Mark Wooding [Fri, 27 Mar 2020 17:09:12 +0000 (17:09 +0000)]
math/f25519.c: Fix spelling of `weird'.
Mark Wooding [Tue, 29 Oct 2019 18:59:32 +0000 (18:59 +0000)]
base/dispatch.c, etc.: Replace inline assembler for the `rdrand' fix.
Mark Wooding [Mon, 16 Dec 2019 17:21:25 +0000 (17:21 +0000)]
Merge branch '2.5.x'
* 2.5.x:
debian/catacomb2.symbols: Bump versions for fixed functions.
rand/rand.c: Mix the pool key in `rand_gate' and `rand_stretch'.
rand/lcrand.c: Swap flags and max so generator not advertised as strong.
pub/dh-kcdsa.c: Free the correct factor.
math/limlee.c: Don't leak the factor vector on overall failure.
math/limlee.c: Handle an abort from `pgen' correctly.
math/pgen.c: Don't free the tester if it's not set up.
math/ec-exp.h: Fix segfault when base point is at infinity.
key/key-data.c (key_copydata): Fix catastrophic bug.
key/key-data.c (key_split): Fix long-standing reference leak.
key/key-misc.c (key_bytag): Don't give up because a by-id search fails.
base/dispatch.c, etc.: Check that `rdrand' works.
Mark Wooding [Mon, 16 Dec 2019 16:48:01 +0000 (16:48 +0000)]
debian/catacomb2.symbols: Bump versions for fixed functions.
I didn't do this for the 2.4.x branch because there's no way to say
`2.4.x with x > 4 or 2.5.x with x > 1'. But I can be sure that all
releases beyond 2.5.1 will have the fixes.
There's no version-bump for the `rdrand' fix. I'm not leaning on it
very hard.
Mark Wooding [Mon, 16 Dec 2019 17:20:15 +0000 (17:20 +0000)]
Merge branch '2.4.x' into 2.5.x
* 2.4.x:
rand/rand.c: Mix the pool key in `rand_gate' and `rand_stretch'.
rand/lcrand.c: Swap flags and max so generator not advertised as strong.
pub/dh-kcdsa.c: Free the correct factor.
math/limlee.c: Don't leak the factor vector on overall failure.
math/limlee.c: Handle an abort from `pgen' correctly.
math/pgen.c: Don't free the tester if it's not set up.
math/ec-exp.h: Fix segfault when base point is at infinity.
key/key-data.c (key_copydata): Fix catastrophic bug.
key/key-data.c (key_split): Fix long-standing reference leak.
key/key-misc.c (key_bytag): Don't give up because a by-id search fails.
base/dispatch.c, etc.: Check that `rdrand' works.
Mark Wooding [Thu, 12 Dec 2019 19:12:26 +0000 (19:12 +0000)]
rand/rand.c: Mix the pool key in `rand_gate' and `rand_stretch'.
Back in commit
d6fab4f6ae209afd6799a2974ce2849123965170, I rearranged
the cryptography to use plain SHA256 rather than RIPEMD160-HMAC for
determining the cipher key for churning the generator state.
I also managed to remove all the points at which the key actually
influences the behaviour of the generator!
This was four years ago, and I can't remember exactly why, but my guess
is that the key was previously inserted as part of `rmd160_macinit',
which was replaced by the unheyed `HASH_INIT' function.
Mark Wooding [Fri, 15 Nov 2019 19:37:29 +0000 (19:37 +0000)]
rand/lcrand.c: Swap flags and max so generator not advertised as strong.
Oh, dear. This isn't good.
Even worse, this means that `max' was advertised as zero, so the outputs
have been biased.
Mark Wooding [Wed, 23 Oct 2019 03:10:27 +0000 (04:10 +0100)]
pub/dh-kcdsa.c: Free the correct factor.
Mark Wooding [Thu, 14 Nov 2019 20:17:58 +0000 (20:17 +0000)]
math/limlee.c: Don't leak the factor vector on overall failure.
The `done' function doesn't know whether we succeeded or failed, so it
prepares the factor vector for output regardless. In `limlee', if we
don't have a result, then release the factors.
Mark Wooding [Thu, 14 Nov 2019 19:53:27 +0000 (19:53 +0000)]
math/limlee.c: Handle an abort from `pgen' correctly.
The `llgen' function just tries again if `pgen' reports an abort. This
is entirely contrary to the intend of the `PGEN_ABORT' protocol, so I've
no idea why I thought this was a good idea.
Instead, leave the prime slot null (because adding a return code to the
`pgen' callback breaks the API), and arrange for the caller to notice
and clean up. This is annoyingly because there may be an `mpmul' in
progress.
Mark Wooding [Thu, 14 Nov 2019 19:46:53 +0000 (19:46 +0000)]
math/pgen.c: Don't free the tester if it's not set up.
The problem flow is this:
* The stepper reports a candidate (`p' is `P_STEP', and `proc' returns
`PGEN_TRY').
* We decide to (a) report an event (set `A_EVENT' in `act'), and (b)
initialize the tester (set `p = P_TEST', `proc = test', and `rq =
PGEN_BEGIN'.
* We call the event handler, but it returns `PGEN_ABORT'. We notice
that `p == P_TEST', and set `A_ENDTEST'.
* This causes us to call `test' with `PGEN_DONE'. Alas, the tester
hasn't been initialized, because we haven't actually called it with
`PGEN_BEGIN' yet. Result: segfault.
We can notice this because `rq == PGEN_BEGIN': don't set `A_ENDTEST'
if this is the case.
Mark Wooding [Fri, 18 Oct 2019 21:45:01 +0000 (22:45 +0100)]
math/ec-exp.h: Fix segfault when base point is at infinity.
Mark Wooding [Thu, 21 Nov 2019 17:43:51 +0000 (17:43 +0000)]
key/key-data.c (key_copydata): Fix catastrophic bug.
The fundamental problem is that the key-encoding test has the wrong
sense. The result is that we end up (only) trying to iterate over non-
structured keys, which results in an assertion failure.
Also, switch things around so that we check the encoding type before
checking the flags.
Mark Wooding [Tue, 8 Oct 2019 19:23:01 +0000 (20:23 +0100)]
key/key-data.c (key_split): Fix long-standing reference leak.
Mark Wooding [Sat, 26 Oct 2019 14:38:25 +0000 (15:38 +0100)]
key/key-misc.c (key_bytag): Don't give up because a by-id search fails.
This came to my attention when searching for a key of type `ec' didn't
work because it looks like a hex number. This obviously sucks.
Mark Wooding [Wed, 30 Oct 2019 00:45:11 +0000 (00:45 +0000)]
base/dispatch.c, etc.: Check that `rdrand' works.
When probing for `rdrand', check to make sure that it doesn't just
return the same thing every time, and that it can reasonably well make
progress. We check that up to five 32-bit samples are not all the same,
which will mistakenly mark a working CPU as defective with probability
2^-128.
It seems that some processors will return a constant value from `rdrand'
but set the carry flag to indicate that it's properly random anyway.
See
https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-destroyed-my-weekend/
as an example.
Mark Wooding [Tue, 8 Oct 2019 10:48:32 +0000 (11:48 +0100)]
Merge branch '2.5.x'
* 2.5.x:
key/key-io.c: Mark `exptime' function `static'.
key/key-io.c (key_new): Don't leak attribute `sym_table' on error.
Mark Wooding [Tue, 8 Oct 2019 10:47:53 +0000 (11:47 +0100)]
debian/.gitignore: Ignore `catacomb-data' directory.
Mark Wooding [Tue, 8 Oct 2019 10:45:56 +0000 (11:45 +0100)]
Merge branch '2.4.x' into 2.5.x
* 2.4.x:
key/key-io.c: Mark `exptime' function `static'.
key/key-io.c (key_new): Don't leak attribute `sym_table' on error.
Mark Wooding [Tue, 8 Oct 2019 10:44:19 +0000 (11:44 +0100)]
key/key-io.c: Mark `exptime' function `static'.
I think it was always meant to be so. It doesn't have a prefix, and
isn't used anywhere else. Leaking it into the client namespace was just
a mistake.
Mark Wooding [Tue, 8 Oct 2019 10:36:34 +0000 (11:36 +0100)]
key/key-io.c (key_new): Don't leak attribute `sym_table' on error.
This is safe: `insert' doesn't do anything with `k->a'.
Mark Wooding [Tue, 1 Oct 2019 20:43:41 +0000 (21:43 +0100)]
Merge branch '2.5.x'
* 2.5.x:
catacomb.pc.in: Update dependency on mLib.
Mark Wooding [Tue, 1 Oct 2019 20:43:29 +0000 (21:43 +0100)]
Merge branch '2.4.x' into 2.5.x
* 2.4.x:
catacomb.pc.in: Update dependency on mLib.
Mark Wooding [Tue, 1 Oct 2019 11:54:27 +0000 (12:54 +0100)]
catacomb.pc.in: Update dependency on mLib.
The most recent relevant change appears to be
commit
4d845619c3f21fe19dd7f7b16815281b34de9e33
Author: Mark Wooding <mdw@distorted.org.uk>
Date: Sat, 26 May 2018 23:31:00 +0100
codec/url.c: Always encode whitespace characters.
Vertical whitespace is obviously bad, so this is a longstanding bug; but
all whitespace should really be escaped.
which was first released as part of 2.3.0.
Mark Wooding [Tue, 1 Oct 2019 20:41:20 +0000 (21:41 +0100)]
debian/changelog: Lower placeholder version for benefit of `pkg-config'.
Because it doesn't implement the convention that `~' sorts before
anything else, even though that's a defined part of the RPM
version-number system which it claims to implement.
Mark Wooding [Mon, 30 Sep 2019 01:19:12 +0000 (02:19 +0100)]
debian/changelog: Prepare for next release.
Mark Wooding [Sat, 17 Nov 2018 21:08:11 +0000 (21:08 +0000)]
symm/keccak1600.c (keccak1600_extract): Eliminate intermediate state buffer.
Instead, introduce a handy bitmap which identifies which lanes need
complementing and do the whole thing in the loop.
Mark Wooding [Sun, 29 Sep 2019 14:44:26 +0000 (15:44 +0100)]
rand/lcrand.c, rand/rand.c: Replace dynamic assertions with static ones.
This adds a dependency on mLib 2.4.1.
Mark Wooding [Sat, 28 Sep 2019 01:05:48 +0000 (02:05 +0100)]
base/keysz.c: Delete trailing `,' in enum.
Mark Wooding [Sat, 28 Sep 2019 01:05:27 +0000 (02:05 +0100)]
math/mpx.c: Fix function name in header comment.
Mark Wooding [Sun, 29 Sep 2019 17:42:35 +0000 (18:42 +0100)]
Merge branch '2.5.x'
* 2.5.x:
Release 2.5.1.
Release 2.4.4.
debian/: Ship correct symbols files.
debian/: Bump to Debhelper 10.
debian/rules: Prefix `dh' options with `-O' to prevent sadness.
Mark Wooding [Sun, 29 Sep 2019 16:57:10 +0000 (17:57 +0100)]
Release 2.5.1.
Mark Wooding [Sun, 29 Sep 2019 16:52:39 +0000 (17:52 +0100)]
Merge branch '2.4.x' into 2.5.x
* 2.4.x:
Release 2.4.4.
debian/: Ship correct symbols files.
debian/: Bump to Debhelper 10.
debian/rules: Prefix `dh' options with `-O' to prevent sadness.
Conflicts:
debian/changelog (take both)
debian/control
Also fix debian/catacomb2.symbols to add new symbols; bump `pgen_primep'
to 2.5.0 to ensure that the Baillie--PSW test is used.
Mark Wooding [Sun, 29 Sep 2019 14:58:57 +0000 (15:58 +0100)]
Release 2.4.4.
Mark Wooding [Sat, 28 Sep 2019 00:21:53 +0000 (01:21 +0100)]
debian/: Ship correct symbols files.
Mark Wooding [Sun, 29 Sep 2019 14:56:38 +0000 (15:56 +0100)]
debian/: Bump to Debhelper 10.
Mark Wooding [Sun, 29 Sep 2019 15:39:13 +0000 (16:39 +0100)]
debian/rules: Prefix `dh' options with `-O' to prevent sadness.
Mark Wooding [Thu, 26 Sep 2019 11:11:50 +0000 (12:11 +0100)]
Mostly abolish inline assembler code in favour of dedicated files.
Move the fancy feature probing from `dispatch.c'. This makes it easier to
understand because it's not covered in `%' sigils and backwards, and
also simplifies things because we have better machinery for papering
over the differences between 32- and 64-bit instruction sets.
Also move the `rdrand' code from `rand.c'. This makes things
significantly more complicated because it calls back into C, but it does
improve availability of a security feature, so that's good.
That leaves only a use of `rdtsc' in `perftest.c', which is hardly
critical, and the `rbit' in the ARM64 `gcm.c' code, which has a slightly
slower portable alternative.
Mark Wooding [Thu, 26 Sep 2019 12:50:21 +0000 (13:50 +0100)]
base/regdump.h: Add missing `regfmt.' definitions for `eflags', `rflags'.
Not having these causes GNU `as' to segfault, which is a little
alarming.
Mark Wooding [Thu, 26 Sep 2019 12:49:45 +0000 (13:49 +0100)]
base/regdump.h: Add missing `F(...)' around `callext' targets.
Probably broke Windows.
Mark Wooding [Fri, 27 Sep 2019 00:25:58 +0000 (01:25 +0100)]
Merge branch '2.4.x' into 2.5.x
* 2.4.x:
base/dispatch.c: Check for XMM registers after CPUID probe.
rand/noise.c: Fix foolish bug in the `getentropy' code.
Mark Wooding [Thu, 26 Sep 2019 11:09:10 +0000 (12:09 +0100)]
base/dispatch.c: Check for XMM registers after CPUID probe.
`fxsave' isn't universally available, but if CPUID is reporting that XMM
instructions are available, we can definitely use it.
Mark Wooding [Thu, 26 Sep 2019 16:03:46 +0000 (17:03 +0100)]
rand/noise.c: Fix foolish bug in the `getentropy' code.
I've probably never built this before. :-/
Mark Wooding [Sat, 21 Sep 2019 20:29:19 +0000 (21:29 +0100)]
Release 2.5.0.
Mark Wooding [Sat, 21 Sep 2019 20:18:12 +0000 (21:18 +0100)]
Merge branch '2.4.x'
* 2.4.x:
Release 2.4.3.
debian/control: Don't require `valgrind' on `armel'.
progs/perftest.c: Document the `-n' option for `enc' and `hash'.
key/key-misc.c: Fix bogus parentheses in macro.
symm/rijndael-arm64-crypto.S: Fix bogus element-to-GP move.
symm/chacha.c: Set the correct nonce size for `xchachaNN'.
symm/idea.c: Fix key-size descriptor.
Mark Wooding [Sat, 21 Sep 2019 16:44:24 +0000 (17:44 +0100)]
Release 2.4.3.
Mark Wooding [Sat, 21 Sep 2019 17:18:20 +0000 (18:18 +0100)]
debian/control: Don't require `valgrind' on `armel'.
It isn't there. We must manage without.
Mark Wooding [Sat, 10 Nov 2018 13:55:14 +0000 (13:55 +0000)]
progs/perftest.c: Document the `-n' option for `enc' and `hash'.
(cherry picked from commit
6fbaed9534c9c100ed4c2c45c4a5b3e95142c888)
Mark Wooding [Wed, 18 Sep 2019 17:35:34 +0000 (18:35 +0100)]
key/key-misc.c: Fix bogus parentheses in macro.
The old, bogus behaviour was that it would report `KERR_READONLY' if the
keyring was neither open for writing, /nor/ modified. I think this is
relatively benign, but still well deserving of fixing.
Spotted by Clang.
(cherry picked from commit
924c7057076a23e322d40693912633dc546867e9)
Mark Wooding [Wed, 18 Sep 2019 17:24:49 +0000 (18:24 +0100)]
symm/rijndael-arm64-crypto.S: Fix bogus element-to-GP move.
Spotted by Clang's assembler. GAS is obviously too lenient.
(cherry picked from commit
cead42fc5cf5ff8c1c13f123e4c002077b42f6cd)
Mark Wooding [Thu, 15 Aug 2019 17:16:02 +0000 (18:16 +0100)]
symm/chacha.c: Set the correct nonce size for `xchachaNN'.
Oops.
(cherry picked from commit
9acc7e10f1da03be55e3bc2cdcbbd5775253e3d0)
Mark Wooding [Fri, 9 Nov 2018 22:44:40 +0000 (22:44 +0000)]
symm/idea.c: Fix key-size descriptor.
Missing terminator. Oops.
(cherry picked from commit
9c22e9e0d174ee0c1e649464755568fe61c0e949)
Mark Wooding [Wed, 18 Sep 2019 18:47:47 +0000 (19:47 +0100)]
progs/Makefile.am: Don't link `pixie' against the main `libcatacomb.la'.
It doesn't actually do any cryptography. Instead, Just pick out the
`base' and `key' libraries which contain its (very light) requirements.
This is the conclusion I reached following an Android ARM64 build
failure caused by lack of maths functions.
Mark Wooding [Wed, 18 Sep 2019 17:35:34 +0000 (18:35 +0100)]
key/key-misc.c: Fix bogus parentheses in macro.
The old, bogus behaviour was that it would report `KERR_READONLY' if the
keyring was neither open for writing, /nor/ modified. I think this is
relatively benign, but still well deserving of fixing.
Spotted by Clang.
Mark Wooding [Wed, 18 Sep 2019 17:24:49 +0000 (18:24 +0100)]
symm/rijndael-arm64-crypto.S: Fix bogus element-to-GP move.
Spotted by Clang's assembler. GAS is obviously too lenient.
Mark Wooding [Wed, 18 Sep 2019 16:37:33 +0000 (17:37 +0100)]
configure.ac: Fix the bug report for unexpected CPU or ABI.
Mark Wooding [Wed, 18 Sep 2019 16:28:01 +0000 (17:28 +0100)]
configure.ac: Set the `ASM_DEBUG' automake conditional at the right time.
Most significantly, after we actually know whether we want it turned on.
Mark Wooding [Wed, 18 Sep 2019 16:26:44 +0000 (17:26 +0100)]
configure.ac: Don't force `ENABLE_ASM_DEBUG' on unconditionally.
Oops. I bungled a `case'.
Mark Wooding [Tue, 17 Sep 2019 09:40:39 +0000 (10:40 +0100)]
symm/keccak1600.c: Eliminate the unnecessary temporary vector `b'.
Mark Wooding [Thu, 12 Sep 2019 19:19:15 +0000 (20:19 +0100)]
configure.ac, base/asm-common.h: Check explicitly for `_' on symbols.
There's an autoconf macro for this in the Debian `libltdl-dev' package,
though not in the main `libtool' package.
I think some BSDs are foolish enough to put `_' on symbols even though
they notionally use ELF. This may not be enough to make things work on
them, but it should at least help a bit.
Mark Wooding [Thu, 12 Sep 2019 19:18:59 +0000 (20:18 +0100)]
configure.ac: Give the `asm-debug' stanza a heading.
Mark Wooding [Thu, 12 Sep 2019 19:18:09 +0000 (20:18 +0100)]
configure.ac: Move `asm-debug' after we've finished CPU/ABI detection.
Fortunately it doesn't actually print anything, but if it did it would
produce much confusion.
Mark Wooding [Thu, 15 Aug 2019 15:25:32 +0000 (16:25 +0100)]
math/pgen.h, math/pgen-granfrob.c: Fix typo in function comment.
Mark Wooding [Mon, 12 Aug 2019 13:44:35 +0000 (14:44 +0100)]
math/mp-sqrt.c: Explain the algorithm, and particularly the end condition.
The gnomic remark that `Increasing x is pointless when -q < 2 x + 1' was
enough to lead me back on the right lines, but is hardly adequate. I
ended up wasting quite a lot of time with a whiteboard, because the
`... + 1' makes the termination condition look just enough like `the
fraction comes out zero'. But no: that's (not quite) a
coincidence. (Thinking more carefully, it's no surprise that the delta
looks similar to the derivative, but it's definitely the former we're
interested in here, rather than the latter.)
Mark Wooding [Sun, 8 Sep 2019 17:36:28 +0000 (18:36 +0100)]
Merge branch 'mdw/rsvr'
* mdw/rsvr: (49 commits)
progs/cc-kem.c: Reimplement the `naclbox' bulk cipher in terms of AEAD.
progs/cc-kem.c: Split `aead_init' into two pieces.
symm/latinpoly-def.h: Implement Bernstein's `crypto_secretbox'.
symm/latinpoly-def.h, etc.: Refactor in preparation for a related scheme.
symm/gaead.h: Specify a flag for `AEAD' schemes which don't do AAD.
symm/t/chacha: Add IETF test vector for XChacha20-Poly1305.
symm/gcm-*.S: GCM acceleration using hardware polynomial multiplication.
symm/gcm.c: Make `gcm_mktable' and `gcm_mulk_...' be CPU-dependent.
symm/gcm.c: Add low-level multiplication tests.
base/regdump.[ch], etc.: Fancy register dumping infrastructure.
base/asm-common.h: Add some macros for shifting entire NEON vectors.
base/asm-common.h: Use `push' and `pop', for Thumb compatibility.
base/asm-common.h: Provide default frame pointer registers.
base/asm-common.h: Prefer `nil' as the unspecified-argument sentinel.
base/asm-common.h: Fix bogus indentation.
base/asm-common.h: Settle on no spaces around keyword-argument `='.
base/asm-common.h: Add an `IMM' macro for immediate operands.
base/asm-common.h: Implement the `r' decorator for `MEM' accesses.
base/asm-common.h: Hoist the `_DECOR_mem_...' definitions.
base/asm-common.h: Put `l' suffix on `si', `di', etc. under `CPUFAM_AMD'.
...
Mark Wooding [Tue, 20 Aug 2019 13:19:21 +0000 (14:19 +0100)]
progs/cc-kem.c: Reimplement the `naclbox' bulk cipher in terms of AEAD.
Mark Wooding [Tue, 20 Aug 2019 13:18:36 +0000 (14:18 +0100)]
progs/cc-kem.c: Split `aead_init' into two pieces.
This will let us use the same machinery with different user interfaces.
Mark Wooding [Fri, 16 Aug 2019 11:49:33 +0000 (12:49 +0100)]
symm/latinpoly-def.h: Implement Bernstein's `crypto_secretbox'.
Mark Wooding [Fri, 16 Aug 2019 11:48:22 +0000 (12:48 +0100)]
symm/latinpoly-def.h, etc.: Refactor in preparation for a related scheme.
No functional change at this time, but a bunch of things are renamed and
parts which will be common between the two are factored out.
Mark Wooding [Fri, 16 Aug 2019 11:33:22 +0000 (12:33 +0100)]
symm/gaead.h: Specify a flag for `AEAD' schemes which don't do AAD.
This is a useful shape, and, in particular, it covers the NaCl
`crypto_secretbox' transform.
Mark Wooding [Thu, 15 Aug 2019 17:17:27 +0000 (18:17 +0100)]
symm/t/chacha: Add IETF test vector for XChacha20-Poly1305.
Mark Wooding [Tue, 13 Nov 2018 11:28:53 +0000 (11:28 +0000)]
symm/gcm-*.S: GCM acceleration using hardware polynomial multiplication.
Add assembler implementations of the low-level GCM arithmetic which make
use of polynomial multiplication instructions on x86 (the delightfully
named `pclmul{l,h}q{l,h}dq' instructions) and ARM processors (the ARM32
`vmull.p64' and ARM64 `pmull{,2}' instructions). Of course, this
involves adding the necessary CPU feature detection.
GCM's bit and byte order is remarkably confusing. I've tried quite hard
to write the code so as to help the reader keep track of which bits are
where, but it's very difficult.
There's also a Python implementation which has proven invaluable while
debugging these things.
Mark Wooding [Tue, 13 Nov 2018 11:26:56 +0000 (11:26 +0000)]
symm/gcm.c: Make `gcm_mktable' and `gcm_mulk_...' be CPU-dependent.
A couple of other changes to ease the way:
* Split `gcm_mulk_...' into two endianness variants, so that
CPU-specific variants don't have to track what's going on through
the key table.
* Abstract out `recover_k' to decode the key value from a table, for
the use of `gcm_concat'. This is, of course, necessary if the table
format is CPU-dependent.
* Add testing to make sure that `mktable'/`recover_k' agree with each
other.
There are currently no fancy implementations, but you can tell what's
coming. No actual functional change, except for logging if you set
`CATACOMB_CPUDISPATCH_DEBUG' in the environment.
Mark Wooding [Tue, 13 Nov 2018 11:21:59 +0000 (11:21 +0000)]
symm/gcm.c: Add low-level multiplication tests.
Mark Wooding [Sun, 18 Aug 2019 01:08:07 +0000 (02:08 +0100)]
base/regdump.[ch], etc.: Fancy register dumping infrastructure.
Mark Wooding [Sat, 7 Sep 2019 13:20:19 +0000 (14:20 +0100)]
base/asm-common.h: Add some macros for shifting entire NEON vectors.
The `vext' (A32 NEON) or `ext' (A64) instructions can be (ab)used for
shifting vectors left and right if you have a spare zero vector lying
around. But using them is kind of confusing: left shifts, especially,
need a reversed shift quantity, and the shift is measured in bytes
rather than bits.
Add a couple of macros to make this less strange.
Mark Wooding [Mon, 2 Sep 2019 11:53:54 +0000 (12:53 +0100)]
base/asm-common.h: Use `push' and `pop', for Thumb compatibility.
I still prefer `stmfd' and `ldmfd' for general code, but these are
important macros for which Thumb compatibility might be valuable.
Mark Wooding [Mon, 2 Sep 2019 11:51:05 +0000 (12:51 +0100)]
base/asm-common.h: Provide default frame pointer registers.
And use the default in the obvious places.
Mark Wooding [Mon, 2 Sep 2019 11:50:11 +0000 (12:50 +0100)]
base/asm-common.h: Prefer `nil' as the unspecified-argument sentinel.
Mark Wooding [Mon, 2 Sep 2019 11:49:26 +0000 (12:49 +0100)]
base/asm-common.h: Fix bogus indentation.
Mark Wooding [Mon, 2 Sep 2019 11:49:03 +0000 (12:49 +0100)]
base/asm-common.h: Settle on no spaces around keyword-argument `='.
Mark Wooding [Sun, 18 Aug 2019 01:13:18 +0000 (02:13 +0100)]
base/asm-common.h: Add an `IMM' macro for immediate operands.
The most useful version of this is `IMM(r, ...)', because that varies
according to the target architecture, but the others might be considered
an improvement over the Intel syntax.
It turns out that I don't actually need this: the motivation was caused
by a typo-ed register field. But I think it still makes a useful
addition.
Mark Wooding [Sun, 18 Aug 2019 01:17:13 +0000 (02:17 +0100)]
base/asm-common.h: Implement the `r' decorator for `MEM' accesses.
I think this was an unintentional omission.
Mark Wooding [Sun, 18 Aug 2019 01:11:55 +0000 (02:11 +0100)]
base/asm-common.h: Hoist the `_DECOR_mem_...' definitions.
In particular, the various `_DECOR_mumble_...' groups go above the
special `..._r' suffix.
Mark Wooding [Sun, 18 Aug 2019 01:09:30 +0000 (02:09 +0100)]
base/asm-common.h: Put `l' suffix on `si', `di', etc. under `CPUFAM_AMD'.
Mark Wooding [Fri, 6 Sep 2019 09:30:13 +0000 (10:30 +0100)]
base/asm-common.h: Add include guards.
Mark Wooding [Sat, 2 Mar 2019 13:11:25 +0000 (13:11 +0000)]
**/*.S: Arrange assembler preambles consistently.
Mark Wooding [Sat, 3 Nov 2018 10:54:40 +0000 (10:54 +0000)]
symm/ocb3.h, symm/ocb3-def.h: Implement the OCB3 auth'ned encryption mode.
Note that there is no PMAC3 corresponding to OCB3, like there is for the
previous two versions. The OCB3 header-processing is not a secure
standalone MAC.
Mark Wooding [Mon, 5 Nov 2018 17:34:41 +0000 (17:34 +0000)]
utils/advmodes: Implement (only) a toy version of OCB2.
I doubt this will ever end up as a high-quality mode implementation in
Catacomb, because it doesn't actually provide authenticity. See
`Cryptanalysis of OCB2' by Akiko Inoue and Kazuhiko Minamatsu,
https://eprint.iacr.org/2018/1040.
This is enough to confirm their result.
* First, choose an arbitrary key and nonce, and encrypt a two-block
message whose first block contains len(0^{128}) = 128; the second
block is arbitrary.
$ ./advmodes ocb2-enc rijndael
00112233445566778899aabbccddeeff 00112233445566778899aabbccddeeff "" 0000000000000000000000000000008000112233445566778899aabbccddeeff
0e6475201e14155a2744eb78f396581c3ffbfcf1d7a2505ef8f5e56b2824f4bb
5973f3fdd62e411b05c9d9d982769bbc
* Ask Python to XOR pieces of message and ciphertext:
>>> import catacomb as C
>>> C.bytes('
00000000000000000000000000000080') ^ C.bytes('
0e6475201e14155a2744eb78f396581c')
bytes('
0e6475201e14155a2744eb78f396589c')
>>> C.bytes('
00112233445566778899aabbccddeeff') ^ C.bytes('
3ffbfcf1d7a2505ef8f5e56b2824f4bb')
bytes('
3feadec293f73629706c4fd0e4f91a44')
* Use the first result as the ciphertext and the second as the MAC.
$ ./advmodes ocb2-dec rijndael
00112233445566778899aabbccddeeff 00112233445566778899aabbccddeeff ""
0e6475201e14155a2744eb78f396589c 3feadec293f73629706c4fd0e4f91a44
c5ecf37c57e1b262c83c0739468037e4
Oops.
Mark Wooding [Fri, 2 Nov 2018 22:15:14 +0000 (22:15 +0000)]
symm/ocb1.h, symm/pmac1.h, ...: Implement PMAC1 and OCB1.
Also bump the required mLib version to 2.3.0, for <mLib/compiler.h>.
Mark Wooding [Wed, 31 Oct 2018 22:59:13 +0000 (22:59 +0000)]
symm/ccm.h, symm/ccm-def.h: Implement the CCM authenticated encryption mode.
This is pretty grim, really.
Mark Wooding [Fri, 2 Nov 2018 00:00:02 +0000 (00:00 +0000)]
symm/gcm.h, symm/gcm-def.h: Implement the GCM authenticated encryption mode.
Mark Wooding [Wed, 31 Oct 2018 16:45:06 +0000 (16:45 +0000)]
symm/eax.h, symm/eax-def.h: Implement the EAX authenticated encryption mode.
Mark Wooding [Wed, 31 Oct 2018 12:05:48 +0000 (12:05 +0000)]
symm/cmac.h, symm/cmac-def.h: Implement the CMAC (OMAC) message auth'n mode.
Also introduce `utils/advmodes' containing toy implementations of
`fancy' blockcipher modes, which is useful as a reference and
playground.
Mark Wooding [Sat, 10 Nov 2018 14:06:17 +0000 (14:06 +0000)]
progs/perftest.c: Add measurement support for AEAD schemes.
Mark Wooding [Fri, 9 Nov 2018 18:45:51 +0000 (18:45 +0000)]
progs/catcrypt.c: Support the use of AEAD schemes.
Mark Wooding [Fri, 9 Nov 2018 18:25:52 +0000 (18:25 +0000)]
symm/latinpoly.c, etc.: AEADs based on Salsa20 and ChaCha with Poly1305.
This is an extension of the scheme specified in RFC7539.
Mark Wooding [Fri, 9 Nov 2018 18:21:34 +0000 (18:21 +0000)]
base/keysz.c: New function to find smallest `key' size larger.
Now that AEAD schemes are (ab)using key-size lists for permitted nonce
lengths, it's useful to ask: what's the smallest acceptable size bigger
than the amount of stuff I want to pack into this nonce? The new
`keysz_pad' function answers this question.
Mark Wooding [Fri, 9 Nov 2018 18:17:42 +0000 (18:17 +0000)]
symm/gaead.h: Introduce a new abstraction for authenticated encryption.
... with additional data.
The build system is aware that these can be constructed from
blockciphers, and there is a table of the things. Alas, there aren't
any implemented yet, so the table is empty. For now, at any rate...
Mark Wooding [Wed, 4 Sep 2019 17:42:32 +0000 (18:42 +0100)]
symm/chacha.c, symm/salsa20.c: Merge the `zerononce' values.
Previously, each file had four separate `zerononce' values, for no good
reason. Consolidate them. (I haven't merged them across the files, to
keep the implementations self-contained.)