nettle-bugs

nettle-bugs@lists.lysator.liu.se

1 participants
2193 discussions

Supported Algorithms/Key Format
by Mallikarjun Bailamanavar 21 Jun '13

21 Jun '13

Hi *, My name is Malik and I just started using the Nettle. I am looking for APIs for RSA crypto operations. >From rsa.h header file, I can make out that Nettle supports, - RSA crypto APIs only for PKCS#1 v1.5 padding mechanisms and - CRT format for RSA private key My questions, - Does nettle not support PKCS#1 v2.1 padding mechanisms e.g. RSASSA-PSS? - Does nettle not support exponent format for private key?. Meaning private key is made up of modulus and private exponent. - Is there an API for raw RSA crypto operation? Raw meaning, API must not do any encoding with input data but just has to sign/encrypt it. Can someone please clarify my questions? Thanks very much indeed in advance for the clarifications. Regards, Malik

2 1

query on nettle support.
by manish kanchan 21 Jun '13

21 Jun '13

Hi , I am trying to used Nettle cryptolibrary. I download the source, installed on ubuntu wrote a some sample application using the readme, examples files. There are couple of thing which i am still unsure. Can you help me understand this. 1. Does nettle support on PKCS1 encoding fro RSA encrytpion and signing? 2. In the PrivateKey structure, Is the d ( private expoenent ) never used? Does nettle use private key in CRT format only? and not in expoenent format ( i.e modulus and priv exp) I would be glad if you can clarify this to me. Regards Manish Kanchan

2 1

git.lysator.liu.se temporarily down
by nisse＠lysator.liu.se 30 May '13

30 May '13

The machine git.lysator.liu.se is being upgraded to a more recent debian version. Not sure when it will be operational again (it's maintained on a volunteer basis), but hopefully within a day or two. Possibly the gitorious web interface will be replaced by something different (gitolite, gitlab, ...), since gitorious seems to require quite a bit of work to install. Sorry for the inconvenience. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

ANNOUNCE: Nettle-2.7.1
by nisse＠lysator.liu.se 29 May '13

29 May '13

I'm happy to annnounce a new version of GNU Nettle, a low-level cryptographics library. The Nettle home page can be found at http://www.lysator.liu.se/~nisse/nettle/. One serious bug has been found in the new ECC code shipped in nettle-2.7. Thanks to Magnus Holmgren for help tracking down this problem. NEWS for the 2.7.1 release This is a bugfix release. Bug fixes: * Fixed a bug in the new ECC code. The ecc_j_to_a function called GMP:s mpn_mul_n (via ecc_modp_mul) with overlapping input and output arguments, which is not supported. * The assembly files for SHA1, SHA256 and AES depend on ARMv6 instructions, breaking nettle-2.7 for pre-v6 ARM processors. The configure script now enables those assembly files only when building for ARMv6 or later. * Use a more portable C expression for rotations. The previous version used the following "standard" expression for 32-bit rotation: (x << n) | (x >> (32 - n)) But this gives undefined behavior (according to the C specification) for n = 0. The rotate expression is replaced by the more portable: (x << n) | (x >> ((-n)&31)) This change affects only CAST128, which uses non-constant rotation counts. Unfortunately, the new expression is poorly optimized by released versions of gcc, making CAST128 a bit slower. This is being fixed by the gcc hackers, see http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57157. The following problems have been reported, but are *not* fixed in this release: * ARM assembly files use instruction syntax which is not supported by all assemblers. Workaround: Use a current version of GNU as, or configure with --disable-assembler. * Configuring with --disable-static doesn't work on windows. The libraries are intended to be binary compatible with nettle-2.2 and later. The shared library names are libnettle.so.4.7 and libhogweed.so.2.5, with sonames still libnettle.so.4 and libhogweed.so.2. Available at http://ftp.gnu.org/gnu/nettle/nettle-2.7.1.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-2.7.1.tar.gz http://www.lysator.liu.se/~nisse/archive/nettle-2.7.1.tar.gz and in the "nettle-2.7-fixes" branch in the git repository, see http://git.lysator.liu.se/nettle/nettle. Happy hacking, /Niels Möller -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

arm compilation
by Nikos Mavrogiannopoulos 28 May '13

28 May '13

Hello, Trying to build nettle 2.7 for an arm10 system of mine using its (old) toolchain fails with assembler errors. arm-linux-gcc -Os -I[...] -I. -DHAVE_CONFIG_H -g -O2 -ggdb3 -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-decrypt-internal.o -MD -MP -MF aes-decrypt-internal.o.d -fpic -c aes-decrypt-internal.s aes-decrypt-internal.s: Assembler messages: aes-decrypt-internal.s:81: Error: bad instruction `push {r4,r5,r6,r7,r8,r10,r11,lr}' aes-decrypt-internal.s:87: Error: register or shift expression expected -- `orr r4,r8,lsl#8' aes-decrypt-internal.s:89: Error: register or shift expression expected -- `orr r4,r8,lsl#16' aes-decrypt-internal.s:91: Error: register or shift expression expected -- `orr r4,r8,lsl#24' aes-decrypt-internal.s:93: Error: bad arguments to instruction -- `eor r4,r8' [...] make[2]: *** [aes-decrypt-internal.o] Error 1 $ arm-linux-as -v GNU assembler version 2.16.1 (arm-linux-uclibc) using BFD version 2.16.1 Trying with the latest buildroot another error is issued: arm-buildroot-linux-uclibcgnueabi-as -v GNU assembler version 2.21.1 (arm-buildroot-linux-uclibcgnueabi) using BFD version (GNU Binutils) 2.21.1 arm-buildroot-linux-uclibcgnueabi-gcc -I. -DHAVE_CONFIG_H -pipe -Os -Wno-pointer-sign -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wpointer-arith -Wbad-function-cast -Wnested-externs -fpic -MT aes-encrypt-internal.o -MD -MP -MF aes-encrypt-internal.o.d -fpic -c aes-encrypt-internal.s aes-encrypt-internal.s: Assembler messages: aes-encrypt-internal.s:140: Error: selected processor does not support ARM mode `uxtb r8,r2' aes-encrypt-internal.s:142: Error: selected processor does not support ARM mode `uxtb r8,r3' aes-encrypt-internal.s:144: Error: selected processor does not support ARM mode `uxtb r8,r12' aes-encrypt-internal.s:146: Error: selected processor does not support ARM mode `uxtb r8,r14' Any ideas? regards, Nikos

3 17

Bug in nettle-2.7 ecc code
by nisse＠lysator.liu.se 17 May '13

17 May '13

Testing on the debian build machines revealed a bug in the new ecc code. Curiously enough, causing failures only on 32-bit sparc (see https://buildd.debian.org/status/fetch.php?pkg=nettle&arch=sparc&ver=2.7-2&…), but the bug is not really platform-specific. It turned out that ecc_j_to_a called GMP:s mpn_mul_n (via ecc_modp_mul) with overlapping input and output arguments, which is not supported. The following patch seems to solve the problem: diff --git a/ecc-j-to-a.c b/ecc-j-to-a.c index df8b876..26c1a03 100644 --- a/ecc-j-to-a.c +++ b/ecc-j-to-a.c @@ -46,6 +46,7 @@ ecc_j_to_a (const struct ecc_curve *ecc, #define up (scratch + ecc->size) #define iz2p (scratch + ecc->size) #define iz3p (scratch + 2*ecc->size) +#define izBp (scratch + 3*ecc->size) #define tp scratch mp_limb_t cy; @@ -72,11 +73,11 @@ ecc_j_to_a (const struct ecc_curve *ecc, if (flags & 1) { /* Divide this common factor by B */ - mpn_copyi (iz3p, izp, ecc->size); - mpn_zero (iz3p + ecc->size, ecc->size); - ecc->redc (ecc, iz3p); - - ecc_modp_mul (ecc, iz2p, izp, iz3p); + mpn_copyi (izBp, izp, ecc->size); + mpn_zero (izBp + ecc->size, ecc->size); + ecc->redc (ecc, izBp); + + ecc_modp_mul (ecc, iz2p, izp, izBp); } else ecc_modp_sqr (ecc, iz2p, izp); Thanks to Magnus Holmgren for tracking this down. Note that this bug causes overwrites *within* a properly allocated limb array, which gives incorrect results, but it does not overwrite any pointers or code. I should plan for a bugfix release reasonably soon. Testing with a GMP library compiled with --enable-assert would have revealed the bug earlier. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

Portable rotates
by nisse＠lysator.liu.se 03 May '13

03 May '13

I'm rewriting the cast128 key schedule, to get rid of false warnings, and avoid lots of conditions, and to separate the rotation and the mask subkeys. Then I noticed a portability problem with the rotation macros, #define ROTL32(n,x) (((x)<<(n)) | ((x)>>(32-(n)))) For n == 0, this will work on most machines, but it's not portable, since x >> 32 gives undefined behaviour according to the C spec (when x is a 32-bit type). (On typical hardware, the result of x >> 32 will be either x or 0, and the rotation macro gives the intended result in either case). In most of nettle, there's no problem, because rotation counts are constant and non-zero. cast128 is an exception, with key-dependent rotation counts, which can well be zero (don't know if that's exercised by the test suite, though). A fix is to redefine the macro as #define ROTL32(n,x) (((x)<<(n)) | ((x)>>((-(n))&31))) It should make no difference when n is constant, but for cast128, this portability fix makes the code almost 20% slower. Apparently, gcc, doens't recognize this as a rotate. I just filed a bug report at http://gcc.gnu.org/bugzilla/show_bug.cgi?id=57157 Is there any other trick I'm missing, which is portable C but which doesn't slow it down when compiled with gcc? Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

raspberry pi
by nisse＠lysator.liu.se 30 Apr '13

30 Apr '13

I finally got a Raspberry Pi setup. Took almost 20 minutes to compile nettle, and the configure script figured out not to use neon instructions. It passes the testsuite. Benchmark for the public key functions: name size sign/ms verify/ms rsa 1024 0.1073 1.9099 rsa 2048 0.0167 0.5539 dsa 1024 0.1992 0.1014 ecdsa 192 0.5297 0.1922 ecdsa 224 0.3623 0.1354 ecdsa 256 0.2621 0.0971 ecdsa 384 0.1125 0.0391 ecdsa 521 0.0551 0.0190 So 3 to 5 times slower than the pandaboard (although that's not a completely fair comparison, since the raspberry pi is using gmp-5.0.5, not the gmp bleeding edge). Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

Problems when compiling 32bit version on 64bit host (multilib)
by Florian Pritz 27 Apr '13

27 Apr '13

Hi, I'm compiling nettle for the Arch Linux multilib repository (32bit libraries for a 64bit system so people can run skype and wine without needing a chroot). Looks like the new ecc code doesn't properly handle integer type sizes. Here[1] is the output of make, make check along with the PKGBUILD used to build this and a sample of the generated ecc-*.h files. [1]: http://flo.server-speed.net/tmp/lib32-nettle/ Can I fix that by setting some env variable or does it need code changes? If you need any more files, please tell me.

2 2

ANNOUNCE: Nettle-2.7
by nisse＠lysator.liu.se 24 Apr '13

24 Apr '13

I'm happy to annnounce a new version of GNU Nettle, a low-level cryptographics library. The Nettle home page can be found at http://www.lysator.liu.se/~nisse/nettle/. NEWS for the 2.7 release This release includes an implementation of elliptic curve cryptography (ECC) and optimizations for the ARM architecture. This work was done at the offices of South Pole AB, and generously funded by the .SE Internet Fund. Bug fixes: * Fixed a bug in the buffer handling for incremental SHA3 hashing, with a possible buffer overflow. Patch by Edgar E. Iglesias. New features: * Support for ECDSA signatures. Elliptic curve operations over the following curves: secp192r1, secp224r1, secp256r1, secp384r1 and secp521r1, including x86_64 and ARM assembly for the most important primitives. * Support for UMAC, including x86_64 and ARM assembly. * Support for 12-round salsa20, "salsa20r12", as specified by eSTREAM. Contributed by Nikos Mavrogiannopoulos. Optimizations: * ARM assembly code for several additional algorithms, including AES, Salsa20, and the SHA family of hash functions. * x86_64 assembly for SHA256, SHA512, and SHA3. (SHA3 assembly was included in the 2.6 release, but disabled due to poor performance on some AMD processors. Hopefully, that performance problem is fixed now). The ARM code was tested and benchmarked on Cortex-A9. Some of the functions use "neon" instructions. The configure script decides if neon instructions can be used, and the command line options --enable-arm-neon and --disable-arm-neon can be used to override its choice. Feedback appreciated. The libraries are intended to be binary compatible with nettle-2.2 and later. The shared library names are libnettle.so.4.6 and libhogweed.so.2.4, with sonames still libnettle.so.4 and libhogweed.so.2. http://ftp.gnu.org/gnu/nettle/nettle-2.7.tar.gz ftp://ftp.gnu.org/gnu/nettle/nettle-2.7.tar.gz http://www.lysator.liu.se/~nisse/archive/nettle-2.7.tar.gz ftp://ftp.lysator.liu.se/pub/security/lsh/nettle-2.7.tar.gz (soon) Happy hacking, /Niels Möller -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs