void *outer, void *inner, void *state, + const struct nettle_hash *hash, + size_t key_length, const uint8_t *key) +{ + TMP_DECL(pad, uint8_t, NETTLE_MAX_HASH_BLOCK_SIZE); + TMP_ALLOC(pad, hash->block_size); + + hash->init(state); + if (key_length > hash->block_size) + { + /* Reduce key to the algorithm's hash size. Use the area pointed + * to by state for the temporary state. */ + + TMP_DECL(digest, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE); + TMP_ALLOC(digest, hash->digest_size); + + hash->update(state, key_length, key); + hash->digest(state, hash->digest_size, digest); + + key = digest; + key_length = hash->digest_size; + } + + assert(key_length <= hash->block_size); + + memset(pad, OPAD, hash->block_size); + memxor(pad, key, key_length); + + /* Init happened before */ + hash->update(state, hash->block_size, pad); + memcpy(outer, state, hash->state_size); + + memset(pad, IPAD, hash->block_size); + memxor(pad, key, key_length); + + hash->init(state); + hash->update(state, hash->block_size, pad); + + memcpy(inner, state, hash->state_size); +} + +void +hmac2_update(void *state, + const struct nettle_hash *hash, + size_t length, const uint8_t *data) +{ + hash->update(state, length, data); +} + +void +hmac2_digest(const void *outer, const void *inner, void *state, + const struct nettle_hash *hash, + size_t length, uint8_t *dst) +{ + TMP_DECL(digest, uint8_t, NETTLE_MAX_HASH_DIGEST_SIZE); + TMP_ALLOC(digest, hash->digest_size); + + hash->digest(state, hash->digest_size, digest); + + memcpy(state, outer, hash->state_size); + + hash->update(state, hash->digest_size, digest); + hash->digest(state, length, dst); + + memcpy(state, inner, hash->state_size); +} diff --git a/hmac.h b/hmac.h index 40a8e77aab6d..e6519023d259 100644 --- a/hmac.h +++ b/hmac.h @@ -49,6 +49,9 @@ extern "C" { #define hmac_set_key nettle_hmac_set_key #define hmac_update nettle_hmac_update #define hmac_digest nettle_hmac_digest +#define hmac2_set_key nettle_hmac2_set_key +#define hmac2_update nettle_hmac2_update +#define hmac2_digest nettle_hmac2_digest #define hmac_md5_set_key nettle_hmac_md5_set_key #define hmac_md5_update nettle_hmac_md5_update #define hmac_md5_digest nettle_hmac_md5_digest @@ -87,6 +90,24 @@ hmac_digest(const void *outer, const void *inner, void *state, size_t length, uint8_t *digest); +void +hmac2_set_key(void *outer, void *inner, void *state, + const struct nettle_hash *hash, + size_t length, const uint8_t *key); + +/* This function is not strictly needed, it's s just the same as the + * hash update or hmac2_update functions. */ +void +hmac2_update(void *state, + const struct nettle_hash *hash, + size_t length, const uint8_t *data); + +void +hmac2_digest(const void *outer, const void *inner, void *state, + const struct nettle_hash *hash, + size_t length, uint8_t *digest); + + #define HMAC_CTX(type) \ { type outer; type inner; type state; } @@ -98,10 +119,21 @@ hmac_digest(const void *outer, const void *inner, void *state, hmac_digest( &(ctx)->outer, &(ctx)->inner, &(ctx)->state, \ (hash), (length), (digest) ) +#define HMAC2_CTX(ctx_type, type) \ +{ type outer; type inner; ctx_type state; } + +#define HMAC2_SET_KEY(ctx, hash, length, key) \ + hmac2_set_key( &(ctx)->outer, &(ctx)->inner, &(ctx)->state, \ + (hash), (length), (key) ) + +#define HMAC2_DIGEST(ctx, hash, length, digest) \ + hmac2_digest( &(ctx)->outer, &(ctx)->inner, &(ctx)->state, \ + (hash), (length), (digest) ) + /* HMAC using specific hash functions */ /* hmac-md5 */ -struct hmac_md5_ctx HMAC_CTX(struct md5_ctx); +struct hmac_md5_ctx HMAC2_CTX(struct md5_ctx, struct md5_state); void hmac_md5_set_key(struct hmac_md5_ctx *ctx, -- 2.18.0

2 4

[PATCH] Add benchmarking for HMAC functions
by Dmitry Eremin-Solenikov 30 Jul '18

30 Jul '18

In preparation of changing internal HMAC interface add benchmarking for HMAC functions. Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov(a)gmail.com> --- examples/nettle-benchmark.c | 154 ++++++++++++++++++++++++++++++++++++ 1 file changed, 154 insertions(+) diff --git a/examples/nettle-benchmark.c b/examples/nettle-benchmark.c index 5a88e72dd678..101ba7d4abcc 100644 --- a/examples/nettle-benchmark.c +++ b/examples/nettle-benchmark.c @@ -67,6 +67,7 @@ #include "umac.h" #include "cmac.h" #include "poly1305.h" +#include "hmac.h" #include "nettle-meta.h" #include "nettle-internal.h" @@ -476,6 +477,147 @@ time_poly1305_aes(void) time_function(bench_hash, &info)); } +struct bench_hmac_info +{ + void *ctx; + nettle_hash_update_func *update; + nettle_hash_digest_func *digest; + size_t length; + size_t digest_length; + const uint8_t *data; +}; + +static void +bench_hmac(void *arg) +{ + struct bench_hmac_info *info = arg; + uint8_t digest[NETTLE_MAX_HASH_DIGEST_SIZE]; + size_t pos, length; + + length = info->length; + for (pos = 0; pos < BENCH_BLOCK; pos += length) + { + size_t single = pos + length < BENCH_BLOCK ? + length : + BENCH_BLOCK - pos; + info->update(info->ctx, single, info->data + pos); + info->digest(info->ctx, info->digest_length, digest); + } +} + +static const struct +{ + size_t length; + const char *msg; +} hmac_tests[] = { + { 64, "64 bytes" }, + { 256, "256 bytes" }, + { 1024, "1024 bytes" }, + { 4096, "4096 bytes" }, + { BENCH_BLOCK, "single msg" }, + { 0, NULL }, +}; + +static void +time_hmac_md5(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_md5_ctx md5_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_md5_set_key(&md5_ctx, MD5_BLOCK_SIZE, data); + info.ctx = &md5_ctx; + info.update = (nettle_hash_update_func *) hmac_md5_update; + info.digest = (nettle_hash_digest_func *) hmac_md5_digest; + info.digest_length = MD5_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-md5", hmac_tests[pos].msg, MD5_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + +static void +time_hmac_sha1(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_sha1_ctx sha1_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_sha1_set_key(&sha1_ctx, SHA1_BLOCK_SIZE, data); + info.ctx = &sha1_ctx; + info.update = (nettle_hash_update_func *) hmac_sha1_update; + info.digest = (nettle_hash_digest_func *) hmac_sha1_digest; + info.digest_length = SHA1_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-sha1", hmac_tests[pos].msg, SHA1_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + +static void +time_hmac_sha256(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_sha256_ctx sha256_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_sha256_set_key(&sha256_ctx, SHA256_BLOCK_SIZE, data); + info.ctx = &sha256_ctx; + info.update = (nettle_hash_update_func *) hmac_sha256_update; + info.digest = (nettle_hash_digest_func *) hmac_sha256_digest; + info.digest_length = SHA256_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-sha256", hmac_tests[pos].msg, SHA256_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + +static void +time_hmac_sha512(void) +{ + static uint8_t data[BENCH_BLOCK]; + struct bench_hmac_info info; + struct hmac_sha512_ctx sha512_ctx; + unsigned int pos; + + init_data(data); + info.data = data; + + hmac_sha512_set_key(&sha512_ctx, SHA512_BLOCK_SIZE, data); + info.ctx = &sha512_ctx; + info.update = (nettle_hash_update_func *) hmac_sha512_update; + info.digest = (nettle_hash_digest_func *) hmac_sha512_digest; + info.digest_length = SHA512_DIGEST_SIZE; + + for (pos = 0; hmac_tests[pos].length != 0; pos++) + { + info.length = hmac_tests[pos].length; + display("hmac-sha512", hmac_tests[pos].msg, SHA512_BLOCK_SIZE, + time_function(bench_hmac, &info)); + } +} + static int prefix_p(const char *prefix, const char *s) { @@ -883,6 +1025,18 @@ main(int argc, char **argv) if (!alg || strstr(aeads[i]->name, alg)) time_aead(aeads[i]); + if (!alg || strstr ("hmac-md5", alg)) + time_hmac_md5(); + + if (!alg || strstr ("hmac-sha1", alg)) + time_hmac_sha1(); + + if (!alg || strstr ("hmac-sha256", alg)) + time_hmac_sha256(); + + if (!alg || strstr ("hmac-sha512", alg)) + time_hmac_sha512(); + optind++; } while (alg && argv[optind]); -- 2.18.0

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs