ChangeLog 414 KB
Newer Older
1
2
2020-04-12  Niels Möller  <nisse@lysator.liu.se>

3
4
5
	* Makefile.in (DISTFILES): Reorder to ensure that generated des
	headers can't be older than desdata.stamp.

6
7
8
	* testsuite/ed448-test.c: Define _GNU_SOURCE, for getline with gcc
	-std=c89.

9
10
11
12
13
14
2020-04-06  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac (LIBHOGWEED_MAJOR): Increase hogweed version number
	to 6.0, at request of Gnutls team.
	(LIBHOGWEED_MINOR): Reset to zero.

15
16
17
18
19
20
2020-04-01  Niels Möller  <nisse@lysator.liu.se>

	* config.guess: Update to 2020-01-01 version, from savannah's
	config.git.
	* config.sub: Likewise.

21
22
2020-03-31  Niels Möller  <nisse@lysator.liu.se>

23
24
25
	* aclocal.m4 (LSH_TYPE_SOCKLEN_T, LSH_CHECK_KRB_LIB, LSH_LIB_ARGP)
	(LSH_MAKE_CONDITIONAL): Delete unused macros.

26
27
28
29
30
31
32
33
34
35
	* config.make.in (abs_top_builddir, TEST_SHLIB_DIR): New variables.

	* run-tests: Check TEST_SHLIB_DIR, and set up LD_LIBRARY_PATH and
	related member variables.

	* testsuite/Makefile.in (check): Pass only TEST_SHLIB_DIR
	to the run-tests script, and leave setting of LD_LIBRARY_PATH and
	related variables to that script.
	* examples/Makefile.in (check): Likewise.

36
37
38
39
40
41
2020-03-26  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Bump package version to 3.6.
	(LIBNETTLE_MINOR): Bump minor number, now 7.1.
	(LIBHOGWEED_MINOR): Bump minor numbers, now 5.1

42
43
44
45
46
47
48
49
50
51
2020-03-14  Niels Möller  <nisse@lysator.liu.se>

	From H.J. Lu:
	* configure.ac (ASM_X86_ENDBR)
	(ASM_X86_MARK_CETASM_X86_MARK_CET_ALIGN): New substituted
	variables.
	* config.m4.in: Substituted here. Add ASM_X86_MARK_CET to
	diversion inserted at end of assembly files.
	* asm.m4 (PROLOGUE): Add ASM_X86_ENDBR at entry point.

Niels Möller's avatar
Niels Möller committed
52
53
54
55
56
57
58
59
60
61
62
63
64
2020-03-09  Niels Möller  <nisse@lysator.liu.se>

	From Daiki Ueno:
	* chacha-crypt.c (chacha_crypt32): New function.
	* chacha-set-nonce.c (chacha_set_counter, chacha_set_counter32):
	New functions.
	* chacha.h (CHACHA_COUNTER_SIZE, CHACHA_COUNTER32_SIZE): New constants.
	* chacha-poly1305.c (chacha_poly1305_encrypt)
	(chacha_poly1305_decrypt): Use chacha_crypt32.
	* testsuite/chacha-test.c: Update tests to use new functions.
	* nettle.texinfo: Document new chacha functions, and update
	out-of-date chacha-poly1305 documentation.

Niels Möller's avatar
Niels Möller committed
65
66
67
68
69
70
71
72
2020-03-08  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* cmac-des3-meta.c (nettle_cmac_des): New file, moving definition
	from...
	* testsuite/cmac-test.c: ... old location.
	* nettle-meta.h (nettle_cmac_des): Declare it.

Niels Möller's avatar
Niels Möller committed
73
74
75
76
77
78
79
80
81
2020-02-15  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* ecc-internal.h (ecc_modq_add, ecc_modq_mul, ecc_modp_sqr)
	(ecc_modp_mul, ecc_mod_submul_1, ecc_modp_mul_1, ecc_modp_add)
	(ecc_modp_sub): Deleted macros. Updated callers to use respective
	functions instead.
	(ecc_modp_addmul_1): Delete unused macro.

82
83
2020-02-09  Niels Möller  <nisse@lysator.liu.se>

84
85
86
87
	Addition of struct nettle_mac based on patches by Daiki Ueno.
	* nettle-meta-macs.c (nettle_get_macs): New file, new function.
	* testsuite/meta-mac-test.c: New test.

88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
	* nettle-meta.h (_NETTLE_HMAC): New macro.
	(nettle_hmac_md5, nettle_hmac_ripemd160, nettle_hmac_sha1)
	(nettle_hmac_sha224, nettle_hmac_sha256, nettle_hmac_sha384)
	(nettle_hmac_sha512): Declare.
	(struct nettle_mac): New public struct,
	* testsuite/testutils.h: ...moved from this file.

	* hmac-md5-meta.c: New file.
	* hmac-ripemd160-meta.c: Likewise.
	* hmac-sha1-meta.c: Likewise.
	* hmac-sha224-meta.c: Likewise.
	* hmac-sha256-meta.c: Likewise.
	* hmac-sha384-meta.c: Likewise.
	* hmac-sha512-meta.c: Likewise.

	* Makefile.in (nettle_SOURCES): Add new files.

	* testsuite/testutils.h (_NETTLE_HMAC): Delete unused version of
	this macro.
	* testsuite/testutils.c (test_mac): Allow testing with smaller
	digest size.
	* testsuite/hmac-test.c (test_main): Use test_mac for tests using
	key size == digest size.

112
113
114
115
116
	* testsuite/cmac-test.c (nettle_cmac_aes128, nettle_cmac_aes256):
	Moved to...
	* cmac-aes128-meta.c: New file.
	* cmac-aes256-meta.c: New file.

117
118
119
	* nettle-meta.h (struct nettle_mac): New public struct,
	* testsuite/testutils.h: ...moved from this file.

Niels Möller's avatar
Niels Möller committed
120
121
122
123
124
2020-02-06  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* gost28147.h: Deleted, move declarations to gost28147-internal.h.

125
126
127
128
129
130
131
132
133
2020-02-05  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: On Solaris, link shared libraries with --shared
	rather than -G. For gcc, --shared is the proper way. For Solaris'
	proprietary cc, according to docs, it accepts --shared as an alias
	for -G since Oracle Solaris Studio 12.4, and it was made more gcc
	compatible in later versions. Since 12.4 was released in 2014,
	don't attempt to cater for older versions.

134
135
2020-01-26  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
	* ecc-internal.h (struct ecc_curve): Delete g, the curve
	generator, since it was used only by tests. Update all curve
	instances.

	* eccdata.c (output_curve): Delete output of ecc_g.
	(output_point): Delete name argument, and update callers.

	* testsuite/testutils.c (ecc_ref): Table of reference points moved
	out of test_ecc_mul_a. Add generator to the list of points.
	(test_ecc_mul_a): Use ecc_ref table also for the n == 1 case.
	(test_ecc_ga, test_ecc_get_g, test_ecc_get_ga): New functions,
	using the tabulated generator.

	* testsuite/ecc-add-test.c: Use test_ecc_get_g, instead of
	accessing ecc->g.
	* testsuite/ecc-dup-test.c: Likewise.
	* testsuite/ecc-mul-a-test.c: Use test_ecc_get_ga and test_ecc_ga.
	Delete special case for n == 1.
	* testsuite/ecc-mul-g-test.c: Use test_ecc_ga.

Niels Möller's avatar
Niels Möller committed
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
	Support for GOST DSA, contributed by Dmitry Baryshkov.
	* gostdsa-verify.c (gostdsa_verify): New file and function.
	* gostdsa-sign.c (gostdsa_sign): New file and function.
	* ecc-gostdsa-verify.c (ecdsa_in_range, ecc_gostdsa_verify_itch)
	(ecc_gostdsa_verify): New file and functions.
	* ecc-gostdsa-sign.c (ecc_gostdsa_sign_itch, ecc_gostdsa_sign):
	New file and functions.
	* ecc-internal.h (ECC_GOSTDSA_SIGN_ITCH): New macro.
	* ecc-hash.c (gost_hash): New function.
	* testsuite/gostdsa-verify-test.c: New test.
	* testsuite/gostdsa-sign-test.c: New test.
	* testsuite/gostdsa-keygen-test.c: New test.
	* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Add new tests.

	Support for GOST gc256b and gc512a curves, contributed by Dmitry
	Baryshkov.
	* eccdata.c (ecc_curve_init): Add parameters for gost_gc256b and
	gost_gc512a.
	* ecc-gost-gc256b.c: New file, define _nettle_gost_gc256b.
	* ecc-gost-gc512a.c: New file, define _nettle_gost_gc512a.
	* Makefile.in: Add rules to generate ecc-gost-gc256b.h and
	ecc-gost-gc512a.h.
	(hogweed_SOURCES): Add ecc-gost-gc256b.c ecc-gost-gc512a.c.
	* examples/ecc-benchmark.c (curves): Add to list.
	* testsuite/testutils.c (ecc_curves): Add to list.
	(test_ecc_mul_a): Reference points for new curves.

183
184
	* NEWS: Started on entries for Nettle-3.6.

185
186
187
188
189
2020-01-25  Niels Möller  <nisse@lysator.liu.se>

	* examples/hogweed-benchmark.c (bench_curve_init): Pass correct
	sizes to knuth_lfib_random. Patch contributed by Dmitry Baryshkov.

190
191
2020-01-15  Niels Möller  <nisse@lysator.liu.se>

192
193
194
195
196
197
198
199
200
201
202
203
204
205
	* Makefile.in: Replace suffix rules by pattern rules. Move .asm
	rule above .c rule, since now the order of rules in the Makefile
	matters, rather than the order in the .SUFFIXES list.
	(aesdata, desdata, twofishdata, shadata, gcmdata, eccparams):
	Individual rules replaced by a pattern rule.
	(eccdata): Add explicit dependencies, to complement the pattern
	rule.
	* examples/Makefile.in: Replace suffix rules by pattern rules.
	* testsuite/Makefile.in: Likewise.
	* tools/Makefile.in: Likewise.

	* config.make.in: Empty .SUFFIXES, to not accidentally use any
	suffix rules.

206
207
208
209
210
211
212
213
214
215
	* aclocal.m4 (DEP_INCLUDE): Delete substituted variable.

	* Makefile.in: Use the GNU make directive -include to include
	dependency .d files. Delete dependency files on make clean.
	* examples/Makefile.in: Likewise.
	* testsuite/Makefile.in: Likewise. Also use $(OBJEXT) properly.
	* tools/Makefile.in: Likewise.

	* configure.ac (dummy-dep-files): Delete these config commands.

216
217
218
219
220
221
222
223
224
225
2020-01-10  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Eremin-Solenikov: Consistently rename ecc files and
	internal functions to include curve name rather than just number
	of bits. E.g.,
	* ecc-256.c (nettle_ecc_256_redc): File and function renamed to...
	* ecc-secp256r1.c (_nettle_ecc_256_redc): ... new names.
	* eccdata.c (ecc_curve_init, main): Take curve name as input, not
	bit size.

226
227
228
229
230
231
232
233
234
235
236
237
238
239
2020-01-03  Niels Möller  <nisse@lysator.liu.se>

	Add benchmarking of ed25519, ed448 and curve448.
	* examples/hogweed-benchmark.c: (struct eddsa_ctx): New struct.
	(bench_eddsa_init, bench_eddsa_sign, bench_eddsa_verify)
	(bench_eddsa_clear): New functions.
	(struct curve_ctx): New struct, generalizing struct curve25519_ctx.
	(bench_curve_init, bench_curve_mul_g, bench_curve_mul)
	(bench_curve_clear): New functions.
	(struct curve25519_ctx, bench_curve25519_mul_g)
	(bench_curve25519_mul, bench_curve25519): Deleted.
	(alg_list): Add eddsa and curve entries.
	(main): Delete call to bench_curve25519.

240
241
2020-01-02  Niels Möller  <nisse@lysator.liu.se>

242
243
244
245
246
247
248
249
250
251
252
253
254
	* eddsa-internal.h (nettle_eddsa_dom_func): New typedef.
	(struct ecc_eddsa): Use function pointer to represent eddsa dom
	string. To avoid calling sha512_update with empty input for
	ed25519.
	* ed448-shake256.c (ed448_dom): New function, calling
	sha3_256_update with the magic dom prefix.
	(_nettle_ed448_shake256): Point to it.
	* ed25519-sha512.c (_nettle_ed25519_sha512): Add do-nothing dom function.

	* eddsa-sign.c (_eddsa_sign): Update to use dom function pointer.
	* eddsa-verify.c (_eddsa_verify): Likewise.

	* eddsa-internal.h (struct ecc_eddsa): Add magic dom string,
255
	needed for ed448.
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
	* ed25519-sha512.c (_nettle_ed25519_sha512): Empty dom string.
	* ed448-shake256.c (_nettle_ed448_shake256): New file and
	parameter struct.

	* eddsa-hash.c (_eddsa_hash): Add digest_size as input argument.
	Handle ed448 digests with two extra bytes. Update callers.
	* eddsa-verify.c (_eddsa_verify): Hash dom string.
	* eddsa-sign.c (_eddsa_sign_itch): Assert that
	_eddsa_compress_itch isn't too large.
	(_eddsa_sign): New argument k1, with the hash prefix. Add hashing
	of this prefix and the dom string. Update callers. Fix final
	reduction, it's different for ed25519, with q slightly larger than
	a power of two, and ed448, with q slightly smaller.
	* eddsa-pubkey.c (_eddsa_public_key_itch): Assert that
	_eddsa_compress_itch isn't too large.
271

Niels Möller's avatar
Niels Möller committed
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
	Implementation of ed448-shake256, based on patch by Daiki Ueno.
	* ed448-shake256-pubkey.c (ed448_shake256_public_key): New file
	and function.
	* ed448-shake256-sign.c (ed448_shake256_sign): New file and function.
	* ed448-shake256-verify.c (ed448_shake256_verify): New file and function.

	* Makefile.in (hogweed_SOURCES): Add new ed448 files.

	* testsuite/eddsa-verify-test.c (test_ed448): New function.
	(test_main): New ed448 tests.
	* testsuite/eddsa-sign-test.c (test_ed448_sign): New function.
	(test_main): New ed448 tests.
	* testsuite/ed448-test.c: New tests.
	* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Add ed448-test.c.

	* nettle.texinfo (Curve 25519 and Curve 448): Document ed448.

289
290
2020-01-01  Niels Möller  <nisse@lysator.liu.se>

291
292
293
294
295
296
297
	* ecc-448.c (ecc_mod_pow_2kp1): New function.
	(ecc_mod_pow_446m224m1): Reduce scratch usage from 6*n to 5*n, at
	the cost of one copy operation. Also use ecc_mod_pow_2kp1 where
	applicable.
	(ECC_448_INV_ITCH): Reduce to 5*ECC_LIMB_SIZE.
	(ECC_448_SQRT_ITCH): Reduce to 9*ECC_LIMB_SIZE.

298
299
	* testsuite/eddsa-compress-test.c: Test also with curve448.

300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
2019-12-30  Niels Möller  <nisse@lysator.liu.se>

	Preparation for ed448, based on patch by Daiki Ueno.
	* eddsa-internal.h (struct ecc_eddsa): New struct for eddsa
	parameters.
	* ed25519-sha512.c (_nettle_ed25519_sha512): New parameter struct.
	* eddsa-expand.c (_eddsa_expand_key): Replace input
	struct nettle_hash with struct ecc_eddsa, and generalize for
	ed448. Update all callers.
	* eddsa-sign.c (_eddsa_sign): Likewise.
	* eddsa-verify.c (_eddsa_verify): Likewise.
	* eddsa-compress.c (_eddsa_compress): Store sign bit in most
	significant bit of last byte, as specified by RFC 8032.
	* eddsa-decompress.c (_eddsa_decompress): Corresponding update.
	Also generalize to support ed448, and make validity checks
	stricter.
	* testsuite/eddsa-sign-test.c (test_ed25519_sign): New function.
	(test_main): Use it.
	* testsuite/eddsa-verify-test.c (test_ed25519): New function.
	(test_main): Use it.

321
322
2019-12-28  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
323
	* bignum.h: Drop unrelated include of nettle-meta.h.
324
325
326
	* pss.h: Include nettle-meta.h explicitly.
	* eddsa-internal.h: Likewise.

327
328
2019-12-25  Niels Möller  <nisse@lysator.liu.se>

329
330
331
332
333
334
335
336
	Support for SHAKE256, based on patch by Daiki Ueno.
	* shake256.c (sha3_256_shake): New file and function.
	* Makefile.in (nettle_SOURCES): Add shake256.c.
	* testsuite/testutils.c (test_hash): Allow arbitrary digest size,
	if hash->digest_size == 0.
	* testsuite/shake.awk: New script to extract test vectors.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Add shake256-test.c.
	(DISTFILES): Add shake.awk.
Niels Möller's avatar
Niels Möller committed
337
	* nettle.texinfo (Recommended hash functions): Document SHAKE-256.
338

339
340
341
342
343
344
	* sha3.c (_sha3_pad): Generalized with an argument for the magic
	suffix defining the sha3 instance.
	* sha3-internal.h (_sha3_pad_hash): New macro, for SHA3 hashes.
	Updated all callers of _sha3_pad.
	(_sha3_pad_shake): New macro, using the SHAKE magic byte 0x1f.

345
346
347
348
349
350
351
352
2019-12-19  Niels Möller  <nisse@lysator.liu.se>

	* ecc-mul-a-eh.c (ecc_mul_a_eh) [ECC_MUL_A_EH_WBITS == 0]: Use
	add_hh rather than add_hhh.
	(table_init) [[ECC_MUL_A_EH_WBITS > 0]: Likewise.
	* ecc-internal.h (ECC_MUL_A_EH_ITCH) [ECC_MUL_A_EH_WBITS == 0]:
	Reduced from 13*n to 12*n.

353
354
2019-12-18  Niels Möller  <nisse@lysator.liu.se>

355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
	Rename add and dup functions for Edwards curves.
	* ecc-dup-th.c (ecc_dup_th): New file, move and rename ecc_dup_eh.
	* ecc-add-th.c (ecc_add_th): New file, move and rename ecc_add_eh.
	* ecc-add-thh.c (ecc_add_thh): New file, move and rename
	ecc_add_ehh.
	* ecc-dup-eh.c (ecc_dup_eh_untwisted): Rename to just ecc_dup_eh.
	* ecc-add-eh.c (ecc_add_ehh_untwisted): Rename to just ecc_add_eh.
	* ecc-add-ehh.c (ecc_add_ehh_untwisted): Rename to just ecc_add_ehh.
	* ecc-internal.h (ecc_dup_th, ecc_add_th, ecc_add_thh): Declare
	new functions, delete declarations of ecc_*_untwisted variants.
	(ECC_DUP_TH_ITCH, ECC_ADD_TH_ITCH, ECC_ADD_THH_ITCH): New macros.
	* ecc-25519.c (_nettle_curve25519): Update, use ecc_dup_th and
	friends.
	* ecc-448.c (_nettle_curve448): Update for rename, without
	_untwisted suffix.
	* Makefile.in (hogweed_SOURCES): Added ecc-dup-th.c, ecc-add-th.c,
	and ecc-add-thh.c
	* testsuite/ecc-dup-test.c (test_main): Update asserts.
	* testsuite/ecc-add-test.c (test_main): Likewise.

375
376
377
	* eddsa-verify.c (_eddsa_verify): Use function pointer rather than
	calling ecc_add_eh directly. Preparation for eddsa over curve448.

378
379
380
381
382
383
384
385
386
387
388
2019-12-17  Niels Möller  <nisse@lysator.liu.se>

	* examples/ecc-benchmark.c (bench_dup_hh): Rename, and use
	ecc->dup pointer.
	(bench_dup_jj): ... old name.
	(bench_add_hh): Rename, and use ecc->addd_hh pointer.
	(bench_add_jja): ... old name.
	(bench_dup_eh, bench_add_eh): Deleted.
	(bench_curve): Update, and delete curve25519 special case.
	(main): Update table headers accordingly.

389
390
391
392
2019-12-15  Niels Möller  <nisse@lysator.liu.se>

	* ecc-dup-eh.c (ecc_dup_eh): Eliminate one unneeded ecc_modp_add.

Niels Möller's avatar
Niels Möller committed
393
394
395
396
397
398
399
400
401
402
403
404
2019-12-14  Niels Möller  <nisse@lysator.liu.se>

	* ecc-mul-m.c (ecc_mul_m): New file and function. Implements
	multipliction for curves in Montgomery representation, as used for
	curve25519 and curve448. Extracted from curve25519_mul.
	* ecc-internal.h (ecc_mul_m): Declare.
	(ECC_MUL_M_ITCH): New macro.
	* Makefile.in (hogweed_SOURCES): Add ecc-mul-m.c.

	* curve25519-mul.c (curve25519_mul): Use ecc_mul_m.
	* curve448-mul.c (curve448_mul): Likewise.

405
406
407
408
2019-12-13  Niels Möller  <nisse@lysator.liu.se>

	* Merge curve448 implementation.

409
410
2019-12-09  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
411
412
413
414
415
416
	* ecc-internal.h: Revert itch macro changes. We now have
	h_to_a_itch <= mul_itch, mul_g_itch. Add asserts at a few places
	relying on this.
	(ECC_ECDSA_KEYGEN_ITCH, ECC_MAX): Delete macros.
	(ECC_ECDSA_SIGN_ITCH): Revert previous change.

417
418
419
420
421
	* ecc-448.c (ecc_mod_pow_446m224m1): Reduce scratch space from 9*n
	to 6*n.
	(ECC_448_INV_ITCH, ECC_448_SQRT_ITCH): Reduce accordingly.
	* curve448-mul.c (curve448_mul): Reduce allocation from 14*n to 12*n.

422
423
424
425
426
427
428
429
430
2019-12-08  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/ecc-curve448-modp.asm (nettle_ecc_curve448_modp): New
	assembly function.
	* ecc-448.c (ecc_448_modp) [HAVE_NATIVE_ecc_curve448_modp]: Use
	native nettle_ecc_curve448_modp if available.
	* configure.ac (asm_hogweed_optional_list): Add ecc-curve448-modp.asm.
	(HAVE_NATIVE_ecc_curve448_modp): New config.h define.

431
432
433
434
2019-12-03  Niels Möller  <nisse@lysator.liu.se>

	* ecc-448.c (ecc_448_modp) [GMP_NUMB_BITS == 64]: New function.

Niels Möller's avatar
Niels Möller committed
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
2019-12-01  Niels Möller  <nisse@lysator.liu.se>

	Curve 448 support contributed by Daiki Ueno.
	* eccdata.c (enum ecc_type): Add ECC_TYPE_EDWARDS.
	(ecc_add): Support untwisted edwards curves.
	(ecc_curve_init): Add curve448 parameters.
	* ecc-internal.h (ECC_ECDSA_KEYGEN_ITCH): New macro.
	(ECC_ECDSA_SIGN_ITCH): Increased from 12*size to 13*size.
	(ECC_MAX): New macro.
	* ecc-448.c: New file.
	(ecc_mod_pow_2k, ecc_mod_pow_446m224m1, ecc_448_inv)
	(ecc_448_zero_p, ecc_448_sqrt): New functions.
	(_nettle_curve448): New curve definition.
	* curve448.h (CURVE448_SIZE): New constant.
	(curve448_mul_g, curve448_mul): Declare new public functions.
	* ecc-eh-to-a.c (ecc_eh_to_a): Update assert to allow the curve448
	Edwards curve.
	* curve448-mul.c (curve448_mul): New file and function.
	* curve448-mul-g.c (curve448_mul_g): New file and function.
	* curve448-eh-to-x.c (curve448_eh_to_x): New file and function.
	* ecc-dup-eh.c (ecc_dup_eh_untwisted): New function.
	* ecc-add-ehh.c (ecc_add_ehh_untwisted): New function.
	* ecc-add-eh.c (ecc_add_eh_untwisted): New function.
	* ecc-point.c (ecc_point_set): Add point validation for curve448.
	* ecc-point-mul.c (ecc_point_mul): Allow h_to_a_itch larger than
	mul_itch.
	* ecc-point-mul-g.c (ecc_point_mul_g): Allow h_to_a_itch
	larger than mul_g_itch. Switch from TMP_DECL/_ALLOC/_FREE to
	gmp_alloc_limbs/gmp_free_limbs.
	* ecdsa-keygen.c (ecdsa_generate_keypair): Use
	ECC_ECDSA_KEYGEN_ITCH.
	* Makefile.in (hogweed_SOURCES): Add ecc-448.c, curve448-mul-g.c,
	curve448-mul.c, and curve448-eh-to-x.c.
	(HEADERS): Add curve448.h.
	(ecc-448.h): New generated file.

	* testsuite/testutils.c (ecc_curves): Add _nettle_curve448 to list
	of tested curves.
	(test_ecc_mul_a): Add curve448.
	* testsuite/ecdsa-keygen-test.c (ecc_valid_p): Add curve448 support.
	* testsuite/ecdh-test.c (test_main): Add tests for (non-standard)
	curve448 diffie-hellman.
	* testsuite/ecc-add-test.c (test_main): Update for testing of curve448.
	* testsuite/ecc-dup-test.c (test_main): Likewise.
	* testsuite/ecc-mul-a-test.c (test_main): Likewise. Also increase
	scratch allocation for h_to_a_itch.
	* testsuite/ecc-mul-g-test.c (test_main): Likewise.
	* testsuite/curve448-dh-test.c: Test for curve448.
	* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Add curve448-dh-test.c.

	* examples/ecc-benchmark.c: Add curve448 to list of benchmarked
	curves.

	* nettle.texinfo (Curve 25519 and Curve 448): Add docs.

490
491
492
493
494
495
496
497
498
499
2019-12-07  Niels Möller  <nisse@lysator.liu.se>

	* ecc-eh-to-a.c (ecc_eh_to_a): Require op == 0, delete code only
	used for non-standard ecdsa over curve25519.
	* testsuite/ecdsa-sign-test.c (test_main): Delete test of ecdsa
	over curve25519.
	* testsuite/ecdsa-verify-test.c (test_main): Likewise.
	* testsuite/ecdsa-keygen-test.c (test_main): Exclude curve25519
	from test.

500
501
502
503
504
505
506
2019-12-05  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Use AC_TRY_LINK rather than AC_TRY_COMPILE to
	check for __builtin_bswap64. Since calling an non-existing
	function typically results in a warning only at compile time, but
	fails at link time. Patch contributed by by George Koehler.

Niels Möller's avatar
Niels Möller committed
507
508
509
510
511
2019-12-04  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/testutils.c (test_cipher_cfb8): Add cast of size_t to
	unsigned long for argument to fprintf.

512
513
2019-11-21  Niels Möller  <nisse@lysator.liu.se>

514
515
516
517
518
519
520
	* eccdata.c (ecc_curve_init_str): Delete unused t and d arguments.
	Related to the the edwards_root member of struct ecc_curve, which
	was used by ecc_a_to_eh before it was deleted, see 2014-09-17
	entry below.
	(ecc_curve_init): Delete corresponding curve25519 constants, and
	NULL arguments passed for the other curves.

521
522
	* Merge curve448 preparations, from September 2017.

523
524
2017-09-23  Niels Möller  <nisse@lysator.liu.se>

525
526
527
528
529
530
	* eccdata.c: Reorganize curve25519 precomputation to work directly
	with the twisted Edwards curve, with new point addition based on a
	patch from Daiki Ueno.
	* ecc-25519.c (_nettle_curve25519): Update for removed Montgomery
	curve constant.

531
532
533
534
	* ecc-internal.h (struct ecc_curve): Delete unused pointer
	edwards_root. Update all instances.
	* eccdata.c (output_curve): Don't output it.

535
536
	* testsuite/ecc-add-test.c (test_main): Reduce test duplication.
	Use ecc->add_hhh_itch.
537
538
	* testsuite/ecc-dup-test.c (test_main): Reduce test duplication.
	Use ecc->dup_itch.
539

540
541
2017-09-23  Daiki Ueno  <dueno@redhat.com>

542
543
544
545
	* ecc-eh-to-a.c (ecc_eh_to_a): Use ecc->q.bit_size, instead of
	hard-coded value for curve25519.
	* eddsa-sign.c (_eddsa_sign): Likewise.

546
547
548
549
550
551
552
553
554
555
556
	* ecc-internal.h (ecc_dup_func): New typedef.
	(struct ecc_curve): New constants add_hh_itch and dup_itch, new
	function pointers add_hh and dup.
	* ecc-192.c, ecc-224.c, ecc-256.c, ecc-384.c, ecc-521.c,
	ecc-25519.c: Update accordingly.
	* ecc-mul-g-eh.c (ecc_mul_g_eh): Use new function pointers.
	* ecc-mul-a-eh.c (ecc_mul_a_eh, table_init, ecc_mul_a_eh):
	Likewise.
	* testsuite/ecc-dup-test.c (test_main): Likewise.
	* testsuite/ecc-add-test.c (test_main): Likewise.

Niels Möller's avatar
Niels Möller committed
557
558
2019-10-01  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
559
560
561
	* testsuite/testutils.c (test_cipher_cfb8): Reset destination area
	between tests. Encrypt/decrypt final partial block.

Niels Möller's avatar
Niels Möller committed
562
563
564
565
566
567
	From Daiki Ueno, fixing bug reported by Stephan Mueller:
	* cfb.c (cfb8_decrypt): Don't truncate output IV if input is
	shorter than block size.
	* testsuite/testutils.c (test_cipher_cfb8): Test splitting input
	into multiple calls to cfb8_encrypt and cfb8_decrypt.

568
569
570
2019-09-30  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/siv-test.c (test_cipher_siv): Fix out-of-bounds read.
571
572
573
	Trim allocation size for de_data, drop some uses of
	SIV_DIGEST_SIZE, call FAIL for unexpected returned values.
	(test_compare_results): Delete digest argument.
574

575
576
2019-09-15  Niels Möller  <nisse@lysator.liu.se>

577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
	From Dmitry Eremin-Solenikov:
	* gost28147.c (_gost28147_encrypt_block): New file, encrypt
	function and sbox tables moved here.
	* gosthash94.c: Update functions to take sbox array as argument.
	(gost_block_compress): Use _gost28147_encrypt_block.
	(gosthash94cp_update,gosthash94cp_digest): New functions.
	* gost28147-internal.h: New file.
	* gost28147.h: New file.
	* gosthash94-meta.c (nettle_gosthash94cp): New hash algorithm.
	* nettle-meta-hashes.c (_nettle_hashes): Add nettle_gosthash94 and
	nettle_gosthash94cp.
	* hmac-gosthash94.c (hmac_gosthash94_set_key)
	(hmac_gosthash94_update, hmac_gosthash94_digest)
	(hmac_gosthash94cp_set_key, hmac_gosthash94cp_update)
	(hmac_gosthash94cp_digest): New file and functions.
	* pbkdf2-hmac-gosthash94.c (pbkdf2_hmac_gosthash94cp): New file
	and function.
	* testsuite/pbkdf2-test.c (test_main): Add
	pbkdf2-hmac-gosthash94cp tests.
	* testsuite/hmac-test.c (test_main): Add hmac-gosthash94 tests.
	* testsuite/gosthash94-test.c (test_main): Add gosthash94cp tests.
	* nettle.texinfo (Legacy hash functions): Document gosthash94cp.

600
601
	* testsuite/dlopen-test.c (main): Use libnettle.dylib on MacOS.

602
603
2019-07-08  Niels Möller  <nisse@lysator.liu.se>

604
	* nettle-types.h (union nettle_block16): Mark w member as deprecated.
605
	* eax.c (block16_xor): Use uint64_t member of nettle_block16.
606
	* gcm.c (gcm_gf_add, gcm_gf_shift, gcm_gf_shift_8): Likewise.
607

Niels Möller's avatar
Niels Möller committed
608
609
610
611
612
2019-07-10  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Eremin-Solenikov:
	* cmac64.c (_cmac64_block_mulx, cmac64_set_key, cmac64_init)
	(cmac64_update, cmac64_digest): New file, new functions.
Niels Möller's avatar
Niels Möller committed
613
614
615
616
617
	* cmac-des3.c (cmac_des3_set_key, cmac_des3_update)
	(cmac_des3_digest): New file, new functions.
	* cmac.h: Add cmac64 and cmac_des3 declarations.
	* Makefile.in (nettle_SOURCES): Add cmac64.c and cmac-des3.c.
	* testsuite/cmac-test.c (test_main): Add tests for cmac_des3.
Niels Möller's avatar
Niels Möller committed
618

Niels Möller's avatar
Niels Möller committed
619
620
621
622
623
624
625
626
2019-07-02  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Eremin-Solenikov:
	* testsuite/testutils.c (test_mac): New function.
	* testsuite/cmac-test.c (nettle_cmac_aes128, nettle_cmac_aes256):
	New algorithm structs.
	(test_cmac_aes128, test_cmac_aes256): Use test_mac.

627
628
2019-06-06  Niels Möller  <nisse@lysator.liu.se>

629
	Update for cmac changes, enabling const for the _message functions.
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
	* siv-cmac.c (_siv_s2v): Take a const struct cmac128_key as argument,
	and use a local struct cmac128_ctx for message-specific state.
	(siv_cmac_set_key): Take a struct cmac128_key as argument. Updated
	callers.
	(siv_cmac_encrypt_message, siv_cmac_decrypt_message): Take a const
	struct cmac128_key as argument. Updated callers.

	* siv-cmac.h (SIV_CMAC_CTX): Changed to use struct cmac128_key
	rather than struct cmac128_ctx.

	* siv-cmac-aes256.c (siv_cmac_aes256_encrypt_message)
	(siv_cmac_aes256_decrypt_message): Likewise.
	* siv-cmac-aes128.c (siv_cmac_aes128_encrypt_message)
	(siv_cmac_aes128_decrypt_message): The ctx argument made const.

645
646
2019-05-15  Niels Möller  <nisse@lysator.liu.se>

647
648
649
650
	* siv-cmac.h (SIV_CMAC_AES128_KEY_SIZE, SIV_CMAC_AES256_KEY_SIZE):
	New constants.
	* testsuite/siv-test.c: Simplify tests a little.

651
652
653
654
	* siv-cmac.h (SIV_MIN_NONCE_SIZE): New constant, 1.
	* siv-cmac.c (_siv_s2v): Require non-empty nonce.
	* nettle.texinfo (SIV-CMAC): Update documentation.

655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
2019-05-06  Niels Möller  <nisse@lysator.liu.se>

	SIV-CMAC mode, based on patch by Nikos Mavrogiannopoulos:
	* siv-cmac.h (SIV_BLOCK_SIZE, SIV_DIGEST_SIZE): New constants.
	(SIV_CMAC_CTX): New macro.
	(struct siv_cmac_aes128_ctx, struct siv_cmac_aes256_ctx): New
	context structs.
	* siv-cmac.c (_siv_s2v, siv_cmac_set_key)
	(siv_cmac_encrypt_message)
	(siv_cmac_decrypt_message): New file, new functions.
	* siv-cmac-aes128.c (siv_cmac_aes128_set_key)
	(siv_cmac_aes128_encrypt_message)
	(siv_cmac_aes128_decrypt_message): New file, new functions.
	* siv-cmac-aes256.c (siv_cmac_aes256_set_key)
	(siv_cmac_aes256_encrypt_message)
	(siv_cmac_aes256_decrypt_message): New file, new functions.
	* Makefile.in (nettle_SOURCES): Add siv-cmac source files.
	(HEADERS): Add siv-cmac.h.
	* testsuite/siv-test.c: New file.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Added siv-test.c
	* nettle.texinfo (SIV-CMAC): Documentation.

677
678
679
680
681
682
683
684
2019-04-30  Niels Möller  <nisse@lysator.liu.se>

	Based on a patch contributed by Nikos Mavrogiannopoulos.
	* cmac.c (_cmac128_block_mulx): Renamed function...
	(block_mulx): ... from old name.
	* cmac-internal.h (_cmac128_block_mulx): New file, declare function.
	* Makefile.in (DISTFILES): Added cmac-internal.h.

685
686
2019-06-26  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
687
688
689
690
691
692
693
	* Released nettle-3.5.1.

	* configure.ac: Update version number to 3.5.1.

	* Makefile.in (distdir): Add x86_64/sha_ni to list of distributed
	directories.

694
695
	* Released nettle-3.5.

696
697
698
699
700
701
702
2019-06-25  Niels Möller  <nisse@lysator.liu.se>

	* config.sub: Update to 2019-05-23 version, from savannah's
	config.git.
	* config.guess: Update to 2019-06-10 version, from savannah's
	config.git. Adds recognition of mips R6 and riscv.

703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
2019-06-05  Niels Möller  <nisse@lysator.liu.se>

	Further separation of CMAC per-message state from the
	message-independent subkeys, analogous to the gcm implementation.
	* cmac.h (struct cmac128_ctx): Remove key, instead a struct
	cmac128_key should be passed separately to functions that need it.
	(CMAC128_CTX): Include both a struct cmac128_key and a struct
	cmac128_ctx.
	(CMAC128_SET_KEY, CMAC128_DIGEST): Updated accordingly.

	* cmac.c (cmac128_set_key): Change argument type from cmac128_ctx
	to cmac128_key. Use a nettle_block16 for the constant zero block.
	(cmac128_init): New function, to initialize a cmac128_ctx.
	(cmac128_digest): Add cmac128_key argument. Move padding memset
	into the block handling a partial block. Call cmac128_init to
	reset state.

Niels Möller's avatar
Niels Möller committed
720
721
722
723
724
725
2019-06-01  Niels Möller  <nisse@lysator.liu.se>

	* cmac.h (struct cmac128_key): New struct.
	* cmac.h (struct cmac128_ctx): Use struct cmac128_key.
	* cmac.c (cmac128_set_key, cmac128_digest): Update accordingly.

726
727
728
729
730
731
732
733
2019-05-12  Niels Möller  <nisse@lysator.liu.se>

	Delete old libdes/openssl compatibility interface.
	* des-compat.c: Delete file.
	* des-compat.h: Delete file.
	* testsuite/des-compat-test.c: Delete file.
	* nettle.texinfo (Compatibility functions): Delete mention in documentation.

Niels Möller's avatar
Niels Möller committed
734
735
736
737
2019-05-11  Niels Möller  <nisse@lysator.liu.se>

	* NEWS: More updates for Nettle-3.5.

738
739
740
741
742
743
744
2019-04-27  Niels Möller  <nisse@lysator.liu.se>

	From Simo Sorce:
	* x86_64/poly1305-internal.asm: Add missing EPILOGUE.
	* x86_64/serpent-decrypt.asm: Likewise.
	* x86_64/serpent-encrypt.asm: Likewise.

745
746
747
748
2019-04-14  Niels Möller  <nisse@lysator.liu.se>

	* tools/nettle-pbkdf2.c (main): Check strdup return value.

749
750
751
752
753
754
755
756
757
2019-03-29  Niels Möller  <nisse@lysator.liu.se>

	* aes.h (struct aes_ctx): Redefine using a union of key-size
	specific contexts.
	* aes-decrypt.c (aes_decrypt): Use switch on key_size.
	* aes-encrypt.c (aes_encrypt): Likewise.
	* aes-set-decrypt-key.c (aes_invert_key): Likewise.
	* aes-set-encrypt-key.c (aes_set_encrypt_key): Likewise.

758
759
760
761
762
763
764
2019-03-27  Niels Möller  <nisse@lysator.liu.se>

	* xts.c (xts_shift): Arrange with a single write to u64[1].
	* cmac.c (block_mulx): Rewrite to work in the same way as
	xts_shift, with 64-bit operations. XTS and CMAC use opposite
	endianness, but otherwise, these two functions are identical.

765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
2019-03-24  Niels Möller  <nisse@lysator.liu.se>

	From Simo Sorce:
	* xts.h: New file.
	* xts.c: New file.
	(BE_SHIFT): New macro.
	(xts_shift, check_length, xts_encrypt_message)
	(xts_decrypt_message): New functions.
	* xts-aes128.c (xts_aes128_set_encrypt_key)
	(xts_aes128_set_decrypt_key, xts_aes128_encrypt_message)
	(xts_aes128_decrypt_message): New file, new functions.
	* xts-aes256.c (xts_aes256_set_encrypt_key)
	(xts_aes256_set_decrypt_key, xts_aes256_encrypt_message)
	(xts_aes256_decrypt_message): New file, new functions.
	* nettle.texinfo (XTS): Document XTS mode.
	* Makefile.in (nettle_SOURCES): Add xts sourcce files.
	(HEADERS): New installed header xts.h.
	* testsuite/xts-test.c: New file.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Add xts-test.c.

785
786
787
788
789
790
791
792
793
794
795
2019-02-06  Niels Möller  <nisse@lysator.liu.se>

	* gosthash94.h (struct gosthash94_ctx): Move block buffer last in
	struct.
	* md2.h (struct md2_ctx): Likewise.
	* md4.h (struct md4_ctx): Likewise.
	* md5.h (struct md5_ctx): Likewise.
	* ripemd160.h (struct ripemd160_ctx): Likewise.
	* sha1.h (struct sha1_ctx): Likewise.
	* sha2.h (struct sha256_ctx, struct sha512_ctx): Likewise.

796
797
2019-01-19  Niels Möller  <nisse@lysator.liu.se>

798
799
800
	* examples/Makefile.in (TARGETS): Delete eratosthenes, left over
	from earlier change.

801
802
	* fat-arm.c: Fix declarations of chacha_core functions.

803
804
805
806
807
808
809
810
811
	From Yuriy M. Kaminskiy:
	* fat-setup.h (chacha_core_func): New typedef.
	* fat-arm.c (fat_init): Enable choice between
	_nettle_chacha_core_c and _nettle_chacha_core_neon.
	* configure.ac (asm_nettle_optional_list): Add
	chacha-core-internal-2.asm.
	* chacha-core-internal.c: Enable fat build with C and asm version.
	* arm/fat/chacha-core-internal-2.asm: New file.

Niels Möller's avatar
Niels Möller committed
812
813
814
815
816
2019-01-12  Niels Möller  <nisse@lysator.liu.se>

	* examples/eratosthenes.c: Deleted program.
	* examples/Makefile.in: Delete rule to build and distribute it.

817
818
819
820
821
2019-01-10  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/rsa-compute-root-test.c (test_one): Use %u and
	corresponding cast, when printing bit sizes.

822
823
824
825
826
2019-01-09  Niels Möller  <nisse@lysator.liu.se>

	* examples/nettle-benchmark.c (GET_CYCLE_COUNTER): Add volatile to
	inline asm.

827
828
829
830
2019-01-08  Niels Möller  <nisse@lysator.liu.se>

	* sha512-compress.c: Add missing include of sha2-internal.h.

831
832
833
834
835
2019-01-06  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/rsa-compute-root-test.c (generate_keypair): Fix assert
	call with side-effects.

Niels Möller's avatar
Niels Möller committed
836
837
838
839
840
841
842
843
844
845
2019-01-06  Niels Möller  <nisse@lysator.liu.se>

	* nettle-types.h: Don't use nettle-stdint.h, include <stdint.h>
	directly.
	* nettle-write.h: Likewise.
	* configure.ac: Delete use of AX_CREATE_STDINT_H.
	* aclocal.m4 (AX_CREATE_STDINT_H): Delete.
	* Makefile.in (INSTALL_HEADERS, distclean-here): Delete mention of
	nettle-stdint.h.

846
847
2018-12-26  Niels Möller  <nisse@lysator.liu.se>

848
849
850
851
852
	* examples/hogweed-benchmark.c (make_openssl_rsa_ctx): New helper
	function. Call openssl's RSA_generate_key_ex rather then the
	deprecated RSA_generate_key.
	(bench_openssl_rsa_init, bench_openssl_rsa_tr_init): Use it.

853
854
855
856
	* eccdata.c (ecc_pippenger_precompute): Check that table size is
	at least 2. Intended to silence warning from the clang static
	analyzer.

857
858
859
860
861
	* configure.ac: Bump package version to 3.5.
	(LIBNETTLE_MAJOR): Bump major number, now 7.
	(LIBHOGWEED_MAJOR): Bump major number, now 5.
	(LIBNETTLE_MINOR, LIBHOGWEED_MINOR): Reset to zero.

862
863
864
865
866
867
868
869
870
871
	* pkcs1-internal.h: New header file, moved declarations of
	_pkcs1_sec_decrypt and _pkcs1_sec_decrypt_variable here.
	* rsa-internal.h: ... old location.
	* Makefile.in (DISTFILES): Added pkcs1-internal.h.
	* pkcs1-decrypt.c: Include new file.
	* pkcs1-sec-decrypt.c: Likewise.
	* rsa-decrypt-tr.c: Likewise.
	* rsa-sec-decrypt.c: Likewise.
	* testsuite/pkcs1-sec-decrypt-test.c: Likewise.

872
873
874
875
876
	* tools/nettle-pbkdf2.c: Add #define _GNU_SOURCE, needed for
	strdup with gcc -std=c89.
	* testsuite/ed25519-test.c: Add #define _GNU_SOURCE, needed for
	getline with gcc -std=c89.

877
878
879
880
	* rsa-sign-tr.c (sec_equal): Fix accidental use of C99 for loop.
	Reported by Andreas Gustafsson.
	* testsuite/rsa-sec-decrypt-test.c (test_main): Likewise.

Niels Möller's avatar
Niels Möller committed
881
882
883
884
2018-12-04  Niels Möller  <nisse@lysator.liu.se>

	* Released nettle-3.4.1.

885
886
2018-11-28  Niels Möller  <nisse@lysator.liu.se>

887
888
889
	* configure.ac: Update GMP check. Check for the function
	mpn_sec_div_r, available since GMP-6.0.0.

890
891
892
893
894
895
896
897
	* testsuite/rsa-encrypt-test.c (test_main): Fix allocation of
	decrypted storage. Update test of rsa_decrypt, to allow clobbering
	of all of the passed in message area.

	* pkcs1-decrypt.c (pkcs1_decrypt): Rewrite as a wrapper around
	_pkcs1_sec_decrypt_variable. Improves side-channel silence of the
	only caller, rsa_decrypt.

898
899
900
	* Makefile.in (DISTFILES): Add rsa-internal.h, needed for make
	dist. Patch from Simo Sorce.

901
902
	* rsa-internal.h: Add include of rsa.h.

903
904
905
906
907
908
909
2018-11-27  Niels Möller  <nisse@lysator.liu.se>

	* rsa-sec-compute-root.c (sec_mul, sec_mod_mul, sec_powm): New
	local helper functions, with their own itch functions.
	(_rsa_sec_compute_root_itch, _rsa_sec_compute_root): Rewrote to
	use helpers, for clarity.

910
911
912
913
914
915
916
2018-11-26  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/rsa-compute-root-test.c (generate_keypair): Simplify
	selection of psize and qsize, and fix so that qsize is used.
	(test_main): Add outer loop, to test with more than one key.
	Deallocate storage before exiting.

917
918
2018-11-25  Niels Möller  <nisse@lysator.liu.se>

919
920
921
	* testsuite/rsa-compute-root-test.c: Renamed, from ...
	* testsuite/rsa-sec-compute-root-test.c: ... old name.

922
923
	* rsa.h (rsa_sec_compute_root_tr): Deleted declaration, moved to ...
	* rsa-internal.h (_rsa_sec_compute_root_tr): ... new location.
924
925
926
	* rsa-sign-tr.c (_rsa_sec_compute_root_tr): Renamed, from...
	(rsa_sec_compute_root_tr): ... old name. Updated callers.
	(cnd_mpn_zero): Use a volatile-declared mask variable.
927

928
929
930
	* testsuite/testutils.c (mpz_urandomb) [NETTLE_USE_MINI_GMP]: Fix
	masking of most significant bits.

931
932
933
	* rsa-decrypt-tr.c (rsa_decrypt_tr): Use
	NETTLE_OCTET_SIZE_TO_LIMB_SIZE.

934
935
936
937
	* testsuite/rsa-sec-decrypt-test.c (rsa_decrypt_for_test): Tweak
	valgrind marking, and document potential leakage of lowest and
	highest bits of p and q.

938
939
940
941
	* rsa-sec-compute-root.c (_rsa_sec_compute_root): Avoid calls to
	mpz_sizeinbase, since that potentially leaks most significant bits
	of private key parameters a and b.

942
943
944
	* testsuite/pkcs1-sec-decrypt-test.c (pkcs1_decrypt_for_test): Fix
	valgrind marking of return value.

945
946
947
	Merged below changes from Simo Sorce, to make RSA private key
	operations side-channel silent.

948
949
950
951
2018-11-08  Simo Sorce  <simo@redhat.com>

	* rsa-sign.c (rsa_compute_root) [!NETTLE_USE_MINI_GMP]: Use
	_rsa_sec_compute_root.
Niels Möller's avatar
Niels Möller committed
952

Niels Möller's avatar
Niels Möller committed
953
954
955
	* testsuite/rsa-sec-compute-root-test.c: Add more tests for new
	side-channel silent functions.

Niels Möller's avatar
Niels Möller committed
956
957
958
959
	* rsa-sign.c (rsa_private_key_prepare): Check that qn + cn >= pn,
	since that is required for one of the GMP calls in
	_rsa_sec_compute_root.

Niels Möller's avatar
Niels Möller committed
960
961
	* rsa-decrypt-tr.c: Switch to use side-channel silent functions.

962
963
964
	* pkcs1-sec-decrypt.c (_pkcs1_sec_decrypt_variable): New private
	function. Variable size version for backwards compatibility.

Niels Möller's avatar
Niels Möller committed
965
966
	* testsuite/rsa-sec-decrypt-test.c: Adds more tests.

Niels Möller's avatar
Niels Möller committed
967
968
969
970
	* rsa-sec-decrypt.c (rsa_sec_decrypt): New function.
	Fixed length side-channel silent version of rsa-decrypt.
	* testsuite/rsa-encrypt-test.c: add tests for the new fucntion.

Niels Möller's avatar
Niels Möller committed
971
972
973
	* testsuite/pkcs1-sec-decrypt-test.c: Adds tests for
	_pkcs1_sec_decrypt.

Niels Möller's avatar
Niels Möller committed
974
975
	* gmp-glue.c (mpn_get_base256): New function.

Niels Möller's avatar
Niels Möller committed
976
977
978
	* pkcs1-sec-decrypt.c (_pkcs1_sec_decrypt): New private function.
	Fixed length side-channel silent version of pkcs1-decrypt.

Niels Möller's avatar
Niels Möller committed
979
980
981
982
	* cnd-memcpy.c (cnd_memcpy): New function.
	* memops.h: Declare it.
	* testsuite/cnd-memcpy-test.c: New test case.

983
984
985
986
987
988
989
990
991
992
993
	* rsa-sign-tr.c (rsa_sec_compute_root_tr): New function that uses
	_rsa_sec_compute_root, as well as side-channel silent RSA
	blinding.
	(rsa_compute_root_tr) Rewritten as a wrapper around
	rsa_sec_compute_root_tr.
	(rsa_sec_blind, rsa_sec_unblind, sec_equal, rsa_sec_check_root)
	(cnd_mpn_zero): New helper functions.
	(rsa_sec_compute_root_tr) [NETTLE_USE_MINI_GMP]: Defined as a not
	side-channel silent wrapper around rsa_compute_root_tr, and the
	latter function left unchanged.

994
995
996
997
998
	* rsa-sec-compute-root.c (_rsa_sec_compute_root_itch)
	(_rsa_sec_compute_root): New file, new private functions.
	Side-channel silent version of rsa_compute_root.
	* rsa-internal.h: New header file with declarations.

Niels Möller's avatar
Niels Möller committed
999
1000
	* gmp-glue.h (NETTLE_OCTET_SIZE_TO_LIMB_SIZE): New macro.

1001
1002
1003
1004
1005
1006
2018-11-24  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Bump package version to 3.4.1.
	(LIBNETTLE_MINOR): Bump library version to 6.5.
	(LIBHOGWEED_MINOR): Bump library version to 4.5.

1007
1008
1009
1010
1011
1012
1013
1014
1015
2018-11-17  Niels Möller  <nisse@lysator.liu.se>

	* examples/hogweed-benchmark.c (bench_rsa_verify)
	(bench_openssl_rsa_tr_init): New functions.
	(alg_list): Benchmark timing-resistant RSA functions, i.e.,
	including RSA blinding.
	(main): Increase width of first column, here and in other
	printouts.

1016
1017
1018
1019
1020
1021
2018-10-10  Dmitry Eremin-Solenikov  <dbaryshkov@gmail.com>

	* ctr16.c (_ctr_crypt16): Bugfix for the src == dst case, when
	processing more than on full block of size CTR_BUFFER_LIMIT, src
	and dst arguments to memxor3 were not properly updated.

1022
1023
1024
1025
1026
2018-10-10  Niels Möller  <nisse@lysator.liu.se>

	* aes-set-encrypt-key.c: Add missing include of stdlib.h.
	* des-compat.c: Likewise.

1027
1028
1029
1030
1031
2018-09-13  Niels Möller  <nisse@lysator.liu.se>

	* rsa-keygen.c (rsa_generate_keypair): Delete unlikely and
	redundant check for p == q.

1032
1033
2018-08-09  Niels Möller  <nisse@lysator.liu.se>

1034
1035
1036
	* rsa-internal.h (_rsa_blind, _rsa_unblind): Mark with
	_NETTLE_ATTRIBUTE_DEPRECATED.

Niels Möller's avatar
Niels Möller committed
1037
1038
1039
	* nettle-types.h (_NETTLE_ATTRIBUTE_PURE)
	(_NETTLE_ATTRIBUTE_DEPRECATED): New macros, for gcc and
	lookalikes.
1040
1041
1042
1043
1044
	* ecc-curve.h: Include nettle-types.h, and use
	_NETTLE_ATTRIBUTE_PURE instead of local definition.
	* nettle-meta.h: Use _NETTLE_ATTRIBUTE_PURE, instead of explicit
	#ifdefs.

Niels Möller's avatar
Niels Möller committed
1045
1046
1047
1048
1049
	* aes.h: Mark functions using struct aes_ctx interface as
	deprecated. Add #undef _NETTLE_ATTRIBUTE_DEPRECATED in files where
	the functions are implemented or tested.
	* gcm.h: Similarly mark functions using gcm_aes_ctx as deprecated.

1050
1051
1052
1053
1054
	* nettle-internal.c (des_set_key_wrapper, des3_set_key_wrapper)
	(blowfish128_set_key_wrapper): Wrapper functions, to avoid cast
	between incompatible function types (which gcc-8 warns about).
	Wrappers are expected to compile to a single jmp instruction.

1055
1056
1057
	* des-compat.c (des_compat_des3_encrypt)
	(des_compat_des3_decrypt): Change length argument type to size_t.

1058
1059
1060
1061
1062
2018-08-08  Niels Möller  <nisse@lysator.liu.se>

	* nettle.texinfo (Compatibility): New section on ABI and API
	compatibility.

1063
1064
1065
1066
2018-07-25  Dmitry Eremin-Solenikov  <dbaryshkov@gmail.com>

	* examples/nettle-benchmark.c: Add benchmarking for HMAC functions.

1067
1068
1069
1070
1071
2018-07-13  Niels Möller  <nisse@lysator.liu.se>

	* examples/eratosthenes.c (vector_alloc): Add assert related to
	overflow in the size calculation. Fixes a corner case identified
	by static analysis.
1072
	(vector_init): Analogous assert.
1073

Niels Möller's avatar
Niels Möller committed
1074
1075
2018-07-12  Niels Möller  <nisse@lysator.liu.se>

1076
1077
	* examples/eratosthenes.c (main): Don't allocate bitmap storage
	for limit == 2 (early exit), closing memory leak at exit.
1078
	(main): Fix handling of short -q option.
1079

Niels Möller's avatar
Niels Möller committed
1080
1081
	* eccdata.c (output_curve): Replace mpz_init_set_ui by mpz_set_ui,
	to fix memory leak.
1082
1083
	(ecc_curve_clear): New function.
	(main): Call it, to deallocate storage before exit.
Niels Möller's avatar
Niels Möller committed
1084

1085
1086
1087
1088
1089
1090
2018-07-08  Niels Möller  <nisse@lysator.liu.se>

	* fat-x86_64.c (fat_init): Fix setup for nettle_sha1_compress.
	* x86_64/fat/sha1-compress.asm: Add leading underscore to symbol name.
	* x86_64/fat/sha1-compress-2.asm: Likewise.

Niels Möller's avatar
Niels Möller committed
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
2018-07-07  Niels Möller  <nisse@lysator.liu.se>

	From Nikos Mavrogiannopoulos.
	* sha1-compress.c (nettle_sha1_compress): Renamed, and promoted to
	public function, since there's known appliation usage (filezilla).
	* sha1.h (_nettle_sha1_compress): Old name, now a preprocessor
	alias for the new name.
	* md5-compress.c (nettle_md5_compress): Similarly renamed (used by
	sogo).
	* md5.h (_nettle_md5_compress): Old name,, now a preprocessor
	alias for the new name.

	* chacha-internal.h, dsa-internal.h, eddsa-internal.h:
	* hogweed-internal.h, ripemd160-internal.h, rsa-internal.h:
	* salsa20-internal.h, sha2-internal.h, sha3-internal.h:
	* umac-internal.h: Internal declarations moved to new header
	files, which are not installed..
	* Makefile.in (DISTFILES): Added above files.

	* libnettle.map.in: Use a different symbol version for _nettle_*
	symbols, depending on the minor release. This marks these symbols
	explicitly not part of the public Nettle ABI.
	* libhogweed.map.in: Analogous change.

1115
1116
2018-06-17  Niels Möller  <nisse@lysator.liu.se>

1117
1118
1119
	* aclocal.m4 (NETTLE_CHECK_IFUNC): Fix quoting. Patch contributed
	by Dmitry Eremin-Solenikov.

1120
1121
1122
1123
	* testsuite/symbols-test: Exclude ____chkstk_darwin symbols,
	produced by Apple's Xcode 10 compiler. Patch contributed by
	Dominyk Tiller.

1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
2018-03-25  Niels Möller  <nisse@lysator.liu.se>

	From Michael Weiser.
	* configure.ac (ASM_WORDS_BIGENDIAN): New substution, set from AC_C_BIGENDIAN.
	* config.m4.in: Use it to set WORDS_BIGENDIAN.
	* asm.m4 (IF_BE, IF_LE): New macros.
	* arm/memxor.asm: Support big-endian ARM.
	* arm/memxor3.asm: Likewise.
	* arm/neon/chacha-core-internal.asm: Likewise.
	* arm/neon/salsa20-core-internal.asm: Likewise.
	* arm/neon/umac-nh.asm: Likewise.
	* arm/v6/sha1-compress.asm: Likewise.
	* arm/v6/sha256-compress.asm: Likewise.
	* arm/README: Document big-endian considerations.

1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
2018-03-17  Niels Möller  <nisse@lysator.liu.se>

	Discourage direct access to data symbols with non-public size.
	Direct references to these symbols may result in copy-relocations
	like R_X86_64_COPY, which make the symbol size leak into the ABI.
	* ecc-curve.h (_nettle_secp_192r1, _nettle_secp_224r1)
	(_nettle_secp_256r1, _nettle_secp_384r1, _nettle_secp_521r1): Add
	leading underscore on these data symbols.

	* nettle-meta.h (_nettle_ciphers, _nettle_hashes, _nettle_aeads)
	(_nettle_armors): Add leading underscore on these data symbols.
	Update all internal use. Macros without leading underscore remain,
	and expand to access via accessor functions nettle_get_ciphers and
	similar.

Niels Möller's avatar
Niels Möller committed
1154
1155
2018-03-10  Niels Möller  <nisse@lysator.liu.se>

1156
1157
1158
	* eccdata.c (ecc_table_size): New helper function.
	(ecc_pippenger_precompute): Display warning for poor parameters.

Niels Möller's avatar
Niels Möller committed
1159
1160
1161
	* eccparams.c (main): New program, to list parameter alternatives
	for Pippenger's algorithm.

1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
	* Makefile.in: Tweak parameters for ecc tables.
	(ecc-192.h): Change parameters from k = 7, c = 6 to k = 8, c = 6.
	Reduces table size from 15 KB to 12 KB. Modest speedup, appr. 3%
	for ecdsa signatures.
	(ecc-224.h): Change parameters from k = 12, c = 6 to k = 16, c =
	7. Table size unchanged (14 KB in 32-bit platforms, 18 KB on
	64-bit platforms. Minor speedup, appr. 1% for ecdsa signatures.
	(ecc-256.h): Change parameters from k = 14, c = 6 to k = 11, c =
	6. Table size unchanged, 16 KB. 14% speedup for ecdsa signatures.
	(ecc-384.h): Changed parameters from k = 41, c = 6 to k = 32, c =
	6. Table size unchanged. 12% speedup for ecdsa signatures.
	(ecc-521.h): Changed parameters from k = 56, c = 6 to k 44, c = 6.
	Table size unchanged (17 KB on 32-bit platforms, 18 KB on 64-bit
	platforms). 15% speedup for ecdsa signatures.
	(ecc-255.h): Change parameters from k = 14, c = 6 to k = 11, c =
	6. Table size unchanged, 16 KB. 24% speedup for eddsa signatures.

1179
1180
1181
1182
1183
2018-03-14  Niels Möller  <nisse@lysator.liu.se>

	Merge sha256 code using the x86_64 sha_ni instructions, starting
	2018-02-21.

1184
1185
1186
1187
1188
1189
1190
2018-03-11  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/fat/sha256-compress.asm: New file.
	* x86_64/fat/sha256-compress-2.asm: New file.
	* fat-x86_64.c (fat_init): Select plain x86_64 assembly version or
	sha_ni version for sha256_compress.

1191
1192
1193
1194
1195
2018-02-21  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/sha_ni/sha256-compress.asm: New implementation using sha_ni
	instructions.

1196
1197
1198
1199
2018-02-20  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/cmac-test.c (test_cmac_hash): Deallocate ctx properly.

1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
2018-02-19  Niels Möller  <nisse@lysator.liu.se>

	Mostly aesthetic changes. Besides indentation:
	* cmac.h (struct cmac128): Rename, to cmac128_ctx.
	(CMAC128_CTX): Rename first member from data to ctx.

	* cmac.c: Use const void * as the type for cipher arguments.
	(block_mulx): Un-inline.
	(cmac128_set_key): Make a constant function local.

	* testsuite/cmac-test.c: Delete local typedefs.

2018-02-19  Nikos Mavrogiannopoulos  <nmav@redhat.com>
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233

	Add support for CMAC.
	* cmac.h: New file.
	(struct cmac128): New struct.
	* cmac.c (block_mulx, cmac128_set_key, cmac128_update)
	(cmac128_digest): New file, new functions.
	* cmac-aes128.c (cmac_aes128_set_key, cmac_aes128_update)
	(cmac_aes128_digest): New file, new functions.
	* cmac-aes256.c (cmac_aes256_set_key, cmac_aes256_update)
	(cmac_aes256_digest): New file, new functions.
	* Makefile.in (nettle_SOURCES): Added cmac.c cmac-aes128.c cmac-aes256.c.
	(HEADERS): Added cmac.h.

	* testsuite/cmac-test.c: New tests.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Add cmac-test.c.

	* examples/nettle-benchmark.c (time_cmac): New function.
	(main): Use it.

	* nettle.texinfo: Document CMAC.

1234
1235
2018-02-20  Niels Möller  <nisse@lysator.liu.se>

1236
	* testsuite/cbc-test.c (test_cbc_bulk): Use struct
1237
	aes256_ctx, instead of the deprecated struct aes_ctx.
1238
1239
	* testsuite/cfb-test.c (test_cfb_bulk): Likewise.
	* examples/rsa-session.h (struct rsa_session): Likewise.
1240
1241
1242
1243
1244
	* examples/rsa-encrypt.c (rsa_session_set_encrypt_key)
	(process_file): Use aes256_* functions.
	* examples/rsa-decrypt.c (rsa_session_set_decrypt_key)
	(process_file): Likewise.

1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
2018-02-19  Niels Möller  <nisse@lysator.liu.se>

	* nettle-internal.h: Include sha3.h, needed for the definition of
	NETTLE_MAX_HASH_CONTEXT_SIZE.
	(TMP_DECL_ALIGN, TMP_ALLOC_ALIGN): New macros, to support
	allocation of context structs with alignment requirements.
	[!HAVE_ALLOCA]: Also use assert, rather than calling abort
	directly.

	* pss.c (pss_encode_mgf1, pss_verify_mgf1): Use new macros.
	* pss-mgf1.c (pss_mgf1): Likewise.

1257
1258
1259
1260
1261
1262
2018-02-18  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Moved pss-mgf1-test.c...
	(TS_HOGWEED_SOURCES): ...to here. Fixes link failure in builds
	without public-key support.

Niels Möller's avatar
Niels Möller committed
1263
1264
1265
1266
1267
2018-02-18  Dmitry Eremin-Solenikov  <dbaryshkov@gmail.com>

	* examples/nettle-openssl.c): Move expressions with side effects
	out of asserts.

1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
2018-02-17  Dmitry Eremin-Solenikov  <dbaryshkov@gmail.com>

	(openssl_evp_set_encrypt_key, openssl_evp_set_decrypt_key): Use
	EVP_CipherInit_ex.
	* examples/nettle-openssl.c (nettle_openssl_gcm_aes128)
	(nettle_openssl_gcm_aes192, nettle_openssl_gcm_aes256): New aead
	algorithms, for benchmarking purposes, and supporting wrapper functions.
	* nettle-internal.h: Corresponding declarations.
	* examples/nettle-benchmark.c (main): Include openssl's gcm aes in
	benchmark.

1279
1280
2018-02-16  Niels Möller  <nisse@lysator.liu.se>

1281
1282
1283
	* nettle.texinfo: Improved index entries.
	(Cipher functions): Update CAST128/CAST5 docs. Inconsistencies
	spotted by Henrik Rindlöw.
1284

1285
1286
1287
1288
2018-02-10  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: New configure option --enable-x86-sha-ni.

1289
1290
1291
1292
1293
1294
1295
2018-02-07  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/fat/sha1-compress.asm: New file.
	* x86_64/fat/sha1-compress-2.asm: New file.
	* fat-x86_64.c (fat_init): Select plain x86_64 assembly version or
	sha_ni version for sha1_compress.

1296
1297
2018-02-05  Niels Möller  <nisse@lysator.liu.se>

1298
1299
1300
	* x86_64/sha_ni/sha1-compress.asm: New implementation using sha_ni
	instructions.

1301
1302
1303
1304
	* fat-x86_64.c (get_x86_features): Check for sha_ni extension.

	* x86_64/fat/cpuid.asm: Clear %ecx input to cpuid instruction.

1305
1306
1307
1308
1309
1310
2018-02-01  Nikos Mavrogiannopoulos  <nmav@redhat.com>

	* gcm.c (gcm_fill): New function, for use with _ctr_crypt16.
	(gcm_encrypt, gcm_decrypt): Use _ctr_crypt16. 50% speedup of
	gcm_aes128, benchmarked on x86_64 with aesni instructions.

1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
2018-02-01  Niels Möller  <nisse@lysator.liu.se>

	Based on a patch contributed by Nikos Mavrogiannopoulos.
	* ctr16.c (_ctr_crypt16): New file, renamed and generalized
	function. New function pointer argument, used to fill a block with
	counter values. Use nettle_block16 * as the type for the buffer to
	be filled. Always process any final and partial block, and return
	no value.
	* ctr.c (ctr_crypt): ... previous, replaced, function.
	(ctr_fill16): Updated to new argument type.
	(ctr_crypt): Return immediately after using _ctr_crypt16.

	* ctr-internal.h: New file, declaring _ctr_crypt16.
	(nettle_fill16_func): New function typedef.

	* Makefile.in (nettle_SOURCES): Added ctr16.c.
	(DISTFILES): Added ctr-internal.h.

1329
1330
1331
1332
2018-01-30  Niels Möller  <nisse@lysator.liu.se>

	* Makefile.in (clean-here): Don't delete desdata.stamp.

1333
1334
1335
1336
1337
1338
1339
1340
1341
2018-01-24  Jay Foad  <jay.foad@gmail.com>

	* Makefile.in (TARGETS): Delete dependencies on aesdata, desdata,
	twofishdata, shadata and gcmdata. They are not needed for a normal
	build.
	(clean-here): Explicitly delete of above files.
	(desdata.stamp): New stamp target, to avoid building desdata twice
	in a parallell build.

Niels Möller's avatar
Niels Möller committed
1342
1343
1344
1345
1346
2018-01-23  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac (asm_path): Recognize "x86", in addition to "i?86",
	for 32-bit x86 processors. Reportedly needed for x86 android builds.

Niels Möller's avatar
Niels Möller committed
1347
1348
1349
1350
1351
1352
1353
1354
1355
2018-01-20  Niels Möller  <nisse@lysator.liu.se>

	CFB8 support, contributed by Dmitry Eremin-Solenikov.
	* cfb.c (cfb8_encrypt, cfb8_decrypt): New functions.
	* cfb.h: Declare them.
	(CFB8_ENCRYPT, CFB8_DECRYPT): New macros.
	* testsuite/cfb-test.c: New tests for CFB8.
	* nettle.texinfo (CFB and CFB8): Documentation.

1356
1357
1358
1359
2018-01-16  Niels Möller  <nisse@lysator.liu.se>

	* tools/pkcs1-conv.c (convert_file): Add missing break statements.

Niels Möller's avatar
Niels Möller committed
1360
1361
1362
1363
1364
1365
1366
1367
1368
2018-01-09  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/testutils.c (test_cipher_ctr): Test operations with
	shorter sizes.

	* testsuite/ctr-test.c: Additional unofficial test vectors, to
	exercise carry propagation in the counter, and block size
	different from 16.

1369
1370
2018-01-08  Niels Möller  <nisse@lysator.liu.se>

1371
1372
1373
1374
1375
1376
1377
	* ctr.c (ctr_crypt16): New function, with optimizations specific
	to 16-byte block size.
	(ctr_fill16): New helper function, definition depending on
	WORDS_BIGENDIAN, and little endian version requiring
	HAVE_BUILTIN_BSWAP64.
	(ctr_crypt): Use ctr_crypt16, when appropriate.

1378
1379
	* nettle-types.h (union nettle_block16): Add uint64_t field.

1380
1381
1382
	* configure.ac: Check for __builtin_bswap64, define
	HAVE_BUILTIN_BSWAP64 if available.

Niels Möller's avatar
Niels Möller committed
1383
1384
	* ctr.c (ctr_fill): New function. Use in ctr_crypt.

1385
1386
1387
1388
	* ctr.c (ctr_crypt): For in-place operation, increase max buffer
	size from 4 blocks to 512 bytes, similarly to CBC and CFB.
	Improves in-place aes128 CTR performance by 25% on x86_64.

1389
1390
1391
	* examples/nettle-benchmark.c (time_cipher): Benchmark in-place
	operation separately, for cbc_decrypt and ctr_crypt.

1392
1393
1394
1395
1396
	* cbc.c (cbc_decrypt): For in-place operation (src == dst case),
	eliminate use of src variable.
	* cfb.c (cfb_decrypt): Likewise.
	* gcm.c (gcm_crypt): Likewise, and replace one memxor3 by memxor.

Niels Möller's avatar
Niels Möller committed
1397
1398
1399
1400
1401
1402
1403
2018-01-03  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/aesni/aes-encrypt-internal.asm: Read subkeys into xmm
	registers before the block loop, and completely unroll the round
	loop.
	* x86_64/aesni/aes-decrypt-internal.asm: Likewise.

Niels Möller's avatar
Niels Möller committed
1404
1405
2017-11-19  Niels Möller  <nisse@lysator.liu.se>

1406
	* Released nettle-3.4.
Niels Möller's avatar
Niels Möller committed
1407

1408
1409
1410
1411
1412
1413
2017-11-12  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Update check of GMP_NUMB_BITS declaration in
	assembly files. Was broken by rename of configure variable
	GMP_NUMB_BITS --> NUMB_BITS.

Niels Möller's avatar
Niels Möller committed
1414
1415
1416
1417
1418
1419
1420
1421
2017-11-11  Niels Möller  <nisse@lysator.liu.se>

	* nettle.texinfo: Document nettle_get_hashes, nettle_get_ciphers
	and nettle_get_aeads, and replace nettle_secp_256r1 by
	nettle_get_secp_256r1. Update version numbers. Delete ancient
	setting of ispell-skip-region-alist as an emacs file-local
	variable.

1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
2017-11-08  Niels Möller  <nisse@lysator.liu.se>

	* ecc-curve.h (nettle_secp_192r1, nettle_secp_224r1)
	(nettle_secp_256r1, nettle_secp_384r1, nettle_secp_521r1): Delete
	macro wrappers, partially reverting below 2017-04-09 change. They
	didn't work at all for applications that only see a forward
	declaration of struct ecc_curve. Instead, we will have to make an
	ABI and API break and delete these symbols, when the size of
	struct ecc_curve is increased.

Niels Möller's avatar
Niels Möller committed
1432
1433
1434
1435
1436
1437
2017-11-05  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac Bump package version to 3.4.
	(LIBNETTLE_MINOR): Bump library version to 6.4.
	(LIBHOGWEED_MINOR): Bump library version to 4.4.

Niels Möller's avatar
Niels Möller committed
1438
1439
1440
1441
1442
1443
2017-10-23  Niels Möller  <nisse@lysator.liu.se>

	* examples/Makefile.in (check): Also set DYLD_LIBRARY_PATH in the
	environment, to support Mac OSX shared libraries.
	* testsuite/Makefile.in (LD_LIBRARY_PATH): Likewise.

1444
1445
2017-10-23  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
1446
	Merge API fixes, starting at 2017-01-12.
1447

1448
1449
2017-04-09  Niels Möller  <nisse@lysator.liu.se>

1450
1451
1452
1453
1454
1455
1456
1457
	* ecc-curve.h (nettle_get_secp_192r1, nettle_get_secp_224r1)
	(nettle_get_secp_256r1, nettle_get_secp_384r1)
	(nettle_get_secp_521r1): New functions, returning a pointer to
	corresponding structure.
	(nettle_secp_192r1, nettle_secp_224r1, nettle_secp_256r1)
	(nettle_secp_384r1, nettle_secp_521r1): Redefined as macros,
	calling the corresponding function.

1458
1459
	* nettle-meta.h (nettle_ciphers, nettle_aeads, nettle_armors): New
	macros, analogous to below change to nettle_hashes.
1460

Niels Möller's avatar
Niels Möller committed
1461
	* nettle-meta-ciphers.c (nettle_get_ciphers): New function.
1462

Niels Möller's avatar
Niels Möller committed
1463
	* nettle-meta-aeads.c (nettle_get_aeads): New function.
Niels Möller's avatar
Niels Möller committed
1464

Niels Möller's avatar
Niels Möller committed
1465
	* nettle-meta-armors.c (nettle_get_armors): New function.
1466

1467
1468
2017-01-12  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
1469
1470
1471
1472
1473
	* tools/nettle-hash.c (find_algorithm): Deleted function.
	(main): Replaced by call to nettle_lookup_hash.

	* testsuite/meta-hash-test.c (test_main): Use nettle_lookup_hash.

1474
1475
1476
1477
1478
1479
	* nettle-meta.h (nettle_hashes): New macro, expanding to a call to
	nettle_get_hashes. Direct access to the array causes the array
	size to leak into the ABI, since a plain un-relocatable executable
	linking with libnettle.so gets copy relocations for any referenced
	data items in the shared library.

Niels Möller's avatar
Niels Möller committed
1480
	* nettle-meta-hashes.c (nettle_get_hashes): New function.
1481

Niels Möller's avatar
Niels Möller committed
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
2017-10-16  Niels Möller  <nisse@lysator.liu.se>

	CFB support, contributed by Dmitry Eremin-Solenikov.
	* cfb.c (cfb_encrypt, cfb_decrypt): New file, new functions.
	* cfb.h: New header file.
	(CFB_CTX, CFB_SET_IV, CFB_ENCRYPT, CFB_DECRYPT): New macros.
	* Makefile.in (nettle_SOURCES): Add cfb.c.
	(HEADERS): Add cfb.h.
	* testsuite/cfb-test.c: New test case.
	* testsuite/testutils.c (test_cipher_cfb): New function.
	* nettle.texinfo (CFB): Documentation.

1494
1495
1496
1497
1498
2017-10-16  Niels Möller  <nisse@lysator.liu.se>

	* aclocal.m4 (GMP_PROG_CC_FOR_BUILD): Add -g when compiling with
	gcc.

1499
1500
1501
1502
2017-09-27  Niels Möller  <nisse@lysator.liu.se>

	Merged armor-signedness branch, starting 2017-08-27.

1503
1504
2017-09-24  Niels Möller  <nisse@lysator.liu.se>

1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
	* tools/pkcs1-conv.c (base64_decode_in_place): New helper
	function.
	(decode_base64): Use it.

	* sexp-transport-format.c (base64_encode_in_place): New helper
	function.
	(sexp_transport_vformat): Use it.

	* testsuite/base64-test.c (test_fuzz_once): Update to use char
	type where appropriate.
	(test_main): Use helper functions base64_encode_in_place and
	base64_decode_in_place (copied to this file).

1518
1519
1520
1521
1522
	* testsuite/testutils.c (tstring_data): Use uint8_t for data
	argument.
	* testsuite/testutils.h (SDATA): Use US macro to cast data
	argument.

1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
2017-08-27  Niels Möller  <nisse@lysator.liu.se>

	* base64-encode.c (base64_encode_raw, base64_encode_group)
	(base64_encode_single, base64_encode_update)
	(base64_encode_final): Change type of destination to char *.
	* base16-encode.c (base16_encode_single, base16_encode_update):
	Likewise.
	* base64-decode.c (base64_decode_single, base64_decode_update):
	Change type of source argument to const char *. Update (almost)
	all callers.
	* base16-decode.c (base16_decode_single, base16_decode_update):
	Likewise.
	* nettle-types.h (nettle_armor_encode_update_func)
	(nettle_armor_encode_final_func, nettle_armor_decode_update_func):
	Corresponding updates to typedefs.

1539
1540
2017-09-14  Niels Möller  <nisse@lysator.liu.se>

1541
1542
1543
	* hkdf.c: Delete unneeded includes. Use Nettle licensing notice.
	* hkdf.h: Include only nettle-types.h, not nettle-meta.h.

1544
1545
1546
	* ecc-mod.c (ecc_mod): Workaround to silence a false positive from
	the clang static analyzer.

1547
1548
1549
1550
1551
1552
1553
1554
2017-09-12  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/testutils.h (mpn_zero_p): Avoid redefining mpn_zero_p
	when building with mini-gmp. Since the mini-gmp update, this
	function is defined by mini-gmp, causing link errors if nettle is
	configured with --enable-mini-gmp --disable-shared. Reported by
	Tim Rühsen.

1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
2017-09-09  Daiki Ueno  <dueno@redhat.com>

	* testsuite/ecc-mul-g-test.c (test_main): Fixed mpn_cmp call.
	* testsuite/ecc-mul-a-test.c (test_main): Likewise.
	* eccdata.c (ecc_point_out): Write to given stream, instead of
	stderr.
	* eccdata.c (output_curve): In curve448, the bit size of the order
	is slightly smaller than the one of p's. Adjust ecc_Bmodq_shifted
	accordingly.

1565
1566
1567
1568
1569
1570
2017-09-09  Niels Möller  <nisse@lysator.liu.se>

	* mini-gmp.c: Updated mini-gmp from the gmp repository, latest
	change from 2017-07-23.
	* mini-gmp.h: Likewise.

1571
1572
1573
1574
1575
2017-09-06  Niels Möller  <nisse@lysator.liu.se>

	* hkdf.c (hkdf_expand): Eliminate a (signed) ssize_t variable, use
	break rather than return at loop termination.

Niels Möller's avatar
Niels Möller committed
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
2017-09-06  Niels Möller  <nisse@lysator.liu.se>

	HKDF implementation, contributed by Nikos Mavrogiannopoulos.
	* hkdf.c (hkdf_extract, hkdf_expand): New file, new functions.
	* hkdf.h: New file.
	* Makefile.in (nettle_SOURCES): Add hkdf.c.
	(HEADERS): Add hkdf.h.
	* testsuite/hkdf-test.c: Tests for hkdf-sha256 and hkdf-sha1.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Added hkdf-test.c.
	* nettle.texinfo (Key derivation functions): Document HKDF.

Niels Möller's avatar
Niels Möller committed
1587
1588
1589
1590
2017-09-04  Andreas Schneider  <asn@samba.org>

	* fat-arm.c: Add missing define for _GNU_SOURCE.

1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
2017-08-27  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac (GMP_NUMB_BITS): Set to dummy value "n/a" in
	mini-gmp builds.
	(NUMB_BITS): New substituted variable which always holds the
	configured value.
	* Makefile.in (GMP_NUMB_BITS): Renamed variable...
	(NUMB_BITS): ...new name
	* config.make.in: Update corresponding substitution.

Niels Möller's avatar
Niels Möller committed
1601
1602
1603
1604
1605
2017-08-26  Niels Möller  <nisse@lysator.liu.se>

	* ecc-mod-inv.c (ecc_mod_inv): Add missing assert. Fixes a
	"dead increment" warning from the clang static analyzer.

1606
1607
2017-08-26  Niels Möller  <nisse@lysator.liu.se>

1608
1609
1610
1611
	* examples/nettle-openssl.c (struct openssl_cipher_ctx): New
	struct. Use everywhere, instead of typing EVP_CIPHER_CTX pointers
	directly.

1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
	* configure.ac: Update openssl-related tests. Checks for
	cipher-specific headers are replaced by a check for openssl/evp.h,
	and the check for the BF_ecb_encrypt function is replaced by a
	check for EVP_CIPHER_CTX_new.

2017-08-03  Daniel P. Berrange  <berrange@redhat.com>

	* examples/nettle-openssl.c: Rewritten to use openssl's EVP APIs.
	The older cipher-specific functions always use openssl's generic
	software implementation, while the EVP functions enables
	platform-specific code, e.g., using the x86 AES-NI instructions.
	(nettle_openssl_init): New function.

Niels Möller's avatar
Niels Möller committed
1625
1626
1627
1628
1629
1630
1631
2017-07-18  Niels Möller  <nisse@lysator.liu.se>

	* ecc-add-eh.c (ecc_add_eh): Fix in-place operation by reordering
	two multiplies. Previously, in-place operation resulted in an
	invalid call to mpn_mul with overlapping operands. Reported by
	Sergei Trofimovich.

1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
2017-06-09  Niels Möller  <nisse@lysator.liu.se>

	* pss.c (pss_verify_mgf1): Check for m being too large, fixing an
	assertion failure for certain invalid signatures. Based on a patch
	contributed by Daiki Ueno.

	* testsuite/rsa-pss-sign-tr-test.c (test_main): Add test case
	contributed by Daiki Ueno. Problem originally found by oss-fuzz,
	see https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2132.
	That problem report is currently embargoed, but will hopefully be
	public in a month or two.

1644
1645
1646
1647
1648
1649
1650
1651
1652
2017-05-23  Niels Möller  <nisse@lysator.liu.se>

	Rework the previous change, which had the unintended effect of
	always regenerating .test-rules.make after ./configure is run.
	* testsuite/Makefile.in (test-rules.stamp): New stamp file target,
	depend on Makefile.in, and run $(MAKE) test-rules.
	(.test-rules.make): Add a level of indirection, by depending on
	test-rules.stamp.

1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
2017-05-20  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/Makefile.in (test-rules): Use $(srddir)/-prefix for
	.test-rules.make target, and change dependency from Makefile.in to
	Makefile.

2017-05-17  Nikos Mavrogiannopoulos  <nmav@redhat.com>

	* testsuite/Makefile.in: Ensure .test-rules.make is regenerated
	when Makefile.in is modified.

1664
1665
2017-04-09  Niels Möller  <nisse@lysator.liu.se>

1666
1667
1668
	* testsuite/dlopen-test.c (main): Call dlclose, to fix memory leak
	on success.

1669
1670
1671
1672
1673
1674
1675
	* testsuite/pss-test.c: Delete magic to let valgrind to check if
	pss_encode_mgf1 is side-channel silent with respect to the salt
	and digest inputs. It turns out that the most significant bits of
	the padded bignum, and hence its size, depends on these inputs.
	Which results in a data-dependent branch in the normalization code
	of at the end of gmp's mpz_import.

1676
1677
2017-04-04  Niels Möller  <nisse@lysator.liu.se>

1678
	* pss.c (pss_verify_mgf1): Use const for input mpz_t argument.
1679
	(pss_encode_mgf1): Avoid unnecessary memset and xor operations.
1680

1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
	Merged RSA-PSS support, contributed by Daiki Ueno.
	* pss-mgf1.h, pss.h: New header files.
	* pss-mgf1.c (pss_mgf1): New file and function.
	* pss.c (pss_encode_mgf1, pss_verify_mgf1): New file and
	functions.
	* rsa-verify.c (_rsa_verify_recover): New function.
	* rsa-pss-sha256-sign-tr.c: (rsa_pss_sha256_sign_digest_tr): New
	file and function.
	* rsa-pss-sha256-verify.c (rsa_pss_sha256_verify_digest): New
	file and function.
	* rsa-pss-sha512-sign-tr.c (rsa_pss_sha384_sign_digest_tr)
	(rsa_pss_sha512_sign_digest_tr): New file and functions.
	* rsa-pss-sha512-verify.c (rsa_pss_sha384_verify_digest)
	(rsa_pss_sha512_verify_digest): New file and functions.
	* rsa.h: Prototypes for new functions.
	* testsuite/rsa-pss-sign-tr-test.c: New test case.
	* testsuite/pss-test.c: New test case.
	* testsuite/pss-mgf1-test.c: New test case.
	* Makefile.in, testsuite/Makefile.in: Added new files.
	* nettle.texinfo: Documentation of rsa-pss functions.

1702
1703
2017-03-20  Niels Möller  <nisse@lysator.liu.se>

1704
1705
1706
1707
	* nettle-internal.h (NETTLE_MAX_HASH_CONTEXT_SIZE): New constant.
	* testsuite/meta-hash-test.c (test_main): Add sanity check for
	NETTLE_MAX_HASH_CONTEXT_SIZE.

1708
1709
1710
	* tools/nettle-hash.c (list_algorithms): Also display the internal
	context size.

1711
1712
1713
1714
1715
2017-01-03  Nikos Mavrogiannopoulos <nmav@redhat.com>

	* ecdsa-verify.c (ecdsa_verify): Eliminated memory leak on error
	path.

1716
1717
1718
1719
1720
1721
1722
2016-10-10  Niels Möller  <nisse@lysator.liu.se>

	* write-be32.c (_nettle_write_be32): Use const for source argument.
	* write-le32.c (_nettle_write_le32): Likewise.
	* write-le64.c (_nettle_write_le64): Likewise.
	* nettle-write.h: Update prototypes.

Niels Möller's avatar
Niels Möller committed
1723
1724
1725
1726
2016-10-01  Niels Möller  <nisse@lysator.liu.se>

	* Released nettle-3.3.

1727
1728
1729
1730
1731
1732
2016-09-13  Niels Möller  <nisse@lysator.liu.se>

	* nettle-meta-hashes.c (nettle_hashes): Added SHA3 hashes.
	Reported missing by Thomas Walter.
	* testsuite/meta-hash-test.c: Update test accordingly.

1733
1734
1735
2016-09-07  Niels Möller  <nisse@lysator.liu.se>

	* nettle.texinfo (Elliptic curves): Split into sub-nodes.
Niels Möller's avatar
Niels Möller committed
1736
	(Miscellaneous functions): Document memeql_sec.
Niels Möller's avatar
Niels Möller committed
1737
	* NEWS: Mention memeql_sec.
1738

Niels Möller's avatar
Niels Möller committed
1739
1740
2016-09-06  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
1741
1742
	* NEWS: Update for 3.3.

Niels Möller's avatar
Niels Möller committed
1743
1744
1745
1746
	* configure.ac: Bump package version to 3.3.
	(LIBNETTLE_MINOR): Bump library version to 6.3.
	(LIBHOGWEED_MINOR): Bump library version to 4.3.

1747
1748
1749
1750
1751
1752
2016-09-05  Niels Möller  <nisse@lysator.liu.se>

	* curve25519.h (NETTLE_CURVE25519_RFC7748): New preprocessor
	constant.
	* nettle.texinfo: Document it.

1753
1754
2016-09-03  Niels Möller  <nisse@lysator.liu.se>

1755
1756
	* config.make.in (.SUFFIXES): Delete no longer used .p$(OBJEXT).

1757
1758
1759
	* sexp.h (TOKEN_CHAR): Delete macro and declaration of
	sexp_token_chars. They belong in tools/misc.h, not here.

Niels Möller's avatar
Niels Möller committed
1760
1761
	* examples/ecc-benchmark.c (die): Deleted unused function.

1762
1763
1764
1765
1766
	* testsuite/testutils.h (US): New macro, for unsigned string
	literals.
	(LDATA): Use the US macro, to eliminate pointer signedness
	warnings.

1767
1768
1769
1770
1771
	* testsuite/eddsa-verify-test.c (test_eddsa): Use LDATA.
	* testsuite/pbkdf2-test.c (test_main): Likewise.
	* testsuite/pkcs1-test.c (test_main): Likewise.

	* testsuite/md5-compat-test.c (test_main): Use US macro.
1772

1773
1774
1775
	* testsuite/sexp-test.c (test_main): Use const char * for assoc
	keys. Overlooked in 2016-08-16 change.

1776
	* testsuite/yarrow-test.c (test_main): Fix pointer
1777
	signednesss warnings.
1778
1779
	* testsuite/sexp-format-test.c (test_main): Likewise.
	* testsuite/rsa-encrypt-test.c (test_main): Likewise.
1780
	* tools/nettle-lfib-stream.c (main): Likewise.
1781
	* tools/output.c (sexp_put_string): Likewise.
1782

1783
1784
1785
1786
1787
1788
	* testsuite/testutils.c (test_armor): Change ascii argument to
	const char *.
	* testsuite/base16-test.c (test_main): Use LDATA for the non-ascii
	argument to test_armor.
	* testsuite/base64-test.c (test_main): Likewise.

1789
1790
	* tools/nettle-pbkdf2.c (main): Fix some pointer signedness warning.
	* tools/nettle-hash.c (hash_file): Likewise.
1791

1792
1793
1794
1795
1796
1797
1798
1799
	* examples/rsa-decrypt.c (process_file): Use memeql_sec to check
	the digest.

	* memeql-sec.c (memeql_sec): New public function, moved from...
	* ccm.c (memeql_sec): ... previous location.

	* memops.h: New header file, generalizing memxor.h.

Niels Möller's avatar
Niels Möller committed
1800
1801
1802
1803
	* testsuite/memeql-test.c (test_main): New test case.
	(memeql_sec_for_test): Wrapper to get valgrind to check for
	side-channel silence.

1804
1805
1806
1807
1808
2016-08-29  Niels Möller  <nisse@lysator.liu.se>

	* sexp-format.c (strlen_u8): New helper function.
	(sexp_vformat): Use uint8_t * for strings instead of char *.

1809
1810
2016-08-16  Niels Möller  <nisse@lysator.liu.se>

1811
1812
	* examples/io.c (hash_file): Use uint8_t for buffer.

1813
1814
1815
1816
	* sexp.c (sexp_iterator_check_type, sexp_iterator_check_types)
	(sexp_iterator_assoc): Use const char * for caller's expression
	types. Updated all callers.

1817
1818
1819
	* rsa2openpgp.c (rsa_keypair_to_openpgp): Added cast to const
	uint8_t *.

1820
1821
1822
	* pgp-encode.c (write_string): New helper function, replacing...
	(WRITE): ... deleted macro.

1823
1824
1825
1826
1827
	* examples/io.c (write_data): Renamed, and use const void * for
	the input data. Updated all callers.
	(write_string): ... old name.
	(write_file): Use const void * for the input data.

1828
1829
2016-08-05  Niels Möller  <nisse@lysator.liu.se>

1830
	* examples/hogweed-benchmark.c: Use uint8_t for curve25519 values.
Niels Möller's avatar
Niels Möller committed
1831
	(bench_rsa_init): Use unsigned char for sexp strings.
Niels Möller's avatar
Niels Möller committed
1832
	(bench_dsa_init): Likewise.
1833
1834
	(hash_string): Delete length argument, calling strlen instead.
	Cast string to const uint8_t *. Updated callers.
Niels Möller's avatar
Niels Möller committed
1835

1836
1837
1838
	* examples/io.c (read_file): Use size_t for sizes, and uint8_t for
	the contents.

1839
1840
2016-08-04  Niels Möller  <nisse@lysator.liu.se>

1841
1842
1843
	* dsa-sign.c (dsa_sign): Return failure if p is even, so that an
	invalid key doesn't result in a crash inside mpz_powm_sec.