nettle-bugs

nettle-bugs@lists.lysator.liu.se

2198 discussions

test failures on powerpc64le-redhat-linux
by Martin Sebor 17 Mar '15

17 Mar '15

Running Nettle 3.0 tests on a powerpc64le RHEL 7.1 box shows the two failures below. The cause is in the second definition of the HAVE_NATIVE_64_BIT configuration macro: $ grep HAVE_NATIVE_64_BIT config.* config.h:# define HAVE_NATIVE_64_BIT 1 config.h:# define HAVE_NATIVE_64_BIT (SIZEOF_LONG * CHAR_BIT >= 64) The macro relies on the CHAR_BIT macro being defined at the point of its expansion. Uses of HAVE_NATIVE_64_BIT of the form #if !HAVE_NATIVE_64_BIT in files that don't include <limits.h> (and thus don't have the CHAR_BIT macro defined) end up compiling the conditional blocks that are intended to be included only when the target has no native support for 64 bit arithmetic. One such file that comes into play in the failing tests is camellia-absorb.c. Since powerpc64le obviously does have such support, the code is unnecessary and, as it turns out, introduces errors. Once <limits.h> is included all of Nettle's tests pass even on powerpc64le-redhat-linux. Martin ... Encrypt failed: Input: 0123456789abcdef fedcba9876543210 Output: df51fc645013f77c 25c472e2871f742a Expected: 6767313854966973 0857065648eabe43 /src/nettle-3.0/run-tests: line 57: 46381 Aborted "$1" $testflags FAIL: camellia ... Assert failed: /src/nettle-3.0/testsuite/testutils.c:513: MEMEQ(digest->length, buffer, digest->data) /src/nettle-3.0/run-tests: line 57: 49811 Aborted "$1" $testflags FAIL: gcm ... ==================== 2 of 55 tests failed ====================

2 1

memeql_sec
by nisse＠lysator.liu.se 14 Mar '15

14 Mar '15

I think there's only one sensitive use of memcmp within nettle, and that's the tag comparison in ccm_decrypt_message. I've now written a private function memeql_sec to do that comparison in a more side-channel silent fashion. static int memeql_sec (const void *a, const void *b, size_t n) { volatile const unsigned char *ap = (const unsigned char *) a; volatile const unsigned char *bp = (const unsigned char *) b; volatile unsigned char d; size_t i; for (d = i = 0; i < n; i++) d |= (ap[i] ^ bp[i]); return d == 0; } The idea is to avoid leaking (via timing or memory access patterns) the location of the first difference. Information that a guess for a forged MAC tag matches some characters of the correct MAC can be used to attack the MAC key, in particular for MAC algorithms with linear structure such as gcm and poly1305 (which is why chacha-poly1305 uses a new poly1305 key for each message, and why one shouldn't use gcm with short authentication tags). memeql_sec is a bit similar to http://nacl.cr.yp.to/verify.html. Now, applications using nettle are likely doing a lot of similar comparisons on hash and hmac digests. So it would be good to make this function public. But then I'd need to decide on 1. A good name. 2. A suitable headerfile to declare it in. It would make some sense to group it together with memxor, but memxor.h isn't a good name for that header file. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

3 5

Please add base-64 URL-safe alphabet
by Amos Jeffries 10 Feb '15

10 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 RFC 4648 (https://tools.ietf.org/html/rfc4648) standardizes two Base-64 alphabets. Nettle currently only supports the traditional base-64 alphabet from section 4. There is growing use amongst new protocol definitions and extensions, particularly in the HTTP area for the URL-safe extension alphabet instead of the classical Base-64 alphabet. The attached patch implements a proposed API/ABI extension adding support for RFC 4648 section 5 "Base 64 Encoding with URL and Filename Safe Alphabet" External code simply calls the init() function relevant to the alphabet it is needing to encode/decode with. The library internally uses the context to select which lookup table to use for later base64 function calls. The base64_encode_raw() and base64_encode_group() functions which do not use contexts are left untouched for now. Amos Jeffries Treehouse Networks Ltd. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBAgAGBQJUiXerAAoJELJo5wb/XPRjPxEIAJGMXNF0H84kJntKpe1idimr +x7/xg55GJ2sWEBAbVIHvKvjFZoBIeqNmPeeK+yrqMdA+dtALA37AuezqhiNBtuj YfGd/DyRvys2O2bQ4XNRHxj6zGQU6tlRHHZzSnWp9ywwN4xk/zfNc5JM0EKYqiuu 8crNPzQxP91N33gkdi9LrOkAA8v+/bTYJgTrT46D/2Ut+8ECAcpjS5jwsJiljETu uqO50QlhqGC3ZsHKs1kYnjrbl1Peiqw/b/srEnY3shfS9MKrTYe3qLOsvU5CQpnD A7e8w/SW716D0s4t0SGf85WvUnS6UvDTfAdm3EXAPKNU8PaYpK9D8izq8kgxCP4= =NgGG -----END PGP SIGNATURE-----

4 15

nettle-3.1 loose ends
by nisse＠lysator.liu.se 05 Feb '15

05 Feb '15

Looking at http://www.lysator.liu.se/~nisse/nettle/plan.html, the most important things are done. I think documentation is the only item left which is both important and requires several hours of work. * Versioned symbols. I think this is complete, I just have forgotten to merge that branch. * Base64 with other alphabets. A patch was posted to the list some month ago, I had some comments, and then it seems to have stalled. If it's desirable to break the ABI to implement it, 3.1 may be the last chance for some years time. * OCB mode. Is it a good idea to try to get this into the release? I don't think patents are a problem, but I've mailed sflc, and it would be nice to get their opinion too. Needs not just the code, but also test cases and documentation. * Also OFB mode has been requested, used by openpgp, iirc. Anything else I've missed? And which of the above items are important? There are a lot of things that could be better optimized, including the curve25519 code and the aesni code, but I don't think the release should be delayed for that. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

4 10

OCB mode
by Nikos Mavrogiannopoulos 28 Jan '15

28 Jan '15

Hello, What do you think of having OCB mode in nettle? I particularly like OCB due to it's simplicity and performance comparing to GCM/CCM, but was always patented. However in [0] there is license1 which states: "Under this license, you are authorized to make, use, and distribute open-source software implementations of OCB. This license terminates for you if you sue someone over their open-source software implementation of OCB claiming that you have a patent covering their implementation." What do you think? Should the FSF be consulted on that? regards, Nikos [0]. http://www.cs.ucdavis.edu/~rogaway/ocb/license.htm

4 8

ecc.h vs ecc-internal.h
by nisse＠lysator.liu.se 27 Jan '15

27 Jan '15

I'm about to remove a lot of the internal declarations from ecc.h, and move the ones which still are needed to ecc-internal.h. Problem is that most of these functions work only with particular curve types, and are typically installed in function pointers in struct ecc_curve. If they really are needed as public functions, they must be reimplemented to jump via the appropriate function pointer. And some, like most or all of the corresponding itch functions, are not even defined anywhere anymore (replaced by macros in ecc-internal.h, and fields in struct ecc_curve). ecc_size_j is a borderline case, not sure if it should be public (if so, it should probably be renamed, and not mean "convert to jacobian coordinates", but "convert to whatever internal representation is appropriate for the curve". And everything below ecc_size_j in ecc.h should be removed. Any objections? Any function applications are relying on? Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 2

Intel aes instructions
by nisse＠lysator.liu.se 25 Jan '15

25 Jan '15

I've just pushed new aes code using intel's aesni instructions. See https://git.lysator.liu.se/nettle/nettle/blob/530014f3f811d9018ec83a8748fdb… It gave a speedup of almost 10 times on the haswell machine where I tested it (and in addition, it should avoid sidechannel leaks in those functions). Clearly, this will be more useful after adding support for fat binaries, detecting presence of these instructions at runtime. For now, it has to be enabled explicitly with the configure argument --enable-x86-aesni. I have one question, on how to enable support for these instructions in the assembler. For now I added a pseudo-op .arch bdver2 and that seems to work, but it's a bit too specific for my taste. I would have preferred something like .arch generic64,aes, but I couldn't get that to work. So what's the right way to do this? I haven't played with the corresponding arch flags to gcc, but I'd prefer do declare within the .asm file itself which instruction set it is intended for. Feedback on the actual assembler code is also appreciated, of course. It's pretty basic, a dozen lines, no unrolling or other cleverness. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

5 34

[PATCH 1/2] arm: Add .arch directives for armv6
by Martin Storsjö 24 Jan '15

24 Jan '15

This allows building these files as part of a fat build, even if the assembler by default targets a lower architecture version. --- arm/v6/aes-decrypt-internal.asm | 2 ++ arm/v6/aes-encrypt-internal.asm | 2 ++ arm/v6/sha1-compress.asm | 1 + arm/v6/sha256-compress.asm | 1 + 4 files changed, 6 insertions(+) diff --git a/arm/v6/aes-decrypt-internal.asm b/arm/v6/aes-decrypt-internal.asm index 28d8f6f..3eab3eb 100644 --- a/arm/v6/aes-decrypt-internal.asm +++ b/arm/v6/aes-decrypt-internal.asm @@ -30,6 +30,8 @@ ifelse(< not, see http://www.gnu.org/licenses/. >) + .arch armv6 + include_src(<arm/aes.m4>) define(<PARAM_ROUNDS>, <r0>) diff --git a/arm/v6/aes-encrypt-internal.asm b/arm/v6/aes-encrypt-internal.asm index f7f4769..e4fa25d 100644 --- a/arm/v6/aes-encrypt-internal.asm +++ b/arm/v6/aes-encrypt-internal.asm @@ -30,6 +30,8 @@ ifelse(< not, see http://www.gnu.org/licenses/. >) + .arch armv6 + include_src(<arm/aes.m4>) C Benchmarked at at 706, 870, 963 cycles/block on cortex A9, diff --git a/arm/v6/sha1-compress.asm b/arm/v6/sha1-compress.asm index fc1ebf0..59d6297 100644 --- a/arm/v6/sha1-compress.asm +++ b/arm/v6/sha1-compress.asm @@ -31,6 +31,7 @@ ifelse(< >) .file "sha1-compress.asm" + .arch armv6 define(<STATE>, <r0>) define(<INPUT>, <r1>) diff --git a/arm/v6/sha256-compress.asm b/arm/v6/sha256-compress.asm index 93c12b1..7560778 100644 --- a/arm/v6/sha256-compress.asm +++ b/arm/v6/sha256-compress.asm @@ -31,6 +31,7 @@ ifelse(< >) .file "sha256-compress.asm" + .arch armv6 define(<STATE>, <r0>) define(<INPUT>, <r1>) -- 1.9.3 (Apple Git-50)

1 1

[Fwd: [gnutls-help] Generating DH Parameters larger than 3072 bits]
by Nikos Mavrogiannopoulos 16 Dec '14

16 Dec '14

Hello, It seems that by switching gnutls to nettle 2.7.x for DSA (and DH) key generation the forwarded issues occur. Would it be possible to have a 2.7.x release with the attached patch? That would allow gnutls 3.3.x generate arbitrary DH parameters. regards, Nikos

1 0

function casts
by Nikos Mavrogiannopoulos 13 Dec '14

13 Dec '14

It seems that in the GCM macros nettle uses casts to functions. That is pretty dangerous with the changes of parameters in functions in nettle 3. The issue is the compiler will not warn for serious errors such as different function type. An example macro is GCM_ENCRYPT. #define GCM_ENCRYPT(ctx, encrypt, length, dst, src) \ (0 ? (encrypt)(&(ctx)->cipher, 0, (void *)0, (void *)0) \ : gcm_encrypt(&(ctx)->gcm, &(ctx)->key, &(ctx)->cipher, \ (nettle_cipher_func *) (encrypt), \ (length), (dst), (src))) I don't think that nettle should be casting functions. The issue seems to be present in ctr, eax and cbc modes as well. regards, Nikos

2 10

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs