catacomb
4 years ago@@@ utils/: Add Pocklington proofs for important prime numbers. mdw/pock
Mark Wooding [Tue, 3 Sep 2019 01:41:21 +0000 (02:41 +0100)]
@@@ utils/: Add Pocklington proofs for important prime numbers.

This is work in progress.  I need to complete the (intensive)
computations for some of the larger primes.

4 years agosymm/chacha.c, symm/salsa20.c: Merge the `zerononce' values.
Mark Wooding [Wed, 4 Sep 2019 17:42:32 +0000 (18:42 +0100)]
symm/chacha.c, symm/salsa20.c: Merge the `zerononce' values.

Previously, each file had four separate `zerononce' values, for no good
reason.  Consolidate them.  (I haven't merged them across the files, to
keep the implementations self-contained.)

4 years agosymm/t/chacha: Add IETF test vector for XChacha20.
Mark Wooding [Thu, 15 Aug 2019 17:16:37 +0000 (18:16 +0100)]
symm/t/chacha: Add IETF test vector for XChacha20.

At least I get the answer right.

4 years agosymm/chacha.c: Set the correct nonce size for `xchachaNN'.
Mark Wooding [Thu, 15 Aug 2019 17:16:02 +0000 (18:16 +0100)]
symm/chacha.c: Set the correct nonce size for `xchachaNN'.

Oops.

5 years agomath/f25519.c: Order 10-bit constants the same as 26-bit constants.
Mark Wooding [Fri, 1 Mar 2019 12:21:38 +0000 (12:21 +0000)]
math/f25519.c: Order 10-bit constants the same as 26-bit constants.

5 years agomath/f25519.c, math/fgoldi.c: Remove some unused constant definitions.
Mark Wooding [Fri, 1 Mar 2019 12:21:16 +0000 (12:21 +0000)]
math/f25519.c, math/fgoldi.c: Remove some unused constant definitions.

5 years agomath/: Implement Grantham's Frobenius (primality) test.
Mark Wooding [Sat, 17 Nov 2018 19:21:43 +0000 (19:21 +0000)]
math/: Implement Grantham's Frobenius (primality) test.

This is a rather heavyweight test which is effective when checking
possibly adversarial numbers.

There are no known composites which pass both this test and the
Miller--Rabin test with witness 2 (although infinitely many are
conjectured to exist); the combination is called the `Baillie--PSW'
test (after Baillie, Pomerance, Selfridge, and Wagstaff).  Modify
`pgen_primep' to use Baillie--PSW.

Since Baillie--PSW is somewhat faster than the many rounds of Miller--
Rabin which `pgen_primep' used to use, celebrate by raising the `keen'
threshold in the `dh-param.c' test.

This work was prompted by the paper `Prime and Prejudice', by Martin
R. Albrecht, Jake Massimo, Kenneth G. Paterson, and Juraj Somorovsky;
though, since Catacomb already used 32 iterations of Miller--Rabin with
random witnesses, I can confidently state that the previous
implementation was inefficient but secure when used with a good
randomness source.

5 years agoMerge branch '2.4.x'
Mark Wooding [Sat, 24 Nov 2018 21:53:58 +0000 (21:53 +0000)]
Merge branch '2.4.x'

* 2.4.x:
  progs/cc-progress.c: Use `fstat' to discover the file size.
  math/mpx-mul4-amd64-sse2.S: Always collect iteration count as 32 bits.
  math/mpx-mul4-amd64-sse2.S: Fix stack-argument offset for 64-bit Windows.
  symm/salsa20-x86ish-sse2.S: Fix typo in 64-bit Windows code.
  symm/desx.c, symm/desx.h (desx_init): Fix documentation.
  symm/t/rijndael256: Add tests for small key sizes.
  progs/cc-kem.c (getkem): Parse the `kdf' spec after bulk crypto.
  progs/..., symm/...: Fix 32-bit right-shift idiom.

5 years agoprogs/catcrypt.1: Rephrase the descriptions of the available lists.
Mark Wooding [Fri, 9 Nov 2018 18:45:16 +0000 (18:45 +0000)]
progs/catcrypt.1: Rephrase the descriptions of the available lists.

5 years agoprogs/catcrypt.1: The default `cipher' depends on the bulk transform.
Mark Wooding [Fri, 9 Nov 2018 18:39:11 +0000 (18:39 +0000)]
progs/catcrypt.1: The default `cipher' depends on the bulk transform.

As does the space of acceptable names.  Refactor the manual a little to
describe this properly.

5 years agoprogs/perftest.c: Report cycle counts per operation where possible.
Mark Wooding [Sat, 10 Nov 2018 14:03:21 +0000 (14:03 +0000)]
progs/perftest.c: Report cycle counts per operation where possible.

This is a much more useful figure to work with.  Use `rdtsc' on x86,
falling back to `perf_event_open' on Linux where available.  On other
platforms, you don't get cycle counts: sorry.

5 years agoprogs/perftest.c: Fix key-size handling.
Mark Wooding [Sat, 10 Nov 2018 13:58:54 +0000 (13:58 +0000)]
progs/perftest.c: Fix key-size handling.

  * Allow a key-size parameter to `enc', because algorithms like
    Rijndael have key-size-dependent performance.  This uses the `-b'
    option, because `-B' is already the buffer size for the inner loop.

  * For consistency, use `-b' for the key size in `ksched' too.

  * Finally, check explicit key sizes for validity rather than just
    rounding off and potentially crashing.

5 years agoprogs/perftest.c: Document the `-n' option for `enc' and `hash'.
Mark Wooding [Sat, 10 Nov 2018 13:55:14 +0000 (13:55 +0000)]
progs/perftest.c: Document the `-n' option for `enc' and `hash'.

5 years agoprogs/perftest.c: Rename `c_start', `c_stop' to `c0', c1'.
Mark Wooding [Sat, 10 Nov 2018 13:47:15 +0000 (13:47 +0000)]
progs/perftest.c: Rename `c_start', `c_stop' to `c0', c1'.

5 years agoprogs/perftest.c: Introduce top-level option for batching.
Mark Wooding [Sat, 10 Nov 2018 13:41:29 +0000 (13:41 +0000)]
progs/perftest.c: Introduce top-level option for batching.

`-kN' runs N iterations of the underlying job between looking at the
clock, without affecting the other statistics.  The main purpose here is
to reduce the impact of the measurement overhead.

5 years agosymm/stub.h.in: Fix include-guard names to be identifier-safe.
Mark Wooding [Fri, 9 Nov 2018 18:06:53 +0000 (18:06 +0000)]
symm/stub.h.in: Fix include-guard names to be identifier-safe.

The header's own include-guard was fixed, but not the guards for the
individual headers.

5 years agosymm/blkc.h (BLKC_SHOW): Capture operand as `const'.
Mark Wooding [Fri, 2 Nov 2018 22:09:50 +0000 (22:09 +0000)]
symm/blkc.h (BLKC_SHOW): Capture operand as `const'.

5 years agobase/asm-common.h: Reverse the order of `SHUF' arguments.
Mark Wooding [Mon, 12 Nov 2018 11:03:05 +0000 (11:03 +0000)]
base/asm-common.h: Reverse the order of `SHUF' arguments.

The original idea was this: since one can change one's view of how the
bits in an XMM register are divided into lanes on a per-instruction
basis, it would make more sense if I took a single consistent view of
how the bits are arranged, with the least significant on the right and
the most significant on the left.  Therefore, I listed the shuffle
indices from left to right, counting from right to left.

This, I now realise, was a mistake.  The thing which finally made this
clear to me was that it makes the order of indices in the `SHUF' macro
be inconsistent with the order of bytes in a table for the SSSE3
`pshufb' instruction, and I can't do anything about that.

So: change the order of the arguments, and track down all uses of this
macro to fix them.  Sorry about that.

To verify that I got them all:

for i in $(git grep -l SHUF); do
  git blame -- $i | grep SHUF
done | less

5 years ago**/.gitignore: Push patterns downwards, and format.
Mark Wooding [Fri, 9 Nov 2018 17:28:47 +0000 (17:28 +0000)]
**/.gitignore: Push patterns downwards, and format.

The top-level `.gitignore' was getting too unwieldy, and subsidiary
`.gitignore' files existed but weren't used much.

Push patterns for specific files down into the appropriate directories.
Also, gather and sort the patterns in a vaguely logical way.

5 years agoprogs/cc-progress.c: Use `fstat' to discover the file size.
Mark Wooding [Sat, 24 Nov 2018 19:06:45 +0000 (19:06 +0000)]
progs/cc-progress.c: Use `fstat' to discover the file size.

And `lseek' to discover the current offset.  Annoyingly, Android only
developed `ftello64' and `fseeko64' in API24, so we can't use these (and
it was a pretty grim circumlocution anyway).  On the other hand, Android
has had `lseek64' forever, and its `fstat' is natively 64-bit; and
there's no portability benefit to using the other functions because
Windows doesn't have them anyway.  (Indeed, `lseek' and `stat' are
ancient Unix, so probably more portable.)

5 years agomath/mpx-mul4-amd64-sse2.S: Always collect iteration count as 32 bits.
Mark Wooding [Fri, 16 Nov 2018 12:51:39 +0000 (12:51 +0000)]
math/mpx-mul4-amd64-sse2.S: Always collect iteration count as 32 bits.

Some ABIs, at least, don't guarantee to zero-extend arguments, and we
use the counter as an address offset.

5 years agomath/mpx-mul4-amd64-sse2.S: Fix stack-argument offset for 64-bit Windows.
Mark Wooding [Fri, 16 Nov 2018 12:49:42 +0000 (12:49 +0000)]
math/mpx-mul4-amd64-sse2.S: Fix stack-argument offset for 64-bit Windows.

I failed to account for either the 160 bytes of saved XMM registers
(because the stupid ABI demands that XMM6--XMM15 be preserved across
calls), or for the daft 32-byte shadow space between the return address
and the stacked arguments.

5 years agosymm/salsa20-x86ish-sse2.S: Fix typo in 64-bit Windows code.
Mark Wooding [Fri, 16 Nov 2018 12:22:27 +0000 (12:22 +0000)]
symm/salsa20-x86ish-sse2.S: Fix typo in 64-bit Windows code.

Goes to show how often I test on Windows. :-(

5 years agosymm/desx.c, symm/desx.h (desx_init): Fix documentation.
Mark Wooding [Fri, 9 Nov 2018 21:46:56 +0000 (21:46 +0000)]
symm/desx.c, symm/desx.h (desx_init): Fix documentation.

The two documentation comments disagreed about the orders of the key
pieces.  The implementation had it right: the DES key comes first,
followed by the whitening keys.  Fix the header, and a stupid typo.

5 years agosymm/t/rijndael256: Add tests for small key sizes.
Mark Wooding [Wed, 31 Oct 2018 13:47:47 +0000 (13:47 +0000)]
symm/t/rijndael256: Add tests for small key sizes.

Commit 388489cbb302cb86ee0fd4927243a24525dfd5ee (released in 2.4.2)
added more round constants so that we give the correct answers for
large-block Rijndael with small keys -- and this works fine for clean
builds.  Unfortunately, Catacomb's build system doesn't regenerate
recomputed tables automatically (and that would anyway be a problem for
cross builds), which means that old working trees will still be building
broken code.

Add some tests so that developers notice and hopefully rebuild the
offending tables.

5 years agoprogs/cc-kem.c (getkem): Parse the `kdf' spec after bulk crypto.
Mark Wooding [Sat, 10 Nov 2018 17:26:43 +0000 (17:26 +0000)]
progs/cc-kem.c (getkem): Parse the `kdf' spec after bulk crypto.

Otherwise the buffer holding the remains of the kemalgspec is clobbered.

5 years agoprogs/..., symm/...: Fix 32-bit right-shift idiom.
Mark Wooding [Tue, 30 Oct 2018 22:05:18 +0000 (22:05 +0000)]
progs/..., symm/...: Fix 32-bit right-shift idiom.

This one has a long and troubled history.  Writing

x >> 32

is undefined behaviour if x is only 32 bits wide.  On the other hand, if
it's /not/, then this is necessary to get hold of the upper bits.

The obvious escape plan is to write

(x >> 16) >> 16

(the parentheses are unfortunately necessary), but some Microsoft
compilers managed do bungle compiling this: they merged the two shifts
together and then decided that a shift by 32 places was a no-op.

So I wrote

((x&~MASK32) >> 16) >> 16

which stood for many years.  Unfortunately this is really wrong too: if
x is wider than 32 bits, that's nice, but MASK32 /isn't/ necessarily, so
~MASK32 is all-bits zero and the high bits of x are just lost.

Fix this by casting MASK32 to the-type-of-x before inverting it.

Ugh.

5 years agomath/mpx-mul4-*-sse2.S: Fix commentary notation.
Mark Wooding [Sat, 27 Oct 2018 10:54:43 +0000 (11:54 +0100)]
math/mpx-mul4-*-sse2.S: Fix commentary notation.

Write a `;' between the two halves of an XMM register to emphasize when
we're thinking of it as two 64-bit lanes or four 32-bit lanes.

5 years agomath/mpx-mul4-*-sse2.S (squash): We don't care about the top half of c3 here.
Mark Wooding [Sat, 27 Oct 2018 09:43:24 +0000 (10:43 +0100)]
math/mpx-mul4-*-sse2.S (squash): We don't care about the top half of c3 here.

The previous version of the comment erroneously claimed that the top
half of c3 held y_1; in fact it holds y_2, but we'll clobber it anyway
because the objective is to carry up into y_1, so mark it as
don't-care (like lo).

5 years ago(x86 asm): Zero the high parts of the ?MM registers if available.
Mark Wooding [Thu, 23 Aug 2018 04:13:55 +0000 (05:13 +0100)]
(x86 asm): Zero the high parts of the ?MM registers if available.

There's a performance penalty to trying to preserve the upper parts of
the SSE/AVX vector registers, and it's pointless because we don't need
to preserve them.  (Earlier AVX-capable processors would carefully snip
off the upper parts of the registers and put them in a box, and then
glue them back on when they were wanted, which isn't so bad.  Later
processors instead just track the upper part of the register as an
additional operand, which leads to unnecessary latency.)

Add AVX-specific entry points to the necessary routines, and call them
when AVX is detected.  This would all be easier if Intel had chosen
`vzeroupper' from an existing `nop' encoding space.

5 years agoprogs/catsign.c: Don't gratuitously try to open a temporary file.
Mark Wooding [Mon, 13 Aug 2018 20:30:07 +0000 (21:30 +0100)]
progs/catsign.c: Don't gratuitously try to open a temporary file.

The `merry dance' where we open the necessary output files was bungled,
which caused a temporary file to be opened unless an explicit output
file was requested without buffering.

5 years agobase/asm-common.h: Fix the description comment at the top of the file.
Mark Wooding [Mon, 30 Jul 2018 11:24:04 +0000 (12:24 +0100)]
base/asm-common.h: Fix the description comment at the top of the file.

5 years agoAdd support for fancy AArch64 assembler code.
Mark Wooding [Fri, 22 Jun 2018 09:20:44 +0000 (10:20 +0100)]
Add support for fancy AArch64 assembler code.

It's a fun instruction set, and maybe this will improve my crypto on
Raspberry Pi 3.

5 years agoconfigure.ac: Don't be so picky about identifying ARM variants.
Mark Wooding [Fri, 22 Jun 2018 09:21:10 +0000 (10:21 +0100)]
configure.ac: Don't be so picky about identifying ARM variants.

They're all pretty much the same, really.  If I had some good way to
identify big-endian ARM targets, I'd try that, but I don't know how to
do that right now.

5 years agosymm/salsa20-arm-neon.S: Remove extra copy of the state-layout diagram.
Mark Wooding [Fri, 22 Jun 2018 09:21:55 +0000 (10:21 +0100)]
symm/salsa20-arm-neon.S: Remove extra copy of the state-layout diagram.

I think this is leftover debris from when I was first figuring out this
layout, but it certainly doesn't belong here.

5 years agosymm/rijndael-arm-crypto.S: Use `vmov' rather than `veor' to zero-init.
Mark Wooding [Sat, 23 Jun 2018 03:17:13 +0000 (04:17 +0100)]
symm/rijndael-arm-crypto.S: Use `vmov' rather than `veor' to zero-init.

I think I'd be doing too much x86 coding when I came to do this.

5 years agosymm/rijndael-arm-crypto.S: Delete a redundant instruction.
Mark Wooding [Fri, 22 Jun 2018 09:21:32 +0000 (10:21 +0100)]
symm/rijndael-arm-crypto.S: Delete a redundant instruction.

We've already loaded the previous-cycle word by the time we get to `1:'
here, so we don't need to do it again.  The pointers don't move, so this
was harmless but pointless.

5 years agomath/mpx.c (mpx_lsr): Fix pointer out-of-bounds bug.
Mark Wooding [Fri, 22 Jun 2018 11:45:22 +0000 (12:45 +0100)]
math/mpx.c (mpx_lsr): Fix pointer out-of-bounds bug.

If `n' is huge, and `av' is near the top of memory (e.g., in the top
quarter, if we're using 32-bit digits) then `av + n' wraps around, and
is consequently less than `avl', leading to all sorts of unfortunate
behaviour.

Noticed under `qemu-arm' on stretch, but generally applicable.

5 years agobuild: Configure `pkg-config' correctly for static linking.
Mark Wooding [Thu, 14 Jun 2018 10:02:09 +0000 (11:02 +0100)]
build: Configure `pkg-config' correctly for static linking.

5 years agoRelease 2.4.2. 2.4.2
Mark Wooding [Tue, 12 Jun 2018 00:16:17 +0000 (01:16 +0100)]
Release 2.4.2.

5 years agodebian/control: Add build-depend on valgrind to make `ct-test.c' properly.
Mark Wooding [Tue, 12 Jun 2018 00:20:30 +0000 (01:20 +0100)]
debian/control: Add build-depend on valgrind to make `ct-test.c' properly.

It seems wrong to ship the proper package with this stubbed out.

5 years agosymm/rijndael-mktab.c: Produce more round constants.
Mark Wooding [Fri, 5 Jan 2018 04:28:56 +0000 (04:28 +0000)]
symm/rijndael-mktab.c: Produce more round constants.

We don't have enough for large blocks and/or small keys.  We need 15*8 =
120 words of keys for 256-bit Rijndael, and if we have only a 32-bit key
then we'll need 120 round constants.  So generate them all.

5 years agosymm/rijndael-mktab.c: Don't hardwire output `rcon' table size.
Mark Wooding [Fri, 5 Jan 2018 04:27:14 +0000 (04:27 +0000)]
symm/rijndael-mktab.c: Don't hardwire output `rcon' table size.

We output `sizeof(rc)' entries, so that's what we should put in the
array length.

5 years agosymm/sha{,256,512}.c: Fold message-scheduling in with state update.
Mark Wooding [Sun, 28 May 2017 18:03:08 +0000 (19:03 +0100)]
symm/sha{,256,512}.c: Fold message-scheduling in with state update.

Previously, I implemented these compression functions in two steps:
first performing the message expansion, and then applying the state
update.

Instead, save temporary space by interleaving the two steps.  This also
results in a small performance improvement.

5 years agomath/limlee.c: Fiddle with the large-prime heuristics.
Mark Wooding [Sun, 28 May 2017 08:25:19 +0000 (09:25 +0100)]
math/limlee.c: Fiddle with the large-prime heuristics.

Experimentation shows me that large primes just don't last very long
with the old heuristic.  Switch to another one that's more tolerant but
still weeds out no-hopers.

5 years agosymm/{chacha,salsa20}.h: Mark the cipher classes as `extern'.
Mark Wooding [Mon, 11 Jun 2018 15:36:33 +0000 (16:36 +0100)]
symm/{chacha,salsa20}.h: Mark the cipher classes as `extern'.

Saved by vague linkage, but this is not good.

5 years agoutils/split-pieces: Introduce unsigned quick fields.
Mark Wooding [Mon, 21 May 2018 16:41:57 +0000 (17:41 +0100)]
utils/split-pieces: Introduce unsigned quick fields.

There aren't any in Catacomb at the moment -- and I don't plan to add
any -- but other code uses them so it's useful to be able to work with
them.

5 years agoutils/split-pieces (QfConvert): Split out a subclass.
Mark Wooding [Mon, 21 May 2018 16:40:29 +0000 (17:40 +0100)]
utils/split-pieces (QfConvert): Split out a subclass.

Subclasses must define a boolean `SIGNEDP', and implement `fmt(n)' to
format an individual piece for output.

The new subclass, `SignedQfConvert', is indeed signed, and formats using
`str'; so, again, nothing has actually changed.

5 years agoutils/split-pieces (QfConvert): Rename to `BaseQfConvert'.
Mark Wooding [Mon, 21 May 2018 16:38:23 +0000 (17:38 +0100)]
utils/split-pieces (QfConvert): Rename to `BaseQfConvert'.

Anyone might thing I was about to subclass it.

5 years agoutils/split-pieces (QfConvert): Construct an instance of the right class.
Mark Wooding [Mon, 21 May 2018 16:35:55 +0000 (17:35 +0100)]
utils/split-pieces (QfConvert): Construct an instance of the right class.

Of course, `QfConvert' is always the right class at the moment, but it's
the principle of the thing.

5 years agoprogs/catsign.c; Verify equality of keys more directly.
Mark Wooding [Sun, 3 Jun 2018 09:30:49 +0000 (10:30 +0100)]
progs/catsign.c; Verify equality of keys more directly.

Rather than comparing the two keys' `id' slots, just compare the
pointers.  It's not like we got them from different keyrings or
anything.  This makes it clear that we're checking that we really have
the /same/ key, found by two different paths.

Fortunately, this isn't a security problem: the code in `key/key-io.c'
won't allow two keys with the same `id' value to exist in the same
keyring.  This change therefore doesn't have any observable effect.
But, seeing as I just had a panic regarding a potential security hole in
`tripe-keys', it's as well to make it clear what's actually going on.

5 years agoconfigure.ac: Recognize `androideabi' as a thing we can support.
Mark Wooding [Sun, 20 May 2018 23:57:10 +0000 (00:57 +0100)]
configure.ac: Recognize `androideabi' as a thing we can support.

There's no significant difference in calling conventions, so this is
safe.

5 years agoconfigure.ac: Hack around Termux syslog weirdness.
Mark Wooding [Sat, 19 May 2018 23:46:50 +0000 (00:46 +0100)]
configure.ac: Hack around Termux syslog weirdness.

Termux's <syslog.h> has weird macros to redirect to Android's logcat
machinery, but these need a separate library to be linked in.  Notice
this weirdness and cope.

6 years agosymm/poly1305.c: Fix daft typo in banner comment.
Mark Wooding [Tue, 12 Dec 2017 20:21:39 +0000 (20:21 +0000)]
symm/poly1305.c: Fix daft typo in banner comment.

6 years agoutils/split-pieces: Report the correct command-line syntax.
Mark Wooding [Thu, 19 Oct 2017 23:36:31 +0000 (00:36 +0100)]
utils/split-pieces: Report the correct command-line syntax.

6 years agoutils/curve25519.sage: Remove redundant coercion to field k.
Mark Wooding [Thu, 19 Oct 2017 23:35:57 +0000 (00:35 +0100)]
utils/curve25519.sage: Remove redundant coercion to field k.

6 years agopub/t/x*: Rearrange the Monte-Carlo tests.
Mark Wooding [Thu, 19 Oct 2017 18:35:23 +0000 (19:35 +0100)]
pub/t/x*: Rearrange the Monte-Carlo tests.

  * Insert more intermediate values, specifically at every power of 10.

  * Rather than calculating the whole thing from scratch each time,
    tests other than the first one continue from the previous
    state (which I had to calculate the hard way and enter into the
    test-vector files).  The total iteration count and final results
    still match the RFC.

  * Split the very slow high-iteration-count tests into a separate file,
    where they can be run discretionally without having to edit source
    files.  Arrange to distribute these new files.

6 years agoutils/curve25519.sage: Remove second definition of `A0'.
Mark Wooding [Thu, 19 Oct 2017 18:03:55 +0000 (19:03 +0100)]
utils/curve25519.sage: Remove second definition of `A0'.

6 years agopub/ed{25519,448}.c: Double by adding self, rather than multiplying by two.
Mark Wooding [Mon, 2 Oct 2017 12:25:39 +0000 (13:25 +0100)]
pub/ed{25519,448}.c: Double by adding self, rather than multiplying by two.

Saves a reduction pass.

6 years agobase/ct-test.in: Don't call Valgrind macros unless we found the headers.
Mark Wooding [Mon, 2 Oct 2017 12:47:24 +0000 (13:47 +0100)]
base/ct-test.in: Don't call Valgrind macros unless we found the headers.

Oops.

6 years agoStart verifying that code which should be constant-time really is.
Mark Wooding [Sun, 1 Oct 2017 02:01:02 +0000 (03:01 +0100)]
Start verifying that code which should be constant-time really is.

Introduce utilities `ct_poison' and `ct_remedy' to control Valgrind's
uninitialized-data checking, based on Adam Langley's `ctgrind' idea
described in https://www.imperialviolet.org/2010/04/01/ctgrind.html.
Use these in the tests for fancy-bignum algorithms, such as Poly1305 and
X25519.

There's currently no automated machinery for running these tests.  This
is a little tricky:

  * Some of the tests will need to be skipped because they just take too
    long if they run under Valgrind.

  * The test programs are actually libtool wrappers, which are bash(1)
    scripts.  Firstly, this means we get lots of spurious errors about
    bash; and secondly, the actual test program doesn't end up being
    checked by Valgrind at all.

So it's just manual for now.

6 years agosymm/{salsa20,chacha}.c (..._rand): Don't crash if nonce pointer is null.
Mark Wooding [Sat, 30 Sep 2017 01:43:47 +0000 (02:43 +0100)]
symm/{salsa20,chacha}.c (..._rand): Don't crash if nonce pointer is null.

Oops.

6 years agomath/scaf.c, etc.: Only need 3*NPIECE words of scratch space.
Mark Wooding [Fri, 29 Sep 2017 21:25:32 +0000 (22:25 +0100)]
math/scaf.c, etc.: Only need 3*NPIECE words of scratch space.

The extra one would have been necessary because we're calculating the
high half of a product of two (NPIECE + 1)-piece numbers, but in fact we
only need the low NPIECE pieces of the result.

Fix the commentary and the callers.

6 years agomath/scaf.c: Fix trivial typo.
Mark Wooding [Fri, 29 Sep 2017 21:11:32 +0000 (22:11 +0100)]
math/scaf.c: Fix trivial typo.

6 years agodebian/copyright: Fix dates again.
Mark Wooding [Tue, 15 Aug 2017 13:22:03 +0000 (14:22 +0100)]
debian/copyright: Fix dates again.

Hopefully properly this time.

6 years ago.mailmap: Add file to fix CVS-ish names in history.
Mark Wooding [Tue, 15 Aug 2017 13:21:47 +0000 (14:21 +0100)]
.mailmap: Add file to fix CVS-ish names in history.

6 years agovars.am: Experimental hack for Emacs `flymake'.
Mark Wooding [Mon, 14 Aug 2017 12:38:06 +0000 (13:38 +0100)]
vars.am: Experimental hack for Emacs `flymake'.

I'm not sure whether this will stay here, but it seems harmless enough.

6 years agoRevert "debian: Update for Debhelper 10."
Mark Wooding [Mon, 14 Aug 2017 12:28:57 +0000 (13:28 +0100)]
Revert "debian: Update for Debhelper 10."

This reverts commit aef6942f4a28e2d422fc33709a08116f51406fd1.

6 years agorand/noise.c, progs/pixie.c: Don't ignore return codes from setuid(2) etc.
Mark Wooding [Tue, 8 Aug 2017 22:41:44 +0000 (23:41 +0100)]
rand/noise.c, progs/pixie.c: Don't ignore return codes from setuid(2) etc.

Legitimate warnings, I think, but not worth doing anything complicated
about.

6 years agoprogs/rspit.c: Cope with large files.
Mark Wooding [Tue, 8 Aug 2017 22:13:51 +0000 (23:13 +0100)]
progs/rspit.c: Cope with large files.

Missed this in my earlier `_FILE_OFFSET_BITS' pass.  The calculations
for the progress display and so on are all done in terms of bignums
already, so there's no worries with the arithmetic.

6 years agobase/keysz.c: Fix bogus pointer dereference on wide-arg key size lists.
Mark Wooding [Sat, 29 Jul 2017 00:02:46 +0000 (01:02 +0100)]
base/keysz.c: Fix bogus pointer dereference on wide-arg key size lists.

I must have been seriously short on brain that day.

6 years agosymm/keccak1600.c (keccak1600_p): Minor layout tweak.
Mark Wooding [Mon, 17 Jul 2017 00:00:16 +0000 (01:00 +0100)]
symm/keccak1600.c (keccak1600_p): Minor layout tweak.

Align the final `keccak1600_round' calls to show the symmetry and
difference better.

6 years agodebian/copyright: Fix copyright dates.
Mark Wooding [Fri, 7 Jul 2017 09:53:46 +0000 (10:53 +0100)]
debian/copyright: Fix copyright dates.

6 years agodebian: Update for Debhelper 10.
Mark Wooding [Thu, 6 Jul 2017 10:15:53 +0000 (11:15 +0100)]
debian: Update for Debhelper 10.

6 years agodebian/rules: Capture common options in a makefile variable.
Mark Wooding [Thu, 6 Jul 2017 10:15:05 +0000 (11:15 +0100)]
debian/rules: Capture common options in a makefile variable.

6 years agodebian/rules: Add a comment explaining why we do weird test things.
Mark Wooding [Thu, 6 Jul 2017 10:14:05 +0000 (11:14 +0100)]
debian/rules: Add a comment explaining why we do weird test things.

6 years agodebian/control: Use ${binary:Version} instead of ${Source-Version}.
Mark Wooding [Thu, 6 Jul 2017 10:10:33 +0000 (11:10 +0100)]
debian/control: Use ${binary:Version} instead of ${Source-Version}.

6 years agodebian/copyright: Convert to machine-readable format.
Mark Wooding [Thu, 6 Jul 2017 10:09:11 +0000 (11:09 +0100)]
debian/copyright: Convert to machine-readable format.

6 years agodebian: Multi-arch support.
Mark Wooding [Fri, 14 Jun 2013 19:43:15 +0000 (20:43 +0100)]
debian: Multi-arch support.

6 years agoconfigure.ac: Check for some brain damage from Clang's assembler.
Mark Wooding [Wed, 5 Jul 2017 21:09:59 +0000 (22:09 +0100)]
configure.ac: Check for some brain damage from Clang's assembler.

It doesn't understand `.arch' or the `adcd' instruction.  I'm damned if
I'm writing `dword ptr' everywhere, so Clang users will have to figure
out some way to use Gas if they want the assembler code.

6 years agoconfigure.ac: Delay checking the assembler until we know the target CPU.
Mark Wooding [Wed, 5 Jul 2017 21:08:11 +0000 (22:08 +0100)]
configure.ac: Delay checking the assembler until we know the target CPU.

It turns out that assemblers are deficient in target-specific ways, so
we have to figure out what the target is like before we can probe for
the brokenness.  Reorder things so that this is possible.  No functional
change.

6 years agoconfigure.ac: Abstract out common pattern in CPU/ABI variable defs.
Mark Wooding [Wed, 5 Jul 2017 20:38:41 +0000 (21:38 +0100)]
configure.ac: Abstract out common pattern in CPU/ABI variable defs.

The new combined macro is really ugly, but it's probably better than two
copies of the same thing.  No functional change.

6 years agomath/mpint.h: Add Clang warning-muffling.
Mark Wooding [Wed, 5 Jul 2017 20:32:14 +0000 (21:32 +0100)]
math/mpint.h: Add Clang warning-muffling.

Otherwise the compile is very noisy.

6 years agobase/dispatch.c: Fix operand constraints in `setflags'.
Mark Wooding [Wed, 5 Jul 2017 20:30:20 +0000 (21:30 +0100)]
base/dispatch.c: Fix operand constraints in `setflags'.

It wasn't correct to use `g' here.  Clang legitimately used sp-relative
memory locations, which broke really badly because the stack pointer
moves during the code sequence.  Force the operands into registers to
avoid this problem.

6 years agomath/strongprime.c: Muffle an irritating style warning from Clang.
Mark Wooding [Wed, 5 Jul 2017 20:29:31 +0000 (21:29 +0100)]
math/strongprime.c: Muffle an irritating style warning from Clang.

6 years agoprogs/catsign.c: Mark the various `choke' functions as `NORETURN'.
Mark Wooding [Wed, 5 Jul 2017 20:27:30 +0000 (21:27 +0100)]
progs/catsign.c: Mark the various `choke' functions as `NORETURN'.

If I don't do this, then Clang complains (otherwise correctly) that `y'
might be used uninitialized.

6 years agoMerge branch '2.3.x'
Mark Wooding [Tue, 4 Jul 2017 23:51:36 +0000 (00:51 +0100)]
Merge branch '2.3.x'

* 2.3.x:
  symm/hmac-def.h: Fix the NMAC and SSLMAC classes.

Conflicts:
symm/hmac-def.h

6 years agovars.am, math/Makefile.am: Tweak `silent-rules' machinery.
Mark Wooding [Tue, 4 Jul 2017 17:53:21 +0000 (18:53 +0100)]
vars.am, math/Makefile.am: Tweak `silent-rules' machinery.

Since Automake 1.11, the advice for setting up custom silent-rules
recipes has changed, so use the new machinery.

Also, I'm no longer mainly working on wheezy, and Automake has made the
operation field two spaces wider while I wasn't looking, so make the
output line up properly.

This means that Catacomb now requires Automake 1.11.2 or later to build
from the Git tree.

6 years agosymm/sha3.c: Attach the correct operations to the `shake256' cipher.
Mark Wooding [Tue, 4 Jul 2017 16:54:50 +0000 (17:54 +0100)]
symm/sha3.c: Attach the correct operations to the `shake256' cipher.

Rather embarrassing.  Thanks to GCC 6 for pointing out that
`shake256_gcops' was unused.

6 years agosymm/twofish.c: Break a line to make the code clearer.
Mark Wooding [Tue, 4 Jul 2017 16:47:54 +0000 (17:47 +0100)]
symm/twofish.c: Break a line to make the code clearer.

In retrospect, squashing all of that onto one line was an error.  Thanks
to GCC 6 for pointing this out.

6 years agosymm/hmac-def.h: Fix the NMAC and SSLMAC classes. 2.3.x
Mark Wooding [Tue, 4 Jul 2017 16:55:55 +0000 (17:55 +0100)]
symm/hmac-def.h: Fix the NMAC and SSLMAC classes.

Thanks to GCC 6 for pointing out that many of the necessary bits of
functionality were hanging around unused.  (Why did earlier versions not
spot this?)

It looks like they never worked properly.  I hereby deprecate them, and
intend to remove them in Catacomb 2.5.

6 years agoRelease 2.4.1. 2.4.1
Mark Wooding [Sun, 28 May 2017 18:03:08 +0000 (19:03 +0100)]
Release 2.4.1.

6 years agoMerge branch '2.3.x'
Mark Wooding [Sun, 28 May 2017 18:03:08 +0000 (19:03 +0100)]
Merge branch '2.3.x'

* 2.3.x:
  Release 2.3.2.
  math/mpx.c: Fix two's-complement storing.

Conflicts:
debian/changelog

6 years agoRelease 2.3.2. 2.3.2
Mark Wooding [Sun, 28 May 2017 18:03:08 +0000 (19:03 +0100)]
Release 2.3.2.

6 years agomath/mpx.c: Fix two's-complement storing.
Mark Wooding [Sun, 28 May 2017 18:03:08 +0000 (19:03 +0100)]
math/mpx.c: Fix two's-complement storing.

Oh, dear.  This was a bit wrong.

  * The internal representation, in terms of `mpw' vectors, is always
    nonnegative.  Remove the bogus sign-extension machinery for
    `mpx_load*2cn'.

  * The logic for sign-extending octet vectors in `mpx_store*2cn' was
    the wrong way round.  Fix it.

  * Rather than sign-extending `mpw' vectors, it's necessary to apply a
    correction when we reach the end of an octet vector in
    `mpx_load*2cn'.  Introduce a new argument to `MPX_LOADSTORE' to
    carry the necessary correction logic, and use it.

  * The test functions used a single `mpw' vector length for both
    positive and negative values, which meant that the logic for sign-
    extending octet strings on output wasn't exercised.  Fix the test:
    so that it now does two passes, forcing both sign-extension on
    output and zero-extension on input.

6 years agosymm/{chacha,salsa20}-x86ish-sse2.S: Fix typo in commentary.
Mark Wooding [Tue, 23 May 2017 10:48:46 +0000 (11:48 +0100)]
symm/{chacha,salsa20}-x86ish-sse2.S: Fix typo in commentary.

6 years agokey.1: Document `tag -r' properly.
Mark Wooding [Tue, 23 May 2017 10:48:22 +0000 (11:48 +0100)]
key.1: Document `tag -r' properly.

6 years agoRelease 2.4.0.1. 2.4.0.1
Mark Wooding [Sun, 14 May 2017 20:05:43 +0000 (21:05 +0100)]
Release 2.4.0.1.

6 years agosymm/rijndael-arm-crypto.S: Fix `pushreg'/`popreg' syntax.
Mark Wooding [Sun, 14 May 2017 19:39:45 +0000 (20:39 +0100)]
symm/rijndael-arm-crypto.S: Fix `pushreg'/`popreg' syntax.

My test build didn't catch this because my assembler is too old.  So, it's
brown-paper-bag time once again.

6 years agoRelease 2.4.0. 2.4.0
Mark Wooding [Sun, 14 May 2017 15:08:33 +0000 (16:08 +0100)]
Release 2.4.0.