ChangeLog 439 KB
Newer Older
1
2
2021-03-13  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
3
4
5
6
7
8
9
10
	* ecc-ecdsa-verify.c (ecc_ecdsa_verify): Use ecc_mod_mul_canonical
	to compute the scalars used for ecc multiplication.
	* testsuite/ecdsa-verify-test.c (test_main): Add test case that
	triggers an assert on 64-bit platforms, without above fix.
	* testsuite/ecdsa-sign-test.c (test_main): Test case generating
	the same signature.

2021-03-13  Niels Möller  <nisse@lysator.liu.se>
11

Niels Möller's avatar
Niels Möller committed
12
	* eddsa-verify.c (equal_h): Use ecc_mod_mul_canonical.
13
14
15
16
17
18
19
20
21
22
23
2021-03-11  Niels Möller  <nisse@lysator.liu.se>

	* ecc-mod-arith.c (ecc_mod_mul_canonical, ecc_mod_sqr_canonical):
	New functions.
	* ecc-internal.h: Declare and document new functions.
	* curve448-eh-to-x.c (curve448_eh_to_x): Use ecc_mod_sqr_canonical.
	* curve25519-eh-to-x.c (curve25519_eh_to_x): Use ecc_mod_mul_canonical.
	* ecc-eh-to-a.c (ecc_eh_to_a): Likewise.
	* ecc-j-to-a.c (ecc_j_to_a): Likewise.
	* ecc-mul-m.c (ecc_mul_m): Likewise.

Niels Möller's avatar
Niels Möller committed
24
25
26
27
2021-03-04  Niels Möller  <nisse@lysator.liu.se>

	Merged initial arm64 code.

28
29
30
31
32
2021-02-03  Niels Möller  <nisse@lysator.liu.se>

	* arm64/crypto/gcm-hash.asm: Renamed directory, moved file,...
	* arm64/v8/gcm-hash.asm: ... old name.

33
34
35
36
37
38
39
2021-02-02  Niels Möller  <nisse@lysator.liu.se>

	* arm64/v8/gcm-hash.asm: Add ".arch armv8-a+crypto" directive.
	Supported by both GNU as and clang (the latter at least from
	version 3.9.1).
	* configure.ac: Don't add -march=armv8-a+crypto to CFLAGS.

40
41
42
43
44
45
46
2021-01-31  Niels Möller  <nisse@lysator.liu.se>

	* arm64/v8/gcm-hash.asm: New file, contributed by Maamoun TK and
	Michael Weiser.
	* arm64/README: New file. Document endianness issues, contributed
	by Michael Weiser.

47
48
49
50
2021-02-17  Niels Möller  <nisse@lysator.liu.se>

	* Released Nettle-3.7.1.

51
52
53
54
55
56
57
58
59
2021-02-15  Niels Möller  <nisse@lysator.liu.se>

	* examples/nettle-openssl.c (nettle_openssl_arcfour128): Deleted
	glue to openssl arcfour.
	(openssl_arcfour128_set_encrypt_key)
	(openssl_arcfour128_set_decrypt_key): Deleted.
	* nettle-internal.h: Deleted declaration.
	* examples/nettle-benchmark.c (aeads): Delete benchmarking.

60
61
62
63
64
65
2021-02-13  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Bump package version, to 3.7.1.
	(LIBNETTLE_MINOR): Bump minor number, to 8.2.
	(LIBHOGWEED_MINOR): Bump minor number, to 6.2.

Niels Möller's avatar
Niels Möller committed
66
67
2021-02-10  Niels Möller  <nisse@lysator.liu.se>

68
69
70
71
	* chacha-crypt.c (_nettle_chacha_crypt_4core): Fix for the case
	that counter increment should be 3 (129 <= message length <= 192).
	(_nettle_chacha_crypt32_4core): Likewise.

Niels Möller's avatar
Niels Möller committed
72
73
74
75
76
77
78
79
80
81
	* testsuite/chacha-test.c (test_chacha_rounds): New function, for
	tests with non-standard round count. Extracted from _test_chacha.
	(_test_chacha): Deleted rounds argument. Reorganized crypt/crypt32
	handling. When testing message prefixes of varying length, also
	encrypt the remainder of the message, to catch errors in counter
	value update.
	(test_main): Add a few tests with large messages (16 blocks, 1024
	octets), to improve test coverage for _nettle_chacha_crypt_4core
	and _nettle_chacha_crypt32_4core.

82
83
84
85
86
87
88
89
90
91
2021-01-25  Niels Möller  <nisse@lysator.liu.se>

	* arm/neon/salsa20-core-internal.asm: Deleted file. This ARM Neon
	implementation reportedly gave a speedup of 45% on Cortex A9,
	compared to the C implementation, when it was added back in 2013.
	That appears to no longer be the case with more recent processors
	and compilers. And it's even significantly slower than the C
	implementation on some platforms, including the Raspberry Pi 4.
	With the introduction of salsa20-2core.asm, performance of this
	function is also less important.
92
	* arm/neon/chacha-core-internal.asm: Deleted file, for analogous reasons.
93
	* arm/fat/salsa20-core-internal-2.asm: Deleted file.
94
95
	* arm/fat/chacha-core-internal-2.asm: Deleted file.
	* fat-arm.c (_nettle_salsa20_core, _nettle_chacha_core): Delete fat setup.
96

97
98
99
100
101
102
103
2021-01-31  Niels Möller  <nisse@lysator.liu.se>

	New variants, contributed by Nicolas Mora.
	* pbkdf2-hmac-sha384.c (pbkdf2_hmac_sha384): New file and function.
	* pbkdf2-hmac-sha512.c (pbkdf2_hmac_sha512): New file and function.
	* testsuite/pbkdf2-test.c (test_main): Corresponding tests.

104
105
106
107
2021-01-20  Niels Möller  <nisse@lysator.liu.se>

	* ecc-ecdsa-verify.c (ecc_ecdsa_verify): Fix corner case with
	all-zero hash. Reported by Guido Vranken.
108
	* testsuite/ecdsa-verify-test.c: Add corresponding test case.
109

110
111
112
113
114
115
116
2021-01-10  Niels Möller  <nisse@lysator.liu.se>

	* fat-ppc.c: Don't use __GLIBC_PREREQ in the same preprocessor
	conditional as defined(__GLIBC_PREREQ), but move to a nested #if
	conditional. Fixes compile error on OpenBSD/powerpc64, reported by
	Jasper Lievisse Adriaanse.

Niels Möller's avatar
Niels Möller committed
117
118
119
120
2021-01-04  Niels Möller  <nisse@lysator.liu.se>

	* Released Nettle-3.7.

Niels Möller's avatar
Niels Möller committed
121
122
123
124
2020-12-27  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Enable fat build by default.

125
126
2020-12-26  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
127
128
	* NEWS: News entries for Nettle-3.7.

129
130
131
	* Makefile.in (distdir): Distribute the README files in assembly
	directories.

132
133
134
135
	* configure.ac: Bump package version, to 3.7.
	(LIBNETTLE_MINOR): Bump minor number, to 8.1.
	(LIBHOGWEED_MINOR): Bump minor number, to 6.1.

136
137
138
139
140
2020-12-21  Niels Möller  <nisse@lysator.liu.se>

	From Mamone Tarsha:
	* fat-ppc.c: Check glibc version, and use getauxval only when available.

141
142
143
144
145
2020-12-12  Niels Möller  <nisse@lysator.liu.se>

	* powerpc64/p7/chacha-4core.asm: More interleaving of independent
	instructions, gives slight speedup on Power9.

146
147
2020-12-01  Niels Möller  <nisse@lysator.liu.se>

148
149
150
151
	* powerpc64/p7/chacha-4core.asm: Use protected zone below stack
	pointer to save registers, without modifying the stack pointer.
	(QR): Instruction level interleaving in the main loop, written by
	Torbjörn Granlund.
152

153
154
2020-11-30  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
155
156
157
	* m4-utils.m4 (m4_unquote): New macro, copied from GMP's
	mpn/asm-defs.m4.

158
159
	* chacha-crypt.c: (_nettle_chacha_crypt_4core)
	(_nettle_chacha_crypt32_4core): New functions.
160
161
	(_nettle_chacha_crypt_2core, _nettle_chacha_crypt32_2core):
	Deleted, no longer needed.
162
163
164
165
166
167
168
169
170
	* chacha-internal.h: Add prototypes for _nettle_chacha_4core and
	related functions.
	* configure.ac (asm_nettle_optional_list): Add chacha-4core.asm.
	* powerpc64/fat/chacha-4core.asm: New file.
	* powerpc64/p7/chacha-4core.asm: New file.
	* fat-ppc.c (fat_init): When altivec is available, use
	_nettle_chacha_crypt_4core and _nettle_chacha_crypt32_4core
	instead of _2core variants.

171
172
173
	* chacha-crypt.c (_nettle_chacha_crypt32_3core): Fix bug in
	handling of counter; this function should not propagate any carry.

174
175
	* aes-internal.h: Delete name mangling of internal symbols. Update
	all internal references to use _nettle prefix.
176
	* camellia-internal.h: Likewise.
177
	* chacha-internal.h: Likewise.
178
	* ctr-internal.h: Likewise.
179
	* dsa-internal.h: Likewise.
180
	* gost28147-internal.h: Likewise.
181
	* poly1305-internal.h: Likewise.
182
	* salsa20-internal.h: Likewise.
183
	* sha3-internal.h: Likewise.
184
	* umac-internal.h: Likewise.
185

186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
2020-11-26  Niels Möller  <nisse@lysator.liu.se>

	Enable powerpc64 gcm code in fat builds. Based on patch
	contributed by Mamone Tarsha:
	* powerpc64/fat/gcm-hash.asm: New file.
	* configure.ac: Add HAVE_NATIVE_fat_gcm_init_key and
	HAVE_NATIVE_fat_gcm_hash.
	* gcm.c (gcm_init_key): Renamed, to ...
	(_nettle_gcm_init_key_c): ... new name. Add fat setup conditionals.
	(gcm_hash): Renamed, to...
	(_nettle_gcm_hash_c): ... new name. Add fat setup conditionals.
	* fat-setup.h (gcm_init_key_func, gcm_hash_func): New typedefs.
	* fat-ppc.c: Select implementations of _nettle_gcm_init_key and _nettle_gcm_hash.
	* gcm-internal.h: New file.
	* Makefile.in (DISTFILES): Add gcm-internal.h.

202
203
204
	* powerpc64/p8/gcm-hash.asm: New file, contributed by Mamone
	Tarsha. Implements _nettle_gcm_init_key and _nettle_gcm_hash.

205
206
2020-11-28  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
207
208
209
	* powerpc64/p7/chacha-2core.asm: Simplify counter carry handling
	using the vaddcuw instruction.

210
211
212
213
214
	Merge changes by Marco Bodrato and Torbjorn Granlund, from the
	gmp/mini-gmp copy of this file.
	* run-tests: Delete special handling of zero arguments. Update
	WINEPATH, instead of overwriting it.

Niels Möller's avatar
Niels Möller committed
215
216
217
218
219
220
221
222
2020-11-27  Niels Möller  <nisse@lysator.liu.se>

	* aclocal.m4: Replace some calls to exit with return, since exit
	requires stdlib.h. Including patch contributed by Adrien Béraud.

	* testsuite/version-test.c: Include version.h. Patch contributed
	by Brian Smith.

223
224
225
226
227
2020-11-25  Niels Möller  <nisse@lysator.liu.se>

	* powerpc64/p7/chacha-2core.asm: Add byte swapping of output, for
	big-endian builds.

228
229
230
231
232
233
234
235
236
237
238
2020-11-24  Niels Möller  <nisse@lysator.liu.se>

	Enable ppc chacha_2core in fat builds.
	* configure.ac: Add HAVE_NATIVE_fat_chacha_2core.
	* chacha-crypt.c: Check HAVE_NATIVE_fat_chacha_2core.
	* chacha-internal.h (_chacha_crypt_2core, _chacha_crypt32_2core):
	Add declarations.
	* fat-ppc.c (fat_init): Use _nettle_chacha_crypt_2core and
	_nettle_chacha_crypt32_2core when altivec is available.
	* powerpc64/fat/chacha-2core.asm: New file, including p7 version.

239
240
2020-11-23  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
241
242
	* powerpc64/p7/chacha-2core.asm: New file.

243
244
245
246
247
248
	* chacha-crypt.c (_chacha_crypt_2core, _chacha_crypt32_2core): New
	variants of chacha_crypt, using _chacha_2core to do two blocks at
	a time.
	* chacha-internal.h (_chacha_2core, _chacha_2core32): Add declarations.
	* configure.ac (asm_nettle_optional_list): Add chacha-2core.asm.

249
250
251
252
253
254
255
256
257
2020-11-14  Niels Möller  <nisse@lysator.liu.se>

	* ecc-mod-inv.c (ecc_mod_inv): Use passed in scratch for all
	scratch needs, don't use memory after the result area.
	* ecc-ecdsa-sign.c (ecc_ecdsa_sign): Update invert call.
	* ecc-ecdsa-verify.c (ecc_ecdsa_verify): Likewise.
	* ecc-eh-to-a.c (ecc_eh_to_a): Likewise.
	* ecc-j-to-a.c (ecc_j_to_a): Likewise.
	* ecc-gostdsa-verify.c (ecc_gostdsa_verify): Likewise.
258
259
260
	* curve25519-eh-to-x.c (curve25519_eh_to_x): Likewise.
	* curve448-eh-to-x.c (curve448_eh_to_x): Update invert call, and
	reduce scratch need from 9*size to 5*size.
261
262
263
264
	* ecc-internal.h (ECC_MOD_INV_ITCH, ECC_J_TO_A_ITCH)
	(ECC_EH_TO_A_ITCH): Update accordingly, but no change in total
	scratch need.

Niels Möller's avatar
Niels Möller committed
265
266
267
268
269
270
2020-11-13  Niels Möller  <nisse@lysator.liu.se>

	* ecc-internal.h (ECC_J_TO_A_ITCH): Generalize, and take invert
	itch as an argument, similarly to ECC_EH_TO_A_ITCH. Updated all
	secp and gost curve definitions to use it.

271
272
273
274
275
276
277
2020-10-21  Niels Möller  <nisse@lysator.liu.se>

	* ecc-secp384r1.c (ecc_secp384r1_inv): New function, modular
	inverse using powering.
	(_nettle_secp_384r1): Analogous updates. Increases signing
	performance roughly 15% on x86_64.

278
279
2020-10-20  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
280
281
282
	* ecc-mod-inv.c (ecc_mod_inv_redc): Deleted, no longer needed.
	(ecc_mod_inv_destructive): Deleted, merged with ecc_mod_inv.

283
284
285
286
287
288
289
290
291
292
	* ecc-secp256r1.c (ecc_secp256r1_inv): New function, modular
	inverse using powering.
	(_nettle_secp_256r1): Analogous updates. Increases signing
	performance roughly 6% on x86_64.

	* ecc-secp224r1.c (ecc_secp224r1_inv): New function, modular
	inverse using powering.
	(_nettle_secp_224r1): Analogous updates. Increases signing
	performance roughly 17% on x86_64.

293
294
295
296
297
298
299
2020-10-19  Niels Möller  <nisse@lysator.liu.se>

	* ecc-secp521r1.c (ecc_secp521r1_inv): New function, modular
	inverse using powering.
	(_nettle_secp_521r1): Analogous updates. Increases signing
	performance roughly 15% on x86_64.

300
301
2020-10-15  Niels Möller  <nisse@lysator.liu.se>

302
303
304
305
306
	* ecc-secp192r1.c (ecc_secp192r1_inv): New function, modular
	inverse using powering.
	(_nettle_secp_192r1): Use it for p.invert, and also update
	h_to_a_itch. Increases signing performance roughly 25% on x86_64.

307
308
309
	* testsuite/ecc-modinv-test.c (test_modulo): Allow invert function
	to return a non-canonical representation.

310
311
2020-11-08  Niels Möller  <nisse@lysator.liu.se>

312
	Merge refactoring of ecc modulo and reduce functions.
313
314
315
316
317
318
319
320
	* eddsa-sign.c (_eddsa_sign_itch): Update, since now point
	multiplication needs less scratch than point compression.
	* eddsa-pubkey.c (_eddsa_public_key_itch): Likewise.

	* ecc-internal.h: Update *_ITCH macros for point multiplication
	and signatures. They need slightly less scratch after optimization
	of the point addition functions.

321
	* ecc-mul-m.c (ecc_mul_m): Reduce scratch need.
322
323
324
	(ecc_mul_m): Optimize swapping, with only a single mpn_cnd_swap
	per iteration.

325
	* ecc-add-jja.c (ecc_add_jja): Reduce scratch need.
326
	* ecc-add-jjj.c (ecc_add_jjj): Reduce scratch need.
327
	* ecc-internal.h (ECC_ADD_JJA_ITCH, ECC_ADD_JJJ_ITCH): Now 5*size.
328
	(ECC_MUL_M_ITCH): New 8*size.
329

330
331
2020-11-06  Niels Möller  <nisse@lysator.liu.se>

332
333
334
335
336
337
	After these changes, both curve25519 and curve448 need 4*size for
	invert and 6*size for sqrt.
	* ecc-curve448.c (ecc_mod_pow_446m224m1): Reduce scratch need.
	(ecc_curve448_inv): Likewise.
	(ecc_curve448_sqrt): Likewise.
	* ecc-curve25519.c (ecc_curve25519_sqrt): Reduce scratch need.
338

339
340
	* ecc-add-jja.c (ecc_add_jja): Delete an unneeded copy.

341
342
343
344
345
2020-11-05  Niels Möller  <nisse@lysator.liu.se>

	* ecc-dup-jj.c (ecc_dup_jj): Reduce scratch need.
	* ecc-internal.h (ECC_DUP_JJ_ITCH): Now 4*size.

346
347
2020-11-03  Niels Möller  <nisse@lysator.liu.se>

348
	* ecc-dup-eh.c (ecc_dup_eh): Reduce scratch need.
349
350
	* ecc-dup-th.c (ecc_dup_th): Analogous changes.
	* ecc-internal.h (ECC_DUP_EH_ITCH, ECC_DUP_TH_ITCH): Now 3*size.
351

352
353
354
355
	* ecc-internal.h (ecc_add_func): Document in-place operation.
	* ecc-mul-a-eh.c (ecc_mul_a_eh): Fix call to ecc->add_hhh accordingly.
	* testsuite/ecc-add-test.c (test_main): Likewise.

356
	* ecc-add-eh.c (ecc_add_eh): Reduce scratch need.
357
	* ecc-add-th.c (ecc_add_th): Analogous changes.
358
	* ecc-add-ehh.c (ecc_add_ehh): Reduce scratch need.
359
360
361
	* ecc-add-thh.c (ecc_add_thh): Analogous changes.
	* ecc-internal.h (ECC_ADD_EH_ITCH, ECC_ADD_EHH_ITCH)
	(ECC_ADD_TH_ITCH, ECC_ADD_THH_ITCH): Now 4*size.
362

363
364
365
366
2020-11-02  Niels Möller  <nisse@lysator.liu.se>

	* ecc-curve25519.c (ecc_mod_pow_252m3): Reduce scratch need.
	(ecc_curve25519_inv): Likewise.
367
	(ecc_curve25519_sqrt): Likewise.
368

369
370
2020-11-01  Niels Möller  <nisse@lysator.liu.se>

371
372
373
374
375
376
	* ecc-mod-arith.c (ecc_mod_mul, ecc_mod_sqr): Separate argument
	for scratch area, reducing required size of result area. Update
	all callers to naïvely keep using result in scratch area.
	(ecc_mod_pow_2k, ecc_mod_pow_2k_mul): Simplified, also reducing
	required size of result area.

377
378
	* testsuite/testutils.c (test_ecc_point): Show curve bits on failure.

Niels Möller's avatar
Niels Möller committed
379
380
2020-10-31  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
381
382
383
	* ecc-internal.h (typedef ecc_mod_func): Updated all assembly
	implementations.

Niels Möller's avatar
Niels Möller committed
384
385
386
387
	* testsuite/ecc-mod-test.c (test_one): Extend tests, to also test
	with different destination area.
	* testsuite/ecc-redc-test.c (test_main): Likewise.

388
389
390
391
392
2020-10-30  Niels Möller  <nisse@lysator.liu.se>

	* ecc-internal.h (typedef ecc_mod_func): Add separate result
	argument. Updated all C implementations and callers.

393
394
2020-10-29  Niels Möller  <nisse@lysator.liu.se>

395
396
397
	* ecc-mod.c (ecc_mod): More unified handling of final carry
	folding. Also eliminates a goto statement.

398
399
2020-11-07  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
400
	Merged initial powerpc64 implementation of chacha.
401
402
403
404
405
	* configure.ac: New command line option --enable-power-altivec.
	Update asm_path logic, and add altivec to FAT_TEST_LIST.
	* fat-ppc.c (get_ppc_features): Add logic to check for altivec and
	vsx support, and select aither C or altivec implementation of
	chacha_core.
Niels Möller's avatar
Niels Möller committed
406
	* powerpc64/p7/chacha-core-internal.asm: New file.
407

408
409
2020-09-25  Niels Möller  <nisse@lysator.liu.se>

410
411
412
	* powerpc64/p7/chacha-core-internal.asm: New file.
	* Makefile.in (distdir): Add powerpc64/p7.

413
414
415
416
417
418
2020-10-29  Niels Möller  <nisse@lysator.liu.se>

	* blowfish.c (blowfish_set_key): Add casts to uint32_t. Avoids
	undefined behavior, since shifting an 8-bit value left by 24 bits
	overflows the range of signed int. Reported by Guido Vranken.

419
420
421
422
423
424
425
426
427
428
429
2020-10-28  Niels Möller  <nisse@lysator.liu.se>

	* gmp-glue.h (cnd_add_n, cnd_sub_n, cnd_swap): Deleted, use
	corresponding functions mpn_cnd_add_n, mpn_cnd_sub_n,
	mpn_cnd_swap, available from GMP version 6.1.0. Update all
	callers, in particular, mpn_cnd_add_n and mpn_cnd_sub_n has one
	more argument than the old functions.

	* gmp-glue.c (mpn_cnd_add_n, mpn_cnd_sub_n, mpn_cnd_swap)
	[NETTLE_USE_MINI_GMP]: Fallback definitions or mini-gmp builds.

430
431
432
433
434
435
436
437
438
439
2020-10-14  Niels Möller  <nisse@lysator.liu.se>

	* ecc-mod-arith.c (ecc_mod_pow_2k, ecc_mod_pow_2k_mul): Moved
	functions here.
	* ecc-internal.h (ecc_mod_pow_2kp1): New macro, calling the more
	general ecc_mod_pow_2k_mul.
	* ecc-curve25519.c (ecc_mod_pow_2kp1): Deleted static function.
	* ecc-curve448.c (ecc_mod_pow_2k, ecc_mod_pow_2kp1): Deleted
	static functions.

440
2020-10-13  Niels Möller  <nisse@lysator.liu.se>
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458

	* ecc-mod-inv.c (ecc_mod_inv_destructive): New helper function,
	not preserving input argument. Extracted from old ecc_mod_inv.
	(ecc_mod_inv): Call ecc_mod_inv_destructive.
	(ecc_mod_inv_redc): New inversion function, with input and output
	in redc form.

	* ecc-secp224r1.c: Select between ecc_mod_inv and ecc_mod_inv_redc.
	* ecc-secp256r1.c: Likewise.

	* ecc-j-to-a.c (ecc_j_to_a): Simplify redc-related logic, taking
	advantage of ecc->p.invert handling redc, when appropriate. Reduce
	scratch need from 5n to 4n in the process (assuming inversion
	needs 2n).

	* testsuite/ecc-modinv-test.c (ref_modinv): Updated to do redc, if
	appropriate.

459
460
461
462
463
2020-09-25  Niels Möller  <nisse@lysator.liu.se>

	* gcm.c (gcm_fill): Added separate implementations for big- and
	little-endian, to use uint64_t stores and less overhead.

464
2020-09-24  Niels Möller  <nisse@lysator.liu.se>
465
466
467
468

	* aclocal.m4 (GMP_ASM_POWERPC_R_REGISTERS): Prefer to use register
	names. Can be tested by configuring with CC='gcc -Wa,-mregnames'.

469
2020-09-21  Niels Möller  <nisse@lysator.liu.se>
Niels Möller's avatar
Niels Möller committed
470
471
472
473

	* m4-utils.m4: New file with m4 utilities, copied from GMP's
	mpn/asm-defs.m4.
	* Makefile.in (DISTFILES): Add m4-utils.m4.
474
475
476
477
478
479
480
481
482
483
484
	(%.asm): Include m4-utils.m4 for preprocessing of .asm files, and
	include config.m4 before machine.m4.

	* aclocal.m4 (GMP_ASM_POWERPC_R_REGISTERS): New configure test,
	adapted from corresponding test in GMP's acinlude.m4.
	* configure.ac (ASM_PPC_WANT_R_REGISTERS): New substituted
	variable. Set using GMP_ASM_POWERPC_R_REGISTERS, when powerpc64
	assembly code is enabled.
	* config.m4.in: Substituted here.
	* powerpc64/machine.m4: Check ASM_PPC_WANT_R_REGISTERS, and
	if needed, replace register names like r0, r1, ... with integers.
Niels Möller's avatar
Niels Möller committed
485

486
2020-09-15  Niels Möller  <nisse@lysator.liu.se>
487
488
489

	* Makefile.in (DISTFILES): Add missing file blowfish-internal.h.

490
2020-09-14  Niels Möller  <nisse@lysator.liu.se>
491
492
493
494
495

	* asm.m4: Delete use of changequote, stick to the m4 default
	quoting characters `'. Updated all assembly and m4 files.
	* x86_64/machine.m4 (W64_ENTRY, W64_EXIT): Delete quoting workaround.

496
2020-09-12  Niels Möller  <nisse@lysator.liu.se>
497
498
499

	* x86_64/salsa20-2core.asm: Fix incorrect W64_EXIT.

500
2020-08-29  Niels Möller  <nisse@lysator.liu.se>
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517

	Initial powerpc64 assembly support, contributed by Mamone Tarsha:
	* configure.ac: New configure option --enable-power-crypto-ext.
	(asm_path): Setup this and related variables for powerpc64.
	* powerpc64/machine.m4: New file.
	* powerpc64/README: New file.
	* powerpc64/p8/aes-encrypt-internal.asm: New file.
	* powerpc64/p8/aes-decrypt-internal.asm: New file.
	* powerpc64/fat/aes-encrypt-internal-2.asm: New file.
	* powerpc64/fat/aes-decrypt-internal-2.asm: New file.
	* fat-ppc.c: New file.
	* Makefile.in (OPT_SOURCES): Add fat-ppc.c.
	(distdir): Add powerpc64 directories.
	* aes-decrypt-internal.c (_nettle_aes_decrypt_c): Alternative
	name, for fat builds.
	* aes-encrypt-internal.c (_nettle_aes_encrypt_c): Likewise.

Niels Möller's avatar
Niels Möller committed
518
519
520
521
522
523
2020-07-28  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac (FAT_TEST_LIST): New substituted variable. Set for
	fat builds, otherwise empty.
	* Makefile.in (check-fat): New target, using $(FAT_TEST_LIST).

524
525
2020-07-13  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
526
527
528
	* chacha-crypt.c (chacha_crypt) [HAVE_NATIVE_chacha_3core]: Use
	_chacha_3core.

529
530
531
	* arm/neon/chacha-3core.asm: New file, 3-way interleaving of
	chacha.

532
533
534
535
2020-07-11  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/chacha-test.c (test_main): Delete obsolete tests for
	chacha with 128-bit keys. #if:ed out since 2014-03-04, see below.
536
537
	(test_chacha_core): New function, test chacha with simple input
	structure.
538

539
540
541
2020-07-10  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/salsa20-2core.asm: New file.
Niels Möller's avatar
Niels Möller committed
542
	* x86_64/salsa20-crypt.asm: Deleted, since the 2core assembly is
543
544
	faster.

545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
2020-07-08  Niels Möller  <nisse@lysator.liu.se>

	Rearrange salsa20, enabling ARM fat builds to use sala20_2core.
	* salsa20-crypt-internal.c (_salsa20_crypt_2core)
	(_salsa20_crypt_1core): New file, new functions. One or the other
	is used for implementing salsa20_crypt and salsa20r12_crypt,
	depending on availability of salsa20_2core.
	* salsa20-crypt.c (salsa20_crypt): Call _salsa20_crypt.
	* salsa20r12-crypt.c (salsa20r12_crypt): Likewise.
	* salsa20-internal.h: Declare new internal functions.
	* Makefile.in (nettle_SOURCES): Add salsa20-crypt-internal.c.
	* fat-setup.h (salsa20_crypt_func): New typedef.
	* fat-arm.c (_salsa20_crypt): Select _salsa20_crypt
	implementation, use 2core version when Neon instructions are
	available.
	* arm/fat/salsa20-2core.asm: New file, including Neon
	implementation. Trigger configure's HAVE_NATIVE_fat_salsa20_2core,
	* configure.ac: Add HAVE_NATIVE_fat_salsa20_2core, to identify the
	case that salsa20_2core is defined, but runtime checks are needed
	to determine if it is usable.

566
567
2020-07-06  Niels Möller  <nisse@lysator.liu.se>

568
569
570
	* testsuite/salsa20-test.c (test_salsa20_core): New function, test
	salsa20 with simple input structure.

571
572
573
	* configure.ac: Obey --enable-arm-neon=yes, even if not explicitly
	targetting ARM v6 or later.

574
575
576
577
578
579
580
581
582
583
584
585
2020-07-01  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/bcrypt-test.c: New file. Moved bcrypt tests here.

	Support for bcrypt, contributed by Stephen R. van den Berg.
	* blowfish-bcrypt.c (blowfish_bcrypt_hash)
	(blowfish_bcrypt_verify): New file, new functions.
	* blowfish-internal.h: New header file, declaring internals needed
	for bcrypt.
	* testsuite/blowfish-test.c: Add bcrypt tests.
	* nettle.texinfo (Cipher functions): Document bcrypt.

586
587
588
589
590
591
2020-06-30  Niels Möller  <nisse@lysator.liu.se>

	* nettle.texinfo (Miscellaneous hash functions): New section, with
	Streebog documentation, contributed by Dmitry Baryshkov.
	(Top): Added some missing entries to the detailed node listing

592
593
594
595
596
2020-06-29  Niels Möller  <nisse@lysator.liu.se>

	* .gitlab-ci.yml: Add cross tests for powerpc64le, based on patch
	by Maamoun TK.

597
598
599
600
601
2020-06-25  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/chacha-core-internal.asm (QROUND): Fix use of macro
	arguments. Spotted by Torbjörn Granlund.

602
603
604
605
606
607
608
609
2020-06-02  Niels Möller  <nisse@lysator.liu.se>

	* examples/nettle-benchmark.c (main): Delete call to
	time_overhead. The attempt to measure function call overhead is
	not very useful or accurate. The benchmarking loop is optimized
	away by gcc-10, making the benchmark program hang.
	(bench_nothing, time_overhead): Deleted.

Niels Möller's avatar
Niels Möller committed
610
611
612
613
2020-04-29  Niels Möller  <nisse@lysator.liu.se>

	* Released Nettle-3.6.

614
615
2020-04-27  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
616
617
618
619
620
	* configure.ac: Tweak gcc command line options. Delete checks for
	older gcc versions. Add -Wno-sign-compare, since warnings for
	signed/unsigned comparisons adds a lot of noise, in particular
	when building mini-gmp.

621
622
623
624
	* mini-gmp.c: Updated mini-gmp from the gmp repository, latest
	change from 2020-04-20.
	* mini-gmp.h: Likewise.

Niels Möller's avatar
Niels Möller committed
625
626
2020-04-25  Niels Möller  <nisse@lysator.liu.se>

627
628
629
630
631
632
	* gmp-glue.c (mpz_limbs_read, mpz_limbs_write, mpz_limbs_modify)
	(mpz_limbs_finish, mpz_roinit_n): Delete compatibility
	definitions. These functions available in GMP since version 6.0.0.
	* gmp-glue.h: Delete corresponding declarations, and preprocessor
	conditions.

633
634
635
636
637
638
639
640
	* configure.ac: Update required version of GMP to 6.1.0, needed
	for mpn_zero_p.
	* ecc-ecdsa-verify.c (zero_p): Deleted static function, usage
	replaced with mpn_zero_p.
	* testsuite/testutils.c (mpn_zero_p): Delete conditional
	definition.
	* testsuite/testutils.h: Delete corresponding declarations.

Niels Möller's avatar
Niels Möller committed
641
642
643
	* Makefile.in (DISTFILES): Add poly1305-internal.h.
	* testsuite/Makefile.in (DISTFILES): Delete setup-env.

644
645
2020-04-23  Niels Möller  <nisse@lysator.liu.se>

646
647
648
649
650
651
652
	* run-tests: Set WINEPATH, since it appears wine doesn't search
	for dlls in the unix PATH.
	* examples/setup-env: Delete creation of extra dll symlinks.
	* examples/teardown-env: Delete corresponding cleanup.
	* testsuite/setup-env: Deleted file (same symlink creation).
	* testsuite/teardown-env: Delete corresponding cleanup.

653
654
655
656
657
	* testsuite/ecc-add-test.c (test_main): Delete ASSERTs with
	functions pointer comparisons. They provide little value, and fail
	when linking with hogweed.dll on windows.
	* testsuite/ecc-dup-test.c (test_main): Likewise.

658
659
660
661
662
663
664
2020-04-22  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/Makefile.in: Use pattern rules for test executables,
	replacing...
	(test-rules): ...deleted rule.
	* testsuite/.test-rules.make: Deleted file.

Niels Möller's avatar
Niels Möller committed
665
666
667
668
669
670
671
2020-04-21  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* gostdsa-vko.c (gostdsa_vko): New file and function.
	* testsuite/gostdsa-vko-test.c (test_vko): New test.
	* nettle.texinfo (GOSTDSA): Document it.

672
673
674
675
676
677
678
679
680
681
682
2020-04-19  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* gosthash94.h (struct gosthash94_ctx): Rearrange struct to enable
	use of MD_UPDATE macro, in particular, replacing byte count with
	block count and index. Also move buffer last, for consistency with
	other hash functions.
	* gosthash94.c (gosthash94_update_int): Use MD_UPDATE macro.
	(gosthash94_write_digest): Update for block count rather than byte
	count.

683
684
685
686
687
688
2020-04-17  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac (LIBNETTLE_MAJOR): Increase libnettle version
	number to 8.0, for move of internal poly1305 functions.
	(LIBNETTLE_MINOR): Reset to zero.

689
690
691
692
693
694
695
696
697
698
2020-04-15  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* poly1305.h (poly1305_set_key, poly1305_digest, _poly1305_block):
	Removed declarations from this public header file.
	* poly1305-internal.h: New file, with declarations of internal
	poly1305 functions.
	(_poly1305_set_key, _poly1305_digest): Renamed, with leading
	underscore. Updated definitions and all uses.

699
700
2020-04-12  Niels Möller  <nisse@lysator.liu.se>

701
702
703
	* Makefile.in (DISTFILES): Reorder to ensure that generated des
	headers can't be older than desdata.stamp.

704
705
706
	* testsuite/ed448-test.c: Define _GNU_SOURCE, for getline with gcc
	-std=c89.

707
708
2020-04-06  Niels Möller  <nisse@lysator.liu.se>

709
710
	* configure.ac (LIBHOGWEED_MAJOR): Increase libhogweed version
	number to 6.0, at request of Gnutls team.
711
712
	(LIBHOGWEED_MINOR): Reset to zero.

713
714
715
716
717
718
2020-04-01  Niels Möller  <nisse@lysator.liu.se>

	* config.guess: Update to 2020-01-01 version, from savannah's
	config.git.
	* config.sub: Likewise.

719
720
2020-03-31  Niels Möller  <nisse@lysator.liu.se>

721
722
723
	* aclocal.m4 (LSH_TYPE_SOCKLEN_T, LSH_CHECK_KRB_LIB, LSH_LIB_ARGP)
	(LSH_MAKE_CONDITIONAL): Delete unused macros.

724
725
726
727
728
729
730
731
732
733
	* config.make.in (abs_top_builddir, TEST_SHLIB_DIR): New variables.

	* run-tests: Check TEST_SHLIB_DIR, and set up LD_LIBRARY_PATH and
	related member variables.

	* testsuite/Makefile.in (check): Pass only TEST_SHLIB_DIR
	to the run-tests script, and leave setting of LD_LIBRARY_PATH and
	related variables to that script.
	* examples/Makefile.in (check): Likewise.

734
735
736
737
738
739
2020-03-26  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Bump package version to 3.6.
	(LIBNETTLE_MINOR): Bump minor number, now 7.1.
	(LIBHOGWEED_MINOR): Bump minor numbers, now 5.1

740
741
742
743
744
745
746
747
748
749
2020-03-14  Niels Möller  <nisse@lysator.liu.se>

	From H.J. Lu:
	* configure.ac (ASM_X86_ENDBR)
	(ASM_X86_MARK_CETASM_X86_MARK_CET_ALIGN): New substituted
	variables.
	* config.m4.in: Substituted here. Add ASM_X86_MARK_CET to
	diversion inserted at end of assembly files.
	* asm.m4 (PROLOGUE): Add ASM_X86_ENDBR at entry point.

Niels Möller's avatar
Niels Möller committed
750
751
752
753
754
755
756
757
758
759
760
761
762
2020-03-09  Niels Möller  <nisse@lysator.liu.se>

	From Daiki Ueno:
	* chacha-crypt.c (chacha_crypt32): New function.
	* chacha-set-nonce.c (chacha_set_counter, chacha_set_counter32):
	New functions.
	* chacha.h (CHACHA_COUNTER_SIZE, CHACHA_COUNTER32_SIZE): New constants.
	* chacha-poly1305.c (chacha_poly1305_encrypt)
	(chacha_poly1305_decrypt): Use chacha_crypt32.
	* testsuite/chacha-test.c: Update tests to use new functions.
	* nettle.texinfo: Document new chacha functions, and update
	out-of-date chacha-poly1305 documentation.

Niels Möller's avatar
Niels Möller committed
763
764
765
766
767
768
769
770
2020-03-08  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* cmac-des3-meta.c (nettle_cmac_des): New file, moving definition
	from...
	* testsuite/cmac-test.c: ... old location.
	* nettle-meta.h (nettle_cmac_des): Declare it.

Niels Möller's avatar
Niels Möller committed
771
772
773
774
775
776
777
778
779
2020-02-15  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* ecc-internal.h (ecc_modq_add, ecc_modq_mul, ecc_modp_sqr)
	(ecc_modp_mul, ecc_mod_submul_1, ecc_modp_mul_1, ecc_modp_add)
	(ecc_modp_sub): Deleted macros. Updated callers to use respective
	functions instead.
	(ecc_modp_addmul_1): Delete unused macro.

780
781
2020-02-09  Niels Möller  <nisse@lysator.liu.se>

782
783
784
785
	Addition of struct nettle_mac based on patches by Daiki Ueno.
	* nettle-meta-macs.c (nettle_get_macs): New file, new function.
	* testsuite/meta-mac-test.c: New test.

786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
	* nettle-meta.h (_NETTLE_HMAC): New macro.
	(nettle_hmac_md5, nettle_hmac_ripemd160, nettle_hmac_sha1)
	(nettle_hmac_sha224, nettle_hmac_sha256, nettle_hmac_sha384)
	(nettle_hmac_sha512): Declare.
	(struct nettle_mac): New public struct,
	* testsuite/testutils.h: ...moved from this file.

	* hmac-md5-meta.c: New file.
	* hmac-ripemd160-meta.c: Likewise.
	* hmac-sha1-meta.c: Likewise.
	* hmac-sha224-meta.c: Likewise.
	* hmac-sha256-meta.c: Likewise.
	* hmac-sha384-meta.c: Likewise.
	* hmac-sha512-meta.c: Likewise.

	* Makefile.in (nettle_SOURCES): Add new files.

	* testsuite/testutils.h (_NETTLE_HMAC): Delete unused version of
	this macro.
	* testsuite/testutils.c (test_mac): Allow testing with smaller
	digest size.
	* testsuite/hmac-test.c (test_main): Use test_mac for tests using
	key size == digest size.

810
811
812
813
814
	* testsuite/cmac-test.c (nettle_cmac_aes128, nettle_cmac_aes256):
	Moved to...
	* cmac-aes128-meta.c: New file.
	* cmac-aes256-meta.c: New file.

815
816
817
	* nettle-meta.h (struct nettle_mac): New public struct,
	* testsuite/testutils.h: ...moved from this file.

Niels Möller's avatar
Niels Möller committed
818
819
820
821
822
2020-02-06  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Baryshkov:
	* gost28147.h: Deleted, move declarations to gost28147-internal.h.

823
824
825
826
827
828
829
830
831
2020-02-05  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: On Solaris, link shared libraries with --shared
	rather than -G. For gcc, --shared is the proper way. For Solaris'
	proprietary cc, according to docs, it accepts --shared as an alias
	for -G since Oracle Solaris Studio 12.4, and it was made more gcc
	compatible in later versions. Since 12.4 was released in 2014,
	don't attempt to cater for older versions.

832
833
2020-01-26  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
	* ecc-internal.h (struct ecc_curve): Delete g, the curve
	generator, since it was used only by tests. Update all curve
	instances.

	* eccdata.c (output_curve): Delete output of ecc_g.
	(output_point): Delete name argument, and update callers.

	* testsuite/testutils.c (ecc_ref): Table of reference points moved
	out of test_ecc_mul_a. Add generator to the list of points.
	(test_ecc_mul_a): Use ecc_ref table also for the n == 1 case.
	(test_ecc_ga, test_ecc_get_g, test_ecc_get_ga): New functions,
	using the tabulated generator.

	* testsuite/ecc-add-test.c: Use test_ecc_get_g, instead of
	accessing ecc->g.
	* testsuite/ecc-dup-test.c: Likewise.
	* testsuite/ecc-mul-a-test.c: Use test_ecc_get_ga and test_ecc_ga.
	Delete special case for n == 1.
	* testsuite/ecc-mul-g-test.c: Use test_ecc_ga.

Niels Möller's avatar
Niels Möller committed
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
	Support for GOST DSA, contributed by Dmitry Baryshkov.
	* gostdsa-verify.c (gostdsa_verify): New file and function.
	* gostdsa-sign.c (gostdsa_sign): New file and function.
	* ecc-gostdsa-verify.c (ecdsa_in_range, ecc_gostdsa_verify_itch)
	(ecc_gostdsa_verify): New file and functions.
	* ecc-gostdsa-sign.c (ecc_gostdsa_sign_itch, ecc_gostdsa_sign):
	New file and functions.
	* ecc-internal.h (ECC_GOSTDSA_SIGN_ITCH): New macro.
	* ecc-hash.c (gost_hash): New function.
	* testsuite/gostdsa-verify-test.c: New test.
	* testsuite/gostdsa-sign-test.c: New test.
	* testsuite/gostdsa-keygen-test.c: New test.
	* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Add new tests.

	Support for GOST gc256b and gc512a curves, contributed by Dmitry
	Baryshkov.
	* eccdata.c (ecc_curve_init): Add parameters for gost_gc256b and
	gost_gc512a.
	* ecc-gost-gc256b.c: New file, define _nettle_gost_gc256b.
	* ecc-gost-gc512a.c: New file, define _nettle_gost_gc512a.
	* Makefile.in: Add rules to generate ecc-gost-gc256b.h and
	ecc-gost-gc512a.h.
	(hogweed_SOURCES): Add ecc-gost-gc256b.c ecc-gost-gc512a.c.
	* examples/ecc-benchmark.c (curves): Add to list.
	* testsuite/testutils.c (ecc_curves): Add to list.
	(test_ecc_mul_a): Reference points for new curves.

881
882
	* NEWS: Started on entries for Nettle-3.6.

883
884
885
886
887
2020-01-25  Niels Möller  <nisse@lysator.liu.se>

	* examples/hogweed-benchmark.c (bench_curve_init): Pass correct
	sizes to knuth_lfib_random. Patch contributed by Dmitry Baryshkov.

888
889
2020-01-15  Niels Möller  <nisse@lysator.liu.se>

890
891
892
893
894
895
896
897
898
899
900
901
902
903
	* Makefile.in: Replace suffix rules by pattern rules. Move .asm
	rule above .c rule, since now the order of rules in the Makefile
	matters, rather than the order in the .SUFFIXES list.
	(aesdata, desdata, twofishdata, shadata, gcmdata, eccparams):
	Individual rules replaced by a pattern rule.
	(eccdata): Add explicit dependencies, to complement the pattern
	rule.
	* examples/Makefile.in: Replace suffix rules by pattern rules.
	* testsuite/Makefile.in: Likewise.
	* tools/Makefile.in: Likewise.

	* config.make.in: Empty .SUFFIXES, to not accidentally use any
	suffix rules.

904
905
906
907
908
909
910
911
912
913
	* aclocal.m4 (DEP_INCLUDE): Delete substituted variable.

	* Makefile.in: Use the GNU make directive -include to include
	dependency .d files. Delete dependency files on make clean.
	* examples/Makefile.in: Likewise.
	* testsuite/Makefile.in: Likewise. Also use $(OBJEXT) properly.
	* tools/Makefile.in: Likewise.

	* configure.ac (dummy-dep-files): Delete these config commands.

914
915
916
917
918
919
920
921
922
923
2020-01-10  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Eremin-Solenikov: Consistently rename ecc files and
	internal functions to include curve name rather than just number
	of bits. E.g.,
	* ecc-256.c (nettle_ecc_256_redc): File and function renamed to...
	* ecc-secp256r1.c (_nettle_ecc_256_redc): ... new names.
	* eccdata.c (ecc_curve_init, main): Take curve name as input, not
	bit size.

924
925
926
927
928
929
930
931
932
933
934
935
936
937
2020-01-03  Niels Möller  <nisse@lysator.liu.se>

	Add benchmarking of ed25519, ed448 and curve448.
	* examples/hogweed-benchmark.c: (struct eddsa_ctx): New struct.
	(bench_eddsa_init, bench_eddsa_sign, bench_eddsa_verify)
	(bench_eddsa_clear): New functions.
	(struct curve_ctx): New struct, generalizing struct curve25519_ctx.
	(bench_curve_init, bench_curve_mul_g, bench_curve_mul)
	(bench_curve_clear): New functions.
	(struct curve25519_ctx, bench_curve25519_mul_g)
	(bench_curve25519_mul, bench_curve25519): Deleted.
	(alg_list): Add eddsa and curve entries.
	(main): Delete call to bench_curve25519.

938
939
2020-01-02  Niels Möller  <nisse@lysator.liu.se>

940
941
942
943
944
945
946
947
948
949
950
951
952
	* eddsa-internal.h (nettle_eddsa_dom_func): New typedef.
	(struct ecc_eddsa): Use function pointer to represent eddsa dom
	string. To avoid calling sha512_update with empty input for
	ed25519.
	* ed448-shake256.c (ed448_dom): New function, calling
	sha3_256_update with the magic dom prefix.
	(_nettle_ed448_shake256): Point to it.
	* ed25519-sha512.c (_nettle_ed25519_sha512): Add do-nothing dom function.

	* eddsa-sign.c (_eddsa_sign): Update to use dom function pointer.
	* eddsa-verify.c (_eddsa_verify): Likewise.

	* eddsa-internal.h (struct ecc_eddsa): Add magic dom string,
953
	needed for ed448.
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
	* ed25519-sha512.c (_nettle_ed25519_sha512): Empty dom string.
	* ed448-shake256.c (_nettle_ed448_shake256): New file and
	parameter struct.

	* eddsa-hash.c (_eddsa_hash): Add digest_size as input argument.
	Handle ed448 digests with two extra bytes. Update callers.
	* eddsa-verify.c (_eddsa_verify): Hash dom string.
	* eddsa-sign.c (_eddsa_sign_itch): Assert that
	_eddsa_compress_itch isn't too large.
	(_eddsa_sign): New argument k1, with the hash prefix. Add hashing
	of this prefix and the dom string. Update callers. Fix final
	reduction, it's different for ed25519, with q slightly larger than
	a power of two, and ed448, with q slightly smaller.
	* eddsa-pubkey.c (_eddsa_public_key_itch): Assert that
	_eddsa_compress_itch isn't too large.
969

Niels Möller's avatar
Niels Möller committed
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
	Implementation of ed448-shake256, based on patch by Daiki Ueno.
	* ed448-shake256-pubkey.c (ed448_shake256_public_key): New file
	and function.
	* ed448-shake256-sign.c (ed448_shake256_sign): New file and function.
	* ed448-shake256-verify.c (ed448_shake256_verify): New file and function.

	* Makefile.in (hogweed_SOURCES): Add new ed448 files.

	* testsuite/eddsa-verify-test.c (test_ed448): New function.
	(test_main): New ed448 tests.
	* testsuite/eddsa-sign-test.c (test_ed448_sign): New function.
	(test_main): New ed448 tests.
	* testsuite/ed448-test.c: New tests.
	* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Add ed448-test.c.

	* nettle.texinfo (Curve 25519 and Curve 448): Document ed448.

987
988
2020-01-01  Niels Möller  <nisse@lysator.liu.se>

989
990
991
992
993
994
995
	* ecc-448.c (ecc_mod_pow_2kp1): New function.
	(ecc_mod_pow_446m224m1): Reduce scratch usage from 6*n to 5*n, at
	the cost of one copy operation. Also use ecc_mod_pow_2kp1 where
	applicable.
	(ECC_448_INV_ITCH): Reduce to 5*ECC_LIMB_SIZE.
	(ECC_448_SQRT_ITCH): Reduce to 9*ECC_LIMB_SIZE.

996
997
	* testsuite/eddsa-compress-test.c: Test also with curve448.

998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
2019-12-30  Niels Möller  <nisse@lysator.liu.se>

	Preparation for ed448, based on patch by Daiki Ueno.
	* eddsa-internal.h (struct ecc_eddsa): New struct for eddsa
	parameters.
	* ed25519-sha512.c (_nettle_ed25519_sha512): New parameter struct.
	* eddsa-expand.c (_eddsa_expand_key): Replace input
	struct nettle_hash with struct ecc_eddsa, and generalize for
	ed448. Update all callers.
	* eddsa-sign.c (_eddsa_sign): Likewise.
	* eddsa-verify.c (_eddsa_verify): Likewise.
	* eddsa-compress.c (_eddsa_compress): Store sign bit in most
	significant bit of last byte, as specified by RFC 8032.
	* eddsa-decompress.c (_eddsa_decompress): Corresponding update.
	Also generalize to support ed448, and make validity checks
	stricter.
	* testsuite/eddsa-sign-test.c (test_ed25519_sign): New function.
	(test_main): Use it.
	* testsuite/eddsa-verify-test.c (test_ed25519): New function.
	(test_main): Use it.

1019
1020
2019-12-28  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
1021
	* bignum.h: Drop unrelated include of nettle-meta.h.
1022
1023
1024
	* pss.h: Include nettle-meta.h explicitly.
	* eddsa-internal.h: Likewise.

1025
1026
2019-12-25  Niels Möller  <nisse@lysator.liu.se>

1027
1028
1029
1030
1031
1032
1033
1034
	Support for SHAKE256, based on patch by Daiki Ueno.
	* shake256.c (sha3_256_shake): New file and function.
	* Makefile.in (nettle_SOURCES): Add shake256.c.
	* testsuite/testutils.c (test_hash): Allow arbitrary digest size,
	if hash->digest_size == 0.
	* testsuite/shake.awk: New script to extract test vectors.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Add shake256-test.c.
	(DISTFILES): Add shake.awk.
Niels Möller's avatar
Niels Möller committed
1035
	* nettle.texinfo (Recommended hash functions): Document SHAKE-256.
1036

1037
1038
1039
1040
1041
1042
	* sha3.c (_sha3_pad): Generalized with an argument for the magic
	suffix defining the sha3 instance.
	* sha3-internal.h (_sha3_pad_hash): New macro, for SHA3 hashes.
	Updated all callers of _sha3_pad.
	(_sha3_pad_shake): New macro, using the SHAKE magic byte 0x1f.

1043
1044
1045
1046
1047
1048
1049
1050
2019-12-19  Niels Möller  <nisse@lysator.liu.se>

	* ecc-mul-a-eh.c (ecc_mul_a_eh) [ECC_MUL_A_EH_WBITS == 0]: Use
	add_hh rather than add_hhh.
	(table_init) [[ECC_MUL_A_EH_WBITS > 0]: Likewise.
	* ecc-internal.h (ECC_MUL_A_EH_ITCH) [ECC_MUL_A_EH_WBITS == 0]:
	Reduced from 13*n to 12*n.

1051
1052
2019-12-18  Niels Möller  <nisse@lysator.liu.se>

1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
	Rename add and dup functions for Edwards curves.
	* ecc-dup-th.c (ecc_dup_th): New file, move and rename ecc_dup_eh.
	* ecc-add-th.c (ecc_add_th): New file, move and rename ecc_add_eh.
	* ecc-add-thh.c (ecc_add_thh): New file, move and rename
	ecc_add_ehh.
	* ecc-dup-eh.c (ecc_dup_eh_untwisted): Rename to just ecc_dup_eh.
	* ecc-add-eh.c (ecc_add_ehh_untwisted): Rename to just ecc_add_eh.
	* ecc-add-ehh.c (ecc_add_ehh_untwisted): Rename to just ecc_add_ehh.
	* ecc-internal.h (ecc_dup_th, ecc_add_th, ecc_add_thh): Declare
	new functions, delete declarations of ecc_*_untwisted variants.
	(ECC_DUP_TH_ITCH, ECC_ADD_TH_ITCH, ECC_ADD_THH_ITCH): New macros.
	* ecc-25519.c (_nettle_curve25519): Update, use ecc_dup_th and
	friends.
	* ecc-448.c (_nettle_curve448): Update for rename, without
	_untwisted suffix.
	* Makefile.in (hogweed_SOURCES): Added ecc-dup-th.c, ecc-add-th.c,
	and ecc-add-thh.c
	* testsuite/ecc-dup-test.c (test_main): Update asserts.
	* testsuite/ecc-add-test.c (test_main): Likewise.

1073
1074
1075
	* eddsa-verify.c (_eddsa_verify): Use function pointer rather than
	calling ecc_add_eh directly. Preparation for eddsa over curve448.

1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
2019-12-17  Niels Möller  <nisse@lysator.liu.se>

	* examples/ecc-benchmark.c (bench_dup_hh): Rename, and use
	ecc->dup pointer.
	(bench_dup_jj): ... old name.
	(bench_add_hh): Rename, and use ecc->addd_hh pointer.
	(bench_add_jja): ... old name.
	(bench_dup_eh, bench_add_eh): Deleted.
	(bench_curve): Update, and delete curve25519 special case.
	(main): Update table headers accordingly.

1087
1088
1089
1090
2019-12-15  Niels Möller  <nisse@lysator.liu.se>

	* ecc-dup-eh.c (ecc_dup_eh): Eliminate one unneeded ecc_modp_add.

Niels Möller's avatar
Niels Möller committed
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
2019-12-14  Niels Möller  <nisse@lysator.liu.se>

	* ecc-mul-m.c (ecc_mul_m): New file and function. Implements
	multipliction for curves in Montgomery representation, as used for
	curve25519 and curve448. Extracted from curve25519_mul.
	* ecc-internal.h (ecc_mul_m): Declare.
	(ECC_MUL_M_ITCH): New macro.
	* Makefile.in (hogweed_SOURCES): Add ecc-mul-m.c.

	* curve25519-mul.c (curve25519_mul): Use ecc_mul_m.
	* curve448-mul.c (curve448_mul): Likewise.

1103
1104
1105
1106
2019-12-13  Niels Möller  <nisse@lysator.liu.se>

	* Merge curve448 implementation.

1107
1108
2019-12-09  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
1109
1110
1111
1112
1113
1114
	* ecc-internal.h: Revert itch macro changes. We now have
	h_to_a_itch <= mul_itch, mul_g_itch. Add asserts at a few places
	relying on this.
	(ECC_ECDSA_KEYGEN_ITCH, ECC_MAX): Delete macros.
	(ECC_ECDSA_SIGN_ITCH): Revert previous change.

1115
1116
1117
1118
1119
	* ecc-448.c (ecc_mod_pow_446m224m1): Reduce scratch space from 9*n
	to 6*n.
	(ECC_448_INV_ITCH, ECC_448_SQRT_ITCH): Reduce accordingly.
	* curve448-mul.c (curve448_mul): Reduce allocation from 14*n to 12*n.

1120
1121
1122
1123
1124
1125
1126
1127
1128
2019-12-08  Niels Möller  <nisse@lysator.liu.se>

	* x86_64/ecc-curve448-modp.asm (nettle_ecc_curve448_modp): New
	assembly function.
	* ecc-448.c (ecc_448_modp) [HAVE_NATIVE_ecc_curve448_modp]: Use
	native nettle_ecc_curve448_modp if available.
	* configure.ac (asm_hogweed_optional_list): Add ecc-curve448-modp.asm.
	(HAVE_NATIVE_ecc_curve448_modp): New config.h define.

1129
1130
1131
1132
2019-12-03  Niels Möller  <nisse@lysator.liu.se>

	* ecc-448.c (ecc_448_modp) [GMP_NUMB_BITS == 64]: New function.

Niels Möller's avatar
Niels Möller committed
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
2019-12-01  Niels Möller  <nisse@lysator.liu.se>

	Curve 448 support contributed by Daiki Ueno.
	* eccdata.c (enum ecc_type): Add ECC_TYPE_EDWARDS.
	(ecc_add): Support untwisted edwards curves.
	(ecc_curve_init): Add curve448 parameters.
	* ecc-internal.h (ECC_ECDSA_KEYGEN_ITCH): New macro.
	(ECC_ECDSA_SIGN_ITCH): Increased from 12*size to 13*size.
	(ECC_MAX): New macro.
	* ecc-448.c: New file.
	(ecc_mod_pow_2k, ecc_mod_pow_446m224m1, ecc_448_inv)
	(ecc_448_zero_p, ecc_448_sqrt): New functions.
	(_nettle_curve448): New curve definition.
	* curve448.h (CURVE448_SIZE): New constant.
	(curve448_mul_g, curve448_mul): Declare new public functions.
	* ecc-eh-to-a.c (ecc_eh_to_a): Update assert to allow the curve448
	Edwards curve.
	* curve448-mul.c (curve448_mul): New file and function.
	* curve448-mul-g.c (curve448_mul_g): New file and function.
	* curve448-eh-to-x.c (curve448_eh_to_x): New file and function.
	* ecc-dup-eh.c (ecc_dup_eh_untwisted): New function.
	* ecc-add-ehh.c (ecc_add_ehh_untwisted): New function.
	* ecc-add-eh.c (ecc_add_eh_untwisted): New function.
	* ecc-point.c (ecc_point_set): Add point validation for curve448.
	* ecc-point-mul.c (ecc_point_mul): Allow h_to_a_itch larger than
	mul_itch.
	* ecc-point-mul-g.c (ecc_point_mul_g): Allow h_to_a_itch
	larger than mul_g_itch. Switch from TMP_DECL/_ALLOC/_FREE to
	gmp_alloc_limbs/gmp_free_limbs.
	* ecdsa-keygen.c (ecdsa_generate_keypair): Use
	ECC_ECDSA_KEYGEN_ITCH.
	* Makefile.in (hogweed_SOURCES): Add ecc-448.c, curve448-mul-g.c,
	curve448-mul.c, and curve448-eh-to-x.c.
	(HEADERS): Add curve448.h.
	(ecc-448.h): New generated file.

	* testsuite/testutils.c (ecc_curves): Add _nettle_curve448 to list
	of tested curves.
	(test_ecc_mul_a): Add curve448.
	* testsuite/ecdsa-keygen-test.c (ecc_valid_p): Add curve448 support.
	* testsuite/ecdh-test.c (test_main): Add tests for (non-standard)
	curve448 diffie-hellman.
	* testsuite/ecc-add-test.c (test_main): Update for testing of curve448.
	* testsuite/ecc-dup-test.c (test_main): Likewise.
	* testsuite/ecc-mul-a-test.c (test_main): Likewise. Also increase
	scratch allocation for h_to_a_itch.
	* testsuite/ecc-mul-g-test.c (test_main): Likewise.
	* testsuite/curve448-dh-test.c: Test for curve448.
	* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Add curve448-dh-test.c.

	* examples/ecc-benchmark.c: Add curve448 to list of benchmarked
	curves.

	* nettle.texinfo (Curve 25519 and Curve 448): Add docs.

1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
2019-12-07  Niels Möller  <nisse@lysator.liu.se>

	* ecc-eh-to-a.c (ecc_eh_to_a): Require op == 0, delete code only
	used for non-standard ecdsa over curve25519.
	* testsuite/ecdsa-sign-test.c (test_main): Delete test of ecdsa
	over curve25519.
	* testsuite/ecdsa-verify-test.c (test_main): Likewise.
	* testsuite/ecdsa-keygen-test.c (test_main): Exclude curve25519
	from test.

1198
1199
1200
1201
1202
1203
1204
2019-12-05  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Use AC_TRY_LINK rather than AC_TRY_COMPILE to
	check for __builtin_bswap64. Since calling an non-existing
	function typically results in a warning only at compile time, but
	fails at link time. Patch contributed by by George Koehler.

Niels Möller's avatar
Niels Möller committed
1205
1206
1207
1208
1209
2019-12-04  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/testutils.c (test_cipher_cfb8): Add cast of size_t to
	unsigned long for argument to fprintf.

1210
1211
2019-11-21  Niels Möller  <nisse@lysator.liu.se>

1212
1213
1214
1215
1216
1217
1218
	* eccdata.c (ecc_curve_init_str): Delete unused t and d arguments.
	Related to the the edwards_root member of struct ecc_curve, which
	was used by ecc_a_to_eh before it was deleted, see 2014-09-17
	entry below.
	(ecc_curve_init): Delete corresponding curve25519 constants, and
	NULL arguments passed for the other curves.

1219
1220
	* Merge curve448 preparations, from September 2017.

1221
1222
2017-09-23  Niels Möller  <nisse@lysator.liu.se>

1223
1224
1225
1226
1227
1228
	* eccdata.c: Reorganize curve25519 precomputation to work directly
	with the twisted Edwards curve, with new point addition based on a
	patch from Daiki Ueno.
	* ecc-25519.c (_nettle_curve25519): Update for removed Montgomery
	curve constant.

1229
1230
1231
1232
	* ecc-internal.h (struct ecc_curve): Delete unused pointer
	edwards_root. Update all instances.
	* eccdata.c (output_curve): Don't output it.

1233
1234
	* testsuite/ecc-add-test.c (test_main): Reduce test duplication.
	Use ecc->add_hhh_itch.
1235
1236
	* testsuite/ecc-dup-test.c (test_main): Reduce test duplication.
	Use ecc->dup_itch.
1237

1238
1239
2017-09-23  Daiki Ueno  <dueno@redhat.com>

1240
1241
1242
1243
	* ecc-eh-to-a.c (ecc_eh_to_a): Use ecc->q.bit_size, instead of
	hard-coded value for curve25519.
	* eddsa-sign.c (_eddsa_sign): Likewise.

1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
	* ecc-internal.h (ecc_dup_func): New typedef.
	(struct ecc_curve): New constants add_hh_itch and dup_itch, new
	function pointers add_hh and dup.
	* ecc-192.c, ecc-224.c, ecc-256.c, ecc-384.c, ecc-521.c,
	ecc-25519.c: Update accordingly.
	* ecc-mul-g-eh.c (ecc_mul_g_eh): Use new function pointers.
	* ecc-mul-a-eh.c (ecc_mul_a_eh, table_init, ecc_mul_a_eh):
	Likewise.
	* testsuite/ecc-dup-test.c (test_main): Likewise.
	* testsuite/ecc-add-test.c (test_main): Likewise.

Niels Möller's avatar
Niels Möller committed
1255
1256
2019-10-01  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
1257
1258
1259
	* testsuite/testutils.c (test_cipher_cfb8): Reset destination area
	between tests. Encrypt/decrypt final partial block.

Niels Möller's avatar
Niels Möller committed
1260
1261
1262
1263
1264
1265
	From Daiki Ueno, fixing bug reported by Stephan Mueller:
	* cfb.c (cfb8_decrypt): Don't truncate output IV if input is
	shorter than block size.
	* testsuite/testutils.c (test_cipher_cfb8): Test splitting input
	into multiple calls to cfb8_encrypt and cfb8_decrypt.

1266
1267
1268
2019-09-30  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/siv-test.c (test_cipher_siv): Fix out-of-bounds read.
1269
1270
1271
	Trim allocation size for de_data, drop some uses of
	SIV_DIGEST_SIZE, call FAIL for unexpected returned values.
	(test_compare_results): Delete digest argument.
1272

1273
1274
2019-09-15  Niels Möller  <nisse@lysator.liu.se>

1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
	From Dmitry Eremin-Solenikov:
	* gost28147.c (_gost28147_encrypt_block): New file, encrypt
	function and sbox tables moved here.
	* gosthash94.c: Update functions to take sbox array as argument.
	(gost_block_compress): Use _gost28147_encrypt_block.
	(gosthash94cp_update,gosthash94cp_digest): New functions.
	* gost28147-internal.h: New file.
	* gost28147.h: New file.
	* gosthash94-meta.c (nettle_gosthash94cp): New hash algorithm.
	* nettle-meta-hashes.c (_nettle_hashes): Add nettle_gosthash94 and
	nettle_gosthash94cp.
	* hmac-gosthash94.c (hmac_gosthash94_set_key)
	(hmac_gosthash94_update, hmac_gosthash94_digest)
	(hmac_gosthash94cp_set_key, hmac_gosthash94cp_update)
	(hmac_gosthash94cp_digest): New file and functions.
	* pbkdf2-hmac-gosthash94.c (pbkdf2_hmac_gosthash94cp): New file
	and function.
	* testsuite/pbkdf2-test.c (test_main): Add
	pbkdf2-hmac-gosthash94cp tests.
	* testsuite/hmac-test.c (test_main): Add hmac-gosthash94 tests.
	* testsuite/gosthash94-test.c (test_main): Add gosthash94cp tests.
	* nettle.texinfo (Legacy hash functions): Document gosthash94cp.

1298
1299
	* testsuite/dlopen-test.c (main): Use libnettle.dylib on MacOS.

1300
1301
2019-07-08  Niels Möller  <nisse@lysator.liu.se>

1302
	* nettle-types.h (union nettle_block16): Mark w member as deprecated.
1303
	* eax.c (block16_xor): Use uint64_t member of nettle_block16.
1304
	* gcm.c (gcm_gf_add, gcm_gf_shift, gcm_gf_shift_8): Likewise.
1305

Niels Möller's avatar
Niels Möller committed
1306
1307
1308
1309
1310
2019-07-10  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Eremin-Solenikov:
	* cmac64.c (_cmac64_block_mulx, cmac64_set_key, cmac64_init)
	(cmac64_update, cmac64_digest): New file, new functions.
Niels Möller's avatar
Niels Möller committed
1311
1312
1313
1314
1315
	* cmac-des3.c (cmac_des3_set_key, cmac_des3_update)
	(cmac_des3_digest): New file, new functions.
	* cmac.h: Add cmac64 and cmac_des3 declarations.
	* Makefile.in (nettle_SOURCES): Add cmac64.c and cmac-des3.c.
	* testsuite/cmac-test.c (test_main): Add tests for cmac_des3.
Niels Möller's avatar
Niels Möller committed
1316

Niels Möller's avatar
Niels Möller committed
1317
1318
1319
1320
1321
1322
1323
1324
2019-07-02  Niels Möller  <nisse@lysator.liu.se>

	From Dmitry Eremin-Solenikov:
	* testsuite/testutils.c (test_mac): New function.
	* testsuite/cmac-test.c (nettle_cmac_aes128, nettle_cmac_aes256):
	New algorithm structs.
	(test_cmac_aes128, test_cmac_aes256): Use test_mac.

1325
1326
2019-06-06  Niels Möller  <nisse@lysator.liu.se>

1327
	Update for cmac changes, enabling const for the _message functions.
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
	* siv-cmac.c (_siv_s2v): Take a const struct cmac128_key as argument,
	and use a local struct cmac128_ctx for message-specific state.
	(siv_cmac_set_key): Take a struct cmac128_key as argument. Updated
	callers.
	(siv_cmac_encrypt_message, siv_cmac_decrypt_message): Take a const
	struct cmac128_key as argument. Updated callers.

	* siv-cmac.h (SIV_CMAC_CTX): Changed to use struct cmac128_key
	rather than struct cmac128_ctx.

	* siv-cmac-aes256.c (siv_cmac_aes256_encrypt_message)
	(siv_cmac_aes256_decrypt_message): Likewise.
	* siv-cmac-aes128.c (siv_cmac_aes128_encrypt_message)
	(siv_cmac_aes128_decrypt_message): The ctx argument made const.

1343
1344
2019-05-15  Niels Möller  <nisse@lysator.liu.se>

1345
1346
1347
1348
	* siv-cmac.h (SIV_CMAC_AES128_KEY_SIZE, SIV_CMAC_AES256_KEY_SIZE):
	New constants.
	* testsuite/siv-test.c: Simplify tests a little.

1349
1350
1351
1352
	* siv-cmac.h (SIV_MIN_NONCE_SIZE): New constant, 1.
	* siv-cmac.c (_siv_s2v): Require non-empty nonce.
	* nettle.texinfo (SIV-CMAC): Update documentation.

1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
2019-05-06  Niels Möller  <nisse@lysator.liu.se>

	SIV-CMAC mode, based on patch by Nikos Mavrogiannopoulos:
	* siv-cmac.h (SIV_BLOCK_SIZE, SIV_DIGEST_SIZE): New constants.
	(SIV_CMAC_CTX): New macro.
	(struct siv_cmac_aes128_ctx, struct siv_cmac_aes256_ctx): New
	context structs.
	* siv-cmac.c (_siv_s2v, siv_cmac_set_key)
	(siv_cmac_encrypt_message)
	(siv_cmac_decrypt_message): New file, new functions.
	* siv-cmac-aes128.c (siv_cmac_aes128_set_key)
	(siv_cmac_aes128_encrypt_message)
	(siv_cmac_aes128_decrypt_message): New file, new functions.
	* siv-cmac-aes256.c (siv_cmac_aes256_set_key)
	(siv_cmac_aes256_encrypt_message)
	(siv_cmac_aes256_decrypt_message): New file, new functions.
	* Makefile.in (nettle_SOURCES): Add siv-cmac source files.
	(HEADERS): Add siv-cmac.h.
	* testsuite/siv-test.c: New file.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Added siv-test.c
	* nettle.texinfo (SIV-CMAC): Documentation.

1375
1376
1377
1378
1379
1380
1381
1382
2019-04-30  Niels Möller  <nisse@lysator.liu.se>

	Based on a patch contributed by Nikos Mavrogiannopoulos.
	* cmac.c (_cmac128_block_mulx): Renamed function...
	(block_mulx): ... from old name.
	* cmac-internal.h (_cmac128_block_mulx): New file, declare function.
	* Makefile.in (DISTFILES): Added cmac-internal.h.

1383
1384
2019-06-26  Niels Möller  <nisse@lysator.liu.se>

Niels Möller's avatar
Niels Möller committed
1385
1386
1387
1388
1389
1390
1391
	* Released nettle-3.5.1.

	* configure.ac: Update version number to 3.5.1.

	* Makefile.in (distdir): Add x86_64/sha_ni to list of distributed
	directories.

1392
1393
	* Released nettle-3.5.

1394
1395
1396
1397
1398
1399
1400
2019-06-25  Niels Möller  <nisse@lysator.liu.se>

	* config.sub: Update to 2019-05-23 version, from savannah's
	config.git.
	* config.guess: Update to 2019-06-10 version, from savannah's
	config.git. Adds recognition of mips R6 and riscv.

1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
2019-06-05  Niels Möller  <nisse@lysator.liu.se>

	Further separation of CMAC per-message state from the
	message-independent subkeys, analogous to the gcm implementation.
	* cmac.h (struct cmac128_ctx): Remove key, instead a struct
	cmac128_key should be passed separately to functions that need it.
	(CMAC128_CTX): Include both a struct cmac128_key and a struct
	cmac128_ctx.
	(CMAC128_SET_KEY, CMAC128_DIGEST): Updated accordingly.

	* cmac.c (cmac128_set_key): Change argument type from cmac128_ctx
	to cmac128_key. Use a nettle_block16 for the constant zero block.
	(cmac128_init): New function, to initialize a cmac128_ctx.
	(cmac128_digest): Add cmac128_key argument. Move padding memset
	into the block handling a partial block. Call cmac128_init to
	reset state.

Niels Möller's avatar
Niels Möller committed
1418
1419
1420
1421
1422
1423
2019-06-01  Niels Möller  <nisse@lysator.liu.se>

	* cmac.h (struct cmac128_key): New struct.
	* cmac.h (struct cmac128_ctx): Use struct cmac128_key.
	* cmac.c (cmac128_set_key, cmac128_digest): Update accordingly.

1424
1425
1426
1427
1428
1429
1430
1431
2019-05-12  Niels Möller  <nisse@lysator.liu.se>

	Delete old libdes/openssl compatibility interface.
	* des-compat.c: Delete file.
	* des-compat.h: Delete file.
	* testsuite/des-compat-test.c: Delete file.
	* nettle.texinfo (Compatibility functions): Delete mention in documentation.

Niels Möller's avatar
Niels Möller committed
1432
1433
1434
1435
2019-05-11  Niels Möller  <nisse@lysator.liu.se>

	* NEWS: More updates for Nettle-3.5.

1436
1437
1438
1439
1440
1441
1442
2019-04-27  Niels Möller  <nisse@lysator.liu.se>

	From Simo Sorce:
	* x86_64/poly1305-internal.asm: Add missing EPILOGUE.
	* x86_64/serpent-decrypt.asm: Likewise.
	* x86_64/serpent-encrypt.asm: Likewise.

1443
1444
1445
1446
2019-04-14  Niels Möller  <nisse@lysator.liu.se>

	* tools/nettle-pbkdf2.c (main): Check strdup return value.

1447
1448
1449
1450
1451
1452
1453
1454
1455
2019-03-29  Niels Möller  <nisse@lysator.liu.se>

	* aes.h (struct aes_ctx): Redefine using a union of key-size
	specific contexts.
	* aes-decrypt.c (aes_decrypt): Use switch on key_size.
	* aes-encrypt.c (aes_encrypt): Likewise.
	* aes-set-decrypt-key.c (aes_invert_key): Likewise.
	* aes-set-encrypt-key.c (aes_set_encrypt_key): Likewise.

1456
1457
1458
1459
1460
1461
1462
2019-03-27  Niels Möller  <nisse@lysator.liu.se>

	* xts.c (xts_shift): Arrange with a single write to u64[1].
	* cmac.c (block_mulx): Rewrite to work in the same way as
	xts_shift, with 64-bit operations. XTS and CMAC use opposite
	endianness, but otherwise, these two functions are identical.

1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
2019-03-24  Niels Möller  <nisse@lysator.liu.se>

	From Simo Sorce:
	* xts.h: New file.
	* xts.c: New file.
	(BE_SHIFT): New macro.
	(xts_shift, check_length, xts_encrypt_message)
	(xts_decrypt_message): New functions.
	* xts-aes128.c (xts_aes128_set_encrypt_key)
	(xts_aes128_set_decrypt_key, xts_aes128_encrypt_message)
	(xts_aes128_decrypt_message): New file, new functions.
	* xts-aes256.c (xts_aes256_set_encrypt_key)
	(xts_aes256_set_decrypt_key, xts_aes256_encrypt_message)
	(xts_aes256_decrypt_message): New file, new functions.
	* nettle.texinfo (XTS): Document XTS mode.
	* Makefile.in (nettle_SOURCES): Add xts sourcce files.
	(HEADERS): New installed header xts.h.
	* testsuite/xts-test.c: New file.
	* testsuite/Makefile.in (TS_NETTLE_SOURCES): Add xts-test.c.

1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
2019-02-06  Niels Möller  <nisse@lysator.liu.se>

	* gosthash94.h (struct gosthash94_ctx): Move block buffer last in
	struct.
	* md2.h (struct md2_ctx): Likewise.
	* md4.h (struct md4_ctx): Likewise.
	* md5.h (struct md5_ctx): Likewise.
	* ripemd160.h (struct ripemd160_ctx): Likewise.
	* sha1.h (struct sha1_ctx): Likewise.
	* sha2.h (struct sha256_ctx, struct sha512_ctx): Likewise.

1494
1495
2019-01-19  Niels Möller  <nisse@lysator.liu.se>

1496
1497
1498
	* examples/Makefile.in (TARGETS): Delete eratosthenes, left over
	from earlier change.

1499
1500
	* fat-arm.c: Fix declarations of chacha_core functions.

1501
1502
1503
1504
1505
1506
1507
1508
1509
	From Yuriy M. Kaminskiy:
	* fat-setup.h (chacha_core_func): New typedef.
	* fat-arm.c (fat_init): Enable choice between
	_nettle_chacha_core_c and _nettle_chacha_core_neon.
	* configure.ac (asm_nettle_optional_list): Add
	chacha-core-internal-2.asm.
	* chacha-core-internal.c: Enable fat build with C and asm version.
	* arm/fat/chacha-core-internal-2.asm: New file.

Niels Möller's avatar
Niels Möller committed
1510
1511
1512
1513
1514
2019-01-12  Niels Möller  <nisse@lysator.liu.se>

	* examples/eratosthenes.c: Deleted program.
	* examples/Makefile.in: Delete rule to build and distribute it.

1515
1516
1517
1518
1519
2019-01-10  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/rsa-compute-root-test.c (test_one): Use %u and
	corresponding cast, when printing bit sizes.

1520
1521
1522
1523
1524
2019-01-09  Niels Möller  <nisse@lysator.liu.se>

	* examples/nettle-benchmark.c (GET_CYCLE_COUNTER): Add volatile to
	inline asm.

1525
1526
1527
1528
2019-01-08  Niels Möller  <nisse@lysator.liu.se>

	* sha512-compress.c: Add missing include of sha2-internal.h.

1529
1530
1531
1532
1533
2019-01-06  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/rsa-compute-root-test.c (generate_keypair): Fix assert
	call with side-effects.

Niels Möller's avatar
Niels Möller committed
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
2019-01-06  Niels Möller  <nisse@lysator.liu.se>

	* nettle-types.h: Don't use nettle-stdint.h, include <stdint.h>
	directly.
	* nettle-write.h: Likewise.
	* configure.ac: Delete use of AX_CREATE_STDINT_H.
	* aclocal.m4 (AX_CREATE_STDINT_H): Delete.
	* Makefile.in (INSTALL_HEADERS, distclean-here): Delete mention of
	nettle-stdint.h.

1544
1545
2018-12-26  Niels Möller  <nisse@lysator.liu.se>

1546
1547
1548
1549
1550
	* examples/hogweed-benchmark.c (make_openssl_rsa_ctx): New helper
	function. Call openssl's RSA_generate_key_ex rather then the
	deprecated RSA_generate_key.
	(bench_openssl_rsa_init, bench_openssl_rsa_tr_init): Use it.

1551
1552
1553
1554
	* eccdata.c (ecc_pippenger_precompute): Check that table size is
	at least 2. Intended to silence warning from the clang static
	analyzer.

1555
1556
1557
1558
1559
	* configure.ac: Bump package version to 3.5.
	(LIBNETTLE_MAJOR): Bump major number, now 7.
	(LIBHOGWEED_MAJOR): Bump major number, now 5.
	(LIBNETTLE_MINOR, LIBHOGWEED_MINOR): Reset to zero.

1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
	* pkcs1-internal.h: New header file, moved declarations of
	_pkcs1_sec_decrypt and _pkcs1_sec_decrypt_variable here.
	* rsa-internal.h: ... old location.
	* Makefile.in (DISTFILES): Added pkcs1-internal.h.
	* pkcs1-decrypt.c: Include new file.
	* pkcs1-sec-decrypt.c: Likewise.
	* rsa-decrypt-tr.c: Likewise.
	* rsa-sec-decrypt.c: Likewise.
	* testsuite/pkcs1-sec-decrypt-test.c: Likewise.

1570
1571
1572
1573
1574
	* tools/nettle-pbkdf2.c: Add #define _GNU_SOURCE, needed for
	strdup with gcc -std=c89.
	* testsuite/ed25519-test.c: Add #define _GNU_SOURCE, needed for
	getline with gcc -std=c89.

1575
1576
1577
1578
	* rsa-sign-tr.c (sec_equal): Fix accidental use of C99 for loop.
	Reported by Andreas Gustafsson.
	* testsuite/rsa-sec-decrypt-test.c (test_main): Likewise.

Niels Möller's avatar
Niels Möller committed
1579
1580
1581
1582
2018-12-04  Niels Möller  <nisse@lysator.liu.se>

	* Released nettle-3.4.1.

1583
1584
2018-11-28  Niels Möller  <nisse@lysator.liu.se>

1585
1586
1587
	* configure.ac: Update GMP check. Check for the function
	mpn_sec_div_r, available since GMP-6.0.0.

1588
1589
1590
1591
1592
1593
1594
1595
	* testsuite/rsa-encrypt-test.c (test_main): Fix allocation of
	decrypted storage. Update test of rsa_decrypt, to allow clobbering
	of all of the passed in message area.

	* pkcs1-decrypt.c (pkcs1_decrypt): Rewrite as a wrapper around
	_pkcs1_sec_decrypt_variable. Improves side-channel silence of the
	only caller, rsa_decrypt.

1596
1597
1598
	* Makefile.in (DISTFILES): Add rsa-internal.h, needed for make
	dist. Patch from Simo Sorce.

1599
1600
	* rsa-internal.h: Add include of rsa.h.

1601
1602
1603
1604
1605
1606
1607
2018-11-27  Niels Möller  <nisse@lysator.liu.se>

	* rsa-sec-compute-root.c (sec_mul, sec_mod_mul, sec_powm): New
	local helper functions, with their own itch functions.
	(_rsa_sec_compute_root_itch, _rsa_sec_compute_root): Rewrote to
	use helpers, for clarity.

1608
1609
1610
1611
1612
1613
1614
2018-11-26  Niels Möller  <nisse@lysator.liu.se>

	* testsuite/rsa-compute-root-test.c (generate_keypair): Simplify
	selection of psize and qsize, and fix so that qsize is used.
	(test_main): Add outer loop, to test with more than one key.
	Deallocate storage before exiting.

1615
1616
2018-11-25  Niels Möller  <nisse@lysator.liu.se>

1617
1618
1619
	* testsuite/rsa-compute-root-test.c: Renamed, from ...
	* testsuite/rsa-sec-compute-root-test.c: ... old name.

1620
1621
	* rsa.h (rsa_sec_compute_root_tr): Deleted declaration, moved to ...
	* rsa-internal.h (_rsa_sec_compute_root_tr): ... new location.
1622
1623
1624
	* rsa-sign-tr.c (_rsa_sec_compute_root_tr): Renamed, from...
	(rsa_sec_compute_root_tr): ... old name. Updated callers.
	(cnd_mpn_zero): Use a volatile-declared mask variable.
1625

1626
1627
1628
	* testsuite/testutils.c (mpz_urandomb) [NETTLE_USE_MINI_GMP]: Fix
	masking of most significant bits.

1629
1630
1631
	* rsa-decrypt-tr.c (rsa_decrypt_tr): Use
	NETTLE_OCTET_SIZE_TO_LIMB_SIZE.

1632
1633
1634
1635
	* testsuite/rsa-sec-decrypt-test.c (rsa_decrypt_for_test): Tweak
	valgrind marking, and document potential leakage of lowest and
	highest bits of p and q.

1636
1637
1638
1639
	* rsa-sec-compute-root.c (_rsa_sec_compute_root): Avoid calls to
	mpz_sizeinbase, since that potentially leaks most significant bits
	of private key parameters a and b.

1640
1641
1642
	* testsuite/pkcs1-sec-decrypt-test.c (pkcs1_decrypt_for_test): Fix
	valgrind marking of return value.

1643
1644
1645
	Merged below changes from Simo Sorce, to make RSA private key
	operations side-channel silent.

1646
1647
1648
1649
2018-11-08  Simo Sorce  <simo@redhat.com>

	* rsa-sign.c (rsa_compute_root) [!NETTLE_USE_MINI_GMP]: Use
	_rsa_sec_compute_root.
Niels Möller's avatar
Niels Möller committed
1650

Niels Möller's avatar
Niels Möller committed
1651
1652
1653
	* testsuite/rsa-sec-compute-root-test.c: Add more tests for new
	side-channel silent functions.

Niels Möller's avatar
Niels Möller committed
1654
1655
1656
1657
	* rsa-sign.c (rsa_private_key_prepare): Check that qn + cn >= pn,
	since that is required for one of the GMP calls in
	_rsa_sec_compute_root.

Niels Möller's avatar
Niels Möller committed
1658
1659
	* rsa-decrypt-tr.c: Switch to use side-channel silent functions.

1660
1661
1662
	* pkcs1-sec-decrypt.c (_pkcs1_sec_decrypt_variable): New private
	function. Variable size version for backwards compatibility.

Niels Möller's avatar
Niels Möller committed
1663
1664
	* testsuite/rsa-sec-decrypt-test.c: Adds more tests.

Niels Möller's avatar
Niels Möller committed
1665
1666
1667
1668
	* rsa-sec-decrypt.c (rsa_sec_decrypt): New function.
	Fixed length side-channel silent version of rsa-decrypt.
	* testsuite/rsa-encrypt-test.c: add tests for the new fucntion.

Niels Möller's avatar
Niels Möller committed
1669
1670
1671
	* testsuite/pkcs1-sec-decrypt-test.c: Adds tests for
	_pkcs1_sec_decrypt.

Niels Möller's avatar
Niels Möller committed
1672
1673
	* gmp-glue.c (mpn_get_base256): New function.

Niels Möller's avatar
Niels Möller committed
1674
1675
1676
	* pkcs1-sec-decrypt.c (_pkcs1_sec_decrypt): New private function.
	Fixed length side-channel silent version of pkcs1-decrypt.

Niels Möller's avatar
Niels Möller committed
1677
1678
1679
1680
	* cnd-memcpy.c (cnd_memcpy): New function.
	* memops.h: Declare it.
	* testsuite/cnd-memcpy-test.c: New test case.

1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
	* rsa-sign-tr.c (rsa_sec_compute_root_tr): New function that uses
	_rsa_sec_compute_root, as well as side-channel silent RSA
	blinding.
	(rsa_compute_root_tr) Rewritten as a wrapper around
	rsa_sec_compute_root_tr.
	(rsa_sec_blind, rsa_sec_unblind, sec_equal, rsa_sec_check_root)
	(cnd_mpn_zero): New helper functions.
	(rsa_sec_compute_root_tr) [NETTLE_USE_MINI_GMP]: Defined as a not
	side-channel silent wrapper around rsa_compute_root_tr, and the
	latter function left unchanged.

1692
1693
1694
1695
1696
	* rsa-sec-compute-root.c (_rsa_sec_compute_root_itch)
	(_rsa_sec_compute_root): New file, new private functions.
	Side-channel silent version of rsa_compute_root.
	* rsa-internal.h: New header file with declarations.

Niels Möller's avatar
Niels Möller committed
1697
1698
	* gmp-glue.h (NETTLE_OCTET_SIZE_TO_LIMB_SIZE): New macro.

1699
1700
1701
1702
1703
1704
2018-11-24  Niels Möller  <nisse@lysator.liu.se>

	* configure.ac: Bump package version to 3.4.1.
	(LIBNETTLE_MINOR): Bump library version to 6.5.
	(LIBHOGWEED_MINOR): Bump library version to 4.5.

1705
1706
1707
1708
1709
1710
1711
1712
1713
2018-11-17  Niels Möller  <nisse@lysator.liu.se>

	* examples/hogweed-benchmark.c (bench_rsa_verify)
	(bench_openssl_rsa_tr_init): New functions.
	(alg_list): Benchmark timing-resistant RSA functions, i.e.,
	including RSA blinding.
	(main): Increase width of first column, here and in other
	printouts.

1714
1715
1716
1717
1718
1719
2018-10-10  Dmitry Eremin-Solenikov  <dbaryshkov@gmail.com>

	* ctr16.c (_ctr_crypt16): Bugfix for the src == dst case, when
	processing more than on full block of size CTR_BUFFER_LIMIT, src
	and dst arguments to memxor3 were not properly updated.

1720
1721
1722
1723
1724
2018-10-10  Niels Möller  <nisse@lysator.liu.se>

	* aes-set-encrypt-key.c: Add missing include of stdlib.h.
	* des-compat.c: Likewise.

1725
1726
1727
1728
1729
2018-09-13  Niels Möller  <nisse@lysator.liu.se>

	* rsa-keygen.c (rsa_generate_keypair): Delete unlikely and
	redundant check for p == q.

1730
1731
2018-08-09  Niels Möller  <nisse@lysator.liu.se>

1732
1733
1734
	* rsa-internal.h (_rsa_blind, _rsa_unblind): Mark with
	_NETTLE_ATTRIBUTE_DEPRECATED.

Niels Möller's avatar
Niels Möller committed
1735
1736
1737
	* nettle-types.h (_NETTLE_ATTRIBUTE_PURE)
	(_NETTLE_ATTRIBUTE_DEPRECATED): New macros, for gcc and
	lookalikes.
1738
1739
1740
1741
1742
	* ecc-curve.h: Include nettle-types.h, and use
	_NETTLE_ATTRIBUTE_PURE instead of local definition.
	* nettle-meta.h: Use _NETTLE_ATTRIBUTE_PURE, instead of explicit
	#ifdefs.

Niels Möller's avatar
Niels Möller committed
1743
1744
1745
1746
1747
	* aes.h: Mark functions using struct aes_ctx interface as
	deprecated. Add #undef _NETTLE_ATTRIBUTE_DEPRECATED in files where
	the functions are implemented or tested.
	* gcm.h: Similarly mark functions using gcm_aes_ctx as deprecated.

1748
1749
1750
1751
1752
	* nettle-internal.c (des_set_key_wrapper, des3_set_key_wrapper)
	(blowfish128_set_key_wrapper): Wrapper functions, to avoid cast
	between incompatible function types (which gcc-8 warns about).
	Wrappers are expected to compile to a single jmp instruction.

1753
1754
1755
	* des-compat.c (des_compat_des3_encrypt)
	(des_compat_des3_decrypt): Change length argument type to size_t.

1756
1757
1758
1759
1760
2018-08-08  Niels Möller  <nisse@lysator.liu.se>

	* nettle.texinfo (Compatibility): New section on ABI and API
	compatibility.

1761
1762
1763
1764
2018-07-25  Dmitry Eremin-Solenikov  <dbaryshkov@gmail.com>

	* examples/nettle-benchmark.c: Add benchmarking for HMAC functions.

1765
1766
1767
1768
1769
2018-07-13  Niels Möller  <nisse@lysator.liu.se>

	* examples/eratosthenes.c (vector_alloc): Add assert related to
	overflow in the size calculation. Fixes a corner case identified
	by static analysis.
1770
	(vector_init): Analogous assert.
1771

Niels Möller's avatar
Niels Möller committed
1772
1773
2018-07-12  Niels Möller  <nisse@lysator.liu.se>

1774
1775
	* examples/eratosthenes.c (main): Don't allocate bitmap storage
	for limit == 2 (early exit), closing memory leak at exit.
1776
	(main): Fix handling of short -q option.
1777

Niels Möller's avatar