Mark Wooding [Fri, 5 Jan 2018 04:28:56 +0000 (04:28 +0000)]
symm/rijndael-mktab.c: Produce more round constants.
We don't have enough for large blocks and/or small keys. We need 15*8 =
120 words of keys for 256-bit Rijndael, and if we have only a 32-bit key
then we'll need 120 round constants. So generate them all.
Mark Wooding [Fri, 5 Jan 2018 04:27:14 +0000 (04:27 +0000)]
symm/rijndael-mktab.c: Don't hardwire output `rcon' table size.
We output `sizeof(rc)' entries, so that's what we should put in the
array length.
Mark Wooding [Sun, 28 May 2017 18:03:08 +0000 (19:03 +0100)]
symm/sha{,256,512}.c: Fold message-scheduling in with state update.
Previously, I implemented these compression functions in two steps:
first performing the message expansion, and then applying the state
update.
Instead, save temporary space by interleaving the two steps. This also
results in a small performance improvement.
Mark Wooding [Sun, 28 May 2017 08:25:19 +0000 (09:25 +0100)]
math/limlee.c: Fiddle with the large-prime heuristics.
Experimentation shows me that large primes just don't last very long
with the old heuristic. Switch to another one that's more tolerant but
still weeds out no-hopers.
Mark Wooding [Mon, 11 Jun 2018 15:36:33 +0000 (16:36 +0100)]
symm/{chacha,salsa20}.h: Mark the cipher classes as `extern'.
Saved by vague linkage, but this is not good.
Mark Wooding [Mon, 21 May 2018 16:41:57 +0000 (17:41 +0100)]
utils/split-pieces: Introduce unsigned quick fields.
There aren't any in Catacomb at the moment -- and I don't plan to add
any -- but other code uses them so it's useful to be able to work with
them.
Mark Wooding [Mon, 21 May 2018 16:40:29 +0000 (17:40 +0100)]
utils/split-pieces (QfConvert): Split out a subclass.
Subclasses must define a boolean `SIGNEDP', and implement `fmt(n)' to
format an individual piece for output.
The new subclass, `SignedQfConvert', is indeed signed, and formats using
`str'; so, again, nothing has actually changed.
Mark Wooding [Mon, 21 May 2018 16:38:23 +0000 (17:38 +0100)]
utils/split-pieces (QfConvert): Rename to `BaseQfConvert'.
Anyone might thing I was about to subclass it.
Mark Wooding [Mon, 21 May 2018 16:35:55 +0000 (17:35 +0100)]
utils/split-pieces (QfConvert): Construct an instance of the right class.
Of course, `QfConvert' is always the right class at the moment, but it's
the principle of the thing.
Mark Wooding [Sun, 3 Jun 2018 09:30:49 +0000 (10:30 +0100)]
progs/catsign.c; Verify equality of keys more directly.
Rather than comparing the two keys' `id' slots, just compare the
pointers. It's not like we got them from different keyrings or
anything. This makes it clear that we're checking that we really have
the /same/ key, found by two different paths.
Fortunately, this isn't a security problem: the code in `key/key-io.c'
won't allow two keys with the same `id' value to exist in the same
keyring. This change therefore doesn't have any observable effect.
But, seeing as I just had a panic regarding a potential security hole in
`tripe-keys', it's as well to make it clear what's actually going on.
Mark Wooding [Sun, 20 May 2018 23:57:10 +0000 (00:57 +0100)]
configure.ac: Recognize `androideabi' as a thing we can support.
There's no significant difference in calling conventions, so this is
safe.
Mark Wooding [Sat, 19 May 2018 23:46:50 +0000 (00:46 +0100)]
configure.ac: Hack around Termux syslog weirdness.
Termux's <syslog.h> has weird macros to redirect to Android's logcat
machinery, but these need a separate library to be linked in. Notice
this weirdness and cope.
Mark Wooding [Tue, 12 Dec 2017 20:21:39 +0000 (20:21 +0000)]
symm/poly1305.c: Fix daft typo in banner comment.
Mark Wooding [Thu, 19 Oct 2017 23:36:31 +0000 (00:36 +0100)]
utils/split-pieces: Report the correct command-line syntax.
Mark Wooding [Thu, 19 Oct 2017 23:35:57 +0000 (00:35 +0100)]
utils/curve25519.sage: Remove redundant coercion to field k.
Mark Wooding [Thu, 19 Oct 2017 18:35:23 +0000 (19:35 +0100)]
pub/t/x*: Rearrange the Monte-Carlo tests.
* Insert more intermediate values, specifically at every power of 10.
* Rather than calculating the whole thing from scratch each time,
tests other than the first one continue from the previous
state (which I had to calculate the hard way and enter into the
test-vector files). The total iteration count and final results
still match the RFC.
* Split the very slow high-iteration-count tests into a separate file,
where they can be run discretionally without having to edit source
files. Arrange to distribute these new files.
Mark Wooding [Thu, 19 Oct 2017 18:03:55 +0000 (19:03 +0100)]
utils/curve25519.sage: Remove second definition of `A0'.
Mark Wooding [Mon, 2 Oct 2017 12:25:39 +0000 (13:25 +0100)]
pub/ed{25519,448}.c: Double by adding self, rather than multiplying by two.
Saves a reduction pass.
Mark Wooding [Mon, 2 Oct 2017 12:47:24 +0000 (13:47 +0100)]
base/ct-test.in: Don't call Valgrind macros unless we found the headers.
Oops.
Mark Wooding [Sun, 1 Oct 2017 02:01:02 +0000 (03:01 +0100)]
Start verifying that code which should be constant-time really is.
Introduce utilities `ct_poison' and `ct_remedy' to control Valgrind's
uninitialized-data checking, based on Adam Langley's `ctgrind' idea
described in https://www.imperialviolet.org/2010/04/01/ctgrind.html.
Use these in the tests for fancy-bignum algorithms, such as Poly1305 and
X25519.
There's currently no automated machinery for running these tests. This
is a little tricky:
* Some of the tests will need to be skipped because they just take too
long if they run under Valgrind.
* The test programs are actually libtool wrappers, which are bash(1)
scripts. Firstly, this means we get lots of spurious errors about
bash; and secondly, the actual test program doesn't end up being
checked by Valgrind at all.
So it's just manual for now.
Mark Wooding [Sat, 30 Sep 2017 01:43:47 +0000 (02:43 +0100)]
symm/{salsa20,chacha}.c (..._rand): Don't crash if nonce pointer is null.
Oops.
Mark Wooding [Fri, 29 Sep 2017 21:25:32 +0000 (22:25 +0100)]
math/scaf.c, etc.: Only need 3*NPIECE words of scratch space.
The extra one would have been necessary because we're calculating the
high half of a product of two (NPIECE + 1)-piece numbers, but in fact we
only need the low NPIECE pieces of the result.
Fix the commentary and the callers.
Mark Wooding [Fri, 29 Sep 2017 21:11:32 +0000 (22:11 +0100)]
math/scaf.c: Fix trivial typo.
Mark Wooding [Tue, 15 Aug 2017 13:22:03 +0000 (14:22 +0100)]
debian/copyright: Fix dates again.
Hopefully properly this time.
Mark Wooding [Tue, 15 Aug 2017 13:21:47 +0000 (14:21 +0100)]
.mailmap: Add file to fix CVS-ish names in history.
Mark Wooding [Mon, 14 Aug 2017 12:38:06 +0000 (13:38 +0100)]
vars.am: Experimental hack for Emacs `flymake'.
I'm not sure whether this will stay here, but it seems harmless enough.
Mark Wooding [Mon, 14 Aug 2017 12:28:57 +0000 (13:28 +0100)]
Revert "debian: Update for Debhelper 10."
This reverts commit
aef6942f4a28e2d422fc33709a08116f51406fd1.
Mark Wooding [Tue, 8 Aug 2017 22:41:44 +0000 (23:41 +0100)]
rand/noise.c, progs/pixie.c: Don't ignore return codes from setuid(2) etc.
Legitimate warnings, I think, but not worth doing anything complicated
about.
Mark Wooding [Tue, 8 Aug 2017 22:13:51 +0000 (23:13 +0100)]
progs/rspit.c: Cope with large files.
Missed this in my earlier `_FILE_OFFSET_BITS' pass. The calculations
for the progress display and so on are all done in terms of bignums
already, so there's no worries with the arithmetic.
Mark Wooding [Sat, 29 Jul 2017 00:02:46 +0000 (01:02 +0100)]
base/keysz.c: Fix bogus pointer dereference on wide-arg key size lists.
I must have been seriously short on brain that day.
Mark Wooding [Mon, 17 Jul 2017 00:00:16 +0000 (01:00 +0100)]
symm/keccak1600.c (keccak1600_p): Minor layout tweak.
Align the final `keccak1600_round' calls to show the symmetry and
difference better.
Mark Wooding [Fri, 7 Jul 2017 09:53:46 +0000 (10:53 +0100)]
debian/copyright: Fix copyright dates.
Mark Wooding [Thu, 6 Jul 2017 10:15:53 +0000 (11:15 +0100)]
debian: Update for Debhelper 10.
Mark Wooding [Thu, 6 Jul 2017 10:15:05 +0000 (11:15 +0100)]
debian/rules: Capture common options in a makefile variable.
Mark Wooding [Thu, 6 Jul 2017 10:14:05 +0000 (11:14 +0100)]
debian/rules: Add a comment explaining why we do weird test things.
Mark Wooding [Thu, 6 Jul 2017 10:10:33 +0000 (11:10 +0100)]
debian/control: Use ${binary:Version} instead of ${Source-Version}.
Mark Wooding [Thu, 6 Jul 2017 10:09:11 +0000 (11:09 +0100)]
debian/copyright: Convert to machine-readable format.
Mark Wooding [Fri, 14 Jun 2013 19:43:15 +0000 (20:43 +0100)]
debian: Multi-arch support.
Mark Wooding [Wed, 5 Jul 2017 21:09:59 +0000 (22:09 +0100)]
configure.ac: Check for some brain damage from Clang's assembler.
It doesn't understand `.arch' or the `adcd' instruction. I'm damned if
I'm writing `dword ptr' everywhere, so Clang users will have to figure
out some way to use Gas if they want the assembler code.
Mark Wooding [Wed, 5 Jul 2017 21:08:11 +0000 (22:08 +0100)]
configure.ac: Delay checking the assembler until we know the target CPU.
It turns out that assemblers are deficient in target-specific ways, so
we have to figure out what the target is like before we can probe for
the brokenness. Reorder things so that this is possible. No functional
change.
Mark Wooding [Wed, 5 Jul 2017 20:38:41 +0000 (21:38 +0100)]
configure.ac: Abstract out common pattern in CPU/ABI variable defs.
The new combined macro is really ugly, but it's probably better than two
copies of the same thing. No functional change.
Mark Wooding [Wed, 5 Jul 2017 20:32:14 +0000 (21:32 +0100)]
math/mpint.h: Add Clang warning-muffling.
Otherwise the compile is very noisy.
Mark Wooding [Wed, 5 Jul 2017 20:30:20 +0000 (21:30 +0100)]
base/dispatch.c: Fix operand constraints in `setflags'.
It wasn't correct to use `g' here. Clang legitimately used sp-relative
memory locations, which broke really badly because the stack pointer
moves during the code sequence. Force the operands into registers to
avoid this problem.
Mark Wooding [Wed, 5 Jul 2017 20:29:31 +0000 (21:29 +0100)]
math/strongprime.c: Muffle an irritating style warning from Clang.
Mark Wooding [Wed, 5 Jul 2017 20:27:30 +0000 (21:27 +0100)]
progs/catsign.c: Mark the various `choke' functions as `NORETURN'.
If I don't do this, then Clang complains (otherwise correctly) that `y'
might be used uninitialized.
Mark Wooding [Tue, 4 Jul 2017 23:51:36 +0000 (00:51 +0100)]
Merge branch '2.3.x'
* 2.3.x:
symm/hmac-def.h: Fix the NMAC and SSLMAC classes.
Conflicts:
symm/hmac-def.h
Mark Wooding [Tue, 4 Jul 2017 17:53:21 +0000 (18:53 +0100)]
vars.am, math/Makefile.am: Tweak `silent-rules' machinery.
Since Automake 1.11, the advice for setting up custom silent-rules
recipes has changed, so use the new machinery.
Also, I'm no longer mainly working on wheezy, and Automake has made the
operation field two spaces wider while I wasn't looking, so make the
output line up properly.
This means that Catacomb now requires Automake 1.11.2 or later to build
from the Git tree.
Mark Wooding [Tue, 4 Jul 2017 16:54:50 +0000 (17:54 +0100)]
symm/sha3.c: Attach the correct operations to the `shake256' cipher.
Rather embarrassing. Thanks to GCC 6 for pointing out that
`shake256_gcops' was unused.
Mark Wooding [Tue, 4 Jul 2017 16:47:54 +0000 (17:47 +0100)]
symm/twofish.c: Break a line to make the code clearer.
In retrospect, squashing all of that onto one line was an error. Thanks
to GCC 6 for pointing this out.
Mark Wooding [Tue, 4 Jul 2017 16:55:55 +0000 (17:55 +0100)]
symm/hmac-def.h: Fix the NMAC and SSLMAC classes.
Thanks to GCC 6 for pointing out that many of the necessary bits of
functionality were hanging around unused. (Why did earlier versions not
spot this?)
It looks like they never worked properly. I hereby deprecate them, and
intend to remove them in Catacomb 2.5.
Mark Wooding [Sun, 28 May 2017 18:03:08 +0000 (19:03 +0100)]
Release 2.4.1.
Mark Wooding [Sun, 28 May 2017 18:03:08 +0000 (19:03 +0100)]
Merge branch '2.3.x'
* 2.3.x:
Release 2.3.2.
math/mpx.c: Fix two's-complement storing.
Conflicts:
debian/changelog
Mark Wooding [Sun, 28 May 2017 18:03:08 +0000 (19:03 +0100)]
Release 2.3.2.
Mark Wooding [Sun, 28 May 2017 18:03:08 +0000 (19:03 +0100)]
math/mpx.c: Fix two's-complement storing.
Oh, dear. This was a bit wrong.
* The internal representation, in terms of `mpw' vectors, is always
nonnegative. Remove the bogus sign-extension machinery for
`mpx_load*2cn'.
* The logic for sign-extending octet vectors in `mpx_store*2cn' was
the wrong way round. Fix it.
* Rather than sign-extending `mpw' vectors, it's necessary to apply a
correction when we reach the end of an octet vector in
`mpx_load*2cn'. Introduce a new argument to `MPX_LOADSTORE' to
carry the necessary correction logic, and use it.
* The test functions used a single `mpw' vector length for both
positive and negative values, which meant that the logic for sign-
extending octet strings on output wasn't exercised. Fix the test:
so that it now does two passes, forcing both sign-extension on
output and zero-extension on input.
Mark Wooding [Tue, 23 May 2017 10:48:46 +0000 (11:48 +0100)]
symm/{chacha,salsa20}-x86ish-sse2.S: Fix typo in commentary.
Mark Wooding [Tue, 23 May 2017 10:48:22 +0000 (11:48 +0100)]
key.1: Document `tag -r' properly.
Mark Wooding [Sun, 14 May 2017 20:05:43 +0000 (21:05 +0100)]
Release 2.4.0.1.
Mark Wooding [Sun, 14 May 2017 19:39:45 +0000 (20:39 +0100)]
symm/rijndael-arm-crypto.S: Fix `pushreg'/`popreg' syntax.
My test build didn't catch this because my assembler is too old. So, it's
brown-paper-bag time once again.
Mark Wooding [Sun, 14 May 2017 15:08:33 +0000 (16:08 +0100)]
Release 2.4.0.
Mark Wooding [Wed, 10 May 2017 20:58:36 +0000 (21:58 +0100)]
pub/ed448.[ch], etc.: Add the Ed448 signature scheme from RFC8032.
Mark Wooding [Mon, 1 May 2017 00:38:30 +0000 (01:38 +0100)]
math/fgoldi.[ch]: Implement the extra operations needed for Ed448.
Mark Wooding [Mon, 1 May 2017 00:38:30 +0000 (01:38 +0100)]
math/scmul.h, pub/
ed25519.c: Abstract out scalar multiplication code.
Because what it needed was to be embedded in a hairy macro.
Mark Wooding [Wed, 10 May 2017 20:57:51 +0000 (21:57 +0100)]
progs/*.1: Mention the default hash for `
ed25519',
Mark Wooding [Wed, 10 May 2017 20:23:22 +0000 (21:23 +0100)]
pub/
ed25519.[ch], etc.: Implement the `context' variant from RFC8032.
Add the test vectors from the RFC, and a little Makefile machinery to
mix them into the main test set.
Mark Wooding [Mon, 1 May 2017 00:38:30 +0000 (01:38 +0100)]
math/f25519.c, utils/curve25519.sage: Slightly improve `quosqrt' algorithm.
The algorithm from the Bernstein et al. paper was somewhat ugly.
Replace it with a different one using the techniques I used in `fgoldi'
for the main calculation, but with the same end structure.
Mark Wooding [Wed, 10 May 2017 20:15:56 +0000 (21:15 +0100)]
pub/
ed25519.c: Rearrange `ptadd' to use fewer registers.
Taking a little inspiration from the three-address code in the
paper (which I can't use as-is, because it clobbers one of its inputs) I
managed to delete two of the temporary registers.
Mark Wooding [Wed, 10 May 2017 20:17:27 +0000 (21:17 +0100)]
pub/
ed25519.c: Don't return the `h1' private-key portion if it's not wanted.
Saves making a temporary buffer in `ed25519_pubkey'.
Mark Wooding [Wed, 10 May 2017 20:13:54 +0000 (21:13 +0100)]
pub/
ed25519.c: Range-check coordinates and scalars when verifying.
This is a requirement of RFC8032, though Bernstein et al don't see the
point.
It's easy enough to test that verification rejects an out-of-range
scalar part in the signature, but there's hardly any space in the
curve-point part, so I've had to cheat.
Mark Wooding [Wed, 10 May 2017 20:11:51 +0000 (21:11 +0100)]
pub/{
ed25519,x25519,x448}.c: Use symbolic constants for sizes of things.
The main code still knows the right numbers by magic.
Mark Wooding [Wed, 10 May 2017 20:06:03 +0000 (21:06 +0100)]
utils/split-pieces, pub/
ed25519.c: New utility makes field-element constants.
It seems to make slightly different (but equivalent) constants from the
machinery in `utils/curve25519.sage'. Replace the constants in
`pub/
ed25519.c' with the new ones.
Mark Wooding [Wed, 10 May 2017 20:54:46 +0000 (21:54 +0100)]
symm/sha3.[ch]: Add support for SHA3 and related functions based on Keccak.
Mark Wooding [Wed, 10 May 2017 20:53:25 +0000 (21:53 +0100)]
symm/hash.h: Add support for test vectors with hex-encoded messages.
Mark Wooding [Wed, 10 May 2017 20:52:30 +0000 (21:52 +0100)]
progs/rspit.c: Make the `salsae' tab be `const'.
Silly oversight.
Mark Wooding [Wed, 10 May 2017 20:51:45 +0000 (21:51 +0100)]
symm/hmac-def.h: Set HMAC keys up in a more principled manner.
No longer does it reach into the hash context and run `HASH_compress' by
hand.
This means that nothing assumes that `HASH_compress' exists any more.
Mark Wooding [Wed, 10 May 2017 20:50:04 +0000 (21:50 +0100)]
symm/hmac-def.h: Report key sizes as 16-bit quantities.
Hash states can be huge. It was an obvious mistake defining the
recommended key size in terms of the state size, but I can't change it
now.
Mark Wooding [Wed, 10 May 2017 20:46:39 +0000 (21:46 +0100)]
base/keysz.[ch]: Add a flag to say that arguments are 16 bits wide.
This breaks programs which thing they can parse arbitrary key-size
descriptors. The obvious such thing is the Python interface, so note
that we need a later version.
Mark Wooding [Mon, 1 May 2017 00:38:30 +0000 (01:38 +0100)]
symm/keccak1600.[ch]: Add the Keccak-p[1600, n] permutation.
Currently just a special snowflake. Fancier things forthcoming.
Mark Wooding [Wed, 10 May 2017 19:58:34 +0000 (20:58 +0100)]
symm/sha512.[ch], etc.: Support SHA512/224 and SHA512/256.
These are more truncated versions of SHA512 with different initial
values. The point of the exercise is performance: SHA512 runs faster
than SHA256 on 64-bit processors (it munches twice as much data per run
through the compression function, but has only 25% more rounds). Add
test vectors for the hash function from NIST and Wikipedia, and HMAC
tests I found under a rock.
Mark Wooding [Wed, 10 May 2017 19:53:27 +0000 (20:53 +0100)]
symm/t/sha...: Add official NIST HMAC test vectors.
I found some at last, annoyingly provided as PDF documents.
Unsurprisingly, the code passed first time.
Strange: the tests include two tests for the message `Sample message for
keylen=blocklen', exactly one of which has the key length equal to the
block length. Whatevs.
Mark Wooding [Wed, 10 May 2017 18:48:20 +0000 (19:48 +0100)]
symm/: Eliminate the remaining checked-in stubby source files.
Now that $(STUBS_SRC) actually works, use it to eliminate `safersk.c',
`sha224.c', `sha384.c', and `whirlpool256.c'. Move test vectors to
their new homes, and modify the base files to actually run them.
Alas, the build machinery wants to ship `t/safersk' even though it's
empty, so leave it as a stub. (Maybe...) And the HMAC mode machinery
wants to put its test in the mode test-vector file, which is a bit
annoying. Still, the cruft is reduced.
Mark Wooding [Wed, 10 May 2017 18:36:44 +0000 (19:36 +0100)]
symm/stub.c.in: Add a trivial test rig which says to look over there.
As hinted.
Mark Wooding [Wed, 10 May 2017 18:35:59 +0000 (19:35 +0100)]
symm/Makefile.am: Add a `base' column to the $(STUBS_SRC) list.
The list is currently empty, so this is just a matter of fiddling with
the bits of Makefile which process it. But it means that we can add
things to `stub.c.in' which refer to the base C file, for example to
tell a reader where the real thing is.
Mark Wooding [Wed, 10 May 2017 19:26:41 +0000 (20:26 +0100)]
symm/blkc.h, symm/hash.h: Factor out pieces of the test machinery.
This will allow a source file to include tests for a hash function or
block cipher /and/ other kinds of tests. Possibly even for another hash
function or block cipher.
This was mostly done already for block ciphers: the remaining piece
involved making a macro to populate the test table. But hash functions
haven't been as fortunate.
Fix the new definitions to allow non-identifier names for hashes and
block ciphers, to match the mode definitions.
Mark Wooding [Wed, 10 May 2017 18:29:41 +0000 (19:29 +0100)]
symm/: Allow block cipher and hash functions with strange names.
This is quite a performance, actually.
* The `multigen' tool now has a modifier `:f' which makes a filename-
safe version of a value.
* The `multigen' input files and `Makefile.am' have been changed to
use `:f' appropriately.
* All of the `MUMBLE-def.h' header files have been changed to
introduce a new macro `MUMBLE_DEFX' with two extra arguments: the
thing's presentable name (for use in class structures), and a
filename-safe version of it. The old `MUMBLE_DEF' macro still
exists for compatibility (has anyone else written a mode?).
* Similar changes have been made to the testing machinery in `blkc.h'
and `hash.h', but this still needs cleaning up somewhat.
Mark Wooding [Wed, 10 May 2017 21:24:53 +0000 (22:24 +0100)]
math/{genlimits.c,mpdump.c}: Delete long-defunct source files.
These programs' jobs have been taken over by `mpgen', which is much
better at it.
Mark Wooding [Thu, 11 May 2017 09:42:15 +0000 (10:42 +0100)]
progs/: Generate XDH and EdDSA operations using macros.
There are already two very similar XDH implementations, and EdDSA is
likely to have more. Let's not write more code than we need to.
Mark Wooding [Wed, 10 May 2017 20:03:51 +0000 (21:03 +0100)]
pub/
ed25519.c: Use the correct type for the field-element constants.
This fixes a bug: `bz_pieces' had the wrong type, but likely worked
anyway by luck -- especially on little-endian machines.
Mark Wooding [Wed, 10 May 2017 20:01:03 +0000 (21:01 +0100)]
math/f{25519,goldi}.[ch]: Export the piece type.
Mark Wooding [Wed, 10 May 2017 20:19:54 +0000 (21:19 +0100)]
math/scaf.c: Add some debugging utilities I found handy.
Mark Wooding [Wed, 10 May 2017 20:19:32 +0000 (21:19 +0100)]
math/scaf.c: Fix conditional subtractions in `scaf_reduce'.
So that they actually subtract the right thing. Obvious blunder. The
big surprise is that none of the literally thousands of
Ed25519 tests
which have hammered on that code caught it. (Found during development
of Ed448, coming later.)
Mark Wooding [Thu, 11 May 2017 09:42:15 +0000 (10:42 +0100)]
pub/rsa-pub.c: Implement the optimal addition chains for e = 3, e = 65537.
Also add tests for e = 3 (previously missing) and e = 17 (to exercise
the general modexp path).
Mark Wooding [Thu, 11 May 2017 09:42:15 +0000 (10:42 +0100)]
progs/perftest.c: Allow setting the public exponent in RSA tests.
Mark Wooding [Thu, 11 May 2017 09:42:15 +0000 (10:42 +0100)]
pub/rsa-gen.c, progs/key.c: Overhaul RSA key generation.
Rewrite the key-generation code from scratch. The new version seems
simpler to me, and allows the caller to choose the public exponent. It
also retries repeatedly until it finds acceptable values unless told to
stop within a finite number of steps.
Add an option to `key' to allow the user to select a different
exponent. Recommend e = 3 in the manpage.
Mark Wooding [Thu, 11 May 2017 09:42:15 +0000 (10:42 +0100)]
math/strongprime.c: Improve the commentary.
Mark Wooding [Thu, 11 May 2017 09:42:15 +0000 (10:42 +0100)]
math/strongprime.c: Replace inexplicable exponentiation with extended-gcd.
For some reason, I calculated s^-1 as s^{r-2} (mod r). This code isn't
even slightly constant-time, and gcd is faster than modexp. Also, this
bit isn't time-critical anyway, and the code is way simpler like this.
Mark Wooding [Sun, 14 May 2017 03:11:09 +0000 (04:11 +0100)]
Merge branch '2.3.x'
* 2.3.x:
Release 2.3.1.
pub/bbs-gen.c, pub/rsa-gen.c: Remove the lower-bounding on q.
math/strongprime.c: Clamp the starting point.
math/strongprime.c: Reduce failures by adding some more slop bits.
progs/catcrypt.c, progs/cc-sig.c: Compare MAC tags in constant time.
progs/cc-sig.c: Initialize hash context properly for RSA-PSS.
progs/cc-sig.c: Don't destroy an RSA context just after building it.
math/g-bin.c, math/g-prime.c: Fix type incompatibility.
math/g-*.c: Group implementations include `group.h' via `group-guts.h'.
key/key-io.c: Produce valid key lines for empty keys.
key/key-io.c: Fix segfault opening `KOPEN_READ | KOPEN_NOFILE' key files.
Conflicts:
math/group-guts.h (trivial)
progs/catcrypt.c (already picked up)
Mark Wooding [Sat, 13 May 2017 14:21:43 +0000 (15:21 +0100)]
Release 2.3.1.
Mark Wooding [Thu, 11 May 2017 09:42:15 +0000 (10:42 +0100)]
pub/bbs-gen.c, pub/rsa-gen.c: Remove the lower-bounding on q.
It's unnecessary. It was a bad idea because it biases q quite heavily,
but now `strongprime' generates primes in the right interval so that
getting the right bit length isn't a problem.
Mark Wooding [Thu, 11 May 2017 09:42:15 +0000 (10:42 +0100)]
math/strongprime.c: Clamp the starting point.
Now the result will be in the upper quarter of the `obvious' range, and
the product of two such values is guaranteed to have the desired number
of bits. This saves callers from doing stupid things like trying to
clamp one of the factors by hand, which ends up significantly biasing
the second factor. (This isn't very bad, because there's a /lot/ of
randomness in the chosen congruence class, but it's good to fix this
sort of thing.)
Mark Wooding [Thu, 11 May 2017 09:42:15 +0000 (10:42 +0100)]
math/strongprime.c: Reduce failures by adding some more slop bits.
In my experiments, failures were happening about 2--3% of the time,
which is way more than one is really willing to tolerate.