nettle-bugs

nettle-bugs@lists.lysator.liu.se

1 participants
2208 discussions

Hashing with EdDSA
by nisse＠lysator.liu.se 10 Sep '14

10 Sep '14

I'm looking into EdDSA. According to the paper, signing of a message M, using private key (a, k), corresponding to public key A, is essentially r = H(k | M), with k the second half of the private key R = rB, with B the specified generator of the curve, S = ((r + H(R | A | M) a) mod l, l is the curve order with some rules to encode R, A, S as strings. H is typically sha-512. If M is the original, arbitrarily long, message to be signed, this breaks the common structure that you can first compute a message digest, and then apply the secret key to produce a signature. But this doesn't work above, because the complete message has to be hashed twice, first with the secret prefix k, next with the prefix R | A, and any hashing without the private key available is useless. And even worse, one has to buffer the complete message because the prefix of the second hash depends on the output of the first hash. Or should M itself be a digest of the message to be signed? That will enable a more main-stream signature interface, where the inputs to the signature function are the private key and the short message digest. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 4

Simplifying pic vs non-pic object files
by nisse＠lysator.liu.se 04 Sep '14

04 Sep '14

Currently, the nettle Makefile creates two object files for each source file, .o for inclusion in the static library, and .po ("pure object") for the shared library. By default, both are compiled as pic code, but --disable-pic drops the pic flags when compiling the .o files, to get non-pic code into the static library. I'm considering dropping this complication. Just build a single .o file, which is pic by default, and non-pic if --disable-pic is given. To build a non-pic static library, one would configure with "--disable-pic --disable-shared" (since just --disable-pic would produce a shared library with non-pic code, which is highly undesirable). And to produce a static non-pic library and a shared pic library, one would need to use separate build trees. Does that make sense? It would make things simpler, shorten build time, and eliminate the problem of naming two types of object files. One might also have --disable-pic imply --disable-shared (unless explicitly overridden by the user). Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 2

[PATCH 1/5] Don't include OPT_ASM_SOURCES twice in hogweed_PURE_OBJS
by Martin Storsjö 25 Aug '14

25 Aug '14

OPT_ASM_SOURCES is already included via hogweed_OBJS. This avoids build errors about duplicate symbols in the shared library. --- Makefile.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile.in b/Makefile.in index 1ec807b..2db76c5 100644 --- a/Makefile.in +++ b/Makefile.in @@ -180,7 +180,7 @@ nettle_OBJS = $(nettle_SOURCES:.c=.$(OBJEXT)) $(LIBOBJS) nettle_PURE_OBJS = $(nettle_OBJS:.$(OBJEXT)=.p$(OBJEXT)) hogweed_OBJS = $(hogweed_SOURCES:.c=.$(OBJEXT)) $(OPT_ASM_SOURCES:.asm=.$(OBJEXT)) -hogweed_PURE_OBJS = $(hogweed_OBJS:.$(OBJEXT)=.p$(OBJEXT)) $(OPT_ASM_SOURCES:.asm=.p$(OBJEXT)) +hogweed_PURE_OBJS = $(hogweed_OBJS:.$(OBJEXT)=.p$(OBJEXT)) libnettle.a: $(nettle_OBJS) -rm -f $@ -- 1.7.9.4

5 29

curve25519
by nisse＠lysator.liu.se 12 Jul '14

12 Jul '14

I'v started to look closer at curve25519, and I've added support for it in the eccdata program. For the ecc operations, my current thinking is that one should use the Edwards curve equivalence outlined in http://cr.yp.to/papers.html#newelliptic, rather than the Montgomery x-coordinate method suggested in the curve25519 paper. The x-coordinate method needs an addition chain with additional values, which is a bit alien to all other scalar ecc multiplication in Nettle. The equivalent Edwards curve is x^2 + y^2 = 1 + (121665/121666) x^2 y^2 (mod p). Computations should be about as fast (according to the paper), and since the constant (121665/121666) is a non-square, the formulas are "complete", with no need to handle any special cases. One needs conversion of the coordinates, and one also needs a square root to get the y coordinate, but I hope that shouldn't be too difficult. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 1

[PATCH] fix typo in ecc-mod.c
by Daniel Kahn Gillmor 12 Jul '14

12 Jul '14

--- ecc-mod.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ecc-mod.c b/ecc-mod.c index 7876d02..3301506 100644 --- a/ecc-mod.c +++ b/ecc-mod.c @@ -40,7 +40,7 @@ #include "ecc-internal.h" /* Computes r mod m, where m is of size mn. bp holds B^mn mod m, as mn - limbs, but the upper mn - bn libms are zero. */ + limbs, but the upper mn - bn limbs are zero. */ void ecc_mod (mp_limb_t *rp, mp_size_t rn, mp_size_t mn, const mp_limb_t *bp, mp_size_t bn, -- 2.0.0

2 1

[PATCH 1/3] Don't hardcode the -lgmp linker flag in the hogweed pkg-config file
by Martin Storsjö 27 Jun '14

27 Jun '14

--- hogweed.pc.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hogweed.pc.in b/hogweed.pc.in index 457f5f2..839f7d0 100644 --- a/hogweed.pc.in +++ b/hogweed.pc.in @@ -13,6 +13,6 @@ URL: http://www.lysator.liu.se/~nisse/nettle Version: @PACKAGE_VERSION@ Requires.private: nettle Libs: -L${libdir} -lhogweed -Libs.private: -lgmp +Libs.private: @LIBS@ Cflags: -I${includedir} -- 1.8.5.2 (Apple Git-48)

2 4

nettle-mini
by Nikos Mavrogiannopoulos 27 Jun '14

27 Jun '14

Hello, I have put in https://github.com/nmav/nettle-mini/tree/gmp-mini a version of nettle that has an additional configure option. The --enable-mini-gmp. This will compile libghoweed using mini-gmp thus allowing nettle to be used in space constrained systems. Note that using nettle with mini-gmp instead of gmp imposes a penalty of around 10x, and may leak more information due to side-channels (this should not be the case for RSA as blinding is performed in hogweed, but I haven't checked the other algorithms). regards, Nikos

3 5

turn RSA blinding off in openssl
by Nikos Mavrogiannopoulos 25 Jun '14

25 Jun '14

2 1

pbkdf2 functions return longer values than requested
by Aapo Talvensaari 10 Jun '14

10 Jun '14

I started implementing LuaJIT FFI bindings to Nettle, and I found that nettle_pbkdf2_hmac_sha1 and nettle_pbkdf2_hmac_sha256 sometimes return longer dst than what was requested. See: https://github.com/bungle/lua-resty-nettle/blob/master/lib/resty/nettle/pbk… I had to put ":sub(1, len)" to overcome that. Is it by a design or is it a bug (maybe in my code?). Regards Aapo

2 2

git server changes
by nisse＠lysator.liu.se 08 Jun '14

08 Jun '14

Lysator's git server, git.lysator.liu.se, is about to be replaced. New server will run gitlab software instead of the current gitorious. Nettle and LSH repos (as well as other repos I have there) will move, but they may be temporarily unavailable in the weekend or next week. Don't panic. I'll send another mail once everything is ready at the new server. Intention is that git urls will be unchanged. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

2 3

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs