From: Mark Wooding <mdw@distorted.org.uk>
Date: Mon, 25 May 2015 17:59:52 +0000 (+0100)
Subject: Merge branch 'mdw/fixes'
X-Git-Tag: 2.2.0~7
X-Git-Url: https://git.distorted.org.uk/~mdw/catacomb/commitdiff_plain/16efb197c59c4b4cfaef7b2f23bd39f70176dd9e?hp=7e21b65f43dcdb5fa98c919b14429d697d876230

Merge branch 'mdw/fixes'

* mdw/fixes:
  symm/safer.[ch]: Correct description for `safer_setup'.
  symm/rc4.h: Mention that RC4 isn't really very good.
  symm/rc4.[ch]: Fix incorrect documentation on `rc4_rand'.
  symm/seal.c: Fix IV handling through `gcipher' interface.
  math/mpint.h: Add new conversions.
  math/mpint.[ch]: Consolidate the list of supplied conversions in header.
  progs/rspit.c: Update the baton more frequently if we can.
  progs/rspit.c: Higher resolution timing.
  progs/rspit.c: Handle large requested output.
  progs/rspit.c: Better handling of block cipher IVs.
  progs/rspit.c: Make the internal tables be const.
  rand/rand.[ch]: Spring-clean the random source cryptography.
  rand/rand.[ch]: Don't dynamically construct the global generator.
  symm/multigen: Some UI improvements.
  symm: Expunge stubby header files from the source tree.
  symm/Makefile.am: Modes files listed as `EXTRA_DIST' and `nodist_...'.
  symm/Makefile.am: Have modes things depend on `Makefile.am'.
  symm/modes.am.in: Fix `Generated from ...' header.
---

diff --git a/configure.ac b/configure.ac
index 2b77ab46..acee1b52 100644
--- a/configure.ac
+++ b/configure.ac
@@ -136,7 +136,7 @@ AC_CACHE_CHECK([whether the freewheel noise generator will work],
 [struct itimerval itv = { { 0, 0 }, { 0, 5000 } };
 jmp_buf j;
 setitimer(ITIMER_REAL, &itv, 0);
-sigsetjump(j, 1);],
+sigsetjmp(j, 1);],
 [catacomb_cv_freewheel=yes],
 [catacomb_cv_freewheel=no])])
 case $catacomb_cv_freewheel in
diff --git a/math/mpmont.c b/math/mpmont.c
index 88efacab..1f9143b6 100644
--- a/math/mpmont.c
+++ b/math/mpmont.c
@@ -160,6 +160,7 @@ mp *mpmont_reduce(mpmont *mm, mp *d, mp *a)
       u->vl = u->v + n;
     u = mp_mul(u, u, mm->m);
     d = mp_add(d, a, u);
+    MP_ENSURE(d, n);
     mp_drop(u);
   }
 
diff --git a/math/t/mpmont b/math/t/mpmont
index 27e03c15..37535af7 100644
--- a/math/t/mpmont
+++ b/math/t/mpmont
@@ -17,6 +17,9 @@ mul {
   7041548659011846562361842096561083537784928869240554198760844555642215260669458833049231069318370838770180094409088437631986867239713464317243824963669990014087444248250948204574690463940534304651099653802302150197753463246181762684347288736386534346725039618007392334267637262008343417972878515511486456037
   21451817224897484023627307128311082613304580637202546848860538836010530320943159719981586919811151828606838777812233053319458755053306547823820900602281867134174742586071226220962576712633552196944784360512851517812225731562588375896089193406088239903885470354101095713609394462435076126493339021945199401247
   48192532305912989641372170084506981675917951543147719789775743631071830656350879578731578070582102149232280305157616093002880139716311910835926678896882798493523792373475521651115163420137602661060123597773253524671874189844988793471524978853764238038494563159505836018994860909028653670132922744758133798212;
+
+  0x1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001
+  0 1 0;
 }
 
 exp {
diff --git a/progs/catcrypt.1 b/progs/catcrypt.1
index 6bace86f..597118f2 100644
--- a/progs/catcrypt.1
+++ b/progs/catcrypt.1
@@ -584,7 +584,7 @@ All messages.
 .PP
 .B Warning!
 All output written has been checked for authenticity.  However, output
-can fail madway through for many reasons, and the resulting message may
+can fail midway through for many reasons, and the resulting message may
 therefore be truncated.  Don't rely on the output being complete until
 .B OK
 is printed or
diff --git a/progs/key.1 b/progs/key.1
index 9adb9588..f301391f 100644
--- a/progs/key.1
+++ b/progs/key.1
@@ -279,8 +279,8 @@ benefit of users, and isn't interpreted by applications at all.
 (Hopefully.)
 .TP
 .B "attributes"
-A key as zero or more name/value pairs.  The names and values are
-arbitrary strings, except they may not contain null bytes.  Some
+A key has zero or more name/value pairs.  The names and values are
+arbitrary strings, except that they may not contain null bytes.  Some
 attributes may have meaning for particular applications or key types;
 others may be assigned global meanings in future.
 .SH "COMMAND REFERENCE"
@@ -323,7 +323,7 @@ The built-in elliptic curves which can be used with the
 command.
 .TP
 .B dh
-The built-in Diffie-Hellman groups which can be used with the
+The built-in Diffie\(enHellman groups which can be used with the
 .B add \-a dh
 command.
 .TP
@@ -463,19 +463,20 @@ Suppresses the progress indication which is usually generated while
 time-consuming key generation tasks are being performed.
 .TP
 .BI "\-L, \-\-lim-lee"
-When generating Diffie-Hellman parameters, generate a Lim-Lee prime
-rather than a random (or safe) prime.  See the details on Diffie-Hellman
-key generation below.
+When generating Diffie\(enHellman parameters, generate a Lim\(enLee
+prime rather than a random (or safe) prime.  See the details on
+Diffie\(enHellman key generation below.
 .TP
 .BI "\-K, \-\-kcdsa"
-When generating Diffie-Hellman parameters, generate a KCDSA-style
-Lim-Lee prime rather than a random (or safe) prime.  See the details on
-Diffie-Hellman key generation below.
+When generating Diffie\(enHellman parameters, generate a KCDSA-style
+Lim\(enLee prime rather than a random (or safe) prime.  See the details
+on Diffie\(enHellman key generation below.
 .TP
 .BI "\-S, \-\-subgroup"
-When generating Diffie-Hellman parameters with a Lim-Lee prime, choose a
-generator of a prime-order subgroup rather than a subgroup of order
-.RI ( p "- 1)/2."
+When generating Diffie\(enHellman parameters with a Lim\(enLee prime,
+choose a generator of a prime-order subgroup rather than a subgroup of
+order
+.RI ( p "\ \-\ 1)/2."
 .PP
 The key's type is given by the required
 .I type
@@ -513,14 +514,14 @@ and
 the public exponent;
 .IR d ,
 the private exponent, chosen such that
-.IR ed \ \(==\ 1
+.IR ed \~\(==\~1
 (mod
-.RI ( p \ \-\ 1)( q \ \-\ 1));
+.RI lcm( p "\~\-\~1, " q \~\-\~1));
 and some other values useful for optimizing private-key operations:
-.IR q \*(ss\-1\*(se\ mod\  p ,
-.IR d \ mod\  p \ \-\ 1,
+.IR q "\*(ss\-1\*(se mod " p ,
+.IR d "\~mod " p \~\-\~1,
 and
-.IR d \ mod\  q \ \-\ 1.
+.IR d "\~mod " q \~\-\~1.
 The values
 .I n
 and
@@ -539,15 +540,15 @@ and
 to be
 .I strong
 primes: both
-.IR p \ \-\ 1
+.IR p \~\-\~1
 and
-.IR p \ +\ 1
-have large prime factors \- call them
+.IR p \~+\~1
+have large prime factors \(en call them
 .I r
 and
 .I s
-respectively \- and
-.IR r \ \-\ 1
+respectively \(en and
+.IR r \~\-\~1
 also has a large prime factor;
 .I q
 has similar properties.
@@ -559,12 +560,12 @@ corrssponding public and private exponents is sufficient to be able to
 factor the modulus and recover other users' private keys.
 .TP
 .B "dh-param"
-Generates parameters for use with the Diffie-Hellman key exchange
+Generates parameters for use with the Diffie\(enHellman key exchange
 protocol, and many related systems, such as ElGamal encryption and
 signatures, and even DSA.  (The separate DSA algorithm uses the
 generator described in FIPS186-1.)
 .IP
-The Diffie-Hellman parameters are a prime modulus
+The Diffie\(enHellman parameters are a prime modulus
 .I p
 and a generator
 .I g
@@ -583,10 +584,10 @@ If no
 .I q
 size is selected using the
 .B \-B
-option and the Lim-Lee prime options are disabled, then
+option and the Lim\(enLee prime options are disabled, then
 .I p
 is chosen to be a `safe' prime (i.e.,
-.IR p \ =\ 2 q \ +\ 1,
+.IR p "\~= 2" q \~+\~1,
 with
 .I q
 prime).  Finding safe primes takes a very long time.  In this case, the
@@ -596,31 +597,33 @@ is fixed as 4.
 .IP
 If a size is chosen for
 .I q
-and Lim-Lee primes are not selected then the prime
+and Lim\(enLee primes are not selected then the prime
 .I q
 is generated and
 .I p
 is chosen so that
-.IR p \ \-\ 1
+.IR p \~\-\~1
 is a multiple of
 .IR q .
 .IP
 If the
 .B \-L
-option was given, Lim-Lee primes are selected: the parameters are chosen
-such that
-.IR p \ =\ 2\  q \*(us0\*(ue\ q \*(us1\*(ue\ q \*(us2\*(ue\ ...\ +\ 1,
+option was given, Lim\(enLee primes are selected: the parameters are
+chosen such that
+.IR p "\~= 2\~" q \*(us0\*(ue
+.IR q \*(us1\*(ue
+.IR q \*(us2\*(ue\~...\~+\~1,
 where the
-.IR q \*(us i\*(ue
+.IR q \*(us i \*(ue
 are primes at least as large as the setting given by the
 .B \-B
 option (or 256 bits, if no setting was given).
 .IP
 If the
 .B \-K
-option was given, KCDSA-style Lim-Lee primes are selected: the
+option was given, KCDSA-style Lim\(enLee primes are selected: the
 parameters are chosen such that
-.IR p \ =\ 2\  q\ v \ +\ 1,
+.IR p "\~= 2" qv \~+\~1,
 where
 .IR p,
 .I q
@@ -639,7 +642,8 @@ is chosen to generate the subgroup of order
 otherwise,
 .I g
 will generate the group of order
-.RI ( p \ \-\ 1)/2\ =\  q \*(us0\*(ue\ q \*(us1\*(ue\ q \*(us2\*(ue\ ...
+.RI ( p "\~\-\~1)/2\~= " q "\*(us0\*(ue " q \*(us1\*(ue
+.IR q \*(us2\*(ue\~...
 .IP
 Finally, the
 .B \-C
@@ -648,23 +652,23 @@ from the provided group specification, which may either be the the name
 of one of the built-in groups (say
 .B "key show dh"
 for a list) or a triple
-.RI ( p ,\  q ,\  g ).
+.RI ( p ,\~ q ,\~ g ).
 separated by commas.  No random generation is done in this case: the
 given parameters are simply stored.
 .TP
 .B "dh"
-Generates a public/private key pair for use with offline Diffie-Hellman,
+Generates a public/private key pair for use with offline Diffie\(enHellman,
 ElGamal, DSA or similar discrete-logarithm-based systems.  It selects a
 private key
-.IR x \ <\  q ,
+.IR x \~<\~ q ,
 and computes the public key
-.IR y \ =\  g\*(ssx\*(se \ mod\  p .
+.IR y "\~= " g \*(ss x "\*(se mod\~" p .
 .TP
 .B "dsa-param"
 Generates parameters for the DSA algorithm.  DSA parameters are also
-suitable for use with Diffie-Hellman and ElGamal system.
+suitable for use with Diffie\(enHellman and ElGamal system.
 .IP
-The main difference between DSA and Diffie-Hellman parameter generation
+The main difference between DSA and Diffie\(enHellman parameter generation
 is thatthe DSA parameter generation
 algorithm creates a
 .I seed
@@ -689,12 +693,12 @@ be 160 bits, and the choice of 768 bits for
 gives commensurate security.
 .TP
 .B "dsa"
-Generates a public/private key pair for DSA.  As for Diffie-Hellman
+Generates a public/private key pair for DSA.  As for Diffie\(enHellman
 keys, it selects a
 private key
-.IR x \ <\  q ,
+.IR x \~<\~ q ,
 and computes the public key
-.IR y \ =\  g\*(ssx\*(se \ mod\  p .
+.IR y "\~= " g \*(ss x "\*(se mod\~" p .
 .TP
 .B "bbs"
 Generates a public/private key pair for the Blum-Blum-Shub random-number
@@ -705,7 +709,7 @@ The key components are prime numbers
 .I p
 and
 .IR q ,
-both congruent to 3 (mod\ 4), and their product
+both congruent to 3 (mod\~4), and their product
 .IR n .
 The public key is simply the modulus
 .IR n ;
@@ -723,9 +727,9 @@ are
 .I strong
 (see the discussion of strong primes above, in the section on RSA keys),
 and that
-.RI ( p \ \-\ 1)/2
+.RI ( p \~\-\~1)/2
 and
-.RI ( q \ \-\ 1)/2
+.RI ( q \~\-\~1)/2
 are relatively prime, giving a maximum possible period length.
 .IP
 The key size requested by the
diff --git a/pub/dsa-misc.c b/pub/dsa-misc.c
index 4f68c7bc..8b03271b 100644
--- a/pub/dsa-misc.c
+++ b/pub/dsa-misc.c
@@ -84,6 +84,7 @@ mp *dsa_nonce(mp *d, mp *q, mp *x, const octet *m,
   size_t bsz = 2*n + 2*ch->hashsz;
   octet *b = XS_ALLOC(bsz);
   octet *kb = b, *rb = kb + n, *hb = rb + ch->hashsz;
+  static const char prefix[] = "catacomb-dsa-nonce";
   ghash *h;
 
   mp_storeb(x, kb, n);
@@ -92,6 +93,7 @@ mp *dsa_nonce(mp *d, mp *q, mp *x, const octet *m,
   do {
     for (j = 0; j < n; j += ch->hashsz) {
       h = GH_INIT(ch);
+      GH_HASH(h, prefix, sizeof(prefix));
       GH_HASHBUF32(h, kb, n);
       GH_HASHBUF32(h, m, ch->hashsz);
       if (r) GH_HASHBUF32(h, rb, ch->hashsz);